|
| 1 | +// FUZZER COMMANDS: |
| 2 | +// RUSTFLAGS="--cfg hashes_fuzz --cfg=secp256k1_fuzz" cargo +nightly fuzz run --features "libfuzzer_fuzz" process_onion_failure_target |
| 3 | +// RUSTFLAGS="--cfg hashes_fuzz --cfg=secp256k1_fuzz" cargo +nightly fuzz coverage -v --features "libfuzzer_fuzz" process_onion_failure_target |
| 4 | +// llvm-cov show target/aarch64-apple-darwin/coverage/aarch64-apple-darwin/release/process_onion_failure_target --instr-profile=/Users/joost/repo/rust-lightning/fuzz/coverage/process_onion_failure_target/coverage.profdata --format=html --output-dir=reports |
| 5 | + |
| 6 | +use std::sync::Arc; |
| 7 | + |
| 8 | +use bitcoin::{ |
| 9 | + key::Secp256k1, |
| 10 | + secp256k1::{PublicKey, SecretKey}, |
| 11 | +}; |
| 12 | +use lightning::{ |
| 13 | + blinded_path::BlindedHop, |
| 14 | + ln::{ |
| 15 | + channelmanager::{HTLCSource, PaymentId}, |
| 16 | + msgs::OnionErrorPacket, |
| 17 | + }, |
| 18 | + routing::router::{BlindedTail, Path, RouteHop, TrampolineHop}, |
| 19 | + types::features::{ChannelFeatures, Features, NodeFeatures}, |
| 20 | + util::{logger::Logger, test_utils::TestLogger}, |
| 21 | +}; |
| 22 | + |
| 23 | +// Imports that need to be added manually |
| 24 | +use crate::utils::test_logger::{self}; |
| 25 | + |
| 26 | +/// Actual fuzz test, method signature and name are fixed |
| 27 | +fn do_test<Out: test_logger::Output>(data: &[u8], out: Out) { |
| 28 | + let mut read_pos = 0; |
| 29 | + macro_rules! get_slice { |
| 30 | + ($len: expr) => {{ |
| 31 | + let slice_len = $len as usize; |
| 32 | + if data.len() < read_pos + slice_len { |
| 33 | + return; |
| 34 | + } |
| 35 | + read_pos += slice_len; |
| 36 | + &data[read_pos - slice_len..read_pos] |
| 37 | + }}; |
| 38 | + } |
| 39 | + |
| 40 | + let secp_ctx = Secp256k1::new(); |
| 41 | + |
| 42 | + let logger: Arc<dyn Logger> = Arc::new(test_logger::TestLogger::new("".to_owned(), out)); |
| 43 | + |
| 44 | + macro_rules! get_u64 { |
| 45 | + () => { |
| 46 | + match get_slice!(8).try_into() { |
| 47 | + Ok(val) => u64::from_be_bytes(val), |
| 48 | + Err(_) => return, |
| 49 | + } |
| 50 | + }; |
| 51 | + } |
| 52 | + |
| 53 | + macro_rules! get_u32 { |
| 54 | + () => { |
| 55 | + match get_slice!(4).try_into() { |
| 56 | + Ok(val) => u32::from_be_bytes(val), |
| 57 | + Err(_) => return, |
| 58 | + } |
| 59 | + }; |
| 60 | + } |
| 61 | + |
| 62 | + macro_rules! get_bool { |
| 63 | + () => { |
| 64 | + get_slice!(1)[0] != 0 |
| 65 | + }; |
| 66 | + } |
| 67 | + |
| 68 | + macro_rules! get_u8 { |
| 69 | + () => { |
| 70 | + get_slice!(1)[0] |
| 71 | + }; |
| 72 | + } |
| 73 | + |
| 74 | + let session_priv = match SecretKey::from_slice(get_slice!(32)) { |
| 75 | + Ok(val) => val, |
| 76 | + Err(_) => return, |
| 77 | + }; |
| 78 | + |
| 79 | + let payment_id = match get_slice!(32).try_into() { |
| 80 | + Ok(val) => PaymentId(val), |
| 81 | + Err(_) => return, |
| 82 | + }; |
| 83 | + |
| 84 | + macro_rules! get_pubkey { |
| 85 | + () => { |
| 86 | + match PublicKey::from_slice(get_slice!(33)) { |
| 87 | + Ok(val) => val, |
| 88 | + Err(_) => return, |
| 89 | + } |
| 90 | + }; |
| 91 | + } |
| 92 | + |
| 93 | + let mut hops = Vec::<RouteHop>::new(); |
| 94 | + let hop_count = get_slice!(1)[0] as usize; |
| 95 | + for i in 0..hop_count { |
| 96 | + hops.push(RouteHop { |
| 97 | + pubkey: get_pubkey!(), |
| 98 | + node_features: NodeFeatures::empty(), |
| 99 | + short_channel_id: get_u64!(), |
| 100 | + channel_features: ChannelFeatures::empty(), |
| 101 | + fee_msat: get_u64!(), |
| 102 | + cltv_expiry_delta: get_u32!(), |
| 103 | + maybe_announced_channel: get_bool!(), |
| 104 | + }); |
| 105 | + } |
| 106 | + |
| 107 | + let blinded_tail = match get_bool!() { |
| 108 | + true => { |
| 109 | + let mut trampoline_hops = Vec::<TrampolineHop>::new(); |
| 110 | + let trampoline_hop_count = get_slice!(1)[0] as usize; |
| 111 | + for i in 0..trampoline_hop_count { |
| 112 | + trampoline_hops.push(TrampolineHop { |
| 113 | + pubkey: get_pubkey!(), |
| 114 | + node_features: NodeFeatures::empty(), |
| 115 | + fee_msat: get_u64!(), |
| 116 | + cltv_expiry_delta: get_u32!(), |
| 117 | + }); |
| 118 | + } |
| 119 | + let mut blinded_hops = Vec::<BlindedHop>::new(); |
| 120 | + let blinded_hop_count = get_slice!(1)[0] as usize; |
| 121 | + for i in 0..blinded_hop_count { |
| 122 | + blinded_hops.push(BlindedHop { |
| 123 | + blinded_node_id: get_pubkey!(), |
| 124 | + encrypted_payload: get_slice!(get_u8!()).to_vec(), |
| 125 | + }); |
| 126 | + } |
| 127 | + Some(BlindedTail { |
| 128 | + trampoline_hops, |
| 129 | + hops: blinded_hops, |
| 130 | + blinding_point: get_pubkey!(), |
| 131 | + excess_final_cltv_expiry_delta: get_u32!(), |
| 132 | + final_value_msat: get_u64!(), |
| 133 | + }) |
| 134 | + }, |
| 135 | + false => None, |
| 136 | + }; |
| 137 | + |
| 138 | + let path = Path { hops, blinded_tail }; |
| 139 | + |
| 140 | + let htlc_source = HTLCSource::OutboundRoute { |
| 141 | + path, |
| 142 | + session_priv, |
| 143 | + first_hop_htlc_msat: get_u64!(), |
| 144 | + payment_id, |
| 145 | + }; |
| 146 | + |
| 147 | + let failure_len = u16::from_be_bytes(get_slice!(2).try_into().unwrap()); |
| 148 | + let encrypted_packet = OnionErrorPacket { data: get_slice!(failure_len as u64).into() }; |
| 149 | + |
| 150 | + lightning::ln::onion_utils::process_onion_failure( |
| 151 | + &secp_ctx, |
| 152 | + &logger, |
| 153 | + &htlc_source, |
| 154 | + encrypted_packet, |
| 155 | + ); |
| 156 | +} |
| 157 | + |
| 158 | +/// Method that needs to be added manually, {name}_test |
| 159 | +pub fn process_onion_failure_test<Out: test_logger::Output>(data: &[u8], out: Out) { |
| 160 | + do_test(data, out); |
| 161 | +} |
| 162 | + |
| 163 | +/// Method that needs to be added manually, {name}_run |
| 164 | +#[no_mangle] |
| 165 | +pub extern "C" fn process_onion_failure_run(data: *const u8, datalen: usize) { |
| 166 | + do_test(unsafe { std::slice::from_raw_parts(data, datalen) }, test_logger::DevNull {}); |
| 167 | +} |
0 commit comments