Line data    Source code

       1             : // Copyright (c) 2022 The Bitcoin Core developers
       2             : // Distributed under the MIT software license, see the accompanying
       3             : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
       4             : 
       5             : #include <consensus/amount.h>
       6             : #include <consensus/validation.h>
       7             : #include <net_processing.h>
       8             : #include <node/eviction.h>
       9             : #include <policy/policy.h>
      10             : #include <primitives/transaction.h>
      11             : #include <script/script.h>
      12             : #include <sync.h>
      13             : #include <test/fuzz/FuzzedDataProvider.h>
      14             : #include <test/fuzz/fuzz.h>
      15             : #include <test/fuzz/util.h>
      16             : #include <test/util/setup_common.h>
      17           2 : #include <txorphanage.h>
      18           2 : #include <uint256.h>
      19             : #include <util/check.h>
      20             : #include <util/time.h>
      21             : 
      22             : #include <cstdint>
      23             : #include <memory>
      24             : #include <set>
      25             : #include <utility>
      26             : #include <vector>
      27             : 
      28           0 : void initialize_orphanage()
      29             : {
      30           0 :     static const auto testing_setup = MakeNoLogFileContext();
      31           0 : }
      32             : 
      33           4 : FUZZ_TARGET(txorphan, .init = initialize_orphanage)
      34             : {
      35           0 :     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
      36           0 :     SetMockTime(ConsumeTime(fuzzed_data_provider));
      37             : 
      38           0 :     TxOrphanage orphanage;
      39           0 :     std::vector<COutPoint> outpoints;
      40             :     // initial outpoints used to construct transactions later
      41           0 :     for (uint8_t i = 0; i < 4; i++) {
      42           0 :         outpoints.emplace_back(uint256{i}, 0);
      43           0 :     }
      44             :     // if true, allow duplicate input when constructing tx
      45           0 :     const bool duplicate_input = fuzzed_data_provider.ConsumeBool();
      46             : 
      47           0 :     LIMITED_WHILE(outpoints.size() < 200'000 && fuzzed_data_provider.ConsumeBool(), 10 * DEFAULT_MAX_ORPHAN_TRANSACTIONS)
      48             :     {
      49             :         // construct transaction
      50           0 :         const CTransactionRef tx = [&] {
      51           0 :             CMutableTransaction tx_mut;
      52           0 :             const auto num_in = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, outpoints.size());
      53           0 :             const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, outpoints.size());
      54             :             // pick unique outpoints from outpoints as input
      55           0 :             for (uint32_t i = 0; i < num_in; i++) {
      56           0 :                 auto& prevout = PickValue(fuzzed_data_provider, outpoints);
      57           0 :                 tx_mut.vin.emplace_back(prevout);
      58             :                 // pop the picked outpoint if duplicate input is not allowed
      59           0 :                 if (!duplicate_input) {
      60           0 :                     std::swap(prevout, outpoints.back());
      61           0 :                     outpoints.pop_back();
      62           0 :                 }
      63           0 :             }
      64             :             // output amount will not affect txorphanage
      65           0 :             for (uint32_t i = 0; i < num_out; i++) {
      66           0 :                 tx_mut.vout.emplace_back(CAmount{0}, CScript{});
      67           0 :             }
      68             :             // restore previously popped outpoints
      69           0 :             for (auto& in : tx_mut.vin) {
      70           0 :                 outpoints.push_back(in.prevout);
      71             :             }
      72           0 :             auto new_tx = MakeTransactionRef(tx_mut);
      73             :             // add newly constructed transaction to outpoints
      74           2 :             for (uint32_t i = 0; i < num_out; i++) {
      75           0 :                 outpoints.emplace_back(new_tx->GetHash(), i);
      76           0 :             }
      77           0 :             return new_tx;
      78           0 :         }();
      79             : 
      80             :         // trigger orphanage functions
      81           0 :         LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10 * DEFAULT_MAX_ORPHAN_TRANSACTIONS)
      82             :         {
      83           2 :             NodeId peer_id = fuzzed_data_provider.ConsumeIntegral<NodeId>();
      84             : 
      85           0 :             CallOneOf(
      86             :                 fuzzed_data_provider,
      87           0 :                 [&] {
      88           0 :                     orphanage.AddChildrenToWorkSet(*tx);
      89           0 :                 },
      90           0 :                 [&] {
      91             :                     {
      92           0 :                         CTransactionRef ref = orphanage.GetTxToReconsider(peer_id);
      93           0 :                         if (ref) {
      94           0 :                             bool have_tx = orphanage.HaveTx(GenTxid::Txid(ref->GetHash())) || orphanage.HaveTx(GenTxid::Wtxid(ref->GetHash()));
      95           0 :                             Assert(have_tx);
      96           0 :                         }
      97           0 :                     }
      98           0 :                 },
      99           0 :                 [&] {
     100           0 :                     bool have_tx = orphanage.HaveTx(GenTxid::Txid(tx->GetHash())) || orphanage.HaveTx(GenTxid::Wtxid(tx->GetHash()));
     101             :                     // AddTx should return false if tx is too big or already have it
     102             :                     // tx weight is unknown, we only check when tx is already in orphanage
     103             :                     {
     104           0 :                         bool add_tx = orphanage.AddTx(tx, peer_id);
     105             :                         // have_tx == true -> add_tx == false
     106           0 :                         Assert(!have_tx || !add_tx);
     107             :                     }
     108           0 :                     have_tx = orphanage.HaveTx(GenTxid::Txid(tx->GetHash())) || orphanage.HaveTx(GenTxid::Wtxid(tx->GetHash()));
     109             :                     {
     110           0 :                         bool add_tx = orphanage.AddTx(tx, peer_id);
     111             :                         // if have_tx is still false, it must be too big
     112           0 :                         Assert(!have_tx == (GetTransactionWeight(*tx) > MAX_STANDARD_TX_WEIGHT));
     113           0 :                         Assert(!have_tx || !add_tx);
     114             :                     }
     115           0 :                 },
     116           0 :                 [&] {
     117           0 :                     bool have_tx = orphanage.HaveTx(GenTxid::Txid(tx->GetHash())) || orphanage.HaveTx(GenTxid::Wtxid(tx->GetHash()));
     118             :                     // EraseTx should return 0 if m_orphans doesn't have the tx
     119             :                     {
     120           0 :                         Assert(have_tx == orphanage.EraseTx(tx->GetHash()));
     121             :                     }
     122           0 :                     have_tx = orphanage.HaveTx(GenTxid::Txid(tx->GetHash())) || orphanage.HaveTx(GenTxid::Wtxid(tx->GetHash()));
     123             :                     // have_tx should be false and EraseTx should fail
     124             :                     {
     125           0 :                         Assert(!have_tx && !orphanage.EraseTx(tx->GetHash()));
     126             :                     }
     127           0 :                 },
     128           0 :                 [&] {
     129           0 :                     orphanage.EraseForPeer(peer_id);
     130           0 :                 },
     131           0 :                 [&] {
     132             :                     // test mocktime and expiry
     133           0 :                     SetMockTime(ConsumeTime(fuzzed_data_provider));
     134           0 :                     auto limit = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
     135           0 :                     orphanage.LimitOrphans(limit);
     136           0 :                     Assert(orphanage.Size() <= limit);
     137           0 :                 });
     138           0 :         }
     139           0 :     }
     140           0 : }