f: add fuzzing

Author: joostjager

fuzz/Cargo.toml

@@ -22,8 +22,10 @@ lightning = { path = "../lightning", features = ["regex", "_test_utils"] }
 lightning-invoice = { path = "../lightning-invoice" }
 lightning-liquidity = { path = "../lightning-liquidity" }
 lightning-rapid-gossip-sync = { path = "../lightning-rapid-gossip-sync" }
+lightning-persister = { path = "../lightning-persister", features = ["tokio"]}
 bech32 = "0.11.0"
 bitcoin = { version = "0.32.2", features = ["secp-lowmemory"] }
+tokio = { version = "1.35.*", default-features = false, features = ["rt-multi-thread"] }
 
 afl = { version = "0.12", optional = true }
 honggfuzz = { version = "0.5", optional = true, default-features = false }

fuzz/src/bin/fs_store_target.rs

@@ -0,0 +1,120 @@
+// This file is Copyright its original authors, visible in version control
+// history.
+//
+// This file is licensed under the Apache License, Version 2.0 <LICENSE-APACHE
+// or http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your option.
+// You may not use this file except in accordance with one or both of these
+// licenses.
+
+// This file is auto-generated by gen_target.sh based on target_template.txt
+// To modify it, modify target_template.txt and run gen_target.sh instead.
+
+#![cfg_attr(feature = "libfuzzer_fuzz", no_main)]
+#![cfg_attr(rustfmt, rustfmt_skip)]
+
+#[cfg(not(fuzzing))]
+compile_error!("Fuzz targets need cfg=fuzzing");
+
+#[cfg(not(hashes_fuzz))]
+compile_error!("Fuzz targets need cfg=hashes_fuzz");
+
+#[cfg(not(secp256k1_fuzz))]
+compile_error!("Fuzz targets need cfg=secp256k1_fuzz");
+
+extern crate lightning_fuzz;
+use lightning_fuzz::fs_store::*;
+
+#[cfg(feature = "afl")]
+#[macro_use] extern crate afl;
+#[cfg(feature = "afl")]
+fn main() {
+	fuzz!(|data| {
+		fs_store_run(data.as_ptr(), data.len());
+	});
+}
+
+#[cfg(feature = "honggfuzz")]
+#[macro_use] extern crate honggfuzz;
+#[cfg(feature = "honggfuzz")]
+fn main() {
+	loop {
+		fuzz!(|data| {
+			fs_store_run(data.as_ptr(), data.len());
+		});
+	}
+}
+
+#[cfg(feature = "libfuzzer_fuzz")]
+#[macro_use] extern crate libfuzzer_sys;
+#[cfg(feature = "libfuzzer_fuzz")]
+fuzz_target!(|data: &[u8]| {
+	fs_store_run(data.as_ptr(), data.len());
+});
+
+#[cfg(feature = "stdin_fuzz")]
+fn main() {
+	use std::io::Read;
+
+	let mut data = Vec::with_capacity(8192);
+	std::io::stdin().read_to_end(&mut data).unwrap();
+	fs_store_run(data.as_ptr(), data.len());
+}
+
+#[test]
+fn run_test_cases() {
+	use std::fs;
+	use std::io::Read;
+	use lightning_fuzz::utils::test_logger::StringBuffer;
+
+	use std::sync::{atomic, Arc};
+	// {
+	// 	let data: Vec<u8> = vec![0];
+	// 	fs_store_run(data.as_ptr(), data.len());
+	// }
+	let mut threads = Vec::new();
+	let threads_running = Arc::new(atomic::AtomicUsize::new(0));
+	if let Ok(tests) = fs::read_dir("test_cases/fs_store") {
+		for test in tests {
+			let mut data: Vec<u8> = Vec::new();
+			let path = test.unwrap().path();
+			fs::File::open(&path).unwrap().read_to_end(&mut data).unwrap();
+			threads_running.fetch_add(1, atomic::Ordering::AcqRel);
+
+			let thread_count_ref = Arc::clone(&threads_running);
+			let main_thread_ref = std::thread::current();
+			threads.push((path.file_name().unwrap().to_str().unwrap().to_string(),
+				std::thread::spawn(move || {
+					let string_logger = StringBuffer::new();
+
+					let panic_logger = string_logger.clone();
+					let res = if ::std::panic::catch_unwind(move || {
+						fs_store_test(&data, panic_logger);
+					}).is_err() {
+						Some(string_logger.into_string())
+					} else { None };
+					thread_count_ref.fetch_sub(1, atomic::Ordering::AcqRel);
+					main_thread_ref.unpark();
+					res
+				})
+			));
+			while threads_running.load(atomic::Ordering::Acquire) > 32 {
+				std::thread::park();
+			}
+		}
+	}
+	let mut failed_outputs = Vec::new();
+	for (test, thread) in threads.drain(..) {
+		if let Some(output) = thread.join().unwrap() {
+			println!("\nOutput of {}:\n{}\n", test, output);
+			failed_outputs.push(test);
+		}
+	}
+	if !failed_outputs.is_empty() {
+		println!("Test cases which failed: ");
+		for case in failed_outputs {
+			println!("{}", case);
+		}
+		panic!();
+	}
+}

fuzz/src/bin/gen_target.sh

@@ -28,6 +28,7 @@ GEN_TEST base32
 GEN_TEST fromstr_to_netaddress
 GEN_TEST feature_flags
 GEN_TEST lsps_message
+GEN_TEST fs_store
 
 GEN_TEST msg_accept_channel msg_targets::
 GEN_TEST msg_announcement_signatures msg_targets::

fuzz/src/fs_store.rs

@@ -0,0 +1,135 @@
+use lightning::util::persist::{KVStore, KVStoreSync};
+use lightning_persister::fs_store::FilesystemStore;
+use tokio::runtime::Runtime;
+
+use crate::utils::test_logger;
+
+/// Actual fuzz test, method signature and name are fixed
+fn do_test<Out: test_logger::Output>(data: &[u8], out: Out) {
+	let rt = Runtime::new().unwrap();
+	rt.block_on(do_test_internal(data, out));
+}
+
+async fn do_test_internal<Out: test_logger::Output>(data: &[u8], out: Out) {
+	let mut read_pos = 0;
+	macro_rules! get_slice {
+		($len: expr) => {{
+			let slice_len = $len as usize;
+			if data.len() < read_pos + slice_len {
+				return;
+			}
+			read_pos += slice_len;
+			&data[read_pos - slice_len..read_pos]
+		}};
+	}
+
+	let mut temp_path = std::env::temp_dir();
+	temp_path.push("fs_store_fuzz");
+	let fs_store: FilesystemStore = FilesystemStore::new(temp_path);
+
+	let primary_namespace = "primary";
+	let secondary_namespace = "secondary";
+	let key = "key";
+
+	// Remove the key in case something was left over from a previous run.
+	_ = KVStoreSync::remove(&fs_store, primary_namespace, secondary_namespace, key, false);
+
+	let mut next_data_value = 0u64;
+	let mut get_next_data_value = || {
+		let data_value = next_data_value.to_be_bytes().to_vec();
+		next_data_value += 1;
+
+		data_value
+	};
+
+	let mut current_data = None;
+
+	let mut futures = Vec::new();
+	loop {
+		let v = get_slice!(1)[0];
+		match v {
+			// Sync write
+			0x00 => {
+				let data_value = get_next_data_value();
+
+				KVStoreSync::write(
+					&fs_store,
+					primary_namespace,
+					secondary_namespace,
+					key,
+					data_value.clone(),
+				)
+				.unwrap();
+
+				current_data = Some(data_value);
+			},
+			// Sync remove
+			0x01 => {
+				KVStoreSync::remove(&fs_store, primary_namespace, secondary_namespace, key, false)
+					.unwrap();
+
+				current_data = None;
+			},
+			// Async write
+			0x02 => {
+				let data_value = get_next_data_value();
+
+				let fut = KVStore::write(
+					&fs_store,
+					primary_namespace,
+					secondary_namespace,
+					key,
+					data_value.clone(),
+				);
+
+				// Already set the current_data, even though writing hasn't finished yet. This supports the call-time
+				// ordering semantics.
+				current_data = Some(data_value);
+
+				// Store the future for later completion.
+				futures.push(fut);
+				if futures.len() > 10 {
+					return;
+				}
+			},
+			// Async write completion
+			0x10..=0x19 => {
+				let fut_idx = (v - 0x10) as usize;
+				if fut_idx >= futures.len() {
+					return;
+				}
+
+				let fut = futures.remove(fut_idx);
+
+				fut.await.unwrap();
+			},
+			_ => {
+				return;
+			},
+		}
+
+		// If no more writes are pending, we can reliably see if the data is consistent.
+		if futures.is_empty() {
+			let data_value =
+				KVStoreSync::read(&fs_store, primary_namespace, secondary_namespace, key).ok();
+			assert_eq!(data_value, current_data);
+
+			let list =
+				KVStoreSync::list(&fs_store, primary_namespace, secondary_namespace).unwrap();
+			assert_eq!(list.is_empty(), current_data.is_none());
+
+			assert_eq!(0, fs_store.state_size());
+		}
+	}
+}
+
+/// Method that needs to be added manually, {name}_test
+pub fn fs_store_test<Out: test_logger::Output>(data: &[u8], out: Out) {
+	do_test(data, out);
+}
+
+/// Method that needs to be added manually, {name}_run
+#[no_mangle]
+pub extern "C" fn fs_store_run(data: *const u8, datalen: usize) {
+	do_test(unsafe { std::slice::from_raw_parts(data, datalen) }, test_logger::DevNull {});
+}

fuzz/src/lib.rs

@@ -9,6 +9,7 @@
 
 extern crate bitcoin;
 extern crate lightning;
+extern crate lightning_persister;
 extern crate lightning_rapid_gossip_sync;
 
 #[cfg(not(fuzzing))]
@@ -45,4 +46,5 @@ pub mod router;
 pub mod static_invoice_deser;
 pub mod zbase32;
 
+pub mod fs_store;
 pub mod msg_targets;

fuzz/targets.h

@@ -21,6 +21,7 @@ void base32_run(const unsigned char* data, size_t data_len);
 void fromstr_to_netaddress_run(const unsigned char* data, size_t data_len);
 void feature_flags_run(const unsigned char* data, size_t data_len);
 void lsps_message_run(const unsigned char* data, size_t data_len);
+void fs_store_run(const unsigned char* data, size_t data_len);
 void msg_accept_channel_run(const unsigned char* data, size_t data_len);
 void msg_announcement_signatures_run(const unsigned char* data, size_t data_len);
 void msg_channel_reestablish_run(const unsigned char* data, size_t data_len);

lightning-persister/src/fs_store.rs

@@ -80,8 +80,9 @@ impl FilesystemStore {
 		self.inner.data_dir.clone()
 	}
 
-	#[cfg(all(feature = "tokio", test))]
-	pub(crate) fn state_size(&self) -> usize {
+	#[cfg(any(all(feature = "tokio", test), fuzzing))]
+	/// Returns the size of the async state.
+	pub fn state_size(&self) -> usize {
 		let outer_lock = self.inner.locks.lock().unwrap();
 		outer_lock.len()
 	}