Skip to content

Commit be677dc

Browse files
authored
Merge pull request #416 from TheBlueMatt/2019-12-fuzz-clib
Refactor fuzzing to be a C-callable library plus rust binaries
2 parents cd21a35 + e28fd78 commit be677dc

File tree

72 files changed

+1619
-873
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+1619
-873
lines changed

fuzz/Cargo.toml

Lines changed: 5 additions & 120 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ cargo-fuzz = true
1414
afl_fuzz = ["afl"]
1515
honggfuzz_fuzz = ["honggfuzz"]
1616
libfuzzer_fuzz = ["libfuzzer-sys"]
17+
stdin_fuzz = []
1718

1819
[dependencies]
1920
afl = { version = "0.4", optional = true }
@@ -36,123 +37,7 @@ members = ["."]
3637
lto = true
3738
codegen-units = 1
3839

39-
[[bin]]
40-
name = "peer_crypt_target"
41-
path = "fuzz_targets/peer_crypt_target.rs"
42-
43-
[[bin]]
44-
name = "full_stack_target"
45-
path = "fuzz_targets/full_stack_target.rs"
46-
47-
[[bin]]
48-
name = "chanmon_fail_consistency"
49-
path = "fuzz_targets/chanmon_fail_consistency.rs"
50-
51-
[[bin]]
52-
name = "router_target"
53-
path = "fuzz_targets/router_target.rs"
54-
55-
[[bin]]
56-
name = "chanmon_deser_target"
57-
path = "fuzz_targets/chanmon_deser_target.rs"
58-
59-
# message fuzz targets
60-
[[bin]]
61-
name = "msg_ping_target"
62-
path = "fuzz_targets/msg_targets/msg_ping_target.rs"
63-
64-
[[bin]]
65-
name = "msg_pong_target"
66-
path = "fuzz_targets/msg_targets/msg_pong_target.rs"
67-
68-
[[bin]]
69-
name = "msg_error_message_target"
70-
path = "fuzz_targets/msg_targets/msg_error_message_target.rs"
71-
72-
[[bin]]
73-
name = "msg_update_add_htlc_target"
74-
path = "fuzz_targets/msg_targets/msg_update_add_htlc_target.rs"
75-
76-
[[bin]]
77-
name = "msg_accept_channel_target"
78-
path = "fuzz_targets/msg_targets/msg_accept_channel_target.rs"
79-
80-
[[bin]]
81-
name = "msg_closing_signed_target"
82-
path = "fuzz_targets/msg_targets/msg_closing_signed_target.rs"
83-
84-
[[bin]]
85-
name = "msg_commitment_signed_target"
86-
path = "fuzz_targets/msg_targets/msg_commitment_signed_target.rs"
87-
88-
[[bin]]
89-
name = "msg_funding_created_target"
90-
path = "fuzz_targets/msg_targets/msg_funding_created_target.rs"
91-
92-
[[bin]]
93-
name = "msg_funding_locked_target"
94-
path = "fuzz_targets/msg_targets/msg_funding_locked_target.rs"
95-
96-
[[bin]]
97-
name = "msg_funding_signed_target"
98-
path = "fuzz_targets/msg_targets/msg_funding_signed_target.rs"
99-
100-
[[bin]]
101-
name = "msg_open_channel_target"
102-
path = "fuzz_targets/msg_targets/msg_open_channel_target.rs"
103-
104-
[[bin]]
105-
name = "msg_revoke_and_ack_target"
106-
path = "fuzz_targets/msg_targets/msg_revoke_and_ack_target.rs"
107-
108-
[[bin]]
109-
name = "msg_shutdown_target"
110-
path = "fuzz_targets/msg_targets/msg_shutdown_target.rs"
111-
112-
[[bin]]
113-
name = "msg_update_fail_malformed_htlc_target"
114-
path = "fuzz_targets/msg_targets/msg_update_fail_malformed_htlc_target.rs"
115-
116-
[[bin]]
117-
name = "msg_update_fee_target"
118-
path = "fuzz_targets/msg_targets/msg_update_fee_target.rs"
119-
120-
[[bin]]
121-
name = "msg_update_fulfill_htlc_target"
122-
path = "fuzz_targets/msg_targets/msg_update_fulfill_htlc_target.rs"
123-
124-
[[bin]]
125-
name = "msg_update_fail_htlc_target"
126-
path = "fuzz_targets/msg_targets/msg_update_fail_htlc_target.rs"
127-
128-
[[bin]]
129-
name = "msg_channel_reestablish_target"
130-
path = "fuzz_targets/msg_targets/msg_channel_reestablish_target.rs"
131-
132-
[[bin]]
133-
name = "msg_announcement_signatures_target"
134-
path = "fuzz_targets/msg_targets/msg_announcement_signatures_target.rs"
135-
136-
[[bin]]
137-
name = "msg_channel_announcement_target"
138-
path = "fuzz_targets/msg_targets/msg_channel_announcement_target.rs"
139-
140-
[[bin]]
141-
name = "msg_channel_update_target"
142-
path = "fuzz_targets/msg_targets/msg_channel_update_target.rs"
143-
144-
[[bin]]
145-
name = "msg_decoded_onion_error_packet_target"
146-
path = "fuzz_targets/msg_targets/msg_decoded_onion_error_packet_target.rs"
147-
148-
[[bin]]
149-
name = "msg_init_target"
150-
path = "fuzz_targets/msg_targets/msg_init_target.rs"
151-
152-
[[bin]]
153-
name = "msg_node_announcement_target"
154-
path = "fuzz_targets/msg_targets/msg_node_announcement_target.rs"
155-
156-
[[bin]]
157-
name = "msg_onion_hop_data_target"
158-
path = "fuzz_targets/msg_targets/msg_onion_hop_data_target.rs"
40+
[lib]
41+
name = "lightning_fuzz"
42+
path = "src/lib.rs"
43+
crate-type = ["rlib", "dylib", "staticlib"]
Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
// This file is auto-generated by gen_target.sh based on target_template.txt
2+
// To modify it, modify target_template.txt and run gen_target.sh instead.
3+
4+
//Uncomment this for libfuzzer builds:
5+
//#![no_main]
6+
7+
extern crate lightning_fuzz;
8+
use lightning_fuzz::chanmon_consistency::*;
9+
10+
use std::io::Read;
11+
12+
#[cfg(feature = "afl")]
13+
#[macro_use] extern crate afl;
14+
#[cfg(feature = "afl")]
15+
fn main() {
16+
fuzz!(|data| {
17+
chanmon_consistency_run(data.as_ptr(), data.len());
18+
});
19+
}
20+
21+
#[cfg(feature = "honggfuzz")]
22+
#[macro_use] extern crate honggfuzz;
23+
#[cfg(feature = "honggfuzz")]
24+
fn main() {
25+
loop {
26+
fuzz!(|data| {
27+
chanmon_consistency_run(data.as_ptr(), data.len());
28+
});
29+
}
30+
}
31+
32+
#[cfg(feature = "libfuzzer_fuzz")]
33+
#[macro_use] extern crate libfuzzer_sys;
34+
#[cfg(feature = "libfuzzer_fuzz")]
35+
fuzz_target!(|data: &[u8]| {
36+
chanmon_consistency_run(data.as_ptr(), data.len());
37+
});
38+
39+
#[cfg(feature = "stdin_fuzz")]
40+
fn main() {
41+
let mut data = Vec::with_capacity(8192);
42+
std::io::stdin().read_to_end(&mut data).unwrap();
43+
chanmon_consistency_run(data.as_ptr(), data.len());
44+
}

fuzz/src/bin/chanmon_deser_target.rs

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
// This file is auto-generated by gen_target.sh based on target_template.txt
2+
// To modify it, modify target_template.txt and run gen_target.sh instead.
3+
4+
//Uncomment this for libfuzzer builds:
5+
//#![no_main]
6+
7+
extern crate lightning_fuzz;
8+
use lightning_fuzz::chanmon_deser::*;
9+
10+
use std::io::Read;
11+
12+
#[cfg(feature = "afl")]
13+
#[macro_use] extern crate afl;
14+
#[cfg(feature = "afl")]
15+
fn main() {
16+
fuzz!(|data| {
17+
chanmon_deser_run(data.as_ptr(), data.len());
18+
});
19+
}
20+
21+
#[cfg(feature = "honggfuzz")]
22+
#[macro_use] extern crate honggfuzz;
23+
#[cfg(feature = "honggfuzz")]
24+
fn main() {
25+
loop {
26+
fuzz!(|data| {
27+
chanmon_deser_run(data.as_ptr(), data.len());
28+
});
29+
}
30+
}
31+
32+
#[cfg(feature = "libfuzzer_fuzz")]
33+
#[macro_use] extern crate libfuzzer_sys;
34+
#[cfg(feature = "libfuzzer_fuzz")]
35+
fuzz_target!(|data: &[u8]| {
36+
chanmon_deser_run(data.as_ptr(), data.len());
37+
});
38+
39+
#[cfg(feature = "stdin_fuzz")]
40+
fn main() {
41+
let mut data = Vec::with_capacity(8192);
42+
std::io::stdin().read_to_end(&mut data).unwrap();
43+
chanmon_deser_run(data.as_ptr(), data.len());
44+
}

fuzz/src/bin/full_stack_target.rs

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
// This file is auto-generated by gen_target.sh based on target_template.txt
2+
// To modify it, modify target_template.txt and run gen_target.sh instead.
3+
4+
//Uncomment this for libfuzzer builds:
5+
//#![no_main]
6+
7+
extern crate lightning_fuzz;
8+
use lightning_fuzz::full_stack::*;
9+
10+
use std::io::Read;
11+
12+
#[cfg(feature = "afl")]
13+
#[macro_use] extern crate afl;
14+
#[cfg(feature = "afl")]
15+
fn main() {
16+
fuzz!(|data| {
17+
full_stack_run(data.as_ptr(), data.len());
18+
});
19+
}
20+
21+
#[cfg(feature = "honggfuzz")]
22+
#[macro_use] extern crate honggfuzz;
23+
#[cfg(feature = "honggfuzz")]
24+
fn main() {
25+
loop {
26+
fuzz!(|data| {
27+
full_stack_run(data.as_ptr(), data.len());
28+
});
29+
}
30+
}
31+
32+
#[cfg(feature = "libfuzzer_fuzz")]
33+
#[macro_use] extern crate libfuzzer_sys;
34+
#[cfg(feature = "libfuzzer_fuzz")]
35+
fuzz_target!(|data: &[u8]| {
36+
full_stack_run(data.as_ptr(), data.len());
37+
});
38+
39+
#[cfg(feature = "stdin_fuzz")]
40+
fn main() {
41+
let mut data = Vec::with_capacity(8192);
42+
std::io::stdin().read_to_end(&mut data).unwrap();
43+
full_stack_run(data.as_ptr(), data.len());
44+
}

fuzz/src/bin/gen_target.sh

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/bin/sh
2+
3+
echo "#include <stdint.h>" > ../../targets.h
4+
GEN_TEST() {
5+
cat target_template.txt | sed s/TARGET_NAME/$1/ | sed s/TARGET_MOD/$2$1/ > $1_target.rs
6+
echo "void $1_run(const unsigned char* data, size_t data_len);" >> ../../targets.h
7+
}
8+
9+
GEN_TEST chanmon_deser
10+
GEN_TEST chanmon_consistency
11+
GEN_TEST full_stack
12+
GEN_TEST peer_crypt
13+
GEN_TEST router
14+
15+
GEN_TEST msg_accept_channel msg_targets::
16+
GEN_TEST msg_announcement_signatures msg_targets::
17+
GEN_TEST msg_channel_reestablish msg_targets::
18+
GEN_TEST msg_closing_signed msg_targets::
19+
GEN_TEST msg_commitment_signed msg_targets::
20+
GEN_TEST msg_decoded_onion_error_packet msg_targets::
21+
GEN_TEST msg_funding_created msg_targets::
22+
GEN_TEST msg_funding_locked msg_targets::
23+
GEN_TEST msg_funding_signed msg_targets::
24+
GEN_TEST msg_init msg_targets::
25+
GEN_TEST msg_open_channel msg_targets::
26+
GEN_TEST msg_revoke_and_ack msg_targets::
27+
GEN_TEST msg_shutdown msg_targets::
28+
GEN_TEST msg_update_fail_htlc msg_targets::
29+
GEN_TEST msg_update_fail_malformed_htlc msg_targets::
30+
GEN_TEST msg_update_fee msg_targets::
31+
GEN_TEST msg_update_fulfill_htlc msg_targets::
32+
33+
GEN_TEST msg_channel_announcement msg_targets::
34+
GEN_TEST msg_channel_update msg_targets::
35+
GEN_TEST msg_node_announcement msg_targets::
36+
37+
GEN_TEST msg_update_add_htlc msg_targets::
38+
GEN_TEST msg_error_message msg_targets::
39+
GEN_TEST msg_onion_hop_data msg_targets::
40+
41+
GEN_TEST msg_ping msg_targets::
42+
GEN_TEST msg_pong msg_targets::
Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
// This file is auto-generated by gen_target.sh based on target_template.txt
2+
// To modify it, modify target_template.txt and run gen_target.sh instead.
3+
4+
//Uncomment this for libfuzzer builds:
5+
//#![no_main]
6+
7+
extern crate lightning_fuzz;
8+
use lightning_fuzz::msg_targets::msg_accept_channel::*;
9+
10+
use std::io::Read;
11+
12+
#[cfg(feature = "afl")]
13+
#[macro_use] extern crate afl;
14+
#[cfg(feature = "afl")]
15+
fn main() {
16+
fuzz!(|data| {
17+
msg_accept_channel_run(data.as_ptr(), data.len());
18+
});
19+
}
20+
21+
#[cfg(feature = "honggfuzz")]
22+
#[macro_use] extern crate honggfuzz;
23+
#[cfg(feature = "honggfuzz")]
24+
fn main() {
25+
loop {
26+
fuzz!(|data| {
27+
msg_accept_channel_run(data.as_ptr(), data.len());
28+
});
29+
}
30+
}
31+
32+
#[cfg(feature = "libfuzzer_fuzz")]
33+
#[macro_use] extern crate libfuzzer_sys;
34+
#[cfg(feature = "libfuzzer_fuzz")]
35+
fuzz_target!(|data: &[u8]| {
36+
msg_accept_channel_run(data.as_ptr(), data.len());
37+
});
38+
39+
#[cfg(feature = "stdin_fuzz")]
40+
fn main() {
41+
let mut data = Vec::with_capacity(8192);
42+
std::io::stdin().read_to_end(&mut data).unwrap();
43+
msg_accept_channel_run(data.as_ptr(), data.len());
44+
}

0 commit comments

Comments
 (0)