Coverage Report

Created: 2026-06-18 19:06

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/root/bitcoin/src/test/fuzz/connman.cpp
Line
Count
Source
1
// Copyright (c) 2020-present The Bitcoin Core developers
2
// Distributed under the MIT software license, see the accompanying
3
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5
#include <addrman.h>
6
#include <chainparams.h>
7
#include <common/args.h>
8
#include <net.h>
9
#include <net_processing.h>
10
#include <netaddress.h>
11
#include <protocol.h>
12
#include <test/fuzz/FuzzedDataProvider.h>
13
#include <test/fuzz/fuzz.h>
14
#include <test/fuzz/util.h>
15
#include <test/fuzz/util/net.h>
16
#include <test/fuzz/util/threadinterrupt.h>
17
#include <test/util/setup_common.h>
18
#include <test/util/time.h>
19
#include <util/translation.h>
20
21
#include <cstdint>
22
#include <vector>
23
24
namespace {
25
const TestingSetup* g_setup;
26
27
int32_t GetCheckRatio()
28
0
{
29
0
    return std::clamp<int32_t>(g_setup->m_node.args->GetIntArg("-checkaddrman", 0), 0, 1000000);
30
0
}
31
32
} // namespace
33
34
void initialize_connman()
35
0
{
36
0
    static const auto testing_setup = MakeNoLogFileContext<const TestingSetup>();
37
0
    g_setup = testing_setup.get();
38
0
}
39
40
FUZZ_TARGET(connman, .init = initialize_connman)
41
0
{
42
0
    SeedRandomStateForTest(SeedRand::ZEROS);
43
0
    FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
44
0
    FakeNodeClock clock{ConsumeTime(fuzzed_data_provider)};
45
0
    auto netgroupman{ConsumeNetGroupManager(fuzzed_data_provider)};
46
0
    auto addr_man_ptr{std::make_unique<AddrManDeterministic>(netgroupman, fuzzed_data_provider, GetCheckRatio())};
47
0
    if (fuzzed_data_provider.ConsumeBool()) {
  Branch (47:9): [True: 0, False: 0]
48
0
        const std::vector<uint8_t> serialized_data{ConsumeRandomLengthByteVector(fuzzed_data_provider)};
49
0
        DataStream ds{serialized_data};
50
0
        try {
51
0
            ds >> *addr_man_ptr;
52
0
        } catch (const std::ios_base::failure&) {
53
0
            addr_man_ptr = std::make_unique<AddrManDeterministic>(netgroupman, fuzzed_data_provider, GetCheckRatio());
54
0
        }
55
0
    }
56
0
    AddrManDeterministic& addr_man{*addr_man_ptr};
57
0
    auto net_events{ConsumeNetEvents(fuzzed_data_provider)};
58
59
    // Mock CreateSock() to create FuzzedSock.
60
0
    auto CreateSockOrig = CreateSock;
61
0
    CreateSock = [&fuzzed_data_provider](int, int, int) {
62
0
        return std::make_unique<FuzzedSock>(fuzzed_data_provider);
63
0
    };
64
65
    // Mock g_dns_lookup() to return a fuzzed address.
66
0
    auto g_dns_lookup_orig = g_dns_lookup;
67
0
    g_dns_lookup = [&fuzzed_data_provider](const std::string&, bool) {
68
0
        return std::vector<CNetAddr>{ConsumeNetAddr(fuzzed_data_provider)};
69
0
    };
70
71
0
    ConnmanTestMsg connman{fuzzed_data_provider.ConsumeIntegral<uint64_t>(),
72
0
                     fuzzed_data_provider.ConsumeIntegral<uint64_t>(),
73
0
                     addr_man,
74
0
                     netgroupman,
75
0
                     Params(),
76
0
                     fuzzed_data_provider.ConsumeBool(),
77
0
                     ConsumeThreadInterrupt(fuzzed_data_provider)};
78
79
0
    const uint64_t max_outbound_limit{fuzzed_data_provider.ConsumeIntegral<uint64_t>()};
80
0
    CConnman::Options options;
81
0
    options.m_msgproc = &net_events;
82
0
    options.nMaxOutboundLimit = max_outbound_limit;
83
84
0
    auto consume_whitelist = [&]() {
85
0
        std::vector<NetWhitelistPermissions> result(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 3));
86
0
        for (auto& entry : result) {
  Branch (86:26): [True: 0, False: 0]
87
0
            entry.m_flags = ConsumeWeakEnum(fuzzed_data_provider, ALL_NET_PERMISSION_FLAGS);
88
0
            entry.m_subnet = ConsumeSubNet(fuzzed_data_provider);
89
0
        }
90
0
        return result;
91
0
    };
92
0
    options.vWhitelistedRangeIncoming = consume_whitelist();
93
0
    options.vWhitelistedRangeOutgoing = consume_whitelist();
94
95
0
    connman.Init(options);
96
97
0
    CNetAddr random_netaddr;
98
0
    CAddress random_address;
99
0
    CNode random_node = ConsumeNode(fuzzed_data_provider);
100
0
    CSubNet random_subnet;
101
0
    std::string random_string;
102
0
    std::vector<NodeId> node_ids;
103
104
0
    LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 100) {
105
0
        CNode& p2p_node{*ConsumeNodeAsUniquePtr(fuzzed_data_provider).release()};
106
        // Simulate post-handshake state.
107
0
        p2p_node.fSuccessfullyConnected = true;
108
0
        connman.AddTestNode(p2p_node);
109
0
        node_ids.push_back(p2p_node.GetId());
110
0
    }
111
112
0
    LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
113
0
        CallOneOf(
114
0
            fuzzed_data_provider,
115
0
            [&] {
116
0
                random_netaddr = ConsumeNetAddr(fuzzed_data_provider);
117
0
            },
118
0
            [&] {
119
0
                random_address = ConsumeAddress(fuzzed_data_provider);
120
0
            },
121
0
            [&] {
122
0
                random_subnet = ConsumeSubNet(fuzzed_data_provider);
123
0
            },
124
0
            [&] {
125
0
                random_string = fuzzed_data_provider.ConsumeRandomLengthString(64);
126
0
            },
127
0
            [&] {
128
0
                connman.AddNode({random_string, fuzzed_data_provider.ConsumeBool()});
129
0
            },
130
0
            [&] {
131
0
                connman.CheckIncomingNonce(fuzzed_data_provider.ConsumeIntegral<uint64_t>());
132
0
            },
133
0
            [&] {
134
0
                connman.DisconnectNode(fuzzed_data_provider.ConsumeIntegral<NodeId>());
135
0
            },
136
0
            [&] {
137
0
                connman.DisconnectNode(random_netaddr);
138
0
            },
139
0
            [&] {
140
0
                connman.DisconnectNode(random_string);
141
0
            },
142
0
            [&] {
143
0
                connman.DisconnectNode(random_subnet);
144
0
            },
145
0
            [&] {
146
0
                NodeId id = node_ids.empty() || fuzzed_data_provider.ConsumeBool()
  Branch (146:29): [True: 0, False: 0]
  Branch (146:49): [True: 0, False: 0]
147
0
                    ? fuzzed_data_provider.ConsumeIntegral<NodeId>()
148
0
                    : PickValue(fuzzed_data_provider, node_ids);
149
0
                (void)connman.ForNode(id, [&](CNode* pnode) {
150
0
                    (void)pnode->GetId();
151
0
                    (void)pnode->IsInboundConn();
152
0
                    (void)pnode->IsFullOutboundConn();
153
0
                    return true;
154
0
                });
155
0
            },
156
0
            [&] {
157
0
                auto max_addresses = fuzzed_data_provider.ConsumeIntegral<size_t>();
158
0
                auto max_pct = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 100);
159
0
                auto filtered = fuzzed_data_provider.ConsumeBool();
160
0
                (void)connman.GetAddressesUnsafe(max_addresses, max_pct, /*network=*/std::nullopt, filtered);
161
0
            },
162
0
            [&] {
163
0
                auto max_addresses = fuzzed_data_provider.ConsumeIntegral<size_t>();
164
0
                auto max_pct = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 100);
165
0
                (void)connman.GetAddresses(/*requestor=*/random_node, max_addresses, max_pct);
166
0
            },
167
0
            [&] {
168
0
                (void)connman.GetDeterministicRandomizer(fuzzed_data_provider.ConsumeIntegral<uint64_t>());
169
0
            },
170
0
            [&] {
171
0
                (void)connman.GetNodeCount(fuzzed_data_provider.PickValueInArray({ConnectionDirection::None, ConnectionDirection::In, ConnectionDirection::Out, ConnectionDirection::Both}));
172
0
            },
173
0
            [&] {
174
0
                (void)connman.OutboundTargetReached(fuzzed_data_provider.ConsumeBool());
175
0
            },
176
0
            [&] {
177
0
                CSerializedNetMsg serialized_net_msg;
178
0
                serialized_net_msg.m_type = fuzzed_data_provider.ConsumeRandomLengthString(CMessageHeader::MESSAGE_TYPE_SIZE);
179
0
                serialized_net_msg.data = ConsumeRandomLengthByteVector(fuzzed_data_provider);
180
0
                connman.PushMessage(&random_node, std::move(serialized_net_msg));
181
0
            },
182
0
            [&] {
183
0
                connman.RemoveAddedNode(random_string);
184
0
            },
185
0
            [&] {
186
0
                connman.SetNetworkActive(fuzzed_data_provider.ConsumeBool());
187
0
            },
188
0
            [&] {
189
0
                connman.SetTryNewOutboundPeer(fuzzed_data_provider.ConsumeBool());
190
0
            },
191
0
            [&] {
192
0
                ConnectionType conn_type{
193
0
                    fuzzed_data_provider.PickValueInArray(ALL_CONNECTION_TYPES)};
194
0
                if (conn_type == ConnectionType::INBOUND) { // INBOUND is not allowed
  Branch (194:21): [True: 0, False: 0]
195
0
                    conn_type = ConnectionType::OUTBOUND_FULL_RELAY;
196
0
                }
197
198
0
                std::optional<Proxy> proxy_override;
199
0
                if (conn_type == ConnectionType::PRIVATE_BROADCAST || fuzzed_data_provider.ConsumeBool()) {
  Branch (199:21): [True: 0, False: 0]
  Branch (199:71): [True: 0, False: 0]
200
0
                    proxy_override.emplace(ConsumeService(fuzzed_data_provider));
201
0
                }
202
203
0
                connman.OpenNetworkConnection(
204
0
                    /*addrConnect=*/random_address,
205
0
                    /*fCountFailure=*/fuzzed_data_provider.ConsumeBool(),
206
0
                    /*grant_outbound=*/{},
207
0
                    /*pszDest=*/fuzzed_data_provider.ConsumeBool() ? nullptr : random_string.c_str(),
  Branch (207:33): [True: 0, False: 0]
208
0
                    /*conn_type=*/conn_type,
209
0
                    /*use_v2transport=*/fuzzed_data_provider.ConsumeBool(),
210
0
                    /*proxy_override=*/proxy_override);
211
0
            },
212
0
            [&] {
213
0
                connman.SetNetworkActive(fuzzed_data_provider.ConsumeBool());
214
0
                const auto peer = ConsumeAddress(fuzzed_data_provider);
215
0
                connman.CreateNodeFromAcceptedSocketPublic(
216
0
                    /*sock=*/CreateSock(AF_INET, SOCK_STREAM, IPPROTO_TCP),
217
0
                    /*permissions=*/ConsumeWeakEnum(fuzzed_data_provider, ALL_NET_PERMISSION_FLAGS),
218
0
                    /*addr_bind=*/ConsumeAddress(fuzzed_data_provider),
219
0
                    /*addr_peer=*/peer);
220
0
            },
221
0
            [&] {
222
0
                CConnman::Options options;
223
224
0
                options.vBinds = ConsumeServiceVector(fuzzed_data_provider);
225
226
0
                options.vWhiteBinds = std::vector<NetWhitebindPermissions>{
227
0
                    fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 5)};
228
0
                for (auto& wb : options.vWhiteBinds) {
  Branch (228:31): [True: 0, False: 0]
229
0
                    wb.m_flags = ConsumeWeakEnum(fuzzed_data_provider, ALL_NET_PERMISSION_FLAGS);
230
0
                    wb.m_service = ConsumeService(fuzzed_data_provider);
231
0
                }
232
233
0
                options.onion_binds = ConsumeServiceVector(fuzzed_data_provider);
234
235
0
                options.bind_on_any = options.vBinds.empty() && options.vWhiteBinds.empty() &&
  Branch (235:39): [True: 0, False: 0]
  Branch (235:65): [True: 0, False: 0]
236
0
                                      options.onion_binds.empty();
  Branch (236:39): [True: 0, False: 0]
237
238
0
                connman.InitBindsPublic(options);
239
0
            },
240
0
            [&] {
241
0
                connman.SocketHandlerPublic();
242
0
            });
243
0
    }
244
0
    connman.ForEachNode([](CNode* pnode) {
245
0
        (void)pnode->GetId();
246
0
        (void)pnode->IsInboundConn();
247
0
        (void)pnode->IsFullOutboundConn();
248
0
        (void)pnode->ConnectionTypeAsString();
249
0
    });
250
0
    (void)connman.GetAddedNodeInfo(fuzzed_data_provider.ConsumeBool());
251
0
    (void)connman.GetExtraFullOutboundCount();
252
0
    (void)connman.GetLocalServices();
253
0
    assert(connman.GetMaxOutboundTarget() == max_outbound_limit);
  Branch (253:5): [True: 0, False: 0]
254
0
    (void)connman.GetMaxOutboundTimeframe();
255
0
    (void)connman.GetMaxOutboundTimeLeftInCycle();
256
0
    (void)connman.GetNetworkActive();
257
0
    std::vector<CNodeStats> stats;
258
0
    connman.GetNodeStats(stats);
259
0
    (void)connman.GetOutboundTargetBytesLeft();
260
0
    (void)connman.GetTotalBytesRecv();
261
0
    (void)connman.GetTotalBytesSent();
262
0
    (void)connman.GetTryNewOutboundPeer();
263
0
    (void)connman.GetUseAddrmanOutgoing();
264
0
    (void)connman.ASMapHealthCheck();
265
266
0
    connman.ClearTestNodes();
267
0
    g_dns_lookup = g_dns_lookup_orig;
268
0
    CreateSock = CreateSockOrig;
269
0
}