1 // Copyright (c) 2020-2021 The Bitcoin Core developers
2 // Distributed under the MIT software license, see the accompanying
3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5 #include <banman.h>
6 #include <fs.h>
7 #include <netaddress.h>
8 #include <test/fuzz/FuzzedDataProvider.h>
9 #include <test/fuzz/fuzz.h>
10 #include <test/fuzz/util.h>
11 #include <test/util/setup_common.h>
12 #include <util/readwritefile.h>
13 #include <util/system.h>
14
15 #include <cassert>
16 #include <cstdint>
17 #include <limits>
18 #include <string>
19 #include <vector>
20
21 namespace {
ConsumeBanTimeOffset(FuzzedDataProvider & fuzzed_data_provider)22 int64_t ConsumeBanTimeOffset(FuzzedDataProvider& fuzzed_data_provider) noexcept
23 {
24 // Avoid signed integer overflow by capping to int32_t max:
25 // banman.cpp:137:73: runtime error: signed integer overflow: 1591700817 + 9223372036854775807 cannot be represented in type 'long'
26 return fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(std::numeric_limits<int64_t>::min(), std::numeric_limits<int32_t>::max());
27 }
28 } // namespace
29
initialize_banman()30 void initialize_banman()
31 {
32 static const auto testing_setup = MakeNoLogFileContext<>();
33 }
34
operator ==(const CBanEntry & lhs,const CBanEntry & rhs)35 static bool operator==(const CBanEntry& lhs, const CBanEntry& rhs)
36 {
37 return lhs.nVersion == rhs.nVersion &&
38 lhs.nCreateTime == rhs.nCreateTime &&
39 lhs.nBanUntil == rhs.nBanUntil;
40 }
41
FUZZ_TARGET_INIT(banman,initialize_banman)42 FUZZ_TARGET_INIT(banman, initialize_banman)
43 {
44 // The complexity is O(N^2), where N is the input size, because each call
45 // might call DumpBanlist (or other methods that are at least linear
46 // complexity of the input size).
47 int limit_max_ops{300};
48 FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
49 SetMockTime(ConsumeTime(fuzzed_data_provider));
50 fs::path banlist_file = gArgs.GetDataDirNet() / "fuzzed_banlist";
51
52 const bool start_with_corrupted_banlist{fuzzed_data_provider.ConsumeBool()};
53 bool force_read_and_write_to_err{false};
54 if (start_with_corrupted_banlist) {
55 const std::string sfx{fuzzed_data_provider.ConsumeBool() ? ".dat" : ".json"};
56 assert(WriteBinaryFile(banlist_file.string() + sfx,
57 fuzzed_data_provider.ConsumeRandomLengthString()));
58 } else {
59 force_read_and_write_to_err = fuzzed_data_provider.ConsumeBool();
60 if (force_read_and_write_to_err) {
61 banlist_file = fs::path{"path"} / "to" / "inaccessible" / "fuzzed_banlist";
62 }
63 }
64
65 {
66 BanMan ban_man{banlist_file, /* client_interface */ nullptr, /* default_ban_time */ ConsumeBanTimeOffset(fuzzed_data_provider)};
67 while (--limit_max_ops >= 0 && fuzzed_data_provider.ConsumeBool()) {
68 CallOneOf(
69 fuzzed_data_provider,
70 [&] {
71 ban_man.Ban(ConsumeNetAddr(fuzzed_data_provider),
72 ConsumeBanTimeOffset(fuzzed_data_provider), fuzzed_data_provider.ConsumeBool());
73 },
74 [&] {
75 ban_man.Ban(ConsumeSubNet(fuzzed_data_provider),
76 ConsumeBanTimeOffset(fuzzed_data_provider), fuzzed_data_provider.ConsumeBool());
77 },
78 [&] {
79 ban_man.ClearBanned();
80 },
81 [&] {
82 ban_man.IsBanned(ConsumeNetAddr(fuzzed_data_provider));
83 },
84 [&] {
85 ban_man.IsBanned(ConsumeSubNet(fuzzed_data_provider));
86 },
87 [&] {
88 ban_man.Unban(ConsumeNetAddr(fuzzed_data_provider));
89 },
90 [&] {
91 ban_man.Unban(ConsumeSubNet(fuzzed_data_provider));
92 },
93 [&] {
94 banmap_t banmap;
95 ban_man.GetBanned(banmap);
96 },
97 [&] {
98 ban_man.DumpBanlist();
99 },
100 [&] {
101 ban_man.Discourage(ConsumeNetAddr(fuzzed_data_provider));
102 });
103 }
104 if (!force_read_and_write_to_err) {
105 ban_man.DumpBanlist();
106 SetMockTime(ConsumeTime(fuzzed_data_provider));
107 banmap_t banmap;
108 ban_man.GetBanned(banmap);
109 BanMan ban_man_read{banlist_file, /* client_interface */ nullptr, /* default_ban_time */ 0};
110 banmap_t banmap_read;
111 ban_man_read.GetBanned(banmap_read);
112 assert(banmap == banmap_read);
113 }
114 }
115 fs::remove(banlist_file.string() + ".dat");
116 fs::remove(banlist_file.string() + ".json");
117 }
118