Skip to content

Commit cd8d318

Browse files
author
Chandra Pratap
committed
fuzz-tests: Add a test for peer_init_received()
Changelog-None: `peer_init_received()` in `connectd/peer_exchange_initmsg.{c, h}` is responsible for handling `init` messages defined in BOLT #1. Since it deals with untrusted input, add a test for it.
1 parent ad2dc97 commit cd8d318

2 files changed

Lines changed: 171 additions & 0 deletions

File tree

‎tests/fuzz/Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ FUZZ_COMMON_OBJS := \
3636
common/daemon_conn.o \
3737
common/derive_basepoints.o \
3838
common/descriptor_checksum.o \
39+
common/dev_disconnect.o \
3940
common/features.o \
4041
common/fee_states.o \
4142
common/hash_u5.o \
@@ -58,6 +59,7 @@ FUZZ_COMMON_OBJS := \
5859
common/status_wiregen.o \
5960
common/utils.o \
6061
common/version.o \
62+
common/wire_error.o \
6163
wire/bolt12_wiregen.o \
6264
wire/fromwire.o \
6365
wire/onion_wiregen.o \

‎tests/fuzz/fuzz-init_received.c‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
/* This is a fuzz test for `peer_init_received()`, which is responsible for
2+
* handling BOLT #1 `init` messages. All this test essentially does in encode
3+
* the fuzzer's input as the payload for a cryptographically valid 'init'
4+
* message and pass it to this handler.
5+
*/
6+
#include "config.h"
7+
#include <fcntl.h>
8+
#include <ccan/ccan/io/io.h>
9+
#include <ccan/ccan/str/hex/hex.h>
10+
#include <common/setup.h>
11+
#include <common/utils.h>
12+
#include <tests/fuzz/libfuzz.h>
13+
14+
static struct io_plan *test_write(struct io_conn *conn, const void *data,
15+
size_t len, struct io_plan *(*next)(struct io_conn *, void *), void *arg);
16+
17+
static struct io_plan *test_read(struct io_conn *conn, void *data, size_t len,
18+
struct io_plan *(*next)(struct io_conn *, void *), void *arg);
19+
20+
#undef io_write
21+
#define io_write(conn, data, len, cb, cb_arg) \
22+
test_write((conn), \
23+
(data), \
24+
(len), \
25+
(struct io_plan *(*)(struct io_conn *, void *))(cb), \
26+
(void *)(cb_arg))
27+
28+
#undef io_read
29+
#define io_read(conn, data, len, cb, cb_arg) \
30+
test_read((conn), \
31+
(data), \
32+
(len), \
33+
(struct io_plan *(*)(struct io_conn *, void *))(cb), \
34+
(void *)(cb_arg))
35+
36+
#include "../../connectd/peer_exchange_initmsg.c"
37+
38+
/* MOCKS START */
39+
bool address_routable(const struct wireaddr *wireaddr UNNEEDED,
40+
bool allow_localhost UNNEEDED)
41+
{ return false; }
42+
struct io_plan *peer_connected(struct io_conn *conn UNNEEDED,
43+
struct daemon *daemon UNNEEDED,
44+
const struct node_id *id UNNEEDED,
45+
const struct wireaddr_internal *addr UNNEEDED,
46+
const struct wireaddr *remote_addr UNNEEDED,
47+
struct crypto_state *cs UNNEEDED,
48+
const u8 *their_features TAKES UNNEEDED,
49+
enum is_websocket is_websocket UNNEEDED,
50+
bool incoming UNNEEDED)
51+
{ if (taken(their_features))
52+
tal_steal(tmpctx, their_features);
53+
return io_close(conn);
54+
}
55+
/* MOCKS END */
56+
57+
/* Simulate writing and reading the supposed `init` messages to and
58+
* from the peer using an in-memory buffer. This is a better workaround
59+
* than returning `io_close(conn)`.
60+
*/
61+
#define IO_BUFFER_SIZE (1024 * 1024)
62+
static u8 io_buffer[IO_BUFFER_SIZE];
63+
static size_t io_buf_len = 0;
64+
static size_t io_buf_pos = 0;
65+
66+
static struct io_plan *
67+
test_write(struct io_conn *conn, const void *data, size_t len,
68+
struct io_plan *(*next)(struct io_conn *, void *), void *arg)
69+
{
70+
/* append up to available space */
71+
size_t space = IO_BUFFER_SIZE - io_buf_len;
72+
size_t to_copy = len < space ? len : space;
73+
memcpy(io_buffer + io_buf_len, data, to_copy);
74+
io_buf_len += to_copy;
75+
/* simulate as if all bytes were written */
76+
return next(conn, arg);
77+
}
78+
79+
static struct io_plan *
80+
test_read(struct io_conn *conn, void *data, size_t len,
81+
struct io_plan *(*next)(struct io_conn *, void *), void *arg)
82+
{
83+
/* read up to available data */
84+
size_t available = io_buf_len - io_buf_pos;
85+
size_t to_copy = len < available ? len : available;
86+
if (to_copy > 0) {
87+
memcpy(data, io_buffer + io_buf_pos, to_copy);
88+
io_buf_pos += to_copy;
89+
}
90+
/* if buffer is exhausted, reset pointers */
91+
if (io_buf_pos == io_buf_len)
92+
io_buf_pos = io_buf_len = 0;
93+
return next(conn, arg);
94+
}
95+
96+
static struct secret secret_from_hex(const char *hex)
97+
{
98+
struct secret secret;
99+
hex += 2;
100+
if (!hex_decode(hex, strlen(hex), &secret, sizeof(secret)))
101+
abort();
102+
return secret;
103+
}
104+
105+
/* Encodes the given message. Stores the decrypting crypto_state in `cs`. */
106+
static u8 *encode_msg(const tal_t *ctx, const void *message, size_t size, struct crypto_state *cs)
107+
{
108+
struct crypto_state cs_out, cs_in;
109+
struct secret sk, rk, ck;
110+
u16 len;
111+
112+
void *msg = tal_dup_arr(ctx, char, message, size, 0);
113+
114+
ck = secret_from_hex("0x919219dbb2920afa8db80f9a51787a840bcf111ed8d588caf9ab4be716e42b01");
115+
sk = secret_from_hex("0x969ab31b4d288cedf6218839b27a3e2140827047f2c0f01bf5c04435d43511a9");
116+
rk = secret_from_hex("0xbb9020b8965f4df047e07f955f3c4b88418984aadc5cdb35096b9ea8fa5c3442");
117+
118+
cs_out.sn = cs_out.rn = cs_in.sn = cs_in.rn = 0;
119+
cs_out.sk = cs_in.rk = sk;
120+
cs_out.rk = cs_in.sk = rk;
121+
cs_out.s_ck = cs_out.r_ck = cs_in.s_ck = cs_in.r_ck = ck;
122+
123+
u8 *encoded_msg = cryptomsg_encrypt_msg(ctx, &cs_out, msg);
124+
125+
if (!cryptomsg_decrypt_header(&cs_in, encoded_msg, &len))
126+
abort();
127+
128+
/* Trim header */
129+
memmove(encoded_msg, encoded_msg + CRYPTOMSG_HDR_SIZE,
130+
tal_bytelen(encoded_msg) - CRYPTOMSG_HDR_SIZE);
131+
tal_resize(&encoded_msg, tal_bytelen(encoded_msg) - CRYPTOMSG_HDR_SIZE);
132+
133+
*cs = cs_in;
134+
return encoded_msg;
135+
}
136+
137+
static struct io_plan *do_nothing(struct io_conn *conn, void *side)
138+
{
139+
return io_close(conn);
140+
}
141+
142+
void init(int *argc, char ***argv)
143+
{
144+
chainparams = chainparams_for_network("bitcoin");
145+
common_setup("fuzzer");
146+
int devnull = open("/dev/null", O_WRONLY);
147+
status_setup_sync(devnull);
148+
}
149+
150+
void run(const uint8_t *data, size_t size)
151+
{
152+
struct io_conn *conn;
153+
struct crypto_state cs;
154+
struct early_peer *peer;
155+
u8 *encoded_msg;
156+
157+
encoded_msg = encode_msg(tmpctx, data, size, &cs);
158+
peer = tal(tmpctx, struct early_peer);
159+
peer->cs = cs;
160+
peer->msg = encoded_msg;
161+
peer->incoming = true;
162+
peer->daemon = talz(tmpctx, struct daemon);
163+
peer->timeout = NULL;
164+
165+
conn = io_new_conn(tmpctx, -1, do_nothing, NULL);
166+
peer_init_received(conn, peer);
167+
168+
clean_tmpctx();
169+
}

0 commit comments

Comments
 (0)