add fuzz target for messages

[[bin]] section for each new target in Cargo.toml
glob chanbes in travis-fuzz.sh
This commit is contained in:
Yuntai Kyong 2018-05-08 21:57:20 +09:00
parent e2ff3393ea
commit 913ea887fe
17 changed files with 814 additions and 2 deletions

View file

@ -41,3 +41,60 @@ path = "fuzz_targets/channel_target.rs"
[[bin]]
name = "full_stack_target"
path = "fuzz_targets/full_stack_target.rs"
# message fuzz targets
[[bin]]
name = "msg_accept_channel_target"
path = "fuzz_targets/msg_targets/msg_accept_channel_target.rs"
[[bin]]
name = "msg_closing_signed_target"
path = "fuzz_targets/msg_targets/msg_closing_signed_target.rs"
[[bin]]
name = "msg_commitment_signed_target"
path = "fuzz_targets/msg_targets/msg_commitment_signed_target.rs"
[[bin]]
name = "msg_funding_created_target"
path = "fuzz_targets/msg_targets/msg_funding_created_target.rs"
[[bin]]
name = "msg_funding_locked_target"
path = "fuzz_targets/msg_targets/msg_funding_locked_target.rs"
[[bin]]
name = "msg_funding_signed_target"
path = "fuzz_targets/msg_targets/msg_funding_signed_target.rs"
[[bin]]
name = "msg_open_channel_target"
path = "fuzz_targets/msg_targets/msg_open_channel_target.rs"
[[bin]]
name = "msg_revoke_and_ack_target"
path = "fuzz_targets/msg_targets/msg_revoke_and_ack_target.rs"
[[bin]]
name = "msg_shutdown_target"
path = "fuzz_targets/msg_targets/msg_shutdown_target.rs"
[[bin]]
name = "msg_update_add_htlc_target"
path = "fuzz_targets/msg_targets/msg_update_add_htlc_target.rs"
[[bin]]
name = "msg_update_fail_malformed_htlc_target"
path = "fuzz_targets/msg_targets/msg_update_fail_malformed_htlc_target.rs"
[[bin]]
name = "msg_update_fee_target"
path = "fuzz_targets/msg_targets/msg_update_fee_target.rs"
[[bin]]
name = "msg_update_fulfill_htlc_target"
path = "fuzz_targets/msg_targets/msg_update_fulfill_htlc_target.rs"
[[bin]]
name = "msg_update_fail_htlc_target"
path = "fuzz_targets/msg_targets/msg_update_fail_htlc_target.rs"

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::AcceptChannel, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::ClosingSigned, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::CommitmentSigned, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::FundingCreated, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::FundingLocked, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::FundingSigned, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::OpenChannel, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::RevokeAndACK, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::Shutdown, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::UpdateAddHTLC, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::UpdateFailHTLC, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::UpdateFailMalformedHTLC, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::UpdateFee, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,49 @@
extern crate lightning;
use lightning::ln::msgs;
use lightning::util::reset_rng_state;
use lightning::ln::msgs::{MsgEncodable, MsgDecodable};
mod utils;
use utils::slice_to_be16;
#[inline]
pub fn do_test(data: &[u8]) {
reset_rng_state();
let mut read_pos = 0;
loop {
test_msg!(msgs::UpdateFulfillHTLC, data, read_pos);
}
}
#[cfg(feature = "afl")]
extern crate afl;
#[cfg(feature = "afl")]
fn main() {
afl::read_stdio_bytes(|data| {
do_test(&data);
});
}
#[cfg(feature = "honggfuzz")]
#[macro_use] extern crate honggfuzz;
#[cfg(feature = "honggfuzz")]
fn main() {
loop {
fuzz!(|data| {
do_test(data);
});
}
}
#[cfg(test)]
mod tests {
use utils::extend_vec_from_hex;
#[test]
fn duplicate_crash() {
let mut a = Vec::new();
extend_vec_from_hex("00", &mut a);
super::do_test(&a);
}
}

View file

@ -0,0 +1,69 @@
#![macro_use]
#[allow(dead_code)]
#[inline]
pub fn slice_to_be16(v: &[u8]) -> u16 {
((v[0] as u16) << 8*1) |
((v[1] as u16) << 8*0)
}
#[macro_export]
macro_rules! test_msg {
($MsgType: path, $data: ident, $read_pos: ident) => {
{
let len = slice_to_be16(get_slice!($data, $read_pos, 2));
let raw = get_slice!($data, $read_pos, len);
let cb = decode_msg!($MsgType, raw).encode();
assert_eq!(&raw[..cb.len()], &cb[..]);
}
}
}
#[macro_export]
macro_rules! decode_msg {
($MsgType: path, $data: expr) => {
match <($MsgType)>::decode($data) {
Ok(msg) => msg,
Err(e) => match e {
msgs::DecodeError::UnknownRealmByte => return,
msgs::DecodeError::BadPublicKey => return,
msgs::DecodeError::BadSignature => return,
msgs::DecodeError::ExtraAddressesPerType => return,
msgs::DecodeError::WrongLength => return,
}
}
}
}
#[macro_export]
macro_rules! get_slice {
($data: ident, $read_pos: ident, $len: expr) => {
{
let slice_len = $len as usize;
if $data.len() < $read_pos + slice_len {
return;
}
$read_pos += slice_len;
&$data[$read_pos - slice_len..$read_pos]
}
}
}
#[allow(dead_code)]
#[cfg(test)]
pub fn extend_vec_from_hex(hex: &str, out: &mut Vec<u8>) {
let mut b = 0;
for (idx, c) in hex.as_bytes().iter().enumerate() {
b <<= 4;
match *c {
b'A'...b'F' => b |= c - b'A' + 10,
b'a'...b'f' => b |= c - b'a' + 10,
b'0'...b'9' => b |= c - b'0',
_ => panic!("Bad hex"),
}
if (idx & 1) == 1 {
out.push(b);
b = 0;
}
}
}

View file

@ -1,8 +1,8 @@
#!/bin/bash
set -e
cargo install --force honggfuzz
for TARGET in fuzz_targets/*; do
FILENAME=$(basename $TARGET)
for TARGET in fuzz_targets/*.rs fuzz_targets/msg_targets/*_target.rs; do
FILENAME=$(basename $TARGET)
FILE="${FILENAME%.*}"
HFUZZ_BUILD_ARGS="--features honggfuzz_fuzz" HFUZZ_RUN_ARGS="-N1000000 --exit_upon_crash -v" cargo hfuzz run $FILE
if [ -f hfuzz_workspace/$FILE/HONGGFUZZ.REPORT.TXT ]; then