9fe5896a44tor: torcontrol disconnect on too many lines to avoid OOM (David Gumberg)8b68287bf9test: Make torcontrol max line length test stricter and test boundaries. (David Gumberg)ab5889796frefactor: torcontrol add connection checks to restart_with_mock (David Gumberg) Pull request description: LLM disclosure: Found with the help of Claude Opus 4.6, fix, test, description, and commit messages written by me. ------ This fixes a low-severity issue where a misbehaving Tor control daemon can cause bitcoind to OOM by sending continuation lines without sending `250 OK` or similar. This issue is not that serious because if your tor control daemon is malicious you are already in all kinds of trouble, but as a matter of robustness this should be fixed. The fix is to prevent the `TorControlConnection::m_message` buffer from growing without bound by by limiting the number of lines handled by `TorControlConnection::ProcessBuffer()` to `MAX_LINE_COUNT = 1000`. Now the most memory that can be occupied by `m_message` is on the order of `MAX_LINE_LENGTH * MAX_LINE_COUNT= 100MB` Although this is not compliant with the Tor control protocol in general, where commands like `GETINFO ns/all` will likely return thousands of lines, it is more than sufficient for handling the replies from the commands that are used by a node: <details> <summary> #### Tor control commands used by Bitcoin Core </summary> `AUTHENTICATE`: 1 line: The server responds with 250 OK on success or 515 Bad authentication if the authentication cookie is incorrect. Tor closes the connection on an authentication failure. https://spec.torproject.org/control-spec/commands.html#authenticate `GETINFO net/listener/socks`: 2 lines A quoted, space-separated list of the locations where Tor is listening... https://spec.torproject.org/control-spec/commands.html#getinfo `AUTHCHALLENGE SAFECOOKIE`: 1 line If the server accepts the command, the server reply format is: ``` "250 AUTHCHALLENGE" SP "SERVERHASH=" ServerHash SP "SERVERNONCE=" ServerNonce CRLF ``` https://spec.torproject.org/control-spec/commands.html#authenticate `PROTOCOLINFO`: 4-5 lines The server reply format is: ``` 250-PROTOCOLINFO" SP PIVERSION CRLF \*InfoLine "250 OK" CRLF InfoLine = AuthLine / VersionLine / OtherLine ``` (https://spec.torproject.org/control-spec/commands.html#protocolinfo) `ADD_ONION`: 2-3 lines for Bitcoin Core's tor control client. The server reply format is: ``` "250-ServiceID=" ServiceID CRLF ["250-PrivateKey=" KeyType ":" KeyBlob CRLF] *("250-ClientAuth=" ClientName ":" ClientBlob CRLF) "250 OK" CRLF ``` ... The server response will only include a private key if the server was requested to generate a new keypair ... If client authorization is enabled using the “BasicAuth” flag (which is v2 only), the service will not be accessible to clients without valid authorization data (configured with the “HidServAuth” option). The list of authorized clients is specified with one or more “ClientAuth” parameters. If “ClientBlob” is not specified for a client, a new credential will be randomly generated and returned." https://spec.torproject.org/control-spec/commands.html#add_onion We don't set the `BasicAuth` flag, so the response will not include any `ClientAuthLines`. </details> ## Reproduce To reproduce this issue, the following script or similar can be used as the misbehaving Tor control daemon: ```python #!/usr/bin/env python3 """ A fake Tor control service that never finishes its reply. Sends unlimited continuation lines ("250-...") without ever sending the final "250 ...". Each line accumulates in m_message.lines with no cap. Bitcoind OOMs. """ import socket import time PORT = 19191 server = socket.create_server(("127.0.0.1", PORT)) conn, _ = server.accept() conn.recv(4096) # Receive PROTOCOLINFO time_start = time.time() try: while True: conn.sendall(b"250-Ceaseless\r\n" * 10000) except (BrokenPipeError, ConnectionResetError): elapsed = time.time() - time_start print(f"Node disconnected after {elapsed:.2f}s") ``` **🟡¡This will OOM, run in a container, VM, or some sandbox with memory limits!🟡** Start a node with `-torcontrol=127.0.0.1=19191`. E.g. with systemd: ```bash systemd-run --user --scope -p MemoryMax=2G -p MemorySwapMax=0 bitcoind -regtest -torcontrol=127.0.0.1:19191 ``` ACKs for top commit: fjahr: ACK9fe5896a44danielabrozzoni: Code review ACK9fe5896a44janb84: ACK.9fe5896a44sedited: ACK9fe5896a44Tree-SHA512: ccbeba40c096e1fa3911c75c49e3a5c403712f646d77329de48017a19d1f0caa2ee4cc148b6c6473f68e55d7da04f17eb67748b5bf4dede3579b944ee5370cf5
This directory contains integration tests that test bitcoind and its utilities in their entirety. It does not contain unit tests, which can be found in /src/test, /src/wallet/test, etc.
This directory contains the following sets of tests:
- fuzz A runner to execute all fuzz targets from /src/test/fuzz.
- functional which test the functionality of bitcoind and bitcoin-qt by interacting with them through the RPC and P2P interfaces.
- lint which perform various static analysis checks.
The fuzz tests, functional tests and lint scripts can be run as explained in the sections below.
Running tests locally
Before tests can be run locally, Bitcoin Core must be built. See the building instructions for help.
The following examples assume that the build directory is named build.
Fuzz tests
See /doc/fuzzing.md
Functional tests
Dependencies and prerequisites
The ZMQ functional test requires a python ZMQ library. To install it:
- on Unix, run
sudo apt-get install python3-zmq - on mac OS, run
pip3 install pyzmq
The IPC functional test requires a python IPC library. pip3 install pycapnp may work, but if not, install it from source:
git clone -b v2.2.1 https://github.com/capnproto/pycapnp
pip3 install ./pycapnp
If that does not work, try adding -C force-bundled-libcapnp=True to the pip command.
Depending on the system, it may be necessary to install and run in a venv:
python -m venv venv
git clone -b v2.2.1 https://github.com/capnproto/pycapnp
venv/bin/pip3 install ./pycapnp -C force-bundled-libcapnp=True
venv/bin/python3 build/test/functional/interface_ipc.py
The functional tests assume Python UTF-8 Mode, which is the default on most
systems.
On Windows the PYTHONUTF8 environment variable must be set to 1:
set PYTHONUTF8=1
Running the tests
Individual tests can be run by directly calling the test script, e.g.:
build/test/functional/feature_rbf.py
or can be run through the test_runner harness, eg:
build/test/functional/test_runner.py feature_rbf.py
You can run any combination (incl. duplicates) of tests by calling:
build/test/functional/test_runner.py <testname1> <testname2> <testname3> ...
Wildcard test names can be passed, if the paths are coherent and the test runner
is called from a bash shell or similar that does the globbing. For example,
to run all the wallet tests:
build/test/functional/test_runner.py test/functional/wallet*
functional/test_runner.py functional/wallet* # (called from the build/test/ directory)
test_runner.py wallet* # (called from the build/test/functional/ directory)
but not
build/test/functional/test_runner.py wallet*
Combinations of wildcards can be passed:
build/test/functional/test_runner.py ./test/functional/tool* test/functional/mempool*
test_runner.py tool* mempool*
Run the regression test suite with:
build/test/functional/test_runner.py
Run all possible tests with
build/test/functional/test_runner.py --extended
In order to run backwards compatibility tests, first run:
test/get_previous_releases.py
to download the necessary previous release binaries.
By default, up to 4 tests will be run in parallel by test_runner. To specify
how many jobs to run, append --jobs=n
The individual tests and the test_runner harness have many command-line
options. Run build/test/functional/test_runner.py -h to see them all.
Speed up test runs with a RAM disk
If you have available RAM on your system you can create a RAM disk to use as the cache and tmp directories for the functional tests in order to speed them up.
Speed-up amount varies on each system (and according to your RAM speed and other variables), but a 2-3x speed-up is not uncommon.
Linux
To create a 4 GiB RAM disk at /mnt/tmp/:
sudo mkdir -p /mnt/tmp
sudo mount -t tmpfs -o size=4g tmpfs /mnt/tmp/
Configure the size of the RAM disk using the size= option.
The size of the RAM disk needed is relative to the number of concurrent jobs the test suite runs.
For example running the test suite with --jobs=100 might need a 4 GiB RAM disk, but running with --jobs=32 will only need a 2.5 GiB RAM disk.
To use, run the test suite specifying the RAM disk as the cachedir and tmpdir:
build/test/functional/test_runner.py --cachedir=/mnt/tmp/cache --tmpdir=/mnt/tmp
Once finished with the tests and the disk, and to free the RAM, simply unmount the disk:
sudo umount /mnt/tmp
macOS
To create a 4 GiB RAM disk named "ramdisk" at /Volumes/ramdisk/:
diskutil erasevolume HFS+ ramdisk $(hdiutil attach -nomount ram://8388608)
Configure the RAM disk size, expressed as the number of blocks, at the end of the command
(4096 MiB * 2048 blocks/MiB = 8388608 blocks for 4 GiB). To run the tests using the RAM disk:
build/test/functional/test_runner.py --cachedir=/Volumes/ramdisk/cache --tmpdir=/Volumes/ramdisk/tmp
To unmount:
umount /Volumes/ramdisk
Troubleshooting and debugging test failures
Resource contention
The P2P and RPC ports used by the bitcoind nodes-under-test are chosen to make conflicts with other processes unlikely. However, if there is another bitcoind process running on the system (perhaps from a previous test which hasn't successfully killed all its bitcoind nodes), then there may be a port conflict which will cause the test to fail. It is recommended that you run the tests on a system where no other bitcoind processes are running.
On linux, the test framework will warn if there is another bitcoind process running when the tests are started.
If there are zombie bitcoind processes after test failure, you can kill them by running the following commands. Note that these commands will kill all bitcoind processes running on the system, so should not be used if any non-test bitcoind processes are being run.
killall bitcoind
or
pkill -9 bitcoind
Data directory cache
A pre-mined blockchain with 200 blocks is generated the first time a functional test is run and is stored in build/test/cache. This speeds up test startup times since new blockchains don't need to be generated for each test. However, the cache may get into a bad state, in which case tests will fail. If this happens, remove the cache directory (and make sure bitcoind processes are stopped as above):
rm -rf build/test/cache
killall bitcoind
Test logging
The tests contain logging at five different levels (DEBUG, INFO, WARNING, ERROR
and CRITICAL). From within your functional tests you can log to these different
levels using the logger included in the test_framework, e.g.
self.log.debug(object). By default:
- when run through the test_runner harness, all logs are written to
test_framework.logand no logs are output to the console. - when run directly, all logs are written to
test_framework.logand INFO level and above are output to the console. - when run by our CI (Continuous Integration), no logs are output to the console. However, if a test
fails, the
test_framework.logand bitcoinddebug.logs will all be dumped to the console to help troubleshooting.
These log files can be located under the test data directory (which is always printed in the first line of test output):
<test data directory>/test_framework.log<test data directory>/node<node number>/regtest/debug.log.
The node number identifies the relevant test node, starting from node0, which
corresponds to its position in the nodes list of the specific test,
e.g. self.nodes[0].
To change the level of logs output to the console, use the -l command line
argument.
test_framework.log and bitcoind debug.logs can be combined into a single
aggregate log by running the combine_logs.py script. The output can be plain
text, colorized text or html. For example:
build/test/functional/combine_logs.py -c <test data directory> | less -r
will pipe the colorized logs from the test into less.
Use --tracerpc to trace out all the RPC calls and responses to the console. For
some tests (eg any that use submitblock to submit a full block over RPC),
this can result in a lot of screen output.
By default, the test data directory will be deleted after a successful run.
Use --nocleanup to leave the test data directory intact. The test data
directory is never deleted after a failed test.
Attaching a debugger
A python debugger can be attached to tests at any point. Just add the line:
import pdb; pdb.set_trace()
anywhere in the test. You will then be able to inspect variables, as well as call methods that interact with the bitcoind nodes-under-test.
If further introspection of the bitcoind instances themselves becomes
necessary, this can be accomplished by first setting a pdb breakpoint
at an appropriate location, running the test to that point, then using
gdb (or lldb on macOS) to attach to the process and debug.
For instance, to attach to self.node[1] during a run you can get
the pid of the node within pdb.
(pdb) self.node[1].process.pid
Alternatively, you can find the pid by inspecting the temp folder for the specific test you are running. The path to that folder is printed at the beginning of every test run:
2017-06-27 14:13:56.686000 TestFramework (INFO): Initializing test directory /tmp/user/1000/testo9vsdjo3
Use the path to find the pid file in the temp folder:
cat /tmp/user/1000/testo9vsdjo3/node1/regtest/bitcoind.pid
Then you can use the pid to start gdb:
gdb /home/example/bitcoind <pid>
Note: gdb attach step may require ptrace_scope to be modified, or sudo preceding the gdb.
See this link for considerations: https://www.kernel.org/doc/Documentation/security/Yama.txt
Often while debugging RPC calls in functional tests, the test might time out before the
process can return a response. Use --timeout-factor 0 to disable all RPC timeouts for that particular
functional test. Ex: build/test/functional/wallet_hd.py --timeout-factor 0.
Profiling
An easy way to profile node performance during functional tests is provided
for Linux platforms using perf.
Perf will sample the running node and will generate profile data in the node's
datadir. The profile data can then be presented using perf report or a graphical
tool like hotspot.
To generate a profile during test suite runs, use the --perf flag.
To see render the output to text, run
perf report -i /path/to/datadir/send-big-msgs.perf.data.xxxx --stdio | c++filt | less
For ways to generate more granular profiles, see the README in test/functional.
Lint tests
See the README in test/lint.
Writing functional tests
You are encouraged to write functional tests for new or existing features. Further information about the functional test framework and individual tests is found in test/functional.