1 /*
2 * wpa_supplicant - WNM fuzzer
3 * Copyright (c) 2015-2019, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
14 #include "rsn_supp/wpa.h"
15 #include "rsn_supp/wpa_i.h"
16 #include "wpa_supplicant_i.h"
17 #include "bss.h"
18 #include "wnm_sta.h"
19 #include "../../../wpa_supplicant/config.h"
20 #include "../fuzzer-common.h"
21
22
23 struct arg_ctx {
24 const u8 *data;
25 size_t data_len;
26 struct wpa_supplicant wpa_s;
27 struct wpa_bss bss;
28 struct wpa_driver_ops driver;
29 struct wpa_sm wpa;
30 struct wpa_config conf;
31 struct wpa_ssid ssid;
32 };
33
34
test_send_wnm(void * eloop_data,void * user_ctx)35 static void test_send_wnm(void *eloop_data, void *user_ctx)
36 {
37 struct arg_ctx *ctx = eloop_data;
38 const struct ieee80211_mgmt *mgmt;
39
40 wpa_hexdump(MSG_MSGDUMP, "fuzzer - WNM", ctx->data, ctx->data_len);
41
42 mgmt = (const struct ieee80211_mgmt *) ctx->data;
43 ieee802_11_rx_wnm_action(&ctx->wpa_s, mgmt, ctx->data_len);
44
45 eloop_terminate();
46 }
47
48
init_wpa(struct arg_ctx * ctx)49 static int init_wpa(struct arg_ctx *ctx)
50 {
51 ctx->wpa_s.wpa_state = WPA_COMPLETED;
52 os_memcpy(ctx->wpa_s.bssid, "\x02\x00\x00\x00\x03\x00", ETH_ALEN);
53 ctx->wpa_s.current_bss = &ctx->bss;
54 ctx->wpa_s.current_ssid = &ctx->ssid;
55 ctx->wpa_s.driver = &ctx->driver;
56 ctx->wpa_s.wpa = &ctx->wpa;
57 ctx->wpa_s.conf = &ctx->conf;
58 if (wpa_bss_init(&ctx->wpa_s) < 0)
59 return -1;
60
61 return 0;
62 }
63
64
deinit_wpa(struct arg_ctx * ctx)65 static void deinit_wpa(struct arg_ctx *ctx)
66 {
67 wnm_btm_reset(&ctx->wpa_s);
68 wpa_bss_flush(&ctx->wpa_s);
69 }
70
71
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)72 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
73 {
74 struct arg_ctx ctx;
75
76 wpa_fuzzer_set_debug_level();
77
78 if (os_program_init())
79 return 0;
80
81 if (eloop_init()) {
82 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
83 return 0;
84 }
85
86 os_memset(&ctx, 0, sizeof(ctx));
87 ctx.data = data;
88 ctx.data_len = size;
89 if (init_wpa(&ctx))
90 goto fail;
91
92 eloop_register_timeout(0, 0, test_send_wnm, &ctx, NULL);
93
94 wpa_printf(MSG_DEBUG, "Starting eloop");
95 eloop_run();
96 wpa_printf(MSG_DEBUG, "eloop done");
97 deinit_wpa(&ctx);
98
99 fail:
100 eloop_destroy();
101 os_program_deinit();
102
103 return 0;
104 }
105