_ Git - rust-lightning/blob - fuzz/fuzz_targets/router_target.rs

   1 extern crate bitcoin;
   2 extern crate lightning;
   3 extern crate secp256k1;
   4
   5 use bitcoin::network::constants::Network;
   6
   7 use lightning::chain::chaininterface;
   8 use lightning::ln::channelmanager::ChannelDetails;
   9 use lightning::ln::msgs;
  10 use lightning::ln::msgs::{MsgDecodable, RoutingMessageHandler};
  11 use lightning::ln::router::{Router, RouteHint};
  12 use lightning::util::reset_rng_state;
  13 use lightning::util::logger::Logger;
  14
  15 use secp256k1::key::PublicKey;
  16 use secp256k1::Secp256k1;
  17
  18 mod utils;
  19
  20 use utils::test_logger;
  21
  22 use std::sync::Arc;
  23
  24 #[inline]
  25 pub fn slice_to_be16(v: &[u8]) -> u16 {
  26         ((v[0] as u16) << 8*1) |
  27         ((v[1] as u16) << 8*0)
  28 }
  29
  30 #[inline]
  31 pub fn slice_to_be32(v: &[u8]) -> u32 {
  32         ((v[0] as u32) << 8*3) |
  33         ((v[1] as u32) << 8*2) |
  34         ((v[2] as u32) << 8*1) |
  35         ((v[3] as u32) << 8*0)
  36 }
  37
  38 #[inline]
  39 pub fn slice_to_be64(v: &[u8]) -> u64 {
  40         ((v[0] as u64) << 8*7) |
  41         ((v[1] as u64) << 8*6) |
  42         ((v[2] as u64) << 8*5) |
  43         ((v[3] as u64) << 8*4) |
  44         ((v[4] as u64) << 8*3) |
  45         ((v[5] as u64) << 8*2) |
  46         ((v[6] as u64) << 8*1) |
  47         ((v[7] as u64) << 8*0)
  48 }
  49
  50 #[inline]
  51 pub fn do_test(data: &[u8]) {
  52         reset_rng_state();
  53
  54         let mut read_pos = 0;
  55         macro_rules! get_slice_nonadvancing {
  56                 ($len: expr) => {
  57                         {
  58                                 if data.len() < read_pos + $len as usize {
  59                                         return;
  60                                 }
  61                                 &data[read_pos..read_pos + $len as usize]
  62                         }
  63                 }
  64         }
  65         macro_rules! get_slice {
  66                 ($len: expr) => {
  67                         {
  68                                 let res = get_slice_nonadvancing!($len);
  69                                 read_pos += $len;
  70                                 res
  71                         }
  72                 }
  73         }
  74
  75         macro_rules! decode_msg {
  76                 ($MsgType: path, $len: expr) => {
  77                         match <($MsgType)>::decode(get_slice!($len)) {
  78                                 Ok(msg) => msg,
  79                                 Err(e) => match e {
  80                                         msgs::DecodeError::UnknownRealmByte => return,
  81                                         msgs::DecodeError::UnknownRequiredFeature => return,
  82                                         msgs::DecodeError::BadPublicKey => return,
  83                                         msgs::DecodeError::BadSignature => return,
  84                                         msgs::DecodeError::BadText => return,
  85                                         msgs::DecodeError::ExtraAddressesPerType => return,
  86                                         msgs::DecodeError::BadLengthDescriptor => return,
  87                                         msgs::DecodeError::ShortRead => panic!("We picked the length..."),
  88                                 }
  89                         }
  90                 }
  91         }
  92
  93         macro_rules! decode_msg_with_len16 {
  94                 ($MsgType: path, $begin_len: expr, $excess: expr) => {
  95                         {
  96                                 let extra_len = slice_to_be16(&get_slice_nonadvancing!($begin_len as usize + 2)[$begin_len..$begin_len + 2]);
  97                                 decode_msg!($MsgType, $begin_len as usize + 2 + (extra_len as usize) + $excess)
  98                         }
  99                 }
 100         }
 101
 102         let secp_ctx = Secp256k1::new();
 103         macro_rules! get_pubkey {
 104                 () => {
 105                         match PublicKey::from_slice(&secp_ctx, get_slice!(33)) {
 106                                 Ok(key) => key,
 107                                 Err(_) => return,
 108                         }
 109                 }
 110         }
 111
 112         let logger: Arc<Logger> = Arc::new(test_logger::TestLogger{});
 113         let chain_monitor = Arc::new(chaininterface::ChainWatchInterfaceUtil::new(Network::Bitcoin, Arc::clone(&logger)));
 114
 115         let our_pubkey = get_pubkey!();
 116         let router = Router::new(our_pubkey.clone(), chain_monitor, Arc::clone(&logger));
 117
 118         loop {
 119                 match get_slice!(1)[0] {
 120                         0 => {
 121                                 let start_len = slice_to_be16(&get_slice_nonadvancing!(64 + 2)[64..64 + 2]) as usize;
 122                                 let addr_len = slice_to_be16(&get_slice_nonadvancing!(64+start_len+2 + 74)[64+start_len+2 + 72..64+start_len+2 + 74]);
 123                                 if addr_len > (37+1)*4 {
 124                                         return;
 125                                 }
 126                                 let _ = router.handle_node_announcement(&decode_msg_with_len16!(msgs::NodeAnnouncement, 64, 288));
 127                         },
 128                         1 => {
 129                                 let _ = router.handle_channel_announcement(&decode_msg_with_len16!(msgs::ChannelAnnouncement, 64*4, 32+8+33*4));
 130                         },
 131                         2 => {
 132                                 let _ = router.handle_channel_update(&decode_msg!(msgs::ChannelUpdate, 128));
 133                         },
 134                         3 => {
 135                                 match get_slice!(1)[0] {
 136                                         0 => {
 137                                                 router.handle_htlc_fail_channel_update(&msgs::HTLCFailChannelUpdate::ChannelUpdateMessage {msg: decode_msg!(msgs::ChannelUpdate, 128)});
 138                                         },
 139                                         1 => {
 140                                                 let short_channel_id = slice_to_be64(get_slice!(8));
 141                                                 router.handle_htlc_fail_channel_update(&msgs::HTLCFailChannelUpdate::ChannelClosed {short_channel_id});
 142                                         },
 143                                         _ => return,
 144                                 }
 145                         },
 146                         4 => {
 147                                 let target = get_pubkey!();
 148                                 let mut first_hops_vec = Vec::new();
 149                                 let first_hops = match get_slice!(1)[0] {
 150                                         0 => None,
 151                                         1 => {
 152                                                 let count = slice_to_be16(get_slice!(2));
 153                                                 for _ in 0..count {
 154                                                         first_hops_vec.push(ChannelDetails {
 155                                                                 channel_id: [0; 32],
 156                                                                 short_channel_id: Some(slice_to_be64(get_slice!(8))),
 157                                                                 remote_network_id: get_pubkey!(),
 158                                                                 channel_value_satoshis: slice_to_be64(get_slice!(8)),
 159                                                                 user_id: 0,
 160                                                         });
 161                                                 }
 162                                                 Some(&first_hops_vec[..])
 163                                         },
 164                                         _ => return,
 165                                 };
 166                                 let mut last_hops_vec = Vec::new();
 167                                 let last_hops = {
 168                                         let count = slice_to_be16(get_slice!(2));
 169                                         for _ in 0..count {
 170                                                 last_hops_vec.push(RouteHint {
 171                                                         src_node_id: get_pubkey!(),
 172                                                         short_channel_id: slice_to_be64(get_slice!(8)),
 173                                                         fee_base_msat: slice_to_be32(get_slice!(4)),
 174                                                         fee_proportional_millionths: slice_to_be32(get_slice!(4)),
 175                                                         cltv_expiry_delta: slice_to_be16(get_slice!(2)),
 176                                                         htlc_minimum_msat: slice_to_be64(get_slice!(8)),
 177                                                 });
 178                                         }
 179                                         &last_hops_vec[..]
 180                                 };
 181                                 let _ = router.get_route(&target, first_hops, last_hops, slice_to_be64(get_slice!(8)), slice_to_be32(get_slice!(4)));
 182                         },
 183                         _ => return,
 184                 }
 185         }
 186 }
 187
 188 #[cfg(feature = "afl")]
 189 #[macro_use] extern crate afl;
 190 #[cfg(feature = "afl")]
 191 fn main() {
 192         fuzz!(|data| {
 193                 do_test(data);
 194         });
 195 }
 196
 197 #[cfg(feature = "honggfuzz")]
 198 #[macro_use] extern crate honggfuzz;
 199 #[cfg(feature = "honggfuzz")]
 200 fn main() {
 201         loop {
 202                 fuzz!(|data| {
 203                         do_test(data);
 204                 });
 205         }
 206 }
 207
 208 extern crate hex;
 209 #[cfg(test)]
 210 mod tests {
 211
 212         #[test]
 213         fn duplicate_crash() {
 214                 super::do_test(&::hex::decode("00").unwrap());
 215         }
 216 }