From ce425cde6ce795b5fcd6db8fb774e1c31f27fc76 Mon Sep 17 00:00:00 2001 From: Martin Holst Swende Date: Sun, 19 May 2019 21:04:17 +0200 Subject: [PATCH] fuzzers: fuzzers for keystore, rlp, trie, whisper (cred to @guidovranken) --- fuzzbuzz.yaml | 37 ++++ ...0176eaf52ed014ec5c91cf4afa070dd3fd469077-1 | 1 + fuzzers/keystore/keystore-fuzz.go | 22 +++ fuzzers/rlp/corpus/r.bin | 1 + fuzzers/rlp/rlp_fuzzer.go | 114 ++++++++++++ fuzzers/trie/corpus/data | 1 + fuzzers/trie/trie-fuzzer.go | 173 ++++++++++++++++++ .../009c5adfa4fd685caef58e1ce932fa7fb209730a | Bin 0 -> 61 bytes fuzzers/whisperv6/whisper-fuzzer.go | 76 ++++++++ 9 files changed, 425 insertions(+) create mode 100644 fuzzbuzz.yaml create mode 100644 fuzzers/keystore/corpus/0176eaf52ed014ec5c91cf4afa070dd3fd469077-1 create mode 100644 fuzzers/keystore/keystore-fuzz.go create mode 100644 fuzzers/rlp/corpus/r.bin create mode 100644 fuzzers/rlp/rlp_fuzzer.go create mode 100644 fuzzers/trie/corpus/data create mode 100644 fuzzers/trie/trie-fuzzer.go create mode 100644 fuzzers/whisperv6/corpus/009c5adfa4fd685caef58e1ce932fa7fb209730a create mode 100644 fuzzers/whisperv6/whisper-fuzzer.go diff --git a/fuzzbuzz.yaml b/fuzzbuzz.yaml new file mode 100644 index 0000000000..7e3c3337b4 --- /dev/null +++ b/fuzzbuzz.yaml @@ -0,0 +1,37 @@ +# bmt keystore rlp trie whisperv6 + +base: ubuntu:16.04 +targets: + - name: rlp + language: go + version: "1.11" + corpus: ./fuzzers/rlp/corpus + harness: + function: Fuzz + package: github.com/ethereum/go-ethereum/fuzzers/rlp + checkout: github.com/ethereum/go-ethereum/ + - name: keystore + language: go + version: "1.11" + corpus: ./fuzzers/keystore/corpus + harness: + function: Fuzz + package: github.com/ethereum/go-ethereum/fuzzers/keystore + checkout: github.com/ethereum/go-ethereum/ + - name: trie + language: go + version: "1.11" + corpus: ./fuzzers/trie/corpus + harness: + function: Fuzz + package: github.com/ethereum/go-ethereum/fuzzers/trie + checkout: github.com/ethereum/go-ethereum/ + - name: whisperv6 + language: go + version: "1.11" + corpus: ./fuzzers/whisperv6/corpus + harness: + function: Fuzz + package: github.com/ethereum/go-ethereum/fuzzers/whisperv6 + checkout: github.com/ethereum/go-ethereum/ + diff --git a/fuzzers/keystore/corpus/0176eaf52ed014ec5c91cf4afa070dd3fd469077-1 b/fuzzers/keystore/corpus/0176eaf52ed014ec5c91cf4afa070dd3fd469077-1 new file mode 100644 index 0000000000..1c0ecf5250 --- /dev/null +++ b/fuzzers/keystore/corpus/0176eaf52ed014ec5c91cf4afa070dd3fd469077-1 @@ -0,0 +1 @@ +ns©›,²Ô \ No newline at end of file diff --git a/fuzzers/keystore/keystore-fuzz.go b/fuzzers/keystore/keystore-fuzz.go new file mode 100644 index 0000000000..155e3fb62f --- /dev/null +++ b/fuzzers/keystore/keystore-fuzz.go @@ -0,0 +1,22 @@ +package keystore + +import ( + "os" + + "github.com/ethereum/go-ethereum/accounts/keystore" +) + +func Fuzz(input []byte) int { + + ks := keystore.NewKeyStore("/tmp/ks", keystore.LightScryptN, keystore.LightScryptP) + + a, err := ks.NewAccount(string(input)) + if err != nil { + panic(err) + } + if err := ks.Unlock(a, string(input)); err != nil { + panic(err) + } + os.Remove(a.URL.Path) + return 0 +} diff --git a/fuzzers/rlp/corpus/r.bin b/fuzzers/rlp/corpus/r.bin new file mode 100644 index 0000000000..cb98a76a8a --- /dev/null +++ b/fuzzers/rlp/corpus/r.bin @@ -0,0 +1 @@ +Ë€€€À€ÀÃÀÀÀÀ \ No newline at end of file diff --git a/fuzzers/rlp/rlp_fuzzer.go b/fuzzers/rlp/rlp_fuzzer.go new file mode 100644 index 0000000000..9c4de825cd --- /dev/null +++ b/fuzzers/rlp/rlp_fuzzer.go @@ -0,0 +1,114 @@ +package rlp + +import ( + "bytes" + "fmt" + + "github.com/ethereum/go-ethereum/core/types" + "github.com/ethereum/go-ethereum/rlp" +) + +func decodeEncode(input []byte, val interface{}, i int) { + if err := rlp.DecodeBytes(input, val); err == nil { + output, err := rlp.EncodeToBytes(val) + if err != nil { + panic(err) + } + if !bytes.Equal(input, output) { + panic(fmt.Sprintf("case %d: encode-decode is not equal, \ninput : %x\noutput: %x", i, input, output)) + } + } +} + +func Fuzz(input []byte) int { + + var i int + { + if len(input) > 0 { + rlp.Split(input) + } + } + { + if len(input) > 0 { + if elems, _, err := rlp.SplitList(input); err == nil { + rlp.CountValues(elems) + } + } + } + + { + rlp.NewStream(bytes.NewReader(input), 0).Decode(new(interface{})) + } + + { + decodeEncode(input, new(interface{}), i) + i++ + } + { + var v struct { + Int uint + String string + Bytes []byte + } + decodeEncode(input, &v, i) + i++ + } + + { + type Types struct { + Bool bool + Raw rlp.RawValue + Slice []*Types + Iface []interface{} + } + var v Types + decodeEncode(input, &v, i) + i++ + } + { + type AllTypes struct { + Int uint + String string + Bytes []byte + Bool bool + Raw rlp.RawValue + Slice []*AllTypes + Array [3]*AllTypes + Iface []interface{} + } + var v AllTypes + decodeEncode(input, &v, i) + i++ + } + { + decodeEncode(input, [10]byte{}, i) + i++ + } + { + var v struct { + Byte [10]byte + Rool [10]bool + } + decodeEncode(input, &v, i) + i++ + } + { + var h types.Header + decodeEncode(input, &h, i) + i++ + var b types.Block + decodeEncode(input, &b, i) + i++ + var t types.Transaction + decodeEncode(input, &t, i) + i++ + var txs types.Transactions + decodeEncode(input, &txs, i) + i++ + var rs types.Receipts + decodeEncode(input, &rs, i) + i++ + } + + return 0 +} diff --git a/fuzzers/trie/corpus/data b/fuzzers/trie/corpus/data new file mode 100644 index 0000000000..c4a4839cb8 --- /dev/null +++ b/fuzzers/trie/corpus/data @@ -0,0 +1 @@ +asdlfkjasf23oiejfasdfadkfqlkjfasdlkfjalwk4jfalsdkfjawlefkjsadlfkjasldkfjwalefkjasdlfkjM \ No newline at end of file diff --git a/fuzzers/trie/trie-fuzzer.go b/fuzzers/trie/trie-fuzzer.go new file mode 100644 index 0000000000..df2f499ae3 --- /dev/null +++ b/fuzzers/trie/trie-fuzzer.go @@ -0,0 +1,173 @@ +package trie + +import ( + "bytes" + "encoding/binary" + "fmt" + + "github.com/ethereum/go-ethereum/common" + "github.com/ethereum/go-ethereum/ethdb/memorydb" + "github.com/ethereum/go-ethereum/trie" +) + +// randTest performs random trie operations. +// Instances of this test are created by Generate. +type randTest []randTestStep + +type randTestStep struct { + op int + key []byte // for opUpdate, opDelete, opGet + value []byte // for opUpdate + err error // for debugging +} + +type proofDb struct{} + +func (proofDb) Put(key []byte, value []byte) error { + return nil +} + +func (proofDb) Delete(key []byte) error { + return nil +} + +const ( + opUpdate = iota + opDelete + opGet + opCommit + opHash + opReset + opItercheckhash + opProve + opMax // boundary value, not an actual op +) + +type dataSource struct { + input []byte + reader *bytes.Reader +} + +func newDataSource(input []byte) *dataSource { + return &dataSource{ + input, bytes.NewReader(input), + } +} +func (ds *dataSource) ReadByte() byte { + if b, err := ds.reader.ReadByte(); err != nil { + return 0 + } else { + return b + } +} +func (ds *dataSource) Read(buf []byte) (int, error) { + return ds.reader.Read(buf) +} +func (ds *dataSource) Ended() bool { + return ds.reader.Len() == 0 +} + +func Generate(input []byte) randTest { + + var allKeys [][]byte + r := newDataSource(input) + genKey := func() []byte { + + if len(allKeys) < 2 || r.ReadByte() < 0x0f { + // new key + key := make([]byte, r.ReadByte()%50) + r.Read(key) + allKeys = append(allKeys, key) + return key + } + // use existing key + return allKeys[int(r.ReadByte())%len(allKeys)] + } + + var steps randTest + + for i := 0; !r.Ended(); i++ { + + step := randTestStep{op: int(r.ReadByte()) % opMax} + switch step.op { + case opUpdate: + step.key = genKey() + step.value = make([]byte, 8) + binary.BigEndian.PutUint64(step.value, uint64(i)) + case opGet, opDelete, opProve: + step.key = genKey() + } + steps = append(steps, step) + if len(steps) > 500 { + break + } + } + + return steps +} + +func Fuzz(input []byte) int { + program := Generate(input) + if len(program) == 0 { + return -1 + } + if err := runRandTest(program); err != nil { + panic(err) + } + return 0 +} + +func runRandTest(rt randTest) error { + + triedb := trie.NewDatabase(memorydb.New()) + + tr, _ := trie.New(common.Hash{}, triedb) + values := make(map[string]string) // tracks content of the trie + + for i, step := range rt { + switch step.op { + case opUpdate: + tr.Update(step.key, step.value) + values[string(step.key)] = string(step.value) + case opDelete: + tr.Delete(step.key) + delete(values, string(step.key)) + case opGet: + v := tr.Get(step.key) + want := values[string(step.key)] + if string(v) != want { + rt[i].err = fmt.Errorf("mismatch for key 0x%x, got 0x%x want 0x%x", step.key, v, want) + } + case opCommit: + _, rt[i].err = tr.Commit(nil) + case opHash: + tr.Hash() + case opReset: + hash, err := tr.Commit(nil) + if err != nil { + return err + } + newtr, err := trie.New(hash, triedb) + if err != nil { + return err + } + tr = newtr + case opItercheckhash: + checktr, _ := trie.New(common.Hash{}, triedb) + it := trie.NewIterator(tr.NodeIterator(nil)) + for it.Next() { + checktr.Update(it.Key, it.Value) + } + if tr.Hash() != checktr.Hash() { + return fmt.Errorf("hash mismatch in opItercheckhash") + } + case opProve: + rt[i].err = tr.Prove(step.key, 0, proofDb{}) + } + // Abort the test on error. + if rt[i].err != nil { + return rt[i].err + } + } + return nil +} diff --git a/fuzzers/whisperv6/corpus/009c5adfa4fd685caef58e1ce932fa7fb209730a b/fuzzers/whisperv6/corpus/009c5adfa4fd685caef58e1ce932fa7fb209730a new file mode 100644 index 0000000000000000000000000000000000000000..af2f0826730441cc5abb122074afd090fad2eb95 GIT binary patch literal 61 XcmaEK>c|9A!Hu2QZfJ0QyTbqgS<53t literal 0 HcmV?d00001 diff --git a/fuzzers/whisperv6/whisper-fuzzer.go b/fuzzers/whisperv6/whisper-fuzzer.go new file mode 100644 index 0000000000..0c68bbd729 --- /dev/null +++ b/fuzzers/whisperv6/whisper-fuzzer.go @@ -0,0 +1,76 @@ +package whisperv6 + +import ( + "bytes" + + "github.com/ethereum/go-ethereum/crypto" + "github.com/ethereum/go-ethereum/rlp" + "github.com/ethereum/go-ethereum/whisper/whisperv6" +) + +type MessageParams struct { + Topic whisperv6.TopicType + WorkTime uint32 + TTL uint32 + KeySym []byte + Payload []byte +} + +//export fuzzer_entry +func Fuzz(input []byte) int { + + var paramsDecoded MessageParams + err := rlp.DecodeBytes(input, ¶msDecoded) + if err != nil { + return 0 + } + var params whisperv6.MessageParams + params.KeySym = make([]byte, 32) + if len(paramsDecoded.KeySym) <= 32 { + copy(params.KeySym, paramsDecoded.KeySym) + } + if input[0] == 255 { + params.PoW = 0.01 + params.WorkTime = 1 + } else { + params.PoW = 0 + params.WorkTime = 0 + } + params.TTL = paramsDecoded.TTL + params.Payload = paramsDecoded.Payload + text := make([]byte, 0, 512) + text = append(text, params.Payload...) + params.Topic = paramsDecoded.Topic + params.Src, err = crypto.GenerateKey() + if err != nil { + return 0 + } + msg, err := whisperv6.NewSentMessage(¶ms) + if err != nil { + panic(err) + //return + } + env, err := msg.Wrap(¶ms) + if err != nil { + panic(err) + } + decrypted, err := env.OpenSymmetric(params.KeySym) + if err != nil { + panic(err) + } + if !decrypted.ValidateAndParse() { + panic("ValidateAndParse failed") + return 0 + } + if !bytes.Equal(text, decrypted.Payload) { + panic("text != decrypted.Payload") + } + if len(decrypted.Signature) != 65 { + panic("Unexpected signature length") + } + if !whisperv6.IsPubKeyEqual(decrypted.Src, ¶ms.Src.PublicKey) { + panic("Unexpected public key") + } + + return 0 +}