Skip to content

Commit 8a48615

Browse files
author
MarcoFalke
committed
Merge #20188: tests: Add fuzzing harness for CConnman
79ef832 tests: Add fuzzing harness for CConnman (practicalswift) Pull request description: Add fuzzing harness for `CConnman`. See [`doc/fuzzing.md`](https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md) for information on how to fuzz Bitcoin Core. Don't forget to contribute any coverage increasing inputs you find to the [Bitcoin Core fuzzing corpus repo](https://github.com/bitcoin-core/qa-assets). Happy fuzzing :) ACKs for top commit: MarcoFalke: review ACK 79ef832 Tree-SHA512: eb9ffae20e939b818f8b9def064544b9a8fcd127ca22d1a54af1afedf1d24143be42419f3a03d684be59a5ff07b29d8bfa34ef2aaf1d9f9f75c4c1aaa90a29a8
2 parents af8ec1d + 79ef832 commit 8a48615

File tree

3 files changed

+196
-0
lines changed

3 files changed

+196
-0
lines changed

‎src/Makefile.test.include

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ FUZZ_TARGETS = \
3535
test/fuzz/checkqueue \
3636
test/fuzz/coins_deserialize \
3737
test/fuzz/coins_view \
38+
test/fuzz/connman \
3839
test/fuzz/crypto \
3940
test/fuzz/crypto_aes256 \
4041
test/fuzz/crypto_aes256cbc \
@@ -520,6 +521,12 @@ test_fuzz_coins_view_LDADD = $(FUZZ_SUITE_LD_COMMON)
520521
test_fuzz_coins_view_LDFLAGS = $(FUZZ_SUITE_LDFLAGS_COMMON)
521522
test_fuzz_coins_view_SOURCES = test/fuzz/coins_view.cpp
522523

524+
test_fuzz_connman_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
525+
test_fuzz_connman_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
526+
test_fuzz_connman_LDADD = $(FUZZ_SUITE_LD_COMMON)
527+
test_fuzz_connman_LDFLAGS = $(FUZZ_SUITE_LDFLAGS_COMMON)
528+
test_fuzz_connman_SOURCES = test/fuzz/connman.cpp
529+
523530
test_fuzz_crypto_CPPFLAGS = $(AM_CPPFLAGS) $(BITCOIN_INCLUDES)
524531
test_fuzz_crypto_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
525532
test_fuzz_crypto_LDADD = $(FUZZ_SUITE_LD_COMMON)

‎src/test/fuzz/connman.cpp

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
// Copyright (c) 2020 The Bitcoin Core developers
2+
// Distributed under the MIT software license, see the accompanying
3+
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4+
5+
#include <chainparams.h>
6+
#include <chainparamsbase.h>
7+
#include <net.h>
8+
#include <netaddress.h>
9+
#include <protocol.h>
10+
#include <test/fuzz/FuzzedDataProvider.h>
11+
#include <test/fuzz/fuzz.h>
12+
#include <test/fuzz/util.h>
13+
#include <util/translation.h>
14+
15+
#include <cstdint>
16+
#include <vector>
17+
18+
void initialize()
19+
{
20+
InitializeFuzzingContext();
21+
}
22+
23+
void test_one_input(const std::vector<uint8_t>& buffer)
24+
{
25+
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
26+
CConnman connman{fuzzed_data_provider.ConsumeIntegral<uint64_t>(), fuzzed_data_provider.ConsumeIntegral<uint64_t>(), fuzzed_data_provider.ConsumeBool()};
27+
CAddress random_address;
28+
CNetAddr random_netaddr;
29+
CNode random_node = ConsumeNode(fuzzed_data_provider);
30+
CService random_service;
31+
CSubNet random_subnet;
32+
std::string random_string;
33+
while (fuzzed_data_provider.ConsumeBool()) {
34+
switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 30)) {
35+
case 0:
36+
random_address = ConsumeAddress(fuzzed_data_provider);
37+
break;
38+
case 1:
39+
random_netaddr = ConsumeNetAddr(fuzzed_data_provider);
40+
break;
41+
case 2:
42+
random_service = ConsumeService(fuzzed_data_provider);
43+
break;
44+
case 3:
45+
random_subnet = ConsumeSubNet(fuzzed_data_provider);
46+
break;
47+
case 4:
48+
random_string = fuzzed_data_provider.ConsumeRandomLengthString(64);
49+
break;
50+
case 5: {
51+
std::vector<CAddress> addresses;
52+
while (fuzzed_data_provider.ConsumeBool()) {
53+
addresses.push_back(ConsumeAddress(fuzzed_data_provider));
54+
}
55+
// Limit nTimePenalty to int32_t to avoid signed integer overflow
56+
(void)connman.AddNewAddresses(addresses, ConsumeAddress(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<int32_t>());
57+
break;
58+
}
59+
case 6:
60+
connman.AddNode(random_string);
61+
break;
62+
case 7:
63+
connman.CheckIncomingNonce(fuzzed_data_provider.ConsumeIntegral<uint64_t>());
64+
break;
65+
case 8:
66+
connman.DisconnectNode(fuzzed_data_provider.ConsumeIntegral<NodeId>());
67+
break;
68+
case 9:
69+
connman.DisconnectNode(random_netaddr);
70+
break;
71+
case 10:
72+
connman.DisconnectNode(random_string);
73+
break;
74+
case 11:
75+
connman.DisconnectNode(random_subnet);
76+
break;
77+
case 12:
78+
connman.ForEachNode([](auto) {});
79+
break;
80+
case 13:
81+
connman.ForEachNodeThen([](auto) {}, []() {});
82+
break;
83+
case 14:
84+
(void)connman.ForNode(fuzzed_data_provider.ConsumeIntegral<NodeId>(), [&](auto) { return fuzzed_data_provider.ConsumeBool(); });
85+
break;
86+
case 15:
87+
(void)connman.GetAddresses(fuzzed_data_provider.ConsumeIntegral<size_t>(), fuzzed_data_provider.ConsumeIntegral<size_t>());
88+
break;
89+
case 16: {
90+
(void)connman.GetAddresses(random_node, fuzzed_data_provider.ConsumeIntegral<size_t>(), fuzzed_data_provider.ConsumeIntegral<size_t>());
91+
break;
92+
}
93+
case 17:
94+
(void)connman.GetDeterministicRandomizer(fuzzed_data_provider.ConsumeIntegral<uint64_t>());
95+
break;
96+
case 18:
97+
(void)connman.GetNodeCount(fuzzed_data_provider.PickValueInArray({CConnman::CONNECTIONS_NONE, CConnman::CONNECTIONS_IN, CConnman::CONNECTIONS_OUT, CConnman::CONNECTIONS_ALL}));
98+
break;
99+
case 19:
100+
connman.MarkAddressGood(random_address);
101+
break;
102+
case 20:
103+
(void)connman.OutboundTargetReached(fuzzed_data_provider.ConsumeBool());
104+
break;
105+
case 21:
106+
// Limit now to int32_t to avoid signed integer overflow
107+
(void)connman.PoissonNextSendInbound(fuzzed_data_provider.ConsumeIntegral<int32_t>(), fuzzed_data_provider.ConsumeIntegral<int>());
108+
break;
109+
case 22: {
110+
CSerializedNetMsg serialized_net_msg;
111+
serialized_net_msg.m_type = fuzzed_data_provider.ConsumeRandomLengthString(CMessageHeader::COMMAND_SIZE);
112+
serialized_net_msg.data = ConsumeRandomLengthByteVector(fuzzed_data_provider);
113+
connman.PushMessage(&random_node, std::move(serialized_net_msg));
114+
break;
115+
}
116+
case 23:
117+
connman.RemoveAddedNode(random_string);
118+
break;
119+
case 24: {
120+
const std::vector<bool> asmap = ConsumeRandomLengthIntegralVector<bool>(fuzzed_data_provider, 512);
121+
if (SanityCheckASMap(asmap)) {
122+
connman.SetAsmap(asmap);
123+
}
124+
break;
125+
}
126+
case 25:
127+
connman.SetBestHeight(fuzzed_data_provider.ConsumeIntegral<int>());
128+
break;
129+
case 26:
130+
connman.SetMaxOutboundTarget(fuzzed_data_provider.ConsumeIntegral<uint64_t>());
131+
break;
132+
case 27:
133+
connman.SetMaxOutboundTimeframe(fuzzed_data_provider.ConsumeIntegral<uint64_t>());
134+
break;
135+
case 28:
136+
connman.SetNetworkActive(fuzzed_data_provider.ConsumeBool());
137+
break;
138+
case 29:
139+
connman.SetServices(random_service, static_cast<ServiceFlags>(fuzzed_data_provider.ConsumeIntegral<uint64_t>()));
140+
break;
141+
case 30:
142+
connman.SetTryNewOutboundPeer(fuzzed_data_provider.ConsumeBool());
143+
break;
144+
}
145+
}
146+
(void)connman.GetAddedNodeInfo();
147+
(void)connman.GetBestHeight();
148+
(void)connman.GetExtraOutboundCount();
149+
(void)connman.GetLocalServices();
150+
(void)connman.GetMaxOutboundTarget();
151+
(void)connman.GetMaxOutboundTimeframe();
152+
(void)connman.GetMaxOutboundTimeLeftInCycle();
153+
(void)connman.GetNetworkActive();
154+
std::vector<CNodeStats> stats;
155+
connman.GetNodeStats(stats);
156+
(void)connman.GetOutboundTargetBytesLeft();
157+
(void)connman.GetReceiveFloodSize();
158+
(void)connman.GetTotalBytesRecv();
159+
(void)connman.GetTotalBytesSent();
160+
(void)connman.GetTryNewOutboundPeer();
161+
(void)connman.GetUseAddrmanOutgoing();
162+
}

‎src/test/fuzz/util.h

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
#include <chainparamsbase.h>
1212
#include <coins.h>
1313
#include <consensus/consensus.h>
14+
#include <net.h>
1415
#include <netaddress.h>
1516
#include <netbase.h>
1617
#include <primitives/transaction.h>
@@ -260,6 +261,32 @@ CSubNet ConsumeSubNet(FuzzedDataProvider& fuzzed_data_provider) noexcept
260261
return {ConsumeNetAddr(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<uint8_t>()};
261262
}
262263

264+
CService ConsumeService(FuzzedDataProvider& fuzzed_data_provider) noexcept
265+
{
266+
return {ConsumeNetAddr(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<uint16_t>()};
267+
}
268+
269+
CAddress ConsumeAddress(FuzzedDataProvider& fuzzed_data_provider) noexcept
270+
{
271+
return {ConsumeService(fuzzed_data_provider), static_cast<ServiceFlags>(fuzzed_data_provider.ConsumeIntegral<uint64_t>()), fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
272+
}
273+
274+
CNode ConsumeNode(FuzzedDataProvider& fuzzed_data_provider) noexcept
275+
{
276+
const NodeId node_id = fuzzed_data_provider.ConsumeIntegral<NodeId>();
277+
const ServiceFlags local_services = static_cast<ServiceFlags>(fuzzed_data_provider.ConsumeIntegral<uint64_t>());
278+
const int my_starting_height = fuzzed_data_provider.ConsumeIntegral<int>();
279+
const SOCKET socket = INVALID_SOCKET;
280+
const CAddress address = ConsumeAddress(fuzzed_data_provider);
281+
const uint64_t keyed_net_group = fuzzed_data_provider.ConsumeIntegral<uint64_t>();
282+
const uint64_t local_host_nonce = fuzzed_data_provider.ConsumeIntegral<uint64_t>();
283+
const CAddress addr_bind = ConsumeAddress(fuzzed_data_provider);
284+
const std::string addr_name = fuzzed_data_provider.ConsumeRandomLengthString(64);
285+
const ConnectionType conn_type = fuzzed_data_provider.PickValueInArray({ConnectionType::INBOUND, ConnectionType::OUTBOUND_FULL_RELAY, ConnectionType::MANUAL, ConnectionType::FEELER, ConnectionType::BLOCK_RELAY, ConnectionType::ADDR_FETCH});
286+
const bool inbound_onion = fuzzed_data_provider.ConsumeBool();
287+
return {node_id, local_services, my_starting_height, socket, address, keyed_net_group, local_host_nonce, addr_bind, addr_name, conn_type, inbound_onion};
288+
}
289+
263290
void InitializeFuzzingContext(const std::string& chain_name = CBaseChainParams::REGTEST)
264291
{
265292
static const BasicTestingSetup basic_testing_setup{chain_name, {"-nodebuglogfile"}};

0 commit comments

Comments
 (0)