fuzz: exercise ForNode/ForEachNode callbacks in connman fuzz harness
What the developer wrote
Authored by frankomosh
fuzz: exercise ForNode/ForEachNode callbacks in connman fuzz harness
Track inserted node IDs and select from them when calling ForNode, so the ID-match branch is hit more frequently. Replace no-op callbacks with CNode accessor calls to exercise previously uncovered code paths (IsFullOutboundConn, ConnectionTypeAsString) through the iteration.
What changed, and why it matters
This commit only changes a fuzz test file. Fuzz tests are automated tools that throw random inputs at code to find bugs. The change makes the fuzzer exercise more code paths in the connection manager, but it does not alter the actual Bitcoin Core networking code that runs on real nodes. There is no security vulnerability here.
No action required. This is a benign test-only change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies src/test/fuzz/connman.cpp to improve coverage of the CConnman fuzz target. It tracks inserted NodeId values and uses them when calling ForNode, and replaces no-op callbacks with calls to CNode accessors (GetId, IsInboundConn, IsFullOutboundConn, ConnectionTypeAsString). This is purely a test-harness enhancement; no production code is changed.
Changed components
src/test/fuzz/connman.cppInspect captured patch +17 / −4
diff --git a/src/test/fuzz/connman.cpp b/src/test/fuzz/connman.cpp
index 1b0859d6..7ac4f3b8 100644
--- a/src/test/fuzz/connman.cpp
+++ b/src/test/fuzz/connman.cpp
@@ -99,12 +99,14 @@ FUZZ_TARGET(connman, .init = initialize_connman)
CNode random_node = ConsumeNode(fuzzed_data_provider);
CSubNet random_subnet;
std::string random_string;
+ std::vector<NodeId> node_ids;
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 100) {
CNode& p2p_node{*ConsumeNodeAsUniquePtr(fuzzed_data_provider).release()};
// Simulate post-handshake state.
p2p_node.fSuccessfullyConnected = true;
connman.AddTestNode(p2p_node);
+ node_ids.push_back(p2p_node.GetId());
}
LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
@@ -141,10 +143,15 @@ FUZZ_TARGET(connman, .init = initialize_connman)
connman.DisconnectNode(random_subnet);
},
[&] {
- connman.ForEachNode([](auto) {});
- },
- [&] {
- (void)connman.ForNode(fuzzed_data_provider.ConsumeIntegral<NodeId>(), [&](auto) { return fuzzed_data_provider.ConsumeBool(); });
+ NodeId id = node_ids.empty() || fuzzed_data_provider.ConsumeBool()
+ ? fuzzed_data_provider.ConsumeIntegral<NodeId>()
+ : PickValue(fuzzed_data_provider, node_ids);
+ (void)connman.ForNode(id, [&](CNode* pnode) {
+ (void)pnode->GetId();
+ (void)pnode->IsInboundConn();
+ (void)pnode->IsFullOutboundConn();
+ return true;
+ });
},
[&] {
auto max_addresses = fuzzed_data_provider.ConsumeIntegral<size_t>();
@@ -228,6 +235,12 @@ FUZZ_TARGET(connman, .init = initialize_connman)
connman.SocketHandlerPublic();
});
}
+ connman.ForEachNode([](CNode* pnode) {
+ (void)pnode->GetId();
+ (void)pnode->IsInboundConn();
+ (void)pnode->IsFullOutboundConn();
+ (void)pnode->ConnectionTypeAsString();
+ });
(void)connman.GetAddedNodeInfo(fuzzed_data_provider.ConsumeBool());
(void)connman.GetExtraFullOutboundCount();
(void)connman.GetLocalServices();
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.