-
Notifications
You must be signed in to change notification settings - Fork 418
Make full_stack_target
more stable in the face of LDK changes
#4006
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Make full_stack_target
more stable in the face of LDK changes
#4006
Conversation
👋 I see @joostjager was un-assigned. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4006 +/- ##
=======================================
Coverage 88.85% 88.85%
=======================================
Files 175 175
Lines 127710 127710
Branches 127710 127710
=======================================
+ Hits 113475 113478 +3
+ Misses 11672 11667 -5
- Partials 2563 2565 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice quality-of-life improvement 👌
I get a fuzz test failure after rebasing on main, I believe due to a silent rebase conflict with #3999. |
The `full_stack` fuzzer tries to just expose much of the entire library to the fuzzer, and as such when a request comes in from LDK to estimate the current fee it tries to read two bytes of fuzzing input and returns that as the fee to LDK. However, because LDK regularly changes when it requests a fee estimate from the user this causes the fuzz input required to reach a codepath to change regularly, making any existing fuzz corpus stale. Instead, here, we allow the fuzz input to load a fee estimate result into a buffer, and if its empty simply return 253. This allows the fuzzer to still reach fee-estimate-triggered overflows, but only invalidates fuzzing seeds that relied on fee estimate inputs rather than all seeds whenever LDK changes fee estimate calls.
The `full_stack` fuzzer ensures that RNG output is unique by keeping a counter of the number of `get_secure_random_bytes` calls and using it to determine the "random" value to return. However, because LDK regularly changes when it requests RNG output this causes the fuzz input required to reach a codepath to change regularly, making any existing fuzz corpus stale. Instead, here, we allow the fuzz input to set a new RNG output value, but otherwise always return the same output. This allows the fuzzer to still reach RNG-output-specifc paths, but fuzzing seeds aren't invalidated when LDK changes.
The previous two changes should materially reduce how finicky the `full_stack_target` tests are, which we reflect in the comments here.
cc86e37
to
ee06a90
Compare
Indeed. Rebased. |
We regularly make changes to LDK which results in changes to the
full_stack_target
input to reach a given codepath, invalidating existing fuzzing corpuses and breaking thetest_no_existing_test_breakage
test (which is somewhat annoying to fix). Instead of reading every time we get a fee estimate request or counting for RNG, use static values to ensure they're robust against changes in LDK that request more/less fee estimates or more/less RNG output.