1 /*
2 * wpa_supplicant - P2P fuzzer
3 * Copyright (c) 2015, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
14 #include "p2p/p2p.h"
15 #include "ap/hostapd.h"
16 #include "ap/ieee802_1x.h"
17 #include "ap/pmksa_cache_auth.h"
18 #include "../fuzzer-common.h"
19
20
pasn_responder_pmksa_cache_get(struct rsn_pmksa_cache * pmksa,const u8 * bssid,u8 * pmkid,u8 * pmk,size_t * pmk_len)21 int pasn_responder_pmksa_cache_get(struct rsn_pmksa_cache *pmksa,
22 const u8 *bssid, u8 *pmkid, u8 *pmk,
23 size_t *pmk_len)
24 {
25 return -1;
26 }
27
28
debug_print(void * ctx,int level,const char * msg)29 static void debug_print(void *ctx, int level, const char *msg)
30 {
31 wpa_printf(level, "P2P: %s", msg);
32 }
33
34
find_stopped(void * ctx)35 static void find_stopped(void *ctx)
36 {
37 }
38
39
start_listen(void * ctx,unsigned int freq,unsigned int duration,const struct wpabuf * probe_resp_ie)40 static int start_listen(void *ctx, unsigned int freq,
41 unsigned int duration,
42 const struct wpabuf *probe_resp_ie)
43 {
44 return 0;
45 }
46
47
stop_listen(void * ctx)48 static void stop_listen(void *ctx)
49 {
50 }
51
52
dev_found(void * ctx,const u8 * addr,const struct p2p_peer_info * info,int new_device)53 static void dev_found(void *ctx, const u8 *addr,
54 const struct p2p_peer_info *info,
55 int new_device)
56 {
57 }
58
59
dev_lost(void * ctx,const u8 * dev_addr)60 static void dev_lost(void *ctx, const u8 *dev_addr)
61 {
62 }
63
64
send_action(void * ctx,unsigned int freq,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * buf,size_t len,unsigned int wait_time,int * scheduled)65 static int send_action(void *ctx, unsigned int freq, const u8 *dst,
66 const u8 *src, const u8 *bssid, const u8 *buf,
67 size_t len, unsigned int wait_time, int *scheduled)
68 {
69 *scheduled = 0;
70 return 0;
71 }
72
73
send_action_done(void * ctx)74 static void send_action_done(void *ctx)
75 {
76 }
77
78
go_neg_req_rx(void * ctx,const u8 * src,u16 dev_passwd_id,u8 go_intent)79 static void go_neg_req_rx(void *ctx, const u8 *src, u16 dev_passwd_id,
80 u8 go_intent)
81 {
82 }
83
84
init_p2p(void)85 static struct p2p_data * init_p2p(void)
86 {
87 struct p2p_config p2p;
88
89 os_memset(&p2p, 0, sizeof(p2p));
90 p2p.max_peers = 100;
91 p2p.passphrase_len = 8;
92 p2p.channels.reg_classes = 1;
93 p2p.channels.reg_class[0].reg_class = 81;
94 p2p.channels.reg_class[0].channel[0] = 1;
95 p2p.channels.reg_class[0].channel[1] = 2;
96 p2p.channels.reg_class[0].channels = 2;
97 p2p.debug_print = debug_print;
98 p2p.find_stopped = find_stopped;
99 p2p.start_listen = start_listen;
100 p2p.stop_listen = stop_listen;
101 p2p.dev_found = dev_found;
102 p2p.dev_lost = dev_lost;
103 p2p.send_action = send_action;
104 p2p.send_action_done = send_action_done;
105 p2p.go_neg_req_rx = go_neg_req_rx;
106
107 return p2p_init(&p2p);
108 }
109
110
111 struct arg_ctx {
112 const u8 *data;
113 size_t data_len;
114 struct p2p_data *p2p;
115 int count;
116 };
117
118
test_send(void * eloop_data,void * user_ctx)119 static void test_send(void *eloop_data, void *user_ctx)
120 {
121 struct arg_ctx *ctx = eloop_data;
122 struct os_reltime rx_time;
123
124 wpa_hexdump(MSG_MSGDUMP, "fuzzer - IEs", ctx->data, ctx->data_len);
125
126 os_memset(&rx_time, 0, sizeof(rx_time));
127 p2p_scan_res_handler(ctx->p2p, (u8 *) "\x02\x00\x00\x00\x01\x00", 2412,
128 &rx_time, 0, ctx->data, ctx->data_len);
129 p2p_scan_res_handled(ctx->p2p, 0);
130
131 p2p_probe_req_rx(ctx->p2p, (u8 *) "\x02\x00\x00\x00\x01\x00",
132 (u8 *) "\x02\x00\x00\x00\x00\x00",
133 (u8 *) "\x02\x00\x00\x00\x00\x00",
134 ctx->data, ctx->data_len, 2412, 0);
135
136 if (ctx->data_len >= IEEE80211_HDRLEN + 1) {
137 struct os_reltime rx_time;
138 const struct ieee80211_mgmt *mgmt;
139
140 mgmt = (const struct ieee80211_mgmt *) ctx->data;
141 os_memset(&rx_time, 0, sizeof(rx_time));
142 p2p_rx_action(ctx->p2p, mgmt->da, mgmt->sa, mgmt->bssid,
143 mgmt->u.action.category,
144 (const u8 *) ctx->data + IEEE80211_HDRLEN + 1,
145 ctx->data_len - IEEE80211_HDRLEN - 1, 2412);
146 }
147
148 eloop_terminate();
149 }
150
151
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)152 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
153 {
154 struct p2p_data *p2p;
155 struct arg_ctx ctx;
156
157 wpa_fuzzer_set_debug_level();
158
159 if (os_program_init())
160 return -1;
161
162 if (eloop_init()) {
163 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
164 return 0;
165 }
166
167 p2p = init_p2p();
168 if (!p2p) {
169 wpa_printf(MSG_ERROR, "P2P init failed");
170 return 0;
171 }
172
173 os_memset(&ctx, 0, sizeof(ctx));
174 ctx.p2p = p2p;
175 ctx.data = data;
176 ctx.data_len = size;
177
178 eloop_register_timeout(0, 0, test_send, &ctx, NULL);
179
180 wpa_printf(MSG_DEBUG, "Starting eloop");
181 eloop_run();
182 wpa_printf(MSG_DEBUG, "eloop done");
183
184 p2p_deinit(p2p);
185 eloop_destroy();
186 os_program_deinit();
187
188 return 0;
189 }
190