Add instructions on how to fuzz the P2P layer using Honggfuzz NetDriver.
Honggfuzz NetDriver allows for very easy fuzzing of TCP servers such as Bitcoin Core without having to write any custom fuzzing harness. The bitcoind server process is largely fuzzed without modification.
This makes the fuzzing highly realistic: a bug reachable by the fuzzer is likely also remotely triggerable by an untrusted peer.
190++++ b/src/bitcoind.cpp
191+@@ -158,7 +158,11 @@ static bool AppInit(int argc, char* argv[])
192+ return fRet;
193+ }
194+
195++#ifdef HFND_FUZZING_ENTRY_FUNCTION_CXX
src/bitcoind.cpp or src/net.cpp.
Currently testing on my macOS. Keep getting the following warning line, but seems that coverage still increases:
0[2020-11-21T17:11:06-0500][W][91981] netDriver_bindToRndLoopback():143 Could not bind to a random IPv4 Loopback address: Can't assign requested address
@Crypt-iQ I don’t have any Mac to test on, so I’m afraid I cannot help much. Could you add an assertion in PeerManager::ProcessMessage to make sure you’re hitting the relevant code paths? :)
Do you have any Linux machine to test under? :)
Theoretically both types of issues are certainly possible: reproducible (single input enough to trigger condition) and “non-reproducible” (in this context: single input + previous inputs needed to trigger condition).
Practically:
If this fuzzer hits any issues my guess is that such issues will be reproducible with high probability. That has been the case historically with issues uncovered by src/test/fuzz/process_message or src/test/fuzz/process_messages. They have typically not been dependent on a specific state change being cause by previously proceed input.
Does that answer your question? :)
@MarcoFalke I’m not sure I follow TBH. In the case of HonggFuzz NetDriver each input is handled as if it was a new incoming TCP connection, and each input can contain multiple messages (Bitcoin P2P messages).
The TCP connection is not re-used across inputs if that is what you meant :)
Reports a signed integer overflow here: https://github.com/bitcoin/bitcoin/blob/16b784d953365bb2d7ae65acd2b20a79ef8ba7b6/src/net_processing.cpp#L2651
0net_processing.cpp:2651:37: runtime error: signed integer overflow: -9223372036854775808 - 1612058654 cannot be represented in type 'long'
1SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior net_processing.cpp:2651:37 in
Given @Crypt-iQ’s finding above the value of having Honggfuzz NetDriver in the fuzzing toolbox has been proven empirically I guess :)
Is there anything left to do for this documentation only PR?
I had to comment out the following line before building honggfuzz as otherwise it would stop on my 2015 macbook Arch Linux citing slow execution. Could be the age of my computer though. I bumped the timeout as some of the seeds took >4 seconds, and could not use multiple threads due to a lock on the data directory.
-fsanitize=address doesn’t instrument strncmp on my build, so it can’t guess the message commands. I tried with a very simple external testcase (guess “foo” and panic program) to be sure, and it got stuck.
Labels
Docs