_ Git - rust-lightning/blob - fuzz/fuzz_targets/router_target.rs

   1 extern crate bitcoin;
   2 extern crate lightning;
   3 extern crate secp256k1;
   4
   5 use lightning::ln::channelmanager::ChannelDetails;
   6 use lightning::ln::msgs;
   7 use lightning::ln::msgs::{MsgDecodable, RoutingMessageHandler};
   8 use lightning::ln::router::{Router, RouteHint};
   9 use lightning::util::reset_rng_state;
  10
  11 use secp256k1::key::PublicKey;
  12 use secp256k1::Secp256k1;
  13
  14 #[inline]
  15 pub fn slice_to_be16(v: &[u8]) -> u16 {
  16         ((v[0] as u16) << 8*1) |
  17         ((v[1] as u16) << 8*0)
  18 }
  19
  20 #[inline]
  21 pub fn slice_to_be32(v: &[u8]) -> u32 {
  22         ((v[0] as u32) << 8*3) |
  23         ((v[1] as u32) << 8*2) |
  24         ((v[2] as u32) << 8*1) |
  25         ((v[3] as u32) << 8*0)
  26 }
  27
  28 #[inline]
  29 pub fn slice_to_be64(v: &[u8]) -> u64 {
  30         ((v[0] as u64) << 8*7) |
  31         ((v[1] as u64) << 8*6) |
  32         ((v[2] as u64) << 8*5) |
  33         ((v[3] as u64) << 8*4) |
  34         ((v[4] as u64) << 8*3) |
  35         ((v[5] as u64) << 8*2) |
  36         ((v[6] as u64) << 8*1) |
  37         ((v[7] as u64) << 8*0)
  38 }
  39
  40 #[inline]
  41 pub fn do_test(data: &[u8]) {
  42         reset_rng_state();
  43
  44         let mut read_pos = 0;
  45         macro_rules! get_slice_nonadvancing {
  46                 ($len: expr) => {
  47                         {
  48                                 if data.len() < read_pos + $len as usize {
  49                                         return;
  50                                 }
  51                                 &data[read_pos..read_pos + $len as usize]
  52                         }
  53                 }
  54         }
  55         macro_rules! get_slice {
  56                 ($len: expr) => {
  57                         {
  58                                 let res = get_slice_nonadvancing!($len);
  59                                 read_pos += $len;
  60                                 res
  61                         }
  62                 }
  63         }
  64
  65         macro_rules! decode_msg {
  66                 ($MsgType: path, $len: expr) => {
  67                         match <($MsgType)>::decode(get_slice!($len)) {
  68                                 Ok(msg) => msg,
  69                                 Err(e) => match e {
  70                                         msgs::DecodeError::UnknownRealmByte => return,
  71                                         msgs::DecodeError::BadPublicKey => return,
  72                                         msgs::DecodeError::BadSignature => return,
  73                                         msgs::DecodeError::BadText => return,
  74                                         msgs::DecodeError::ExtraAddressesPerType => return,
  75                                         msgs::DecodeError::BadLengthDescriptor => return,
  76                                         msgs::DecodeError::ShortRead => panic!("We picked the length..."),
  77                                 }
  78                         }
  79                 }
  80         }
  81
  82         macro_rules! decode_msg_with_len16 {
  83                 ($MsgType: path, $begin_len: expr, $excess: expr) => {
  84                         {
  85                                 let extra_len = slice_to_be16(&get_slice_nonadvancing!($begin_len as usize + 2)[$begin_len..$begin_len + 2]);
  86                                 decode_msg!($MsgType, $begin_len as usize + 2 + (extra_len as usize) + $excess)
  87                         }
  88                 }
  89         }
  90
  91         let secp_ctx = Secp256k1::new();
  92         macro_rules! get_pubkey {
  93                 () => {
  94                         match PublicKey::from_slice(&secp_ctx, get_slice!(33)) {
  95                                 Ok(key) => key,
  96                                 Err(_) => return,
  97                         }
  98                 }
  99         }
 100
 101         let our_pubkey = get_pubkey!();
 102         let router = Router::new(our_pubkey.clone());
 103
 104         loop {
 105                 match get_slice!(1)[0] {
 106                         0 => {
 107                                 let start_len = slice_to_be16(&get_slice_nonadvancing!(64 + 2)[64..64 + 2]) as usize;
 108                                 let addr_len = slice_to_be16(&get_slice_nonadvancing!(64+start_len+2 + 74)[64+start_len+2 + 72..64+start_len+2 + 74]);
 109                                 if addr_len > (37+1)*4 {
 110                                         return;
 111                                 }
 112                                 let _ = router.handle_node_announcement(&decode_msg_with_len16!(msgs::NodeAnnouncement, 64, 288));
 113                         },
 114                         1 => {
 115                                 let _ = router.handle_channel_announcement(&decode_msg_with_len16!(msgs::ChannelAnnouncement, 64*4, 32+8+33*4));
 116                         },
 117                         2 => {
 118                                 let _ = router.handle_channel_update(&decode_msg!(msgs::ChannelUpdate, 128));
 119                         },
 120                         3 => {
 121                                 match get_slice!(1)[0] {
 122                                         0 => {
 123                                                 router.handle_htlc_fail_channel_update(&msgs::HTLCFailChannelUpdate::ChannelUpdateMessage {msg: decode_msg!(msgs::ChannelUpdate, 128)});
 124                                         },
 125                                         1 => {
 126                                                 let short_channel_id = slice_to_be64(get_slice!(8));
 127                                                 router.handle_htlc_fail_channel_update(&msgs::HTLCFailChannelUpdate::ChannelClosed {short_channel_id});
 128                                         },
 129                                         _ => return,
 130                                 }
 131                         },
 132                         4 => {
 133                                 let target = get_pubkey!();
 134                                 let mut first_hops_vec = Vec::new();
 135                                 let first_hops = match get_slice!(1)[0] {
 136                                         0 => None,
 137                                         1 => {
 138                                                 let count = slice_to_be16(get_slice!(2));
 139                                                 for _ in 0..count {
 140                                                         first_hops_vec.push(ChannelDetails {
 141                                                                 channel_id: [0; 32],
 142                                                                 short_channel_id: Some(slice_to_be64(get_slice!(8))),
 143                                                                 remote_network_id: get_pubkey!(),
 144                                                                 channel_value_satoshis: slice_to_be64(get_slice!(8)),
 145                                                                 user_id: 0,
 146                                                         });
 147                                                 }
 148                                                 Some(&first_hops_vec[..])
 149                                         },
 150                                         _ => return,
 151                                 };
 152                                 let mut last_hops_vec = Vec::new();
 153                                 let last_hops = {
 154                                         let count = slice_to_be16(get_slice!(2));
 155                                         for _ in 0..count {
 156                                                 last_hops_vec.push(RouteHint {
 157                                                         src_node_id: get_pubkey!(),
 158                                                         short_channel_id: slice_to_be64(get_slice!(8)),
 159                                                         fee_base_msat: slice_to_be64(get_slice!(8)),
 160                                                         fee_proportional_millionths: slice_to_be32(get_slice!(4)),
 161                                                         cltv_expiry_delta: slice_to_be16(get_slice!(2)),
 162                                                         htlc_minimum_msat: slice_to_be64(get_slice!(8)),
 163                                                 });
 164                                         }
 165                                         &last_hops_vec[..]
 166                                 };
 167                                 let _ = router.get_route(&target, first_hops, last_hops, slice_to_be64(get_slice!(8)), slice_to_be32(get_slice!(4)));
 168                         },
 169                         _ => return,
 170                 }
 171         }
 172 }
 173
 174 #[cfg(feature = "afl")]
 175 extern crate afl;
 176 #[cfg(feature = "afl")]
 177 fn main() {
 178         afl::read_stdio_bytes(|data| {
 179                 do_test(&data);
 180         });
 181 }
 182
 183 #[cfg(feature = "honggfuzz")]
 184 #[macro_use] extern crate honggfuzz;
 185 #[cfg(feature = "honggfuzz")]
 186 fn main() {
 187         loop {
 188                 fuzz!(|data| {
 189                         do_test(data);
 190                 });
 191         }
 192 }
 193
 194 #[cfg(test)]
 195 mod tests {
 196         fn extend_vec_from_hex(hex: &str, out: &mut Vec<u8>) {
 197                 let mut b = 0;
 198                 for (idx, c) in hex.as_bytes().iter().enumerate() {
 199                         b <<= 4;
 200                         match *c {
 201                                 b'A'...b'F' => b |= c - b'A' + 10,
 202                                 b'a'...b'f' => b |= c - b'a' + 10,
 203                                 b'0'...b'9' => b |= c - b'0',
 204                                 _ => panic!("Bad hex"),
 205                         }
 206                         if (idx & 1) == 1 {
 207                                 out.push(b);
 208                                 b = 0;
 209                         }
 210                 }
 211         }
 212
 213         #[test]
 214         fn duplicate_crash() {
 215                 let mut a = Vec::new();
 216                 extend_vec_from_hex("00", &mut a);
 217                 super::do_test(&a);
 218         }
 219 }