#36635 fuzz: Add a target that feeds arbitrary bytes to V2Transport

ReviewabilityReviewsAgreementSize
#36635 fametrano fuzz: Add a target that feeds arbitrary bytes to V2TransportReady0Crickets0 + 102 tests
  • Fuzz test BIP 324 transport message reception with arbitrary and malformed byte streams
  • Ensure post-handshake receive state transitions and error handling withstand hostile peer traffic
  • Ready to review
  • No review verdicts recorded
  • No substantive comments either way yet
  • Addressed suggestions to assert session ID and test the rekey interval with decoys (uqlidi)
  • Awaiting follow-up review on the updated changes (uqlidi)
  • 0 lines added or modified outside tests
  • 102 lines added or modified in tests
  • 0 lines removed in total
  • 1 files, 1 commits
Test infrastructure#4 of 54
P2 · test coverage
  • P2 because it adds fuzz coverage for high-risk P2P message handling paths fuzzers currently miss
  • Exercises BIP 324 receive states and error handling against hostile peer traffic past the handshake
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Adds the `p2p_transport_v2_receive` fuzz target to test BIP 324 `V2Transport` message reception. The target generates byte streams containing mixtures of arbitrary data and valid or bit-flipped handshake elements (keys, garbage, terminators, encrypted packets) and feeds them in arbitrary slice sizes to reach all receive states and failure transitions.

Problem: Existing fuzz targets do not feed malformed or arbitrary byte streams to `V2Transport` past the initial key exchange, leaving post-handshake BIP 324 receive state transitions and error handling under-tested against hostile peer traffic.

Evidence of importance:

  • PR description: 'No fuzz target feeds V2Transport bytes that an honest peer would not send past the v2 key exchange.'
  • Author reports running the target for 13 minutes under libFuzzer with ASan/UBSan without crashes, confirming it successfully exercises both accepted and rejected message handling paths.

Scope: Adds a single standalone fuzz target in `src/test/fuzz/p2p_transport_serialization.cpp`.

Risk of a mistake: low (tests). Only adds a new fuzzing target; no production or consensus code is touched.

Changed since the previous assessment: Now includes the complete patch implementing the `p2p_transport_v2_receive` fuzz target.

Reviewability

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

  • reviewer: uqlidi to review the changes in 984a01619e 2026-11-01

Agreement

Crickets

no substantive comment either way

Thread notes: fametrano addressed all review comments from uqlidi and updated the PR in 984a01619e.

Objections, suggestions, and questions:

ReviewerTypeHarm, request, or questionStatusMust beAuthor repliedQuote
uqlidi (none)suggestion, correctnessAssert that transport.GetInfo().session_id matches the peer session ID when transport_type is V2fixed · fix pushed · author implemented the session ID assert in 984a01619eansweredyes2026-10-31: 'At that point its session id should match the peer's. Would an assert on that work?'
Status from: 2026-11-01: fametrano: 'Once the transport reports v2, the target asserts that its session id matches the peer's'
uqlidi (none)suggestion, approachAdd an action appending empty decoys so the fuzz target covers the transport rekey intervalfixed · fix pushed · author added empty decoys action in 984a01619eansweredyes2026-10-31: 'Maybe add an action that appends a run of empty decoys? With the diff below, libFuzzer's coverage report shows this rekey branch hit'
Status from: 2026-11-01: fametrano: 'a new action appends a run of empty decoys'

Participants:

  • uqlidi (none, question, 7 statements 2026-10-31 to 2026-10-31): suggested asserting session ID on V2 transport and adding decoy run action to hit rekey branch, along with several nits

Files

102 lines under test/bench/ci.

  • src/test/fuzz/p2p_transport_serialization.cpp +102/-0

Card

The short text the ranking pass compares across PRs.

Adds the `p2p_transport_v2_receive` fuzz target to exercise BIP 324 `V2Transport` byte reception. Existing fuzz tests do not feed malformed or arbitrary byte streams past the initial key exchange, leaving transport error handling and receive state transitions under-tested. The author notes the target crafts streams containing arbitrary bytes mixed with corrupted handshake segments in variable slice sizes, reaching all receive states without crashes under ASan and UBSan.

Data

dossier JSON · extract JSON · model ledger, generated 2026-11-02T01:11, confidence high, input hash 5f10d03836a6873b
thread read through 2026-11-01 (8 statements), head 984a01619e
labels: Fuzzing

Categories

Test infrastructure

P2 · test coverage

Adds fuzz coverage for high-risk p2p message handling paths that fuzzers currently do not reach. The target exercises BIP 324 V2Transport receive states and error handling against arbitrary byte streams past the initial handshake, addressing an area directly targeted at hostile peer traffic.

Membership: Fuzzing label and adds a new fuzz harness in src/test/fuzz/p2p_transport_serialization.cpp

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 0