/root/bitcoin/src/test/fuzz/txorphan.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | // Copyright (c) 2022-present The Bitcoin Core developers |
2 | | // Distributed under the MIT software license, see the accompanying |
3 | | // file COPYING or http://www.opensource.org/licenses/mit-license.php. |
4 | | |
5 | | #include <consensus/amount.h> |
6 | | #include <consensus/validation.h> |
7 | | #include <net_processing.h> |
8 | | #include <node/eviction.h> |
9 | | #include <policy/policy.h> |
10 | | #include <primitives/transaction.h> |
11 | | #include <script/script.h> |
12 | | #include <sync.h> |
13 | | #include <test/fuzz/FuzzedDataProvider.h> |
14 | | #include <test/fuzz/fuzz.h> |
15 | | #include <test/fuzz/util.h> |
16 | | #include <test/util/setup_common.h> |
17 | | #include <txorphanage.h> |
18 | | #include <uint256.h> |
19 | | #include <util/check.h> |
20 | | #include <util/time.h> |
21 | | |
22 | | #include <cstdint> |
23 | | #include <memory> |
24 | | #include <set> |
25 | | #include <utility> |
26 | | #include <vector> |
27 | | |
28 | | void initialize_orphanage() |
29 | 0 | { |
30 | 0 | static const auto testing_setup = MakeNoLogFileContext(); |
31 | 0 | } |
32 | | |
33 | | FUZZ_TARGET(txorphan, .init = initialize_orphanage) |
34 | 0 | { |
35 | 0 | FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); |
36 | 0 | FastRandomContext limit_orphans_rng{/*fDeterministic=*/true}; |
37 | 0 | SetMockTime(ConsumeTime(fuzzed_data_provider)); |
38 | |
|
39 | 0 | TxOrphanage orphanage; |
40 | 0 | std::vector<COutPoint> outpoints; // Duplicates are tolerated |
41 | | |
42 | | // initial outpoints used to construct transactions later |
43 | 0 | for (uint8_t i = 0; i < 4; i++) { |
44 | 0 | outpoints.emplace_back(Txid::FromUint256(uint256{i}), 0); |
45 | 0 | } |
46 | |
|
47 | 0 | CTransactionRef ptx_potential_parent = nullptr; |
48 | |
|
49 | 0 | LIMITED_WHILE(outpoints.size() < 200'000 && fuzzed_data_provider.ConsumeBool(), 10 * DEFAULT_MAX_ORPHAN_TRANSACTIONS) |
50 | 0 | { |
51 | | // construct transaction |
52 | 0 | const CTransactionRef tx = [&] { |
53 | 0 | CMutableTransaction tx_mut; |
54 | 0 | const auto num_in = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, outpoints.size()); |
55 | 0 | const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, 256); |
56 | | // pick outpoints from outpoints as input. We allow input duplicates on purpose, given we are not |
57 | | // running any transaction validation logic before adding transactions to the orphanage |
58 | 0 | for (uint32_t i = 0; i < num_in; i++) { |
59 | 0 | auto& prevout = PickValue(fuzzed_data_provider, outpoints); |
60 | | // try making transactions unique by setting a random nSequence, but allow duplicate transactions if they happen |
61 | 0 | tx_mut.vin.emplace_back(prevout, CScript{}, fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, CTxIn::SEQUENCE_FINAL)); |
62 | 0 | } |
63 | | // output amount will not affect txorphanage |
64 | 0 | for (uint32_t i = 0; i < num_out; i++) { |
65 | 0 | tx_mut.vout.emplace_back(CAmount{0}, CScript{}); |
66 | 0 | } |
67 | 0 | auto new_tx = MakeTransactionRef(tx_mut); |
68 | | // add newly constructed outpoints to the coin pool |
69 | 0 | for (uint32_t i = 0; i < num_out; i++) { |
70 | 0 | outpoints.emplace_back(new_tx->GetHash(), i); |
71 | 0 | } |
72 | 0 | return new_tx; |
73 | 0 | }(); |
74 | | |
75 | | // Trigger orphanage functions that are called using parents. ptx_potential_parent is a tx we constructed in a |
76 | | // previous loop and potentially the parent of this tx. |
77 | 0 | if (ptx_potential_parent) { |
78 | | // Set up future GetTxToReconsider call. |
79 | 0 | orphanage.AddChildrenToWorkSet(*ptx_potential_parent); |
80 | | |
81 | | // Check that all txns returned from GetChildrenFrom* are indeed a direct child of this tx. |
82 | 0 | NodeId peer_id = fuzzed_data_provider.ConsumeIntegral<NodeId>(); |
83 | 0 | for (const auto& child : orphanage.GetChildrenFromSamePeer(ptx_potential_parent, peer_id)) { |
84 | 0 | assert(std::any_of(child->vin.cbegin(), child->vin.cend(), [&](const auto& input) { |
85 | 0 | return input.prevout.hash == ptx_potential_parent->GetHash(); |
86 | 0 | })); |
87 | 0 | } |
88 | 0 | for (const auto& [child, peer] : orphanage.GetChildrenFromDifferentPeer(ptx_potential_parent, peer_id)) { |
89 | 0 | assert(std::any_of(child->vin.cbegin(), child->vin.cend(), [&](const auto& input) { |
90 | 0 | return input.prevout.hash == ptx_potential_parent->GetHash(); |
91 | 0 | })); |
92 | 0 | assert(peer != peer_id); |
93 | 0 | } |
94 | 0 | } |
95 | | |
96 | | // trigger orphanage functions |
97 | 0 | LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10 * DEFAULT_MAX_ORPHAN_TRANSACTIONS) |
98 | 0 | { |
99 | 0 | NodeId peer_id = fuzzed_data_provider.ConsumeIntegral<NodeId>(); |
100 | |
|
101 | 0 | CallOneOf( |
102 | 0 | fuzzed_data_provider, |
103 | 0 | [&] { |
104 | 0 | { |
105 | 0 | CTransactionRef ref = orphanage.GetTxToReconsider(peer_id); |
106 | 0 | if (ref) { |
107 | 0 | Assert(orphanage.HaveTx(ref->GetWitnessHash())); |
108 | 0 | } |
109 | 0 | } |
110 | 0 | }, |
111 | 0 | [&] { |
112 | 0 | bool have_tx = orphanage.HaveTx(tx->GetWitnessHash()); |
113 | | // AddTx should return false if tx is too big or already have it |
114 | | // tx weight is unknown, we only check when tx is already in orphanage |
115 | 0 | { |
116 | 0 | bool add_tx = orphanage.AddTx(tx, peer_id); |
117 | | // have_tx == true -> add_tx == false |
118 | 0 | Assert(!have_tx || !add_tx); |
119 | 0 | } |
120 | 0 | have_tx = orphanage.HaveTx(tx->GetWitnessHash()); |
121 | 0 | { |
122 | 0 | bool add_tx = orphanage.AddTx(tx, peer_id); |
123 | | // if have_tx is still false, it must be too big |
124 | 0 | Assert(!have_tx == (GetTransactionWeight(*tx) > MAX_STANDARD_TX_WEIGHT)); |
125 | 0 | Assert(!have_tx || !add_tx); |
126 | 0 | } |
127 | 0 | }, |
128 | 0 | [&] { |
129 | 0 | bool have_tx = orphanage.HaveTx(tx->GetWitnessHash()); |
130 | | // EraseTx should return 0 if m_orphans doesn't have the tx |
131 | 0 | { |
132 | 0 | Assert(have_tx == orphanage.EraseTx(tx->GetWitnessHash())); |
133 | 0 | } |
134 | 0 | have_tx = orphanage.HaveTx(tx->GetWitnessHash()); |
135 | | // have_tx should be false and EraseTx should fail |
136 | 0 | { |
137 | 0 | Assert(!have_tx && !orphanage.EraseTx(tx->GetWitnessHash())); |
138 | 0 | } |
139 | 0 | }, |
140 | 0 | [&] { |
141 | 0 | orphanage.EraseForPeer(peer_id); |
142 | 0 | }, |
143 | 0 | [&] { |
144 | | // test mocktime and expiry |
145 | 0 | SetMockTime(ConsumeTime(fuzzed_data_provider)); |
146 | 0 | auto limit = fuzzed_data_provider.ConsumeIntegral<unsigned int>(); |
147 | 0 | orphanage.LimitOrphans(limit, limit_orphans_rng); |
148 | 0 | Assert(orphanage.Size() <= limit); |
149 | 0 | }); |
150 | |
|
151 | 0 | } |
152 | | // Set tx as potential parent to be used for future GetChildren() calls. |
153 | 0 | if (!ptx_potential_parent || fuzzed_data_provider.ConsumeBool()) { |
154 | 0 | ptx_potential_parent = tx; |
155 | 0 | } |
156 | |
|
157 | 0 | } |
158 | 0 | } |