Coverage Report

Created: 2024-10-29 12:15

/root/bitcoin/src/test/fuzz/txorphan.cpp
Line
Count
Source (jump to first uncovered line)
1
// Copyright (c) 2022-present The Bitcoin Core developers
2
// Distributed under the MIT software license, see the accompanying
3
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5
#include <consensus/amount.h>
6
#include <consensus/validation.h>
7
#include <net_processing.h>
8
#include <node/eviction.h>
9
#include <policy/policy.h>
10
#include <primitives/transaction.h>
11
#include <script/script.h>
12
#include <sync.h>
13
#include <test/fuzz/FuzzedDataProvider.h>
14
#include <test/fuzz/fuzz.h>
15
#include <test/fuzz/util.h>
16
#include <test/util/setup_common.h>
17
#include <txorphanage.h>
18
#include <uint256.h>
19
#include <util/check.h>
20
#include <util/time.h>
21
22
#include <cstdint>
23
#include <memory>
24
#include <set>
25
#include <utility>
26
#include <vector>
27
28
void initialize_orphanage()
29
0
{
30
0
    static const auto testing_setup = MakeNoLogFileContext();
31
0
}
32
33
FUZZ_TARGET(txorphan, .init = initialize_orphanage)
34
0
{
35
0
    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
36
0
    FastRandomContext limit_orphans_rng{/*fDeterministic=*/true};
37
0
    SetMockTime(ConsumeTime(fuzzed_data_provider));
38
39
0
    TxOrphanage orphanage;
40
0
    std::vector<COutPoint> outpoints; // Duplicates are tolerated
41
42
    // initial outpoints used to construct transactions later
43
0
    for (uint8_t i = 0; i < 4; i++) {
44
0
        outpoints.emplace_back(Txid::FromUint256(uint256{i}), 0);
45
0
    }
46
47
0
    CTransactionRef ptx_potential_parent = nullptr;
48
49
0
    LIMITED_WHILE(outpoints.size() < 200'000 && fuzzed_data_provider.ConsumeBool(), 10 * DEFAULT_MAX_ORPHAN_TRANSACTIONS)
50
0
    {
51
        // construct transaction
52
0
        const CTransactionRef tx = [&] {
53
0
            CMutableTransaction tx_mut;
54
0
            const auto num_in = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, outpoints.size());
55
0
            const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, 256);
56
            // pick outpoints from outpoints as input. We allow input duplicates on purpose, given we are not
57
            // running any transaction validation logic before adding transactions to the orphanage
58
0
            for (uint32_t i = 0; i < num_in; i++) {
59
0
                auto& prevout = PickValue(fuzzed_data_provider, outpoints);
60
                // try making transactions unique by setting a random nSequence, but allow duplicate transactions if they happen
61
0
                tx_mut.vin.emplace_back(prevout, CScript{}, fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, CTxIn::SEQUENCE_FINAL));
62
0
            }
63
            // output amount will not affect txorphanage
64
0
            for (uint32_t i = 0; i < num_out; i++) {
65
0
                tx_mut.vout.emplace_back(CAmount{0}, CScript{});
66
0
            }
67
0
            auto new_tx = MakeTransactionRef(tx_mut);
68
            // add newly constructed outpoints to the coin pool
69
0
            for (uint32_t i = 0; i < num_out; i++) {
70
0
                outpoints.emplace_back(new_tx->GetHash(), i);
71
0
            }
72
0
            return new_tx;
73
0
        }();
74
75
        // Trigger orphanage functions that are called using parents. ptx_potential_parent is a tx we constructed in a
76
        // previous loop and potentially the parent of this tx.
77
0
        if (ptx_potential_parent) {
78
            // Set up future GetTxToReconsider call.
79
0
            orphanage.AddChildrenToWorkSet(*ptx_potential_parent);
80
81
            // Check that all txns returned from GetChildrenFrom* are indeed a direct child of this tx.
82
0
            NodeId peer_id = fuzzed_data_provider.ConsumeIntegral<NodeId>();
83
0
            for (const auto& child : orphanage.GetChildrenFromSamePeer(ptx_potential_parent, peer_id)) {
84
0
                assert(std::any_of(child->vin.cbegin(), child->vin.cend(), [&](const auto& input) {
85
0
                    return input.prevout.hash == ptx_potential_parent->GetHash();
86
0
                }));
87
0
            }
88
0
            for (const auto& [child, peer] : orphanage.GetChildrenFromDifferentPeer(ptx_potential_parent, peer_id)) {
89
0
                assert(std::any_of(child->vin.cbegin(), child->vin.cend(), [&](const auto& input) {
90
0
                    return input.prevout.hash == ptx_potential_parent->GetHash();
91
0
                }));
92
0
                assert(peer != peer_id);
93
0
            }
94
0
        }
95
96
        // trigger orphanage functions
97
0
        LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10 * DEFAULT_MAX_ORPHAN_TRANSACTIONS)
98
0
        {
99
0
            NodeId peer_id = fuzzed_data_provider.ConsumeIntegral<NodeId>();
100
101
0
            CallOneOf(
102
0
                fuzzed_data_provider,
103
0
                [&] {
104
0
                    {
105
0
                        CTransactionRef ref = orphanage.GetTxToReconsider(peer_id);
106
0
                        if (ref) {
107
0
                            Assert(orphanage.HaveTx(ref->GetWitnessHash()));
108
0
                        }
109
0
                    }
110
0
                },
111
0
                [&] {
112
0
                    bool have_tx = orphanage.HaveTx(tx->GetWitnessHash());
113
                    // AddTx should return false if tx is too big or already have it
114
                    // tx weight is unknown, we only check when tx is already in orphanage
115
0
                    {
116
0
                        bool add_tx = orphanage.AddTx(tx, peer_id);
117
                        // have_tx == true -> add_tx == false
118
0
                        Assert(!have_tx || !add_tx);
119
0
                    }
120
0
                    have_tx = orphanage.HaveTx(tx->GetWitnessHash());
121
0
                    {
122
0
                        bool add_tx = orphanage.AddTx(tx, peer_id);
123
                        // if have_tx is still false, it must be too big
124
0
                        Assert(!have_tx == (GetTransactionWeight(*tx) > MAX_STANDARD_TX_WEIGHT));
125
0
                        Assert(!have_tx || !add_tx);
126
0
                    }
127
0
                },
128
0
                [&] {
129
0
                    bool have_tx = orphanage.HaveTx(tx->GetWitnessHash());
130
                    // EraseTx should return 0 if m_orphans doesn't have the tx
131
0
                    {
132
0
                        Assert(have_tx == orphanage.EraseTx(tx->GetWitnessHash()));
133
0
                    }
134
0
                    have_tx = orphanage.HaveTx(tx->GetWitnessHash());
135
                    // have_tx should be false and EraseTx should fail
136
0
                    {
137
0
                        Assert(!have_tx && !orphanage.EraseTx(tx->GetWitnessHash()));
138
0
                    }
139
0
                },
140
0
                [&] {
141
0
                    orphanage.EraseForPeer(peer_id);
142
0
                },
143
0
                [&] {
144
                    // test mocktime and expiry
145
0
                    SetMockTime(ConsumeTime(fuzzed_data_provider));
146
0
                    auto limit = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
147
0
                    orphanage.LimitOrphans(limit, limit_orphans_rng);
148
0
                    Assert(orphanage.Size() <= limit);
149
0
                });
150
151
0
        }
152
        // Set tx as potential parent to be used for future GetChildren() calls.
153
0
        if (!ptx_potential_parent || fuzzed_data_provider.ConsumeBool()) {
154
0
            ptx_potential_parent = tx;
155
0
        }
156
157
0
    }
158
0
}