_ Git - rust-lightning/blob - fuzz/src/router.rs

   1 use bitcoin::blockdata::script::Builder;
   2 use bitcoin::blockdata::transaction::TxOut;
   3 use bitcoin::hash_types::BlockHash;
   4
   5 use lightning::chain;
   6 use lightning::ln::channelmanager::ChannelDetails;
   7 use lightning::ln::features::InitFeatures;
   8 use lightning::ln::msgs;
   9 use lightning::ln::msgs::RoutingMessageHandler;
  10 use lightning::routing::router::{get_route, RouteHint};
  11 use lightning::util::logger::Logger;
  12 use lightning::util::ser::Readable;
  13 use lightning::routing::network_graph::{NetGraphMsgHandler, RoutingFees};
  14
  15 use bitcoin::secp256k1::key::PublicKey;
  16
  17 use utils::test_logger;
  18
  19 use std::sync::Arc;
  20 use std::sync::atomic::{AtomicUsize, Ordering};
  21
  22 #[inline]
  23 pub fn slice_to_be16(v: &[u8]) -> u16 {
  24         ((v[0] as u16) << 8*1) |
  25         ((v[1] as u16) << 8*0)
  26 }
  27
  28 #[inline]
  29 pub fn slice_to_be32(v: &[u8]) -> u32 {
  30         ((v[0] as u32) << 8*3) |
  31         ((v[1] as u32) << 8*2) |
  32         ((v[2] as u32) << 8*1) |
  33         ((v[3] as u32) << 8*0)
  34 }
  35
  36 #[inline]
  37 pub fn slice_to_be64(v: &[u8]) -> u64 {
  38         ((v[0] as u64) << 8*7) |
  39         ((v[1] as u64) << 8*6) |
  40         ((v[2] as u64) << 8*5) |
  41         ((v[3] as u64) << 8*4) |
  42         ((v[4] as u64) << 8*3) |
  43         ((v[5] as u64) << 8*2) |
  44         ((v[6] as u64) << 8*1) |
  45         ((v[7] as u64) << 8*0)
  46 }
  47
  48
  49 struct InputData {
  50         data: Vec<u8>,
  51         read_pos: AtomicUsize,
  52 }
  53 impl InputData {
  54         fn get_slice(&self, len: usize) -> Option<&[u8]> {
  55                 let old_pos = self.read_pos.fetch_add(len, Ordering::AcqRel);
  56                 if self.data.len() < old_pos + len {
  57                         return None;
  58                 }
  59                 Some(&self.data[old_pos..old_pos + len])
  60         }
  61         fn get_slice_nonadvancing(&self, len: usize) -> Option<&[u8]> {
  62                 let old_pos = self.read_pos.load(Ordering::Acquire);
  63                 if self.data.len() < old_pos + len {
  64                         return None;
  65                 }
  66                 Some(&self.data[old_pos..old_pos + len])
  67         }
  68 }
  69
  70 struct FuzzChainSource {
  71         input: Arc<InputData>,
  72 }
  73 impl chain::Access for FuzzChainSource {
  74         fn get_utxo(&self, _genesis_hash: &BlockHash, _short_channel_id: u64) -> Result<TxOut, chain::AccessError> {
  75                 match self.input.get_slice(2) {
  76                         Some(&[0, _]) => Err(chain::AccessError::UnknownChain),
  77                         Some(&[1, _]) => Err(chain::AccessError::UnknownTx),
  78                         Some(&[_, x]) => Ok(TxOut { value: 0, script_pubkey: Builder::new().push_int(x as i64).into_script().to_v0_p2wsh() }),
  79                         None => Err(chain::AccessError::UnknownTx),
  80                         _ => unreachable!(),
  81                 }
  82         }
  83 }
  84
  85 #[inline]
  86 pub fn do_test<Out: test_logger::Output>(data: &[u8], out: Out) {
  87         let input = Arc::new(InputData {
  88                 data: data.to_vec(),
  89                 read_pos: AtomicUsize::new(0),
  90         });
  91         macro_rules! get_slice_nonadvancing {
  92                 ($len: expr) => {
  93                         match input.get_slice_nonadvancing($len as usize) {
  94                                 Some(slice) => slice,
  95                                 None => return,
  96                         }
  97                 }
  98         }
  99         macro_rules! get_slice {
 100                 ($len: expr) => {
 101                         match input.get_slice($len as usize) {
 102                                 Some(slice) => slice,
 103                                 None => return,
 104                         }
 105                 }
 106         }
 107
 108         macro_rules! decode_msg {
 109                 ($MsgType: path, $len: expr) => {{
 110                         let mut reader = ::std::io::Cursor::new(get_slice!($len));
 111                         match <$MsgType>::read(&mut reader) {
 112                                 Ok(msg) => msg,
 113                                 Err(e) => match e {
 114                                         msgs::DecodeError::UnknownVersion => return,
 115                                         msgs::DecodeError::UnknownRequiredFeature => return,
 116                                         msgs::DecodeError::InvalidValue => return,
 117                                         msgs::DecodeError::BadLengthDescriptor => return,
 118                                         msgs::DecodeError::ShortRead => panic!("We picked the length..."),
 119                                         msgs::DecodeError::Io(e) => panic!(format!("{}", e)),
 120                                 }
 121                         }
 122                 }}
 123         }
 124
 125         macro_rules! decode_msg_with_len16 {
 126                 ($MsgType: path, $begin_len: expr, $excess: expr) => {
 127                         {
 128                                 let extra_len = slice_to_be16(&get_slice_nonadvancing!($begin_len as usize + 2)[$begin_len..$begin_len + 2]);
 129                                 decode_msg!($MsgType, $begin_len as usize + 2 + (extra_len as usize) + $excess)
 130                         }
 131                 }
 132         }
 133
 134         macro_rules! get_pubkey {
 135                 () => {
 136                         match PublicKey::from_slice(get_slice!(33)) {
 137                                 Ok(key) => key,
 138                                 Err(_) => return,
 139                         }
 140                 }
 141         }
 142
 143         let logger: Arc<dyn Logger> = Arc::new(test_logger::TestLogger::new("".to_owned(), out));
 144         let chain_source = Arc::new(FuzzChainSource {
 145                 input: Arc::clone(&input),
 146         });
 147
 148         let our_pubkey = get_pubkey!();
 149         let net_graph_msg_handler = NetGraphMsgHandler::new(Some(chain_source), Arc::clone(&logger));
 150
 151         loop {
 152                 match get_slice!(1)[0] {
 153                         0 => {
 154                                 let start_len = slice_to_be16(&get_slice_nonadvancing!(64 + 2)[64..64 + 2]) as usize;
 155                                 let addr_len = slice_to_be16(&get_slice_nonadvancing!(64+start_len+2 + 74)[64+start_len+2 + 72..64+start_len+2 + 74]);
 156                                 if addr_len > (37+1)*4 {
 157                                         return;
 158                                 }
 159                                 let _ = net_graph_msg_handler.handle_node_announcement(&decode_msg_with_len16!(msgs::NodeAnnouncement, 64, 288));
 160                         },
 161                         1 => {
 162                                 let _ = net_graph_msg_handler.handle_channel_announcement(&decode_msg_with_len16!(msgs::ChannelAnnouncement, 64*4, 32+8+33*4));
 163                         },
 164                         2 => {
 165                                 let _ = net_graph_msg_handler.handle_channel_update(&decode_msg!(msgs::ChannelUpdate, 136));
 166                         },
 167                         3 => {
 168                                 match get_slice!(1)[0] {
 169                                         0 => {
 170                                                 net_graph_msg_handler.handle_htlc_fail_channel_update(&msgs::HTLCFailChannelUpdate::ChannelUpdateMessage {msg: decode_msg!(msgs::ChannelUpdate, 136)});
 171                                         },
 172                                         1 => {
 173                                                 let short_channel_id = slice_to_be64(get_slice!(8));
 174                                                 net_graph_msg_handler.handle_htlc_fail_channel_update(&msgs::HTLCFailChannelUpdate::ChannelClosed {short_channel_id, is_permanent: false});
 175                                         },
 176                                         _ => return,
 177                                 }
 178                         },
 179                         4 => {
 180                                 let target = get_pubkey!();
 181                                 let mut first_hops_vec = Vec::new();
 182                                 let first_hops = match get_slice!(1)[0] {
 183                                         0 => None,
 184                                         1 => {
 185                                                 let count = slice_to_be16(get_slice!(2));
 186                                                 for _ in 0..count {
 187                                                         first_hops_vec.push(ChannelDetails {
 188                                                                 channel_id: [0; 32],
 189                                                                 short_channel_id: Some(slice_to_be64(get_slice!(8))),
 190                                                                 remote_network_id: get_pubkey!(),
 191                                                                 counterparty_features: InitFeatures::empty(),
 192                                                                 channel_value_satoshis: slice_to_be64(get_slice!(8)),
 193                                                                 user_id: 0,
 194                                                                 inbound_capacity_msat: 0,
 195                                                                 is_live: true,
 196                                                                 outbound_capacity_msat: 0,
 197                                                         });
 198                                                 }
 199                                                 Some(&first_hops_vec[..])
 200                                         },
 201                                         _ => return,
 202                                 };
 203                                 let mut last_hops_vec = Vec::new();
 204                                 let last_hops = {
 205                                         let count = slice_to_be16(get_slice!(2));
 206                                         for _ in 0..count {
 207                                                 last_hops_vec.push(RouteHint {
 208                                                         src_node_id: get_pubkey!(),
 209                                                         short_channel_id: slice_to_be64(get_slice!(8)),
 210                                                         fees: RoutingFees {
 211                                                                 base_msat: slice_to_be32(get_slice!(4)),
 212                                                                 proportional_millionths: slice_to_be32(get_slice!(4)),
 213                                                         },
 214                                                         cltv_expiry_delta: slice_to_be16(get_slice!(2)),
 215                                                         htlc_minimum_msat: slice_to_be64(get_slice!(8)),
 216                                                 });
 217                                         }
 218                                         &last_hops_vec[..]
 219                                 };
 220                                 let _ = get_route(&our_pubkey, &net_graph_msg_handler.network_graph.read().unwrap(), &target, first_hops, last_hops, slice_to_be64(get_slice!(8)), slice_to_be32(get_slice!(4)), Arc::clone(&logger));
 221                         },
 222                         _ => return,
 223                 }
 224         }
 225 }
 226
 227 pub fn router_test<Out: test_logger::Output>(data: &[u8], out: Out) {
 228         do_test(data, out);
 229 }
 230
 231 #[no_mangle]
 232 pub extern "C" fn router_run(data: *const u8, datalen: usize) {
 233         do_test(unsafe { std::slice::from_raw_parts(data, datalen) }, test_logger::DevNull {});
 234 }