Inside Bitcoin

1// Copyright (c) 2023-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <consensus/validation.h>
6#include <node/context.h>
7#include <node/mempool_args.h>
8#include <node/miner.h>
9#include <node/txdownloadman.h>
10#include <node/txdownloadman_impl.h>
11#include <test/fuzz/FuzzedDataProvider.h>
12#include <test/fuzz/fuzz.h>
13#include <test/fuzz/util.h>
14#include <test/fuzz/util/mempool.h>
15#include <test/util/mining.h>
16#include <test/util/script.h>
17#include <test/util/setup_common.h>
18#include <test/util/time.h>
19#include <test/util/txmempool.h>
20#include <txmempool.h>
21#include <util/hasher.h>
22#include <util/rbf.h>
23#include <util/time.h>
24#include <validation.h>
25#include <validationinterface.h>
26
27namespace {
28
29const TestingSetup* g_setup;
30
31constexpr size_t NUM_COINS{50};
32COutPoint COINS[NUM_COINS];
33
34static TxValidationResult TESTED_TX_RESULTS[] = {
35    // Skip TX_RESULT_UNSET
36    TxValidationResult::TX_CONSENSUS,
37    TxValidationResult::TX_INPUTS_NOT_STANDARD,
38    TxValidationResult::TX_NOT_STANDARD,
39    TxValidationResult::TX_MISSING_INPUTS,
40    TxValidationResult::TX_PREMATURE_SPEND,
41    TxValidationResult::TX_WITNESS_MUTATED,
42    TxValidationResult::TX_WITNESS_STRIPPED,
43    TxValidationResult::TX_CONFLICT,
44    TxValidationResult::TX_MEMPOOL_POLICY,
45    // Skip TX_NO_MEMPOOL
46    TxValidationResult::TX_RECONSIDERABLE,
47    TxValidationResult::TX_UNKNOWN,
48};
49
50// Precomputed transactions. Some may conflict with each other.
51std::vector<CTransactionRef> TRANSACTIONS;
52
53// Limit the total number of peers because we don't expect coverage to change much with lots more peers.
54constexpr int NUM_PEERS = 16;
55
56// Precomputed random durations (positive and negative, each ~exponentially distributed).
57std::chrono::microseconds TIME_SKIPS[128];
58
59static CTransactionRef MakeTransactionSpending(const std::vector<COutPoint>& outpoints, size_t num_outputs, bool add_witness)
60{
61    CMutableTransaction tx;
62    // If no outpoints are given, create a random one.
63    for (const auto& outpoint : outpoints) {
64        tx.vin.emplace_back(outpoint);
65    }
66    if (add_witness) {
67        tx.vin[0].scriptWitness.stack.push_back({1});
68    }
69    for (size_t o = 0; o < num_outputs; ++o) tx.vout.emplace_back(CENT, P2WSH_OP_TRUE);
70    return MakeTransactionRef(tx);
71}
72static std::vector<COutPoint> PickCoins(FuzzedDataProvider& fuzzed_data_provider)
73{
74    std::vector<COutPoint> ret;
75    ret.push_back(fuzzed_data_provider.PickValueInArray(COINS));
76    LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 10) {
77        ret.push_back(fuzzed_data_provider.PickValueInArray(COINS));
78    }
79    return ret;
80}
81
82void initialize()
83{
84    static const auto testing_setup = MakeNoLogFileContext<const TestingSetup>();
85    g_setup = testing_setup.get();
86    for (uint32_t i = 0; i < uint32_t{NUM_COINS}; ++i) {
87        COINS[i] = COutPoint{Txid::FromUint256((HashWriter() << i).GetHash()), i};
88    }
89    size_t outpoints_index = 0;
90    // 2 transactions same txid different witness
91    {
92        auto tx1{MakeTransactionSpending({COINS[outpoints_index]}, /*num_outputs=*/5, /*add_witness=*/false)};
93        auto tx2{MakeTransactionSpending({COINS[outpoints_index]}, /*num_outputs=*/5, /*add_witness=*/true)};
94        Assert(tx1->GetHash() == tx2->GetHash());
95        TRANSACTIONS.emplace_back(tx1);
96        TRANSACTIONS.emplace_back(tx2);
97        outpoints_index += 1;
98    }
99    // 2 parents 1 child
100    {
101        auto tx_parent_1{MakeTransactionSpending({COINS[outpoints_index++]}, /*num_outputs=*/1, /*add_witness=*/true)};
102        TRANSACTIONS.emplace_back(tx_parent_1);
103        auto tx_parent_2{MakeTransactionSpending({COINS[outpoints_index++]}, /*num_outputs=*/1, /*add_witness=*/false)};
104        TRANSACTIONS.emplace_back(tx_parent_2);
105        TRANSACTIONS.emplace_back(MakeTransactionSpending({COutPoint{tx_parent_1->GetHash(), 0}, COutPoint{tx_parent_2->GetHash(), 0}},
106                                                            /*num_outputs=*/1, /*add_witness=*/true));
107    }
108    // 1 parent 2 children
109    {
110        auto tx_parent{MakeTransactionSpending({COINS[outpoints_index++]}, /*num_outputs=*/2, /*add_witness=*/true)};
111        TRANSACTIONS.emplace_back(tx_parent);
112        TRANSACTIONS.emplace_back(MakeTransactionSpending({COutPoint{tx_parent->GetHash(), 0}},
113                                                            /*num_outputs=*/1, /*add_witness=*/true));
114        TRANSACTIONS.emplace_back(MakeTransactionSpending({COutPoint{tx_parent->GetHash(), 1}},
115                                                            /*num_outputs=*/1, /*add_witness=*/true));
116    }
117    // chain of 5 segwit
118    {
119        COutPoint& last_outpoint = COINS[outpoints_index++];
120        for (auto i{0}; i < 5; ++i) {
121            auto tx{MakeTransactionSpending({last_outpoint}, /*num_outputs=*/1, /*add_witness=*/true)};
122            TRANSACTIONS.emplace_back(tx);
123            last_outpoint = COutPoint{tx->GetHash(), 0};
124        }
125    }
126    // chain of 5 non-segwit
127    {
128        COutPoint& last_outpoint = COINS[outpoints_index++];
129        for (auto i{0}; i < 5; ++i) {
130            auto tx{MakeTransactionSpending({last_outpoint}, /*num_outputs=*/1, /*add_witness=*/false)};
131            TRANSACTIONS.emplace_back(tx);
132            last_outpoint = COutPoint{tx->GetHash(), 0};
133        }
134    }
135    // Also create a loose tx for each outpoint. Some of these transactions conflict with the above
136    // or have the same txid.
137    for (const auto& outpoint : COINS) {
138        TRANSACTIONS.emplace_back(MakeTransactionSpending({outpoint}, /*num_outputs=*/1, /*add_witness=*/true));
139    }
140
141    // Create random-looking time jumps
142    int i = 0;
143    // TIME_SKIPS[N] for N=0..15 is just N microseconds.
144    for (; i < 16; ++i) {
145        TIME_SKIPS[i] = std::chrono::microseconds{i};
146    }
147    // TIME_SKIPS[N] for N=16..127 has randomly-looking but roughly exponentially increasing values up to
148    // 198.416453 seconds.
149    for (; i < 128; ++i) {
150        int diff_bits = ((i - 10) * 2) / 9;
151        uint64_t diff = 1 + (CSipHasher(0, 0).Write(i).Finalize() >> (64 - diff_bits));
152        TIME_SKIPS[i] = TIME_SKIPS[i - 1] + std::chrono::microseconds{diff};
153    }
154}
155
156void CheckPackageToValidate(const node::PackageToValidate& package_to_validate, NodeId peer)
157{
158    Assert(package_to_validate.m_senders.size() == 2);
159    Assert(package_to_validate.m_senders.front() == peer);
160    Assert(package_to_validate.m_senders.back() < NUM_PEERS);
161
162    // Package is a 1p1c
163    const auto& package = package_to_validate.m_txns;
164    Assert(IsChildWithParents(package));
165    Assert(package.size() == 2);
166}
167
168FUZZ_TARGET(txdownloadman, .init = initialize)
169{
170    SeedRandomStateForTest(SeedRand::ZEROS);
171    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
172    FakeNodeClock clock{ConsumeTime(fuzzed_data_provider)};
173
174    // Initialize txdownloadman
175    bilingual_str error;
176    CTxMemPool pool{MemPoolOptionsForTest(g_setup->m_node), error};
177    node::TxDownloadManager txdownloadman{node::TxDownloadOptions{.m_mempool = pool, .m_deterministic_txrequest = true}};
178
179    std::chrono::microseconds time{244466666};
180
181    LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 500) {
182        NodeId rand_peer = fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, NUM_PEERS - 1);
183
184        // Transaction can be one of the premade ones or a randomly generated one
185        auto rand_tx = fuzzed_data_provider.ConsumeBool() ?
186            MakeTransactionSpending(PickCoins(fuzzed_data_provider),
187                                    /*num_outputs=*/fuzzed_data_provider.ConsumeIntegralInRange(1, 500),
188                                    /*add_witness=*/fuzzed_data_provider.ConsumeBool()) :
189            TRANSACTIONS.at(fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, TRANSACTIONS.size() - 1));
190
191        CallOneOf(
192            fuzzed_data_provider,
193            [&] {
194                node::TxDownloadConnectionInfo info{
195                    .m_preferred = fuzzed_data_provider.ConsumeBool(),
196                    .m_relay_permissions = fuzzed_data_provider.ConsumeBool(),
197                    .m_wtxid_relay = fuzzed_data_provider.ConsumeBool()
198                };
199                txdownloadman.ConnectedPeer(rand_peer, info);
200            },
201            [&] {
202                txdownloadman.DisconnectedPeer(rand_peer);
203                txdownloadman.CheckIsEmpty(rand_peer);
204            },
205            [&] {
206                txdownloadman.ActiveTipChange();
207            },
208            [&] {
209                CBlock block;
210                block.vtx.push_back(rand_tx);
211                txdownloadman.BlockConnected(std::make_shared<CBlock>(block));
212            },
213            [&] {
214                txdownloadman.BlockDisconnected();
215            },
216            [&] {
217                txdownloadman.MempoolAcceptedTx(rand_tx);
218            },
219            [&] {
220                TxValidationState state;
221                state.Invalid(fuzzed_data_provider.PickValueInArray(TESTED_TX_RESULTS), "");
222                bool first_time_failure{fuzzed_data_provider.ConsumeBool()};
223
224                node::RejectedTxTodo todo = txdownloadman.MempoolRejectedTx(rand_tx, state, rand_peer, first_time_failure);
225                Assert(first_time_failure || !todo.m_should_add_extra_compact_tx);
226            },
227            [&] {
228                auto gtxid = fuzzed_data_provider.ConsumeBool() ?
229                             GenTxid{rand_tx->GetHash()} :
230                             GenTxid{rand_tx->GetWitnessHash()};
231                txdownloadman.AddTxAnnouncement(rand_peer, gtxid, time);
232            },
233            [&] {
234                txdownloadman.GetRequestsToSend(rand_peer, time);
235            },
236            [&] {
237                txdownloadman.ReceivedTx(rand_peer, rand_tx);
238                const auto& [should_validate, maybe_package] = txdownloadman.ReceivedTx(rand_peer, rand_tx);
239                // The only possible results should be:
240                // - Don't validate the tx, no package.
241                // - Don't validate the tx, package.
242                // - Validate the tx, no package.
243                // The only combination that doesn't make sense is validate both tx and package.
244                Assert(!(should_validate && maybe_package.has_value()));
245                if (maybe_package.has_value()) CheckPackageToValidate(*maybe_package, rand_peer);
246            },
247            [&] {
248                txdownloadman.ReceivedNotFound(rand_peer, {rand_tx->GetWitnessHash()});
249            },
250            [&] {