rpc.cpp raw
1 // Copyright (c) 2021-present The Bitcoin Core developers
2 // Distributed under the MIT software license, see the accompanying
3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5 #include <base58.h>
6 #include <key.h>
7 #include <key_io.h>
8 #include <primitives/block.h>
9 #include <primitives/transaction.h>
10 #include <psbt.h>
11 #include <rpc/client.h>
12 #include <rpc/request.h>
13 #include <rpc/server.h>
14 #include <span.h>
15 #include <streams.h>
16 #include <test/fuzz/FuzzedDataProvider.h>
17 #include <test/fuzz/fuzz.h>
18 #include <test/fuzz/util.h>
19 #include <test/util/setup_common.h>
20 #include <test/util/time.h>
21 #include <tinyformat.h>
22 #include <uint256.h>
23 #include <univalue.h>
24 #include <util/strencodings.h>
25 #include <util/string.h>
26 #include <util/time.h>
27
28 #include <algorithm>
29 #include <cassert>
30 #include <cstdint>
31 #include <cstdlib>
32 #include <exception>
33 #include <iostream>
34 #include <memory>
35 #include <optional>
36 #include <stdexcept>
37 #include <vector>
38 enum class ChainType;
39
40 using util::Join;
41 using util::ToString;
42
43 namespace {
44 struct RPCFuzzTestingSetup : public TestingSetup {
45 RPCFuzzTestingSetup(const ChainType chain_type, TestOpts opts) : TestingSetup{chain_type, opts}
46 {
47 }
48
49 void CallRPC(const std::string& rpc_method, const std::vector<std::string>& arguments)
50 {
51 JSONRPCRequest request;
52 request.context = &m_node;
53 request.strMethod = rpc_method;
54 try {
55 request.params = RPCConvertValues(rpc_method, arguments);
56 } catch (const std::runtime_error&) {
57 return;
58 }
59 tableRPC.execute(request);
60 }
61
62 std::vector<std::string> GetRPCCommands() const
63 {
64 return tableRPC.listCommands();
65 }
66 };
67
68 RPCFuzzTestingSetup* rpc_testing_setup = nullptr;
69 std::string g_limit_to_rpc_command;
70
71 // RPC commands which are not appropriate for fuzzing: such as RPC commands
72 // reading or writing to a filename passed as an RPC parameter, RPC commands
73 // resulting in network activity, etc.
74 const std::vector<std::string> RPC_COMMANDS_NOT_SAFE_FOR_FUZZING{
75 "addconnection", // avoid DNS lookups
76 "addnode", // avoid DNS lookups
77 "addpeeraddress", // avoid DNS lookups
78 "dumptxoutset", // avoid writing to disk
79 "enumeratesigners",
80 "echoipc", // avoid assertion failure (Assertion `"EnsureAnyNodeContext(request.context).init" && check' failed.)
81 "exportasmap", // avoid writing to disk
82 "generatetoaddress", // avoid prohibitively slow execution (when `num_blocks` is large)
83 "generatetodescriptor", // avoid prohibitively slow execution (when `nblocks` is large)
84 "gettxoutproof", // avoid prohibitively slow execution
85 "importmempool", // avoid reading from disk
86 "loadtxoutset", // avoid reading from disk
87 "loadwallet", // avoid reading from disk
88 "savemempool", // disabled as a precautionary measure: may take a file path argument in the future
89 "setban", // avoid DNS lookups
90 "stop", // avoid shutdown state
91 };
92
93 // RPC commands which are safe for fuzzing.
94 const std::vector<std::string> RPC_COMMANDS_SAFE_FOR_FUZZING{
95 "abortprivatebroadcast",
96 "analyzepsbt",
97 "clearbanned",
98 "combinepsbt",
99 "combinerawtransaction",
100 "converttopsbt",
101 "createmultisig",
102 "createpsbt",
103 "createrawtransaction",
104 "decodepsbt",
105 "decoderawtransaction",
106 "decodescript",
107 "deriveaddresses",
108 "descriptorprocesspsbt",
109 "disconnectnode",
110 "echo",
111 "echojson",
112 "estimaterawfee",
113 "estimatesmartfee",
114 "finalizepsbt",
115 "generate",
116 "generateblock",
117 "getaddednodeinfo",
118 "getaddrmaninfo",
119 "getbestblockhash",
120 "getblock",
121 "getblockchaininfo",
122 "getblockcount",
123 "getblockfilter",
124 "getblockfrompeer", // when no peers are connected, no p2p message is sent
125 "getblockhash",
126 "getblockheader",
127 "getblockstats",
128 "getblocktemplate",
129 "getchaintips",
130 "getchainstates",
131 "getchaintxstats",
132 "getconnectioncount",
133 "getdeploymentinfo",
134 "getdescriptoractivity",
135 "getdescriptorinfo",
136 "getdifficulty",
137 "getindexinfo",
138 "getmemoryinfo",
139 "getmempoolancestors",
140 "getmempooldescendants",
141 "getmempoolentry",
142 "getmempoolfeeratediagram",
143 "getmempoolcluster",
144 "getmempoolinfo",
145 "getmininginfo",
146 "getnettotals",
147 "getnetworkhashps",
148 "getnetworkinfo",
149 "getnodeaddresses",
150 "getorphantxs",
151 "getpeerinfo",
152 "getprioritisedtransactions",
153 "getprivatebroadcastinfo",
154 "getrawaddrman",
155 "getrawmempool",
156 "getrawtransaction",
157 "getrpcinfo",
158 "gettxout",
159 "gettxoutsetinfo",
160 "gettxspendingprevout",
161 "help",
162 "invalidateblock",
163 "joinpsbts",
164 "listbanned",
165 "logging",
166 "mockscheduler",
167 "ping",
168 "preciousblock",
169 "prioritisetransaction",
170 "pruneblockchain",
171 "reconsiderblock",
172 "scanblocks",
173 "scantxoutset",
174 "sendmsgtopeer", // when no peers are connected, no p2p message is sent
175 "sendrawtransaction",
176 "setmocktime",
177 "setnetworkactive",
178 "signmessagewithprivkey",
179 "signrawtransactionwithkey",
180 "submitblock",
181 "submitheader",
182 "submitpackage",
183 "syncwithvalidationinterfacequeue",
184 "testmempoolaccept",
185 "uptime",
186 "utxoupdatepsbt",
187 "validateaddress",
188 "verifychain",
189 "verifymessage",
190 "verifytxoutproof",
191 "waitforblock",
192 "waitforblockheight",
193 "waitfornewblock",
194 };
195
196 std::string ConsumeScalarRPCArgument(FuzzedDataProvider& fuzzed_data_provider, bool& good_data)
197 {
198 const size_t max_string_length = 4096;
199 const size_t max_base58_bytes_length{64};
200 std::string r;
201 CallOneOf(
202 fuzzed_data_provider,
203 [&] {
204 // string argument
205 r = fuzzed_data_provider.ConsumeRandomLengthString(max_string_length);
206 },
207 [&] {
208 // base64 argument
209 r = EncodeBase64(fuzzed_data_provider.ConsumeRandomLengthString(max_string_length));
210 },
211 [&] {
212 // hex argument
213 r = HexStr(fuzzed_data_provider.ConsumeRandomLengthString(max_string_length));
214 },
215 [&] {
216 // bool argument
217 r = fuzzed_data_provider.ConsumeBool() ? "true" : "false";
218 },
219 [&] {
220 // range argument
221 r = "[" + ToString(fuzzed_data_provider.ConsumeIntegral<int64_t>()) + "," + ToString(fuzzed_data_provider.ConsumeIntegral<int64_t>()) + "]";
222 },
223 [&] {
224 // integral argument (int64_t)
225 r = ToString(fuzzed_data_provider.ConsumeIntegral<int64_t>());
226 },
227 [&] {
228 // integral argument (uint64_t)
229 r = ToString(fuzzed_data_provider.ConsumeIntegral<uint64_t>());
230 },
231 [&] {
232 // floating point argument
233 r = strprintf("%f", fuzzed_data_provider.ConsumeFloatingPoint<double>());
234 },
235 [&] {
236 // tx destination argument
237 r = EncodeDestination(ConsumeTxDestination(fuzzed_data_provider));
238 },
239 [&] {
240 // uint160 argument
241 r = ConsumeUInt160(fuzzed_data_provider).ToString();
242 },
243 [&] {
244 // uint256 argument
245 r = ConsumeUInt256(fuzzed_data_provider).ToString();
246 },
247 [&] {
248 // base32 argument
249 r = EncodeBase32(fuzzed_data_provider.ConsumeRandomLengthString(max_string_length));
250 },
251 [&] {
252 // base58 argument
253 r = EncodeBase58(MakeUCharSpan(fuzzed_data_provider.ConsumeRandomLengthString(max_base58_bytes_length)));
254 },
255 [&] {
256 // base58 argument with checksum
257 r = EncodeBase58Check(MakeUCharSpan(fuzzed_data_provider.ConsumeRandomLengthString(max_base58_bytes_length)));
258 },
259 [&] {
260 // hex encoded block
261 std::optional<CBlock> opt_block = ConsumeDeserializable<CBlock>(fuzzed_data_provider, TX_WITH_WITNESS);
262 if (!opt_block) {
263 good_data = false;
264 return;
265 }
266 DataStream data_stream{};
267 data_stream << TX_WITH_WITNESS(*opt_block);
268 r = HexStr(data_stream);
269 },
270 [&] {
271 // hex encoded block header
272 std::optional<CBlockHeader> opt_block_header = ConsumeDeserializable<CBlockHeader>(fuzzed_data_provider);
273 if (!opt_block_header) {
274 good_data = false;
275 return;
276 }
277 DataStream data_stream{};
278 data_stream << *opt_block_header;
279 r = HexStr(data_stream);
280 },
281 [&] {
282 // hex encoded tx
283 std::optional<CMutableTransaction> opt_tx = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider, TX_WITH_WITNESS);
284 if (!opt_tx) {
285 good_data = false;
286 return;
287 }
288 DataStream data_stream;
289 auto allow_witness = (fuzzed_data_provider.ConsumeBool() ? TX_WITH_WITNESS : TX_NO_WITNESS);
290 data_stream << allow_witness(*opt_tx);
291 r = HexStr(data_stream);
292 },
293 [&] {
294 // base64 encoded psbt
295 std::optional<PartiallySignedTransaction> opt_psbt = ConsumeDeserializableConstructor<PartiallySignedTransaction>(fuzzed_data_provider);
296 if (!opt_psbt) {
297 good_data = false;
298 return;
299 }
300 DataStream data_stream{};
301 data_stream << *opt_psbt;
302 r = EncodeBase64(data_stream);
303 },
304 [&] {
305 // base58 encoded key
306 CKey key = ConsumePrivateKey(fuzzed_data_provider);
307 if (!key.IsValid()) {
308 good_data = false;
309 return;
310 }
311 r = EncodeSecret(key);
312 },
313 [&] {
314 // hex encoded pubkey
315 CKey key = ConsumePrivateKey(fuzzed_data_provider);
316 if (!key.IsValid()) {
317 good_data = false;
318 return;
319 }
320 r = HexStr(key.GetPubKey());
321 });
322 return r;
323 }
324
325 std::string ConsumeArrayRPCArgument(FuzzedDataProvider& fuzzed_data_provider, bool& good_data)
326 {
327 std::vector<std::string> scalar_arguments;
328 LIMITED_WHILE(good_data && fuzzed_data_provider.ConsumeBool(), 100)
329 {
330 scalar_arguments.push_back(ConsumeScalarRPCArgument(fuzzed_data_provider, good_data));
331 }
332 return "[\"" + Join(scalar_arguments, "\",\"") + "\"]";
333 }
334
335 std::string ConsumeRPCArgument(FuzzedDataProvider& fuzzed_data_provider, bool& good_data)
336 {
337 return fuzzed_data_provider.ConsumeBool() ? ConsumeScalarRPCArgument(fuzzed_data_provider, good_data) : ConsumeArrayRPCArgument(fuzzed_data_provider, good_data);
338 }
339
340 RPCFuzzTestingSetup* InitializeRPCFuzzTestingSetup()
341 {
342 static const auto setup = MakeNoLogFileContext<RPCFuzzTestingSetup>();
343 SetRPCWarmupFinished();
344 return setup.get();
345 }
346 }; // namespace
347
348 void initialize_rpc()
349 {
350 rpc_testing_setup = InitializeRPCFuzzTestingSetup();
351 const std::vector<std::string> supported_rpc_commands = rpc_testing_setup->GetRPCCommands();
352 for (const std::string& rpc_command : supported_rpc_commands) {
353 const bool safe_for_fuzzing = std::find(RPC_COMMANDS_SAFE_FOR_FUZZING.begin(), RPC_COMMANDS_SAFE_FOR_FUZZING.end(), rpc_command) != RPC_COMMANDS_SAFE_FOR_FUZZING.end();
354 const bool not_safe_for_fuzzing = std::find(RPC_COMMANDS_NOT_SAFE_FOR_FUZZING.begin(), RPC_COMMANDS_NOT_SAFE_FOR_FUZZING.end(), rpc_command) != RPC_COMMANDS_NOT_SAFE_FOR_FUZZING.end();
355 if (!(safe_for_fuzzing || not_safe_for_fuzzing)) {
356 std::cerr << "Error: RPC command \"" << rpc_command << "\" not found in RPC_COMMANDS_SAFE_FOR_FUZZING or RPC_COMMANDS_NOT_SAFE_FOR_FUZZING. Please update " << __FILE__ << ".\n";
357 std::terminate();
358 }
359 if (safe_for_fuzzing && not_safe_for_fuzzing) {
360 std::cerr << "Error: RPC command \"" << rpc_command << "\" found in *both* RPC_COMMANDS_SAFE_FOR_FUZZING and RPC_COMMANDS_NOT_SAFE_FOR_FUZZING. Please update " << __FILE__ << ".\n";
361 std::terminate();
362 }
363 }
364 const char* limit_to_rpc_command_env = std::getenv("LIMIT_TO_RPC_COMMAND");
365 if (limit_to_rpc_command_env != nullptr) {
366 g_limit_to_rpc_command = std::string{limit_to_rpc_command_env};
367 }
368 }
369
370 FUZZ_TARGET(rpc, .init = initialize_rpc)
371 {
372 SeedRandomStateForTest(SeedRand::ZEROS);
373 FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
374 bool good_data{true};
375 FakeNodeClock clock{ConsumeTime(fuzzed_data_provider)};
376 const std::string rpc_command = fuzzed_data_provider.ConsumeRandomLengthString(64);
377 if (!g_limit_to_rpc_command.empty() && rpc_command != g_limit_to_rpc_command) {
378 return;
379 }
380 const bool safe_for_fuzzing = std::find(RPC_COMMANDS_SAFE_FOR_FUZZING.begin(), RPC_COMMANDS_SAFE_FOR_FUZZING.end(), rpc_command) != RPC_COMMANDS_SAFE_FOR_FUZZING.end();
381 if (!safe_for_fuzzing) {
382 return;
383 }
384 std::vector<std::string> arguments;
385 LIMITED_WHILE(good_data && fuzzed_data_provider.ConsumeBool(), 100)
386 {
387 arguments.push_back(ConsumeRPCArgument(fuzzed_data_provider, good_data));
388 }
389 try {
390 std::optional<test_only_CheckFailuresAreExceptionsNotAborts> maybe_mock{};
391 if (rpc_command == "echo") {
392 // Avoid aborting fuzzing for this specific test-only RPC with an
393 // intentional trigger_internal_bug
394 maybe_mock.emplace();
395 }
396 rpc_testing_setup->CallRPC(rpc_command, arguments);
397 } catch (const UniValue& json_rpc_error) {
398 const std::string error_msg{json_rpc_error.find_value("message").get_str()};
399 if (error_msg.starts_with("Internal bug detected")) {
400 // Only allow the intentional internal bug
401 assert(error_msg.find("trigger_internal_bug") != std::string::npos);
402 }
403 }
404 }
405