/root/bitcoin/src/test/fuzz/connman.cpp
Line | Count | Source |
1 | | // Copyright (c) 2020-present The Bitcoin Core developers |
2 | | // Distributed under the MIT software license, see the accompanying |
3 | | // file COPYING or http://www.opensource.org/licenses/mit-license.php. |
4 | | |
5 | | #include <addrman.h> |
6 | | #include <chainparams.h> |
7 | | #include <common/args.h> |
8 | | #include <net.h> |
9 | | #include <net_processing.h> |
10 | | #include <netaddress.h> |
11 | | #include <protocol.h> |
12 | | #include <test/fuzz/FuzzedDataProvider.h> |
13 | | #include <test/fuzz/fuzz.h> |
14 | | #include <test/fuzz/util.h> |
15 | | #include <test/fuzz/util/net.h> |
16 | | #include <test/fuzz/util/threadinterrupt.h> |
17 | | #include <test/util/setup_common.h> |
18 | | #include <test/util/time.h> |
19 | | #include <util/translation.h> |
20 | | |
21 | | #include <cstdint> |
22 | | #include <vector> |
23 | | |
24 | | namespace { |
25 | | const TestingSetup* g_setup; |
26 | | |
27 | | int32_t GetCheckRatio() |
28 | 0 | { |
29 | 0 | return std::clamp<int32_t>(g_setup->m_node.args->GetIntArg("-checkaddrman", 0), 0, 1000000); |
30 | 0 | } |
31 | | |
32 | | } // namespace |
33 | | |
34 | | void initialize_connman() |
35 | 0 | { |
36 | 0 | static const auto testing_setup = MakeNoLogFileContext<const TestingSetup>(); |
37 | 0 | g_setup = testing_setup.get(); |
38 | 0 | } |
39 | | |
40 | | FUZZ_TARGET(connman, .init = initialize_connman) |
41 | 0 | { |
42 | 0 | SeedRandomStateForTest(SeedRand::ZEROS); |
43 | 0 | FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()}; |
44 | 0 | FakeNodeClock clock{ConsumeTime(fuzzed_data_provider)}; |
45 | 0 | auto netgroupman{ConsumeNetGroupManager(fuzzed_data_provider)}; |
46 | 0 | auto addr_man_ptr{std::make_unique<AddrManDeterministic>(netgroupman, fuzzed_data_provider, GetCheckRatio())}; |
47 | 0 | if (fuzzed_data_provider.ConsumeBool()) { Branch (47:9): [True: 0, False: 0]
|
48 | 0 | const std::vector<uint8_t> serialized_data{ConsumeRandomLengthByteVector(fuzzed_data_provider)}; |
49 | 0 | DataStream ds{serialized_data}; |
50 | 0 | try { |
51 | 0 | ds >> *addr_man_ptr; |
52 | 0 | } catch (const std::ios_base::failure&) { |
53 | 0 | addr_man_ptr = std::make_unique<AddrManDeterministic>(netgroupman, fuzzed_data_provider, GetCheckRatio()); |
54 | 0 | } |
55 | 0 | } |
56 | 0 | AddrManDeterministic& addr_man{*addr_man_ptr}; |
57 | 0 | auto net_events{ConsumeNetEvents(fuzzed_data_provider)}; |
58 | | |
59 | | // Mock CreateSock() to create FuzzedSock. |
60 | 0 | auto CreateSockOrig = CreateSock; |
61 | 0 | CreateSock = [&fuzzed_data_provider](int, int, int) { |
62 | 0 | return std::make_unique<FuzzedSock>(fuzzed_data_provider); |
63 | 0 | }; |
64 | | |
65 | | // Mock g_dns_lookup() to return a fuzzed address. |
66 | 0 | auto g_dns_lookup_orig = g_dns_lookup; |
67 | 0 | g_dns_lookup = [&fuzzed_data_provider](const std::string&, bool) { |
68 | 0 | return std::vector<CNetAddr>{ConsumeNetAddr(fuzzed_data_provider)}; |
69 | 0 | }; |
70 | |
|
71 | 0 | ConnmanTestMsg connman{fuzzed_data_provider.ConsumeIntegral<uint64_t>(), |
72 | 0 | fuzzed_data_provider.ConsumeIntegral<uint64_t>(), |
73 | 0 | addr_man, |
74 | 0 | netgroupman, |
75 | 0 | Params(), |
76 | 0 | fuzzed_data_provider.ConsumeBool(), |
77 | 0 | ConsumeThreadInterrupt(fuzzed_data_provider)}; |
78 | |
|
79 | 0 | const uint64_t max_outbound_limit{fuzzed_data_provider.ConsumeIntegral<uint64_t>()}; |
80 | 0 | CConnman::Options options; |
81 | 0 | options.m_msgproc = &net_events; |
82 | 0 | options.nMaxOutboundLimit = max_outbound_limit; |
83 | |
|
84 | 0 | auto consume_whitelist = [&]() { |
85 | 0 | std::vector<NetWhitelistPermissions> result(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 3)); |
86 | 0 | for (auto& entry : result) { Branch (86:26): [True: 0, False: 0]
|
87 | 0 | entry.m_flags = ConsumeWeakEnum(fuzzed_data_provider, ALL_NET_PERMISSION_FLAGS); |
88 | 0 | entry.m_subnet = ConsumeSubNet(fuzzed_data_provider); |
89 | 0 | } |
90 | 0 | return result; |
91 | 0 | }; |
92 | 0 | options.vWhitelistedRangeIncoming = consume_whitelist(); |
93 | 0 | options.vWhitelistedRangeOutgoing = consume_whitelist(); |
94 | |
|
95 | 0 | connman.Init(options); |
96 | |
|
97 | 0 | CNetAddr random_netaddr; |
98 | 0 | CAddress random_address; |
99 | 0 | CNode random_node = ConsumeNode(fuzzed_data_provider); |
100 | 0 | CSubNet random_subnet; |
101 | 0 | std::string random_string; |
102 | 0 | std::vector<NodeId> node_ids; |
103 | |
|
104 | 0 | LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 100) { |
105 | 0 | CNode& p2p_node{*ConsumeNodeAsUniquePtr(fuzzed_data_provider).release()}; |
106 | | // Simulate post-handshake state. |
107 | 0 | p2p_node.fSuccessfullyConnected = true; |
108 | 0 | connman.AddTestNode(p2p_node); |
109 | 0 | node_ids.push_back(p2p_node.GetId()); |
110 | 0 | } |
111 | |
|
112 | 0 | LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) { |
113 | 0 | CallOneOf( |
114 | 0 | fuzzed_data_provider, |
115 | 0 | [&] { |
116 | 0 | random_netaddr = ConsumeNetAddr(fuzzed_data_provider); |
117 | 0 | }, |
118 | 0 | [&] { |
119 | 0 | random_address = ConsumeAddress(fuzzed_data_provider); |
120 | 0 | }, |
121 | 0 | [&] { |
122 | 0 | random_subnet = ConsumeSubNet(fuzzed_data_provider); |
123 | 0 | }, |
124 | 0 | [&] { |
125 | 0 | random_string = fuzzed_data_provider.ConsumeRandomLengthString(64); |
126 | 0 | }, |
127 | 0 | [&] { |
128 | 0 | connman.AddNode({random_string, fuzzed_data_provider.ConsumeBool()}); |
129 | 0 | }, |
130 | 0 | [&] { |
131 | 0 | connman.CheckIncomingNonce(fuzzed_data_provider.ConsumeIntegral<uint64_t>()); |
132 | 0 | }, |
133 | 0 | [&] { |
134 | 0 | connman.DisconnectNode(fuzzed_data_provider.ConsumeIntegral<NodeId>()); |
135 | 0 | }, |
136 | 0 | [&] { |
137 | 0 | connman.DisconnectNode(random_netaddr); |
138 | 0 | }, |
139 | 0 | [&] { |
140 | 0 | connman.DisconnectNode(random_string); |
141 | 0 | }, |
142 | 0 | [&] { |
143 | 0 | connman.DisconnectNode(random_subnet); |
144 | 0 | }, |
145 | 0 | [&] { |
146 | 0 | NodeId id = node_ids.empty() || fuzzed_data_provider.ConsumeBool() Branch (146:29): [True: 0, False: 0]
Branch (146:49): [True: 0, False: 0]
|
147 | 0 | ? fuzzed_data_provider.ConsumeIntegral<NodeId>() |
148 | 0 | : PickValue(fuzzed_data_provider, node_ids); |
149 | 0 | (void)connman.ForNode(id, [&](CNode* pnode) { |
150 | 0 | (void)pnode->GetId(); |
151 | 0 | (void)pnode->IsInboundConn(); |
152 | 0 | (void)pnode->IsFullOutboundConn(); |
153 | 0 | return true; |
154 | 0 | }); |
155 | 0 | }, |
156 | 0 | [&] { |
157 | 0 | auto max_addresses = fuzzed_data_provider.ConsumeIntegral<size_t>(); |
158 | 0 | auto max_pct = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 100); |
159 | 0 | auto filtered = fuzzed_data_provider.ConsumeBool(); |
160 | 0 | (void)connman.GetAddressesUnsafe(max_addresses, max_pct, /*network=*/std::nullopt, filtered); |
161 | 0 | }, |
162 | 0 | [&] { |
163 | 0 | auto max_addresses = fuzzed_data_provider.ConsumeIntegral<size_t>(); |
164 | 0 | auto max_pct = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 100); |
165 | 0 | (void)connman.GetAddresses(/*requestor=*/random_node, max_addresses, max_pct); |
166 | 0 | }, |
167 | 0 | [&] { |
168 | 0 | (void)connman.GetDeterministicRandomizer(fuzzed_data_provider.ConsumeIntegral<uint64_t>()); |
169 | 0 | }, |
170 | 0 | [&] { |
171 | 0 | (void)connman.GetNodeCount(fuzzed_data_provider.PickValueInArray({ConnectionDirection::None, ConnectionDirection::In, ConnectionDirection::Out, ConnectionDirection::Both})); |
172 | 0 | }, |
173 | 0 | [&] { |
174 | 0 | (void)connman.OutboundTargetReached(fuzzed_data_provider.ConsumeBool()); |
175 | 0 | }, |
176 | 0 | [&] { |
177 | 0 | CSerializedNetMsg serialized_net_msg; |
178 | 0 | serialized_net_msg.m_type = fuzzed_data_provider.ConsumeRandomLengthString(CMessageHeader::MESSAGE_TYPE_SIZE); |
179 | 0 | serialized_net_msg.data = ConsumeRandomLengthByteVector(fuzzed_data_provider); |
180 | 0 | connman.PushMessage(&random_node, std::move(serialized_net_msg)); |
181 | 0 | }, |
182 | 0 | [&] { |
183 | 0 | connman.RemoveAddedNode(random_string); |
184 | 0 | }, |
185 | 0 | [&] { |
186 | 0 | connman.SetNetworkActive(fuzzed_data_provider.ConsumeBool()); |
187 | 0 | }, |
188 | 0 | [&] { |
189 | 0 | connman.SetTryNewOutboundPeer(fuzzed_data_provider.ConsumeBool()); |
190 | 0 | }, |
191 | 0 | [&] { |
192 | 0 | ConnectionType conn_type{ |
193 | 0 | fuzzed_data_provider.PickValueInArray(ALL_CONNECTION_TYPES)}; |
194 | 0 | if (conn_type == ConnectionType::INBOUND) { // INBOUND is not allowed Branch (194:21): [True: 0, False: 0]
|
195 | 0 | conn_type = ConnectionType::OUTBOUND_FULL_RELAY; |
196 | 0 | } |
197 | |
|
198 | 0 | std::optional<Proxy> proxy_override; |
199 | 0 | if (conn_type == ConnectionType::PRIVATE_BROADCAST || fuzzed_data_provider.ConsumeBool()) { Branch (199:21): [True: 0, False: 0]
Branch (199:71): [True: 0, False: 0]
|
200 | 0 | proxy_override.emplace(ConsumeService(fuzzed_data_provider)); |
201 | 0 | } |
202 | |
|
203 | 0 | connman.OpenNetworkConnection( |
204 | 0 | /*addrConnect=*/random_address, |
205 | 0 | /*fCountFailure=*/fuzzed_data_provider.ConsumeBool(), |
206 | 0 | /*grant_outbound=*/{}, |
207 | 0 | /*pszDest=*/fuzzed_data_provider.ConsumeBool() ? nullptr : random_string.c_str(), Branch (207:33): [True: 0, False: 0]
|
208 | 0 | /*conn_type=*/conn_type, |
209 | 0 | /*use_v2transport=*/fuzzed_data_provider.ConsumeBool(), |
210 | 0 | /*proxy_override=*/proxy_override); |
211 | 0 | }, |
212 | 0 | [&] { |
213 | 0 | connman.SetNetworkActive(fuzzed_data_provider.ConsumeBool()); |
214 | 0 | const auto peer = ConsumeAddress(fuzzed_data_provider); |
215 | 0 | connman.CreateNodeFromAcceptedSocketPublic( |
216 | 0 | /*sock=*/CreateSock(AF_INET, SOCK_STREAM, IPPROTO_TCP), |
217 | 0 | /*permissions=*/ConsumeWeakEnum(fuzzed_data_provider, ALL_NET_PERMISSION_FLAGS), |
218 | 0 | /*addr_bind=*/ConsumeAddress(fuzzed_data_provider), |
219 | 0 | /*addr_peer=*/peer); |
220 | 0 | }, |
221 | 0 | [&] { |
222 | 0 | CConnman::Options options; |
223 | |
|
224 | 0 | options.vBinds = ConsumeServiceVector(fuzzed_data_provider); |
225 | |
|
226 | 0 | options.vWhiteBinds = std::vector<NetWhitebindPermissions>{ |
227 | 0 | fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 5)}; |
228 | 0 | for (auto& wb : options.vWhiteBinds) { Branch (228:31): [True: 0, False: 0]
|
229 | 0 | wb.m_flags = ConsumeWeakEnum(fuzzed_data_provider, ALL_NET_PERMISSION_FLAGS); |
230 | 0 | wb.m_service = ConsumeService(fuzzed_data_provider); |
231 | 0 | } |
232 | |
|
233 | 0 | options.onion_binds = ConsumeServiceVector(fuzzed_data_provider); |
234 | |
|
235 | 0 | options.bind_on_any = options.vBinds.empty() && options.vWhiteBinds.empty() && Branch (235:39): [True: 0, False: 0]
Branch (235:65): [True: 0, False: 0]
|
236 | 0 | options.onion_binds.empty(); Branch (236:39): [True: 0, False: 0]
|
237 | |
|
238 | 0 | connman.InitBindsPublic(options); |
239 | 0 | }, |
240 | 0 | [&] { |
241 | 0 | connman.SocketHandlerPublic(); |
242 | 0 | }); |
243 | 0 | } |
244 | 0 | connman.ForEachNode([](CNode* pnode) { |
245 | 0 | (void)pnode->GetId(); |
246 | 0 | (void)pnode->IsInboundConn(); |
247 | 0 | (void)pnode->IsFullOutboundConn(); |
248 | 0 | (void)pnode->ConnectionTypeAsString(); |
249 | 0 | }); |
250 | 0 | (void)connman.GetAddedNodeInfo(fuzzed_data_provider.ConsumeBool()); |
251 | 0 | (void)connman.GetExtraFullOutboundCount(); |
252 | 0 | (void)connman.GetLocalServices(); |
253 | 0 | assert(connman.GetMaxOutboundTarget() == max_outbound_limit); Branch (253:5): [True: 0, False: 0]
|
254 | 0 | (void)connman.GetMaxOutboundTimeframe(); |
255 | 0 | (void)connman.GetMaxOutboundTimeLeftInCycle(); |
256 | 0 | (void)connman.GetNetworkActive(); |
257 | 0 | std::vector<CNodeStats> stats; |
258 | 0 | connman.GetNodeStats(stats); |
259 | 0 | (void)connman.GetOutboundTargetBytesLeft(); |
260 | 0 | (void)connman.GetTotalBytesRecv(); |
261 | 0 | (void)connman.GetTotalBytesSent(); |
262 | 0 | (void)connman.GetTryNewOutboundPeer(); |
263 | 0 | (void)connman.GetUseAddrmanOutgoing(); |
264 | 0 | (void)connman.ASMapHealthCheck(); |
265 | |
|
266 | 0 | connman.ClearTestNodes(); |
267 | 0 | g_dns_lookup = g_dns_lookup_orig; |
268 | 0 | CreateSock = CreateSockOrig; |
269 | 0 | } |