Fuzz test for parsing Offer
authorJeffrey Czyz <jkczyz@gmail.com>
Fri, 20 Jan 2023 18:31:17 +0000 (12:31 -0600)
committerJeffrey Czyz <jkczyz@gmail.com>
Thu, 9 Feb 2023 00:47:48 +0000 (18:47 -0600)
An offer is serialized as a TLV stream and encoded in bech32 without a
checksum. Add a fuzz test that parses the unencoded TLV stream and
deserializes the underlying Offer. Then compare the original bytes with
those obtained by re-serializing the Offer.

fuzz/src/bin/gen_target.sh
fuzz/src/bin/offer_deser_target.rs [new file with mode: 0644]
fuzz/src/lib.rs
fuzz/src/offer_deser.rs [new file with mode: 0644]
fuzz/targets.h
lightning/src/offers/offer.rs

index fa29540f96b35cae0ad5e43e1b8ef485d620520b..f322e60697ab26f0c859cf9e109ba0535d68aff6 100755 (executable)
@@ -9,6 +9,7 @@ GEN_TEST() {
 GEN_TEST chanmon_deser
 GEN_TEST chanmon_consistency
 GEN_TEST full_stack
+GEN_TEST offer_deser
 GEN_TEST onion_message
 GEN_TEST peer_crypt
 GEN_TEST process_network_graph
diff --git a/fuzz/src/bin/offer_deser_target.rs b/fuzz/src/bin/offer_deser_target.rs
new file mode 100644 (file)
index 0000000..49563b1
--- /dev/null
@@ -0,0 +1,113 @@
+// This file is Copyright its original authors, visible in version control
+// history.
+//
+// This file is licensed under the Apache License, Version 2.0 <LICENSE-APACHE
+// or http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your option.
+// You may not use this file except in accordance with one or both of these
+// licenses.
+
+// This file is auto-generated by gen_target.sh based on target_template.txt
+// To modify it, modify target_template.txt and run gen_target.sh instead.
+
+#![cfg_attr(feature = "libfuzzer_fuzz", no_main)]
+
+#[cfg(not(fuzzing))]
+compile_error!("Fuzz targets need cfg=fuzzing");
+
+extern crate lightning_fuzz;
+use lightning_fuzz::offer_deser::*;
+
+#[cfg(feature = "afl")]
+#[macro_use] extern crate afl;
+#[cfg(feature = "afl")]
+fn main() {
+       fuzz!(|data| {
+               offer_deser_run(data.as_ptr(), data.len());
+       });
+}
+
+#[cfg(feature = "honggfuzz")]
+#[macro_use] extern crate honggfuzz;
+#[cfg(feature = "honggfuzz")]
+fn main() {
+       loop {
+               fuzz!(|data| {
+                       offer_deser_run(data.as_ptr(), data.len());
+               });
+       }
+}
+
+#[cfg(feature = "libfuzzer_fuzz")]
+#[macro_use] extern crate libfuzzer_sys;
+#[cfg(feature = "libfuzzer_fuzz")]
+fuzz_target!(|data: &[u8]| {
+       offer_deser_run(data.as_ptr(), data.len());
+});
+
+#[cfg(feature = "stdin_fuzz")]
+fn main() {
+       use std::io::Read;
+
+       let mut data = Vec::with_capacity(8192);
+       std::io::stdin().read_to_end(&mut data).unwrap();
+       offer_deser_run(data.as_ptr(), data.len());
+}
+
+#[test]
+fn run_test_cases() {
+       use std::fs;
+       use std::io::Read;
+       use lightning_fuzz::utils::test_logger::StringBuffer;
+
+       use std::sync::{atomic, Arc};
+       {
+               let data: Vec<u8> = vec![0];
+               offer_deser_run(data.as_ptr(), data.len());
+       }
+       let mut threads = Vec::new();
+       let threads_running = Arc::new(atomic::AtomicUsize::new(0));
+       if let Ok(tests) = fs::read_dir("test_cases/offer_deser") {
+               for test in tests {
+                       let mut data: Vec<u8> = Vec::new();
+                       let path = test.unwrap().path();
+                       fs::File::open(&path).unwrap().read_to_end(&mut data).unwrap();
+                       threads_running.fetch_add(1, atomic::Ordering::AcqRel);
+
+                       let thread_count_ref = Arc::clone(&threads_running);
+                       let main_thread_ref = std::thread::current();
+                       threads.push((path.file_name().unwrap().to_str().unwrap().to_string(),
+                               std::thread::spawn(move || {
+                                       let string_logger = StringBuffer::new();
+
+                                       let panic_logger = string_logger.clone();
+                                       let res = if ::std::panic::catch_unwind(move || {
+                                               offer_deser_test(&data, panic_logger);
+                                       }).is_err() {
+                                               Some(string_logger.into_string())
+                                       } else { None };
+                                       thread_count_ref.fetch_sub(1, atomic::Ordering::AcqRel);
+                                       main_thread_ref.unpark();
+                                       res
+                               })
+                       ));
+                       while threads_running.load(atomic::Ordering::Acquire) > 32 {
+                               std::thread::park();
+                       }
+               }
+       }
+       let mut failed_outputs = Vec::new();
+       for (test, thread) in threads.drain(..) {
+               if let Some(output) = thread.join().unwrap() {
+                       println!("\nOutput of {}:\n{}\n", test, output);
+                       failed_outputs.push(test);
+               }
+       }
+       if !failed_outputs.is_empty() {
+               println!("Test cases which failed: ");
+               for case in failed_outputs {
+                       println!("{}", case);
+               }
+               panic!();
+       }
+}
index 462307d55b42a6e977276065825cc325c8c3c807..dee4dbccb076aab4bc8a5a8c0990037478f03f56 100644 (file)
@@ -18,6 +18,7 @@ pub mod chanmon_deser;
 pub mod chanmon_consistency;
 pub mod full_stack;
 pub mod indexedmap;
+pub mod offer_deser;
 pub mod onion_message;
 pub mod peer_crypt;
 pub mod process_network_graph;
diff --git a/fuzz/src/offer_deser.rs b/fuzz/src/offer_deser.rs
new file mode 100644 (file)
index 0000000..213742d
--- /dev/null
@@ -0,0 +1,69 @@
+// This file is Copyright its original authors, visible in version control
+// history.
+//
+// This file is licensed under the Apache License, Version 2.0 <LICENSE-APACHE
+// or http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your option.
+// You may not use this file except in accordance with one or both of these
+// licenses.
+
+use bitcoin::secp256k1::{KeyPair, PublicKey, Secp256k1, SecretKey};
+use crate::utils::test_logger;
+use core::convert::{Infallible, TryFrom};
+use lightning::offers::invoice_request::UnsignedInvoiceRequest;
+use lightning::offers::offer::{Amount, Offer, Quantity};
+use lightning::offers::parse::SemanticError;
+use lightning::util::ser::Writeable;
+
+#[inline]
+pub fn do_test<Out: test_logger::Output>(data: &[u8], _out: Out) {
+       if let Ok(offer) = Offer::try_from(data.to_vec()) {
+               let mut bytes = Vec::with_capacity(data.len());
+               offer.write(&mut bytes).unwrap();
+               assert_eq!(data, bytes);
+
+               let secp_ctx = Secp256k1::new();
+               let keys = KeyPair::from_secret_key(&secp_ctx, &SecretKey::from_slice(&[42; 32]).unwrap());
+               let pubkey = PublicKey::from(keys);
+               let mut buffer = Vec::new();
+
+               if let Ok(invoice_request) = build_response(&offer, pubkey) {
+                       invoice_request
+                               .sign::<_, Infallible>(
+                                       |digest| Ok(secp_ctx.sign_schnorr_no_aux_rand(digest, &keys))
+                               )
+                               .unwrap()
+                               .write(&mut buffer)
+                               .unwrap();
+               }
+       }
+}
+
+fn build_response<'a>(
+       offer: &'a Offer, pubkey: PublicKey
+) -> Result<UnsignedInvoiceRequest<'a>, SemanticError> {
+       let mut builder = offer.request_invoice(vec![42; 64], pubkey)?;
+
+       builder = match offer.amount() {
+               None => builder.amount_msats(1000).unwrap(),
+               Some(Amount::Bitcoin { amount_msats }) => builder.amount_msats(amount_msats + 1)?,
+               Some(Amount::Currency { .. }) => return Err(SemanticError::UnsupportedCurrency),
+       };
+
+       builder = match offer.supported_quantity() {
+               Quantity::Bounded(n) => builder.quantity(n.get()).unwrap(),
+               Quantity::Unbounded => builder.quantity(10).unwrap(),
+               Quantity::One => builder,
+       };
+
+       builder.build()
+}
+
+pub fn offer_deser_test<Out: test_logger::Output>(data: &[u8], out: Out) {
+       do_test(data, out);
+}
+
+#[no_mangle]
+pub extern "C" fn offer_deser_run(data: *const u8, datalen: usize) {
+       do_test(unsafe { std::slice::from_raw_parts(data, datalen) }, test_logger::DevNull {});
+}
index 5bfee07dafbb149e4db2a8262a22209355ec11ba..b09aacc4a8768338ead45a3a4c3249e2b9d84d4e 100644 (file)
@@ -2,6 +2,7 @@
 void chanmon_deser_run(const unsigned char* data, size_t data_len);
 void chanmon_consistency_run(const unsigned char* data, size_t data_len);
 void full_stack_run(const unsigned char* data, size_t data_len);
+void offer_deser_run(const unsigned char* data, size_t data_len);
 void onion_message_run(const unsigned char* data, size_t data_len);
 void peer_crypt_run(const unsigned char* data, size_t data_len);
 void process_network_graph_run(const unsigned char* data, size_t data_len);
index a535b378250afbd335bf790680c3f157f75d042c..b0819f9e9204f70c707c16312b70668741bdde85 100644 (file)
@@ -242,7 +242,7 @@ impl OfferBuilder {
 ///
 /// [`InvoiceRequest`]: crate::offers::invoice_request::InvoiceRequest
 /// [`Invoice`]: crate::offers::invoice::Invoice
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, PartialEq)]
 pub struct Offer {
        // The serialized offer. Needed when creating an `InvoiceRequest` if the offer contains unknown
        // fields.
@@ -254,7 +254,7 @@ pub struct Offer {
 ///
 /// [`InvoiceRequest`]: crate::offers::invoice_request::InvoiceRequest
 /// [`Invoice`]: crate::offers::invoice::Invoice
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, PartialEq)]
 pub(super) struct OfferContents {
        chains: Option<Vec<ChainHash>>,
        metadata: Option<Vec<u8>>,