wip

joostjager · joostjager · commit 358a5f36ae8c · 2025-03-21T16:43:33.000+01:00
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
@@ -36,10 +36,10 @@ cc = "1.0"
 members = ["."]
 
 [profile.release]
-lto = true
-codegen-units = 1
+lto = "off"
 debug-assertions = true
 overflow-checks = true
+opt-level = 0
 
 # When testing a large fuzz corpus, -O1 offers a nice speedup
 [profile.dev]
diff --git a/fuzz/artifacts/process_onion_failure_target/slow-unit-8bb5dada44b45f849d9c8790595a873a953c9b4a b/fuzz/artifacts/process_onion_failure_target/slow-unit-8bb5dada44b45f849d9c8790595a873a953c9b4a
@@ -0,0 +1 @@
+����������������������������������������������������������������������������������������������������������!�������������������j�
diff --git a/fuzz/corpus/process_onion_failure_target/19ee2996605f08ff9ae9de6904e81d03924f1df0 b/fuzz/corpus/process_onion_failure_target/19ee2996605f08ff9ae9de6904e81d03924f1df0
@@ -0,0 +1,3 @@
+`-
+�`-
+��
diff --git a/fuzz/corpus/process_onion_failure_target/1d709ed7d213609ef127ad465c11bfa574198f7d b/fuzz/corpus/process_onion_failure_target/1d709ed7d213609ef127ad465c11bfa574198f7d
@@ -0,0 +1,2 @@
+`-
+=
diff --git a/fuzz/corpus/process_onion_failure_target/273e86358bf597650f63fb3de473562eaffd084d b/fuzz/corpus/process_onion_failure_target/273e86358bf597650f63fb3de473562eaffd084d
@@ -0,0 +1 @@
+�j�
diff --git a/fuzz/corpus/process_onion_failure_target/31f0124840a6c31c73d3f64f5ac00a347d31faf5 b/fuzz/corpus/process_onion_failure_target/31f0124840a6c31c73d3f64f5ac00a347d31faf5
@@ -0,0 +1 @@
+��%)�������������
diff --git a/fuzz/corpus/process_onion_failure_target/3af6eb63ae060bd099638b5d699dd964f96e92a7 b/fuzz/corpus/process_onion_failure_target/3af6eb63ae060bd099638b5d699dd964f96e92a7
@@ -0,0 +1 @@
+�
diff --git a/fuzz/corpus/process_onion_failure_target/4d001a633b0b6b83ee696ea0e3178fada091217e b/fuzz/corpus/process_onion_failure_target/4d001a633b0b6b83ee696ea0e3178fada091217e
@@ -0,0 +1 @@
+������������������������������������������������������������������������������������������������������������������������������j�
diff --git a/fuzz/corpus/process_onion_failure_target/799f6f0eb85e6888dcc0cdc85dbcaa3ddd3bd704 b/fuzz/corpus/process_onion_failure_target/799f6f0eb85e6888dcc0cdc85dbcaa3ddd3bd704
diff --git a/fuzz/corpus/process_onion_failure_target/866fb8a7db00a75b0a39f127c7b94b8a17d3f2dd b/fuzz/corpus/process_onion_failure_target/866fb8a7db00a75b0a39f127c7b94b8a17d3f2dd
diff --git a/fuzz/corpus/process_onion_failure_target/8880642669fb9f57c27c0bb1428fed82932643e1 b/fuzz/corpus/process_onion_failure_target/8880642669fb9f57c27c0bb1428fed82932643e1
@@ -0,0 +1 @@
+��j)�
diff --git a/fuzz/corpus/process_onion_failure_target/8aef2ae1692ddafc4a359cf920426a426f2c6e4b b/fuzz/corpus/process_onion_failure_target/8aef2ae1692ddafc4a359cf920426a426f2c6e4b
@@ -0,0 +1 @@
+�������������������������������������������������������������������������������������������������������������������������������j�
diff --git a/fuzz/corpus/process_onion_failure_target/9148596deebfc711d7942b76ada296015942cf3a b/fuzz/corpus/process_onion_failure_target/9148596deebfc711d7942b76ada296015942cf3a
@@ -0,0 +1 @@
+)��(j�)�
diff --git a/fuzz/corpus/process_onion_failure_target/adc83b19e793491b1c6ea0fd8b46cd9f32e592fc b/fuzz/corpus/process_onion_failure_target/adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
@@ -0,0 +1 @@
+
diff --git a/fuzz/corpus/process_onion_failure_target/c442f64d460dca6ef7a70f397046cda754d8e40d b/fuzz/corpus/process_onion_failure_target/c442f64d460dca6ef7a70f397046cda754d8e40d
@@ -0,0 +1 @@
+��%)�������������
diff --git a/fuzz/corpus/process_onion_failure_target/de7131bf8ad1d2cac0b7271af4f88293c6f8c4c4 b/fuzz/corpus/process_onion_failure_target/de7131bf8ad1d2cac0b7271af4f88293c6f8c4c4
diff --git a/fuzz/src/lib.rs b/fuzz/src/lib.rs
@@ -28,6 +28,7 @@ pub mod onion_hop_data;
 pub mod onion_message;
 pub mod peer_crypt;
 pub mod process_network_graph;
+pub mod process_onion_failure;
 pub mod refund_deser;
 pub mod router;
 pub mod zbase32;
diff --git a/fuzz/src/process_onion_failure.rs b/fuzz/src/process_onion_failure.rs
@@ -0,0 +1,20 @@
+// Imports that need to be added manually
+use lightning_rapid_gossip_sync::RapidGossipSync;
+
+use crate::utils::test_logger;
+
+/// Actual fuzz test, method signature and name are fixed
+fn do_test<Out: test_logger::Output>(data: &[u8], out: Out) {
+	println!("data -> {:?}", data);
+}
+
+/// Method that needs to be added manually, {name}_test
+pub fn process_onion_failure_test<Out: test_logger::Output>(data: &[u8], out: Out) {
+	do_test(data, out);
+}
+
+/// Method that needs to be added manually, {name}_run
+#[no_mangle]
+pub extern "C" fn process_onion_failure_run(data: *const u8, datalen: usize) {
+	do_test(unsafe { std::slice::from_raw_parts(data, datalen) }, test_logger::DevNull {});
+}
diff --git a/fuzz/targets.h b/fuzz/targets.h
@@ -10,6 +10,7 @@ void bolt11_deser_run(const unsigned char* data, size_t data_len);
 void onion_message_run(const unsigned char* data, size_t data_len);
 void peer_crypt_run(const unsigned char* data, size_t data_len);
 void process_network_graph_run(const unsigned char* data, size_t data_len);
+void process_onion_failure_run(const unsigned char* data, size_t data_len);
 void refund_deser_run(const unsigned char* data, size_t data_len);
 void router_run(const unsigned char* data, size_t data_len);
 void zbase32_run(const unsigned char* data, size_t data_len);
diff --git a/lightning/src/ln/onion_utils.rs b/lightning/src/ln/onion_utils.rs
@@ -2063,6 +2063,7 @@ mod tests {
 	use crate::ln::channelmanager::PaymentId;
 	use crate::ln::msgs;
 	use crate::routing::router::{Path, PaymentParameters, Route, RouteHop};
+	use crate::sign::{EntropySource, RandomBytes};
 	use crate::types::features::{ChannelFeatures, NodeFeatures};
 	use crate::types::payment::PaymentHash;
 	use crate::util::ser::{VecWriter, Writeable, Writer};
@@ -2800,4 +2801,54 @@ mod tests {
 		let recipient_onion = RecipientOnionFields::spontaneous_empty();
 		set_max_path_length(&mut route_params, &recipient_onion, None, None, 42).unwrap();
 	}
+
+	#[test]
+	fn fuzz_decode_onion_failure() {
+		let rnd = RandomBytes::new([1;32]);
+		let data = &rnd.get_secure_random_bytes()[..];
+
+		let mut read_pos = 0;
+		macro_rules! get_slice {
+			($len: expr) => {{
+				let slice_len = $len as usize;
+				if data.len() < read_pos + slice_len {
+					return;
+				}
+				read_pos += slice_len;
+				&data[read_pos - slice_len..read_pos]
+			}};
+		}
+
+		let secp_ctx = Secp256k1::new();
+		let logger: Arc<TestLogger> = Arc::new(TestLogger::new());
+
+		let first_hop_htlc_msat_bytes = match get_slice!(8).try_into() {
+			Ok(val) => val,
+			Err(_) => return,
+		};
+
+		let session_priv = match SecretKey::from_slice(get_slice!(32)) {
+			Ok(val) => val,
+			Err(_) => return,
+		};
+
+		let payment_id = match get_slice!(32).try_into() {
+			Ok(val) => PaymentId(val),
+			Err(_) => return,
+		};
+
+		let htlc_source = HTLCSource::OutboundRoute {
+			path: build_trampoline_test_path(),
+			session_priv,
+			first_hop_htlc_msat: u64::from_be_bytes(first_hop_htlc_msat_bytes),
+			payment_id,
+		};
+
+		let failure_len = u16::from_be_bytes(get_slice!(2).try_into().unwrap());
+		let encrypted_packet = OnionErrorPacket { data:
+			get_slice!(failure_len as u64).into(),
+		};
+
+		process_onion_failure(&secp_ctx, &logger, &htlc_source, encrypted_packet);
+	}
 }
