From f1d74439e007b28d00b3c98c7922c02f8c8e8cd0 Mon Sep 17 00:00:00 2001 From: glozow Date: Fri, 3 Nov 2023 13:48:24 +0000 Subject: [PATCH 1/2] Merge bitcoin/bitcoin#28764: Fuzz: Check individual and package transaction invariants fcb3069fa307942cf7f3edabcda1be96d615c91f Use CheckPackageMempoolAcceptResult for package evaluation fuzzing (Greg Sanders) 34088d6c9ed4ed99bb6b7fc83795da01ec9f3c97 [test util] CheckPackageMempoolAcceptResult for sanity-checking results (glozow) 651fa404e454e31f8e9d830aa292eb3b456b54fb fuzz: tx_pool checks ATMP result invariants (Greg Sanders) Pull request description: Poached from https://github.com/bitcoin/bitcoin/pull/26711 since that PR is being split apart, and modified to match current behavior. ACKs for top commit: glozow: reACK fcb3069fa307942cf7f3edabcda1be96d615c91f, only whitespace changes dergoegge: ACK fcb3069fa307942cf7f3edabcda1be96d615c91f Tree-SHA512: abd687e526d8dfc8d65b3a873ece8ca35fdcbd6b0f7b93da6a723ef4e47cf85612de819e6f2b8631bdf897e1aba27cdd86f89b7bd85fc3356e74be275dcdf8cc --- src/test/fuzz/package_eval.cpp | 291 +++++++++++++++++++++++++++++++++ src/test/fuzz/tx_pool.cpp | 67 +++++++- src/test/util/txmempool.cpp | 116 +++++++++++++ src/test/util/txmempool.h | 49 ++++++ 4 files changed, 521 insertions(+), 2 deletions(-) create mode 100644 src/test/fuzz/package_eval.cpp create mode 100644 src/test/util/txmempool.cpp create mode 100644 src/test/util/txmempool.h diff --git a/src/test/fuzz/package_eval.cpp b/src/test/fuzz/package_eval.cpp new file mode 100644 index 000000000000..8d316134cc7a --- /dev/null +++ b/src/test/fuzz/package_eval.cpp @@ -0,0 +1,291 @@ +// Copyright (c) 2023 The Bitcoin Core developers +// Distributed under the MIT software license, see the accompanying +// file COPYING or http://www.opensource.org/licenses/mit-license.php. + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +using node::NodeContext; + +namespace { + +const TestingSetup* g_setup; +std::vector g_outpoints_coinbase_init_mature; + +struct MockedTxPool : public CTxMemPool { + void RollingFeeUpdate() EXCLUSIVE_LOCKS_REQUIRED(!cs) + { + LOCK(cs); + lastRollingFeeUpdate = GetTime(); + blockSinceLastRollingFeeBump = true; + } +}; + +void initialize_tx_pool() +{ + static const auto testing_setup = MakeNoLogFileContext(); + g_setup = testing_setup.get(); + + for (int i = 0; i < 2 * COINBASE_MATURITY; ++i) { + COutPoint prevout{MineBlock(g_setup->m_node, P2WSH_OP_TRUE)}; + if (i < COINBASE_MATURITY) { + // Remember the txids to avoid expensive disk access later on + g_outpoints_coinbase_init_mature.push_back(prevout); + } + } + SyncWithValidationInterfaceQueue(); +} + +struct OutpointsUpdater final : public CValidationInterface { + std::set& m_mempool_outpoints; + + explicit OutpointsUpdater(std::set& r) + : m_mempool_outpoints{r} {} + + void TransactionAddedToMempool(const CTransactionRef& tx, uint64_t /* mempool_sequence */) override + { + // for coins spent we always want to be able to rbf so they're not removed + + // outputs from this tx can now be spent + for (uint32_t index{0}; index < tx->vout.size(); ++index) { + m_mempool_outpoints.insert(COutPoint{tx->GetHash(), index}); + } + } + + void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override + { + // outpoints spent by this tx are now available + for (const auto& input : tx->vin) { + // Could already exist if this was a replacement + m_mempool_outpoints.insert(input.prevout); + } + // outpoints created by this tx no longer exist + for (uint32_t index{0}; index < tx->vout.size(); ++index) { + m_mempool_outpoints.erase(COutPoint{tx->GetHash(), index}); + } + } +}; + +struct TransactionsDelta final : public CValidationInterface { + std::set& m_added; + + explicit TransactionsDelta(std::set& a) + : m_added{a} {} + + void TransactionAddedToMempool(const CTransactionRef& tx, uint64_t /* mempool_sequence */) override + { + // Transactions may be entered and booted any number of times + m_added.insert(tx); + } + + void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override + { + // Transactions may be entered and booted any number of times + m_added.erase(tx); + } +}; + +void MockTime(FuzzedDataProvider& fuzzed_data_provider, const Chainstate& chainstate) +{ + const auto time = ConsumeTime(fuzzed_data_provider, + chainstate.m_chain.Tip()->GetMedianTimePast() + 1, + std::numeric_limitsnTime)>::max()); + SetMockTime(time); +} + +CTxMemPool MakeMempool(FuzzedDataProvider& fuzzed_data_provider, const NodeContext& node) +{ + // Take the default options for tests... + CTxMemPool::Options mempool_opts{MemPoolOptionsForTest(node)}; + + + // ...override specific options for this specific fuzz suite + mempool_opts.limits.ancestor_count = fuzzed_data_provider.ConsumeIntegralInRange(0, 50); + mempool_opts.limits.ancestor_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange(0, 202) * 1'000; + mempool_opts.limits.descendant_count = fuzzed_data_provider.ConsumeIntegralInRange(0, 50); + mempool_opts.limits.descendant_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange(0, 202) * 1'000; + mempool_opts.max_size_bytes = fuzzed_data_provider.ConsumeIntegralInRange(0, 200) * 1'000'000; + mempool_opts.expiry = std::chrono::hours{fuzzed_data_provider.ConsumeIntegralInRange(0, 999)}; + nBytesPerSigOp = fuzzed_data_provider.ConsumeIntegralInRange(1, 999); + + mempool_opts.estimator = nullptr; + mempool_opts.check_ratio = 1; + mempool_opts.require_standard = fuzzed_data_provider.ConsumeBool(); + + // ...and construct a CTxMemPool from it + return CTxMemPool{mempool_opts}; +} + +FUZZ_TARGET(tx_package_eval, .init = initialize_tx_pool) +{ + FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); + const auto& node = g_setup->m_node; + auto& chainstate{static_cast(node.chainman->ActiveChainstate())}; + + MockTime(fuzzed_data_provider, chainstate); + + // All RBF-spendable outpoints outside of the unsubmitted package + std::set mempool_outpoints; + std::map outpoints_value; + for (const auto& outpoint : g_outpoints_coinbase_init_mature) { + Assert(mempool_outpoints.insert(outpoint).second); + outpoints_value[outpoint] = 50 * COIN; + } + + auto outpoints_updater = std::make_shared(mempool_outpoints); + RegisterSharedValidationInterface(outpoints_updater); + + CTxMemPool tx_pool_{MakeMempool(fuzzed_data_provider, node)}; + MockedTxPool& tx_pool = *static_cast(&tx_pool_); + + chainstate.SetMempool(&tx_pool); + + LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 300) + { + Assert(!mempool_outpoints.empty()); + + std::vector txs; + + // Make packages of 1-to-26 transactions + const auto num_txs = (size_t) fuzzed_data_provider.ConsumeIntegralInRange(1, 26); + std::set package_outpoints; + while (txs.size() < num_txs) { + + // Last transaction in a package needs to be a child of parents to get further in validation + // so the last transaction to be generated(in a >1 package) must spend all package-made outputs + // Note that this test currently only spends package outputs in last transaction. + bool last_tx = num_txs > 1 && txs.size() == num_txs - 1; + + // Create transaction to add to the mempool + const CTransactionRef tx = [&] { + CMutableTransaction tx_mut; + tx_mut.nVersion = CTransaction::CURRENT_VERSION; + tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral(); + // Last tx will sweep all outpoints in package + const auto num_in = last_tx ? package_outpoints.size() : fuzzed_data_provider.ConsumeIntegralInRange(1, mempool_outpoints.size()); + const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange(1, mempool_outpoints.size() * 2); + + auto& outpoints = last_tx ? package_outpoints : mempool_outpoints; + + Assert(!outpoints.empty()); + + CAmount amount_in{0}; + for (size_t i = 0; i < num_in; ++i) { + // Pop random outpoint + auto pop = outpoints.begin(); + std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange(0, outpoints.size() - 1)); + const auto outpoint = *pop; + outpoints.erase(pop); + // no need to update or erase from outpoints_value + amount_in += outpoints_value.at(outpoint); + + // Create input + const auto sequence = ConsumeSequence(fuzzed_data_provider); + const auto script_sig = CScript{}; + const auto script_wit_stack = std::vector>{WITNESS_STACK_ELEM_OP_TRUE}; + CTxIn in; + in.prevout = outpoint; + in.nSequence = sequence; + in.scriptSig = script_sig; + in.scriptWitness.stack = script_wit_stack; + + tx_mut.vin.push_back(in); + } + const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange(0, amount_in); + const auto amount_out = (amount_in - amount_fee) / num_out; + for (int i = 0; i < num_out; ++i) { + tx_mut.vout.emplace_back(amount_out, P2WSH_OP_TRUE); + } + // TODO vary transaction sizes to catch size-related issues + auto tx = MakeTransactionRef(tx_mut); + // Restore previously removed outpoints, except in-package outpoints + if (!last_tx) { + for (const auto& in : tx->vin) { + Assert(outpoints.insert(in.prevout).second); + } + // Cache the in-package outpoints being made + for (size_t i = 0; i < tx->vout.size(); ++i) { + package_outpoints.emplace(tx->GetHash(), i); + } + } + // We need newly-created values for the duration of this run + for (size_t i = 0; i < tx->vout.size(); ++i) { + outpoints_value[COutPoint(tx->GetHash(), i)] = tx->vout[i].nValue; + } + return tx; + }(); + txs.push_back(tx); + } + + if (fuzzed_data_provider.ConsumeBool()) { + MockTime(fuzzed_data_provider, chainstate); + } + if (fuzzed_data_provider.ConsumeBool()) { + tx_pool.RollingFeeUpdate(); + } + if (fuzzed_data_provider.ConsumeBool()) { + const auto& txid = fuzzed_data_provider.ConsumeBool() ? + txs.back()->GetHash().ToUint256() : + PickValue(fuzzed_data_provider, mempool_outpoints).hash; + const auto delta = fuzzed_data_provider.ConsumeIntegralInRange(-50 * COIN, +50 * COIN); + tx_pool.PrioritiseTransaction(txid, delta); + } + + // Remember all added transactions + std::set added; + auto txr = std::make_shared(added); + RegisterSharedValidationInterface(txr); + const bool bypass_limits = fuzzed_data_provider.ConsumeBool(); + + // When there are multiple transactions in the package, we call ProcessNewPackage(txs, test_accept=false) + // and AcceptToMemoryPool(txs.back(), test_accept=true). When there is only 1 transaction, we might flip it + // (the package is a test accept and ATMP is a submission). + auto single_submit = txs.size() == 1 && fuzzed_data_provider.ConsumeBool(); + + const auto result_package = WITH_LOCK(::cs_main, + return ProcessNewPackage(chainstate, tx_pool, txs, /*test_accept=*/single_submit)); + + const auto res = WITH_LOCK(::cs_main, return AcceptToMemoryPool(chainstate, txs.back(), GetTime(), bypass_limits, /*test_accept=*/!single_submit)); + const bool accepted = res.m_result_type == MempoolAcceptResult::ResultType::VALID; + + SyncWithValidationInterfaceQueue(); + UnregisterSharedValidationInterface(txr); + + // There is only 1 transaction in the package. We did a test-package-accept and a ATMP + if (single_submit) { + Assert(accepted != added.empty()); + Assert(accepted == res.m_state.IsValid()); + if (accepted) { + Assert(added.size() == 1); + Assert(txs.back() == *added.begin()); + } + } else if (result_package.m_state.GetResult() != PackageValidationResult::PCKG_POLICY) { + // We don't know anything about the validity since transactions were randomly generated, so + // just use result_package.m_state here. This makes the expect_valid check meaningless, but + // we can still verify that the contents of m_tx_results are consistent with m_state. + const bool expect_valid{result_package.m_state.IsValid()}; + Assert(!CheckPackageMempoolAcceptResult(txs, result_package, expect_valid, nullptr)); + } else { + // This is empty if it fails early checks, or "full" if transactions are looked at deeper + Assert(result_package.m_tx_results.size() == txs.size() || result_package.m_tx_results.empty()); + } + } + + UnregisterSharedValidationInterface(outpoints_updater); + + WITH_LOCK(::cs_main, tx_pool.check(chainstate.CoinsTip(), chainstate.m_chain.Height() + 1)); +} +} // namespace diff --git a/src/test/fuzz/tx_pool.cpp b/src/test/fuzz/tx_pool.cpp index c973fa9582c5..724cee98d7e5 100644 --- a/src/test/fuzz/tx_pool.cpp +++ b/src/test/fuzz/tx_pool.cpp @@ -122,6 +122,67 @@ void MockTime(FuzzedDataProvider& fuzzed_data_provider, const CChainState& chain SetMockTime(time); } +CTxMemPool MakeMempool(FuzzedDataProvider& fuzzed_data_provider, const NodeContext& node) +{ + // Take the default options for tests... + CTxMemPool::Options mempool_opts{MemPoolOptionsForTest(node)}; + + // ...override specific options for this specific fuzz suite + mempool_opts.estimator = nullptr; + mempool_opts.check_ratio = 1; + mempool_opts.require_standard = fuzzed_data_provider.ConsumeBool(); + + // ...and construct a CTxMemPool from it + return CTxMemPool{mempool_opts}; +} + +void CheckATMPInvariants(const MempoolAcceptResult& res, bool txid_in_mempool, bool wtxid_in_mempool) +{ + + switch (res.m_result_type) { + case MempoolAcceptResult::ResultType::VALID: + { + Assert(txid_in_mempool); + Assert(wtxid_in_mempool); + Assert(res.m_state.IsValid()); + Assert(!res.m_state.IsInvalid()); + Assert(res.m_replaced_transactions); + Assert(res.m_vsize); + Assert(res.m_base_fees); + Assert(res.m_effective_feerate); + Assert(res.m_wtxids_fee_calculations); + Assert(!res.m_other_wtxid); + break; + } + case MempoolAcceptResult::ResultType::INVALID: + { + // It may be already in the mempool since in ATMP cases we don't set MEMPOOL_ENTRY or DIFFERENT_WITNESS + Assert(!res.m_state.IsValid()); + Assert(res.m_state.IsInvalid()); + Assert(!res.m_replaced_transactions); + Assert(!res.m_vsize); + Assert(!res.m_base_fees); + // Unable or unwilling to calculate fees + Assert(!res.m_effective_feerate); + Assert(!res.m_wtxids_fee_calculations); + Assert(!res.m_other_wtxid); + break; + } + case MempoolAcceptResult::ResultType::MEMPOOL_ENTRY: + { + // ATMP never sets this; only set in package settings + Assert(false); + break; + } + case MempoolAcceptResult::ResultType::DIFFERENT_WITNESS: + { + // ATMP never sets this; only set in package settings + Assert(false); + break; + } + } +} + FUZZ_TARGET(tx_pool_standard, .init = initialize_tx_pool) { FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); @@ -247,9 +308,11 @@ FUZZ_TARGET(tx_pool_standard, .init = initialize_tx_pool) SyncWithValidationInterfaceQueue(); UnregisterSharedValidationInterface(txr); + bool txid_in_mempool = tx_pool.exists(GenTxid::Txid(tx->GetHash())); + bool wtxid_in_mempool = tx_pool.exists(GenTxid::Wtxid(tx->GetWitnessHash())); + CheckATMPInvariants(res, txid_in_mempool, wtxid_in_mempool); + Assert(accepted != added.empty()); - Assert(accepted == res.m_state.IsValid()); - Assert(accepted != res.m_state.IsInvalid()); if (accepted) { Assert(added.size() == 1); // For now, no package acceptance Assert(tx == *added.begin()); diff --git a/src/test/util/txmempool.cpp b/src/test/util/txmempool.cpp new file mode 100644 index 000000000000..c4fbc8dbb38e --- /dev/null +++ b/src/test/util/txmempool.cpp @@ -0,0 +1,116 @@ +// Copyright (c) 2022 The Bitcoin Core developers +// Distributed under the MIT software license, see the accompanying +// file COPYING or http://www.opensource.org/licenses/mit-license.php. + +#include + +#include +#include +#include +#include +#include +#include +#include +#include + +using node::NodeContext; + +CTxMemPool::Options MemPoolOptionsForTest(const NodeContext& node) +{ + CTxMemPool::Options mempool_opts{ + .estimator = node.fee_estimator.get(), + // Default to always checking mempool regardless of + // chainparams.DefaultConsistencyChecks for tests + .check_ratio = 1, + }; + const auto result{ApplyArgsManOptions(*node.args, ::Params(), mempool_opts)}; + Assert(result); + return mempool_opts; +} + +CTxMemPoolEntry TestMemPoolEntryHelper::FromTx(const CMutableTransaction& tx) const +{ + return FromTx(MakeTransactionRef(tx)); +} + +CTxMemPoolEntry TestMemPoolEntryHelper::FromTx(const CTransactionRef& tx) const +{ + return CTxMemPoolEntry{tx, nFee, TicksSinceEpoch(time), nHeight, m_sequence, spendsCoinbase, sigOpCost, lp}; +} + +std::optional CheckPackageMempoolAcceptResult(const Package& txns, + const PackageMempoolAcceptResult& result, + bool expect_valid, + const CTxMemPool* mempool) +{ + if (expect_valid) { + if (result.m_state.IsInvalid()) { + return strprintf("Package validation unexpectedly failed: %s", result.m_state.ToString()); + } + } else { + if (result.m_state.IsValid()) { + strprintf("Package validation unexpectedly succeeded. %s", result.m_state.ToString()); + } + } + if (result.m_state.GetResult() != PackageValidationResult::PCKG_POLICY && txns.size() != result.m_tx_results.size()) { + strprintf("txns size %u does not match tx results size %u", txns.size(), result.m_tx_results.size()); + } + for (const auto& tx : txns) { + const auto& wtxid = tx->GetWitnessHash(); + if (result.m_tx_results.count(wtxid) == 0) { + return strprintf("result not found for tx %s", wtxid.ToString()); + } + + const auto& atmp_result = result.m_tx_results.at(wtxid); + const bool valid{atmp_result.m_result_type == MempoolAcceptResult::ResultType::VALID}; + if (expect_valid && atmp_result.m_state.IsInvalid()) { + return strprintf("tx %s unexpectedly failed: %s", wtxid.ToString(), atmp_result.m_state.ToString()); + } + + //m_replaced_transactions should exist iff the result was VALID + if (atmp_result.m_replaced_transactions.has_value() != valid) { + return strprintf("tx %s result should %shave m_replaced_transactions", + wtxid.ToString(), valid ? "" : "not "); + } + + // m_vsize and m_base_fees should exist iff the result was VALID or MEMPOOL_ENTRY + const bool mempool_entry{atmp_result.m_result_type == MempoolAcceptResult::ResultType::MEMPOOL_ENTRY}; + if (atmp_result.m_base_fees.has_value() != (valid || mempool_entry)) { + return strprintf("tx %s result should %shave m_base_fees", wtxid.ToString(), valid || mempool_entry ? "" : "not "); + } + if (atmp_result.m_vsize.has_value() != (valid || mempool_entry)) { + return strprintf("tx %s result should %shave m_vsize", wtxid.ToString(), valid || mempool_entry ? "" : "not "); + } + + // m_other_wtxid should exist iff the result was DIFFERENT_WITNESS + const bool diff_witness{atmp_result.m_result_type == MempoolAcceptResult::ResultType::DIFFERENT_WITNESS}; + if (atmp_result.m_other_wtxid.has_value() != diff_witness) { + return strprintf("tx %s result should %shave m_other_wtxid", wtxid.ToString(), diff_witness ? "" : "not "); + } + + // m_effective_feerate and m_wtxids_fee_calculations should exist iff the result was valid + if (atmp_result.m_effective_feerate.has_value() != valid) { + return strprintf("tx %s result should %shave m_effective_feerate", + wtxid.ToString(), valid ? "" : "not "); + } + if (atmp_result.m_wtxids_fee_calculations.has_value() != valid) { + return strprintf("tx %s result should %shave m_effective_feerate", + wtxid.ToString(), valid ? "" : "not "); + } + + if (mempool) { + // The tx by txid should be in the mempool iff the result was not INVALID. + const bool txid_in_mempool{atmp_result.m_result_type != MempoolAcceptResult::ResultType::INVALID}; + if (mempool->exists(GenTxid::Txid(tx->GetHash())) != txid_in_mempool) { + strprintf("tx %s should %sbe in mempool", wtxid.ToString(), txid_in_mempool ? "" : "not "); + } + // Additionally, if the result was DIFFERENT_WITNESS, we shouldn't be able to find the tx in mempool by wtxid. + if (tx->HasWitness() && atmp_result.m_result_type == MempoolAcceptResult::ResultType::DIFFERENT_WITNESS) { + if (mempool->exists(GenTxid::Wtxid(wtxid))) { + strprintf("wtxid %s should not be in mempool", wtxid.ToString()); + } + } + } + } + return std::nullopt; +} diff --git a/src/test/util/txmempool.h b/src/test/util/txmempool.h new file mode 100644 index 000000000000..a866d1ce7415 --- /dev/null +++ b/src/test/util/txmempool.h @@ -0,0 +1,49 @@ +// Copyright (c) 2022 The Bitcoin Core developers +// Distributed under the MIT software license, see the accompanying +// file COPYING or http://www.opensource.org/licenses/mit-license.php. + +#ifndef BITCOIN_TEST_UTIL_TXMEMPOOL_H +#define BITCOIN_TEST_UTIL_TXMEMPOOL_H + +#include +#include +#include + +namespace node { +struct NodeContext; +} +struct PackageMempoolAcceptResult; + +CTxMemPool::Options MemPoolOptionsForTest(const node::NodeContext& node); + +struct TestMemPoolEntryHelper { + // Default values + CAmount nFee{0}; + NodeSeconds time{}; + unsigned int nHeight{1}; + uint64_t m_sequence{0}; + bool spendsCoinbase{false}; + unsigned int sigOpCost{4}; + LockPoints lp; + + CTxMemPoolEntry FromTx(const CMutableTransaction& tx) const; + CTxMemPoolEntry FromTx(const CTransactionRef& tx) const; + + // Change the default value + TestMemPoolEntryHelper& Fee(CAmount _fee) { nFee = _fee; return *this; } + TestMemPoolEntryHelper& Time(NodeSeconds tp) { time = tp; return *this; } + TestMemPoolEntryHelper& Height(unsigned int _height) { nHeight = _height; return *this; } + TestMemPoolEntryHelper& Sequence(uint64_t _seq) { m_sequence = _seq; return *this; } + TestMemPoolEntryHelper& SpendsCoinbase(bool _flag) { spendsCoinbase = _flag; return *this; } + TestMemPoolEntryHelper& SigOpsCost(unsigned int _sigopsCost) { sigOpCost = _sigopsCost; return *this; } +}; + +/** Check expected properties for every PackageMempoolAcceptResult, regardless of value. Returns + * a string if an error occurs with error populated, nullopt otherwise. If mempool is provided, + * checks that the expected transactions are in mempool (this should be set to nullptr for a test_accept). +*/ +std::optional CheckPackageMempoolAcceptResult(const Package& txns, + const PackageMempoolAcceptResult& result, + bool expect_valid, + const CTxMemPool* mempool); +#endif // BITCOIN_TEST_UTIL_TXMEMPOOL_H From bca2f2bc9fee92a1cf29528b9f68f3e1c503c65d Mon Sep 17 00:00:00 2001 From: pasta Date: Tue, 5 Aug 2025 05:45:18 -0500 Subject: [PATCH 2/2] fix: remove package_eval.cpp file creation Bitcoin commit fcb3069fa3 modifies existing package_eval.cpp but Dash doesn't have this file. Creating the file would import entire Bitcoin fuzzing infrastructure (291 lines) instead of the specific 15-line improvement Bitcoin made. Preserves other valid improvements: - tx_pool.cpp: ATMP result invariant checks (67 lines) - txmempool.cpp: CheckPackageMempoolAcceptResult utility (78 lines) - txmempool.h: Function declarations (10 lines) This maintains faithful backporting while keeping beneficial test improvements. --- src/test/fuzz/package_eval.cpp | 291 --------------------------------- 1 file changed, 291 deletions(-) delete mode 100644 src/test/fuzz/package_eval.cpp diff --git a/src/test/fuzz/package_eval.cpp b/src/test/fuzz/package_eval.cpp deleted file mode 100644 index 8d316134cc7a..000000000000 --- a/src/test/fuzz/package_eval.cpp +++ /dev/null @@ -1,291 +0,0 @@ -// Copyright (c) 2023 The Bitcoin Core developers -// Distributed under the MIT software license, see the accompanying -// file COPYING or http://www.opensource.org/licenses/mit-license.php. - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -using node::NodeContext; - -namespace { - -const TestingSetup* g_setup; -std::vector g_outpoints_coinbase_init_mature; - -struct MockedTxPool : public CTxMemPool { - void RollingFeeUpdate() EXCLUSIVE_LOCKS_REQUIRED(!cs) - { - LOCK(cs); - lastRollingFeeUpdate = GetTime(); - blockSinceLastRollingFeeBump = true; - } -}; - -void initialize_tx_pool() -{ - static const auto testing_setup = MakeNoLogFileContext(); - g_setup = testing_setup.get(); - - for (int i = 0; i < 2 * COINBASE_MATURITY; ++i) { - COutPoint prevout{MineBlock(g_setup->m_node, P2WSH_OP_TRUE)}; - if (i < COINBASE_MATURITY) { - // Remember the txids to avoid expensive disk access later on - g_outpoints_coinbase_init_mature.push_back(prevout); - } - } - SyncWithValidationInterfaceQueue(); -} - -struct OutpointsUpdater final : public CValidationInterface { - std::set& m_mempool_outpoints; - - explicit OutpointsUpdater(std::set& r) - : m_mempool_outpoints{r} {} - - void TransactionAddedToMempool(const CTransactionRef& tx, uint64_t /* mempool_sequence */) override - { - // for coins spent we always want to be able to rbf so they're not removed - - // outputs from this tx can now be spent - for (uint32_t index{0}; index < tx->vout.size(); ++index) { - m_mempool_outpoints.insert(COutPoint{tx->GetHash(), index}); - } - } - - void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override - { - // outpoints spent by this tx are now available - for (const auto& input : tx->vin) { - // Could already exist if this was a replacement - m_mempool_outpoints.insert(input.prevout); - } - // outpoints created by this tx no longer exist - for (uint32_t index{0}; index < tx->vout.size(); ++index) { - m_mempool_outpoints.erase(COutPoint{tx->GetHash(), index}); - } - } -}; - -struct TransactionsDelta final : public CValidationInterface { - std::set& m_added; - - explicit TransactionsDelta(std::set& a) - : m_added{a} {} - - void TransactionAddedToMempool(const CTransactionRef& tx, uint64_t /* mempool_sequence */) override - { - // Transactions may be entered and booted any number of times - m_added.insert(tx); - } - - void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override - { - // Transactions may be entered and booted any number of times - m_added.erase(tx); - } -}; - -void MockTime(FuzzedDataProvider& fuzzed_data_provider, const Chainstate& chainstate) -{ - const auto time = ConsumeTime(fuzzed_data_provider, - chainstate.m_chain.Tip()->GetMedianTimePast() + 1, - std::numeric_limitsnTime)>::max()); - SetMockTime(time); -} - -CTxMemPool MakeMempool(FuzzedDataProvider& fuzzed_data_provider, const NodeContext& node) -{ - // Take the default options for tests... - CTxMemPool::Options mempool_opts{MemPoolOptionsForTest(node)}; - - - // ...override specific options for this specific fuzz suite - mempool_opts.limits.ancestor_count = fuzzed_data_provider.ConsumeIntegralInRange(0, 50); - mempool_opts.limits.ancestor_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange(0, 202) * 1'000; - mempool_opts.limits.descendant_count = fuzzed_data_provider.ConsumeIntegralInRange(0, 50); - mempool_opts.limits.descendant_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange(0, 202) * 1'000; - mempool_opts.max_size_bytes = fuzzed_data_provider.ConsumeIntegralInRange(0, 200) * 1'000'000; - mempool_opts.expiry = std::chrono::hours{fuzzed_data_provider.ConsumeIntegralInRange(0, 999)}; - nBytesPerSigOp = fuzzed_data_provider.ConsumeIntegralInRange(1, 999); - - mempool_opts.estimator = nullptr; - mempool_opts.check_ratio = 1; - mempool_opts.require_standard = fuzzed_data_provider.ConsumeBool(); - - // ...and construct a CTxMemPool from it - return CTxMemPool{mempool_opts}; -} - -FUZZ_TARGET(tx_package_eval, .init = initialize_tx_pool) -{ - FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); - const auto& node = g_setup->m_node; - auto& chainstate{static_cast(node.chainman->ActiveChainstate())}; - - MockTime(fuzzed_data_provider, chainstate); - - // All RBF-spendable outpoints outside of the unsubmitted package - std::set mempool_outpoints; - std::map outpoints_value; - for (const auto& outpoint : g_outpoints_coinbase_init_mature) { - Assert(mempool_outpoints.insert(outpoint).second); - outpoints_value[outpoint] = 50 * COIN; - } - - auto outpoints_updater = std::make_shared(mempool_outpoints); - RegisterSharedValidationInterface(outpoints_updater); - - CTxMemPool tx_pool_{MakeMempool(fuzzed_data_provider, node)}; - MockedTxPool& tx_pool = *static_cast(&tx_pool_); - - chainstate.SetMempool(&tx_pool); - - LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 300) - { - Assert(!mempool_outpoints.empty()); - - std::vector txs; - - // Make packages of 1-to-26 transactions - const auto num_txs = (size_t) fuzzed_data_provider.ConsumeIntegralInRange(1, 26); - std::set package_outpoints; - while (txs.size() < num_txs) { - - // Last transaction in a package needs to be a child of parents to get further in validation - // so the last transaction to be generated(in a >1 package) must spend all package-made outputs - // Note that this test currently only spends package outputs in last transaction. - bool last_tx = num_txs > 1 && txs.size() == num_txs - 1; - - // Create transaction to add to the mempool - const CTransactionRef tx = [&] { - CMutableTransaction tx_mut; - tx_mut.nVersion = CTransaction::CURRENT_VERSION; - tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral(); - // Last tx will sweep all outpoints in package - const auto num_in = last_tx ? package_outpoints.size() : fuzzed_data_provider.ConsumeIntegralInRange(1, mempool_outpoints.size()); - const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange(1, mempool_outpoints.size() * 2); - - auto& outpoints = last_tx ? package_outpoints : mempool_outpoints; - - Assert(!outpoints.empty()); - - CAmount amount_in{0}; - for (size_t i = 0; i < num_in; ++i) { - // Pop random outpoint - auto pop = outpoints.begin(); - std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange(0, outpoints.size() - 1)); - const auto outpoint = *pop; - outpoints.erase(pop); - // no need to update or erase from outpoints_value - amount_in += outpoints_value.at(outpoint); - - // Create input - const auto sequence = ConsumeSequence(fuzzed_data_provider); - const auto script_sig = CScript{}; - const auto script_wit_stack = std::vector>{WITNESS_STACK_ELEM_OP_TRUE}; - CTxIn in; - in.prevout = outpoint; - in.nSequence = sequence; - in.scriptSig = script_sig; - in.scriptWitness.stack = script_wit_stack; - - tx_mut.vin.push_back(in); - } - const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange(0, amount_in); - const auto amount_out = (amount_in - amount_fee) / num_out; - for (int i = 0; i < num_out; ++i) { - tx_mut.vout.emplace_back(amount_out, P2WSH_OP_TRUE); - } - // TODO vary transaction sizes to catch size-related issues - auto tx = MakeTransactionRef(tx_mut); - // Restore previously removed outpoints, except in-package outpoints - if (!last_tx) { - for (const auto& in : tx->vin) { - Assert(outpoints.insert(in.prevout).second); - } - // Cache the in-package outpoints being made - for (size_t i = 0; i < tx->vout.size(); ++i) { - package_outpoints.emplace(tx->GetHash(), i); - } - } - // We need newly-created values for the duration of this run - for (size_t i = 0; i < tx->vout.size(); ++i) { - outpoints_value[COutPoint(tx->GetHash(), i)] = tx->vout[i].nValue; - } - return tx; - }(); - txs.push_back(tx); - } - - if (fuzzed_data_provider.ConsumeBool()) { - MockTime(fuzzed_data_provider, chainstate); - } - if (fuzzed_data_provider.ConsumeBool()) { - tx_pool.RollingFeeUpdate(); - } - if (fuzzed_data_provider.ConsumeBool()) { - const auto& txid = fuzzed_data_provider.ConsumeBool() ? - txs.back()->GetHash().ToUint256() : - PickValue(fuzzed_data_provider, mempool_outpoints).hash; - const auto delta = fuzzed_data_provider.ConsumeIntegralInRange(-50 * COIN, +50 * COIN); - tx_pool.PrioritiseTransaction(txid, delta); - } - - // Remember all added transactions - std::set added; - auto txr = std::make_shared(added); - RegisterSharedValidationInterface(txr); - const bool bypass_limits = fuzzed_data_provider.ConsumeBool(); - - // When there are multiple transactions in the package, we call ProcessNewPackage(txs, test_accept=false) - // and AcceptToMemoryPool(txs.back(), test_accept=true). When there is only 1 transaction, we might flip it - // (the package is a test accept and ATMP is a submission). - auto single_submit = txs.size() == 1 && fuzzed_data_provider.ConsumeBool(); - - const auto result_package = WITH_LOCK(::cs_main, - return ProcessNewPackage(chainstate, tx_pool, txs, /*test_accept=*/single_submit)); - - const auto res = WITH_LOCK(::cs_main, return AcceptToMemoryPool(chainstate, txs.back(), GetTime(), bypass_limits, /*test_accept=*/!single_submit)); - const bool accepted = res.m_result_type == MempoolAcceptResult::ResultType::VALID; - - SyncWithValidationInterfaceQueue(); - UnregisterSharedValidationInterface(txr); - - // There is only 1 transaction in the package. We did a test-package-accept and a ATMP - if (single_submit) { - Assert(accepted != added.empty()); - Assert(accepted == res.m_state.IsValid()); - if (accepted) { - Assert(added.size() == 1); - Assert(txs.back() == *added.begin()); - } - } else if (result_package.m_state.GetResult() != PackageValidationResult::PCKG_POLICY) { - // We don't know anything about the validity since transactions were randomly generated, so - // just use result_package.m_state here. This makes the expect_valid check meaningless, but - // we can still verify that the contents of m_tx_results are consistent with m_state. - const bool expect_valid{result_package.m_state.IsValid()}; - Assert(!CheckPackageMempoolAcceptResult(txs, result_package, expect_valid, nullptr)); - } else { - // This is empty if it fails early checks, or "full" if transactions are looked at deeper - Assert(result_package.m_tx_results.size() == txs.size() || result_package.m_tx_results.empty()); - } - } - - UnregisterSharedValidationInterface(outpoints_updater); - - WITH_LOCK(::cs_main, tx_pool.check(chainstate.CoinsTip(), chainstate.m_chain.Height() + 1)); -} -} // namespace