Node / meshtastic / Meshtastic-Android / files / core / network / src / commonTest / kotlin / org / meshtastic / core / network / radio / ReplayFuzz.kt

Displaying Raw • Download

T8b949e/*

* Copyright (c) 2026 Meshtastic LLC

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <https://www.gnu.org/licenses/>.

*/

Tff7b72package T7ee787org.meshtastic.core.network.radio

Tff7b72import T7ee787okio.Buffer

Tff7b72import T7ee787okio.ByteString.Companion.toByteString

Tff7b72import T7ee787org.meshtastic.proto.Data

Tff7b72import T7ee787org.meshtastic.proto.FromRadio

Tff7b72import T7ee787org.meshtastic.proto.MeshPacket

Tff7b72import T7ee787org.meshtastic.proto.NodeInfo

Tff7b72import T7ee787org.meshtastic.proto.Position

Tff7b72import T7ee787org.meshtastic.proto.User

Tff7b72import T7ee787kotlin.random.Random

T8b949e/**

* Deterministic fuzz toolkit for the on-device replay ingestion path — the same `FromRadio` entry every BLE / TCP /

* serial peer feeds (`RadioTransportCallback.handleFromRadio`). It ships with the app's tests (runs under `allTests`),

* so the parse / decode boundary is continuously fuzzed in CI at zero runtime and zero app-size cost.

*

* Untrusted radio input is a real attack surface: a malicious or buggy peer within range controls these bytes. This

* toolkit drives that surface with three input strategies, each aimed at a different layer:

* - [randomBytes] — unstructured noise; worst case for the stream/asset parser and the protobuf decoder.

* - [mutate] — bit-flips / truncations / extensions of a *valid* encoding; near-valid corruption that reaches deep

* field-parsing paths a random blob never would.

* - [adversarialFromRadio] — a structurally **valid** `FromRadio` carrying hostile field values (out-of-range

* coordinates, NaN / infinite metrics, oversized / RTL / emoji names, random sub-payloads). This is the corpus for

* the layer where the real robustness gap lives: the post-decode handlers, which are not exception-isolated.

*

* **Everything is seeded.** A failing case is fully described by its integer seed, so a CI failure reproduces locally

* by pinning that seed — there is no hidden global RNG. Typical use:

* ```

* ReplayFuzz.forSeeds { random, seed ->

* val input = ReplayFuzz.mutate(random, validFrame)

* val error = runCatching { target(input) }.exceptionOrNull()

* assertTrue(error == null || error is IllegalArgumentException) { "seed=$seed -> $error" }

* }

* ```

*

* Scope: this is a *library-level* fuzzer (parser, decoder, handshake). End-to-end fuzzing of the live stack —

* framing + UI + ANR — belongs in the capture tool's live `--fuzz` mode against a device; handler-level fuzzing needs

* the full `MeshMessageProcessor` graph and is a separate integration harness. The [adversarialFromRadio] corpus here

* is designed to feed that harness when it lands.

*/

Tf0883e@SuppressTb4b4b4(Ta5d6ff"Ta5d6ffMagicNumberTa5d6ff"Tb4b4b4)

Tff7b72object T56d364ReplayFuzz Tb4b4b4{

T8b949e/** Default seed sweep per invariant. Each seed is microseconds of work, so this stays well within CI budgets. */

Tff7b72const Tff7b72val Te6edf3DEFAULT_ITERATIONS Tff7b72= T79c0ff1T79c0ff0T79c0ff0T79c0ff0

Tff7b72private Tff7b72const Tff7b72val Te6edf3MAX_RANDOM_LEN Tff7b72= T79c0ff2T79c0ff0T79c0ff4T79c0ff8

Tff7b72private Tff7b72const Tff7b72val Te6edf3MAX_NAME_LEN Tff7b72= T79c0ff8T79c0ff1T79c0ff9T79c0ff2

Tff7b72private Tff7b72const Tff7b72val Te6edf3MAX_PAYLOAD_LEN Tff7b72= T79c0ff2T79c0ff5T79c0ff6

T8b949e/** Runs [body] over the deterministic seed sweep `0 until [count]`; each seed gets its own pinned [Random]. */

Tff7b72inline Tff7b72fun Td2a8ffforSeedsTb4b4b4(Te6edf3countTb4b4b4: Tffa657Int Tff7b72= Te6edf3DEFAULT_ITERATIONSTb4b4b4, Te6edf3bodyTb4b4b4: Tb4b4b4(Te6edf3randomTb4b4b4: Te6edf3RandomTb4b4b4, Te6edf3seedTb4b4b4: Tffa657IntTb4b4b4) Tff7b72-Tff7b72> Tffa657UnitTb4b4b4) Tb4b4b4{

Tff7b72for Tb4b4b4(Te6edf3seed Tff7b72in T79c0ff0 Te6edf3until Te6edf3countTb4b4b4) Te6edf3bodyTb4b4b4(Te6edf3RandomTb4b4b4(Te6edf3seedTb4b4b4)Tb4b4b4, Te6edf3seedTb4b4b4)

Tb4b4b4}

T8b949e/** Unstructured noise of bounded length (bounded so a fuzz sweep can never OOM the test JVM). */

Tff7b72fun Td2a8ffrandomBytesTb4b4b4(Te6edf3randomTb4b4b4: Te6edf3RandomTb4b4b4, Te6edf3maxLenTb4b4b4: Tffa657Int Tff7b72= Te6edf3MAX_RANDOM_LENTb4b4b4)Tb4b4b4: Te6edf3ByteArray Tff7b72=

Te6edf3ByteArrayTb4b4b4(Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Te6edf3maxLen Tff7b72+ T79c0ff1Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3alsoTb4b4b4(Te6edf3randomTff7b72::Te6edf3nextBytesTb4b4b4)

T8b949e/**

* A bit-flipped / truncated / extended copy of [input] — near-valid corruption that exercises field-parsing paths

* while staying small enough to be safe in CI. Returns fresh noise if [input] is empty.

*/

Tff7b72fun Td2a8ffmutateTb4b4b4(Te6edf3randomTb4b4b4: Te6edf3RandomTb4b4b4, Te6edf3inputTb4b4b4: Te6edf3ByteArrayTb4b4b4)Tb4b4b4: Te6edf3ByteArray Tb4b4b4{

Tff7b72if Tb4b4b4(Te6edf3inputTb4b4b4.Te6edf3isEmptyTb4b4b4(Tb4b4b4)Tb4b4b4) Tff7b72return Te6edf3randomBytesTb4b4b4(Te6edf3randomTb4b4b4, T79c0ff1T79c0ff6Tb4b4b4)

Tff7b72val Te6edf3keep Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Te6edf3inputTb4b4b4.Te6edf3size Tff7b72+ T79c0ff1Tb4b4b4) T8b949e// truncate to a 0..size prefix

Tff7b72val Te6edf3tail Tff7b72= Tff7b72if Tb4b4b4(Te6edf3randomTb4b4b4.Te6edf3nextBooleanTb4b4b4(Tb4b4b4)Tb4b4b4) Te6edf3randomBytesTb4b4b4(Te6edf3randomTb4b4b4, T79c0ff1T79c0ff6Tb4b4b4) Tff7b72else Te6edf3ByteArrayTb4b4b4(T79c0ff0Tb4b4b4) T8b949e// sometimes extend

Tff7b72val Te6edf3out Tff7b72= Te6edf3inputTb4b4b4.Te6edf3copyOfTb4b4b4(Te6edf3keepTb4b4b4) Tff7b72+ Te6edf3tail

Te6edf3repeatTb4b4b4(Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(T79c0ff1Tb4b4b4, T79c0ff4Tb4b4b4)Tb4b4b4) Tb4b4b4{

T8b949e// flip 1..3 bits

Tff7b72if Tb4b4b4(Tff7b72outTb4b4b4.Te6edf3isNotEmptyTb4b4b4(Tb4b4b4)Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3i Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tff7b72outTb4b4b4.Te6edf3sizeTb4b4b4)

Tff7b72outTff7b72[Te6edf3iTff7b72] Tff7b72= Tb4b4b4(Tff7b72outTff7b72[Te6edf3iTff7b72]Tb4b4b4.Te6edf3toIntTb4b4b4(Tb4b4b4) Te6edf3xor Tb4b4b4(T79c0ff1 Te6edf3shl Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(T79c0ff8Tb4b4b4)Tb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3toByteTb4b4b4(Tb4b4b4)

Tb4b4b4}

Tb4b4b4}

Tff7b72return Tff7b72out

Tb4b4b4}

T8b949e/** A valid `FromRadio` carrying hostile content. Variant chosen by [random]. Corpus for handler/UI fuzzing. */

Tff7b72fun Td2a8ffadversarialFromRadioTb4b4b4(Te6edf3randomTb4b4b4: Te6edf3RandomTb4b4b4)Tb4b4b4: Te6edf3FromRadio Tff7b72= Tff7b72if Tb4b4b4(Te6edf3randomTb4b4b4.Te6edf3nextBooleanTb4b4b4(Tb4b4b4)Tb4b4b4) Tb4b4b4{

Te6edf3FromRadioTb4b4b4(Te6edf3node_info Tff7b72= Te6edf3adversarialNodeTb4b4b4(Te6edf3randomTb4b4b4)Tb4b4b4)

Tb4b4b4} Tff7b72else Tb4b4b4{

Te6edf3FromRadioTb4b4b4(Te6edf3packet Tff7b72= Te6edf3adversarialPacketTb4b4b4(Te6edf3randomTb4b4b4)Tb4b4b4)

Tb4b4b4}

T8b949e/** A NodeInfo with extreme identity, signal, and location values — the kind a malicious node could advertise. */

Tff7b72fun Td2a8ffadversarialNodeTb4b4b4(Te6edf3randomTb4b4b4: Te6edf3RandomTb4b4b4)Tb4b4b4: Te6edf3NodeInfo Tff7b72= Te6edf3NodeInfoTb4b4b4(

Te6edf3num Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3snr Tff7b72= Te6edf3HOSTILE_FLOATSTb4b4b4.Te6edf3randomTb4b4b4(Te6edf3randomTb4b4b4)Tb4b4b4,

Te6edf3last_heard Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3hops_away Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3user Tff7b72=

Te6edf3UserTb4b4b4(

Te6edf3id Tff7b72= Ta5d6ff"Ta5d6ff!Tffd700${Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3toUIntTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3toStringTb4b4b4(T79c0ff1T79c0ff6Tb4b4b4)Tffd700}Ta5d6ff"Tb4b4b4,

Te6edf3long_name Tff7b72= Te6edf3hostileStringTb4b4b4(Te6edf3randomTb4b4b4)Tb4b4b4,

Te6edf3short_name Tff7b72= Te6edf3hostileStringTb4b4b4(Te6edf3randomTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4,

T8b949e// Unconstrained, so trivially outside the valid +/-90 deg / +/-180 deg ranges (stored x 1e7).

Te6edf3position Tff7b72= Te6edf3PositionTb4b4b4(Te6edf3latitude_i Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4, Te6edf3longitude_i Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

T8b949e/** A MeshPacket with extreme envelope fields and a random (malformed-for-its-portnum) decoded payload. */

Tff7b72fun Td2a8ffadversarialPacketTb4b4b4(Te6edf3randomTb4b4b4: Te6edf3RandomTb4b4b4)Tb4b4b4: Te6edf3MeshPacket Tff7b72= Te6edf3MeshPacketTb4b4b4(

Te6edf3id Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3to Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3channel Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3rx_time Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3hop_limit Tff7b72= Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Tb4b4b4)Tb4b4b4,

Te6edf3decoded Tff7b72= Te6edf3DataTb4b4b4(Te6edf3payload Tff7b72= Te6edf3randomBytesTb4b4b4(Te6edf3randomTb4b4b4, Te6edf3MAX_PAYLOAD_LENTb4b4b4)Tb4b4b4.Te6edf3toByteStringTb4b4b4(Tb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

T8b949e/** Encodes the three replay sections (mirrors `replay_server.py --export` / [ReplayRadioTransport]'s reader). */

Tff7b72fun Td2a8ffassetTb4b4b4(Te6edf3configTb4b4b4: Te6edf3ListTff7b72<Te6edf3FromRadioTff7b72>Tb4b4b4, Te6edf3nodesTb4b4b4: Te6edf3ListTff7b72<Te6edf3FromRadioTff7b72>Tb4b4b4, Te6edf3packetsTb4b4b4: Te6edf3ListTff7b72<Te6edf3FromRadioTff7b72>Tb4b4b4)Tb4b4b4: Te6edf3ByteArray Tb4b4b4{

Tff7b72val Te6edf3buffer Tff7b72= Te6edf3BufferTb4b4b4(Tb4b4b4)

Tff7b72fun Td2a8ffsectionTb4b4b4(Te6edf3framesTb4b4b4: Te6edf3ListTff7b72<Te6edf3FromRadioTff7b72>Tb4b4b4, Te6edf3countedTb4b4b4: Tffa657BooleanTb4b4b4) Tb4b4b4{

Tff7b72if Tb4b4b4(Te6edf3countedTb4b4b4) Te6edf3bufferTb4b4b4.Te6edf3writeIntTb4b4b4(Te6edf3framesTb4b4b4.Te6edf3sizeTb4b4b4)

Te6edf3framesTb4b4b4.Te6edf3forEach Tb4b4b4{ Te6edf3frame Tff7b72-Tff7b72>

Tff7b72val Te6edf3bytes Tff7b72= Te6edf3frameTb4b4b4.Te6edf3encodeTb4b4b4(Tb4b4b4)

Te6edf3bufferTb4b4b4.Te6edf3writeIntTb4b4b4(Te6edf3bytesTb4b4b4.Te6edf3sizeTb4b4b4)

Te6edf3bufferTb4b4b4.Te6edf3writeTb4b4b4(Te6edf3bytesTb4b4b4)

Tb4b4b4}

Tb4b4b4}

Te6edf3sectionTb4b4b4(Te6edf3configTb4b4b4, Te6edf3counted Tff7b72= Tff7b72trueTb4b4b4)

Te6edf3sectionTb4b4b4(Te6edf3nodesTb4b4b4, Te6edf3counted Tff7b72= Tff7b72trueTb4b4b4)

Te6edf3sectionTb4b4b4(Te6edf3packetsTb4b4b4, Te6edf3counted Tff7b72= Tff7b72falseTb4b4b4)

Tff7b72return Te6edf3bufferTb4b4b4.Te6edf3readByteArrayTb4b4b4(Tb4b4b4)

Tb4b4b4}

Tff7b72private Tff7b72val Te6edf3HOSTILE_FLOATS Tff7b72=

Te6edf3listOfTb4b4b4(Tffa657FloatTb4b4b4.Te6edf3NaNTb4b4b4, Tffa657FloatTb4b4b4.Te6edf3POSITIVE_INFINITYTb4b4b4, Tffa657FloatTb4b4b4.Te6edf3NEGATIVE_INFINITYTb4b4b4, Tffa657FloatTb4b4b4.Te6edf3MAX_VALUETb4b4b4, Tff7b72-Tffa657FloatTb4b4b4.Te6edf3MAX_VALUETb4b4b4)

T8b949e// Built from code points (not literals) so the source stays ASCII — no raw bidi control to trip "trojan source"

T8b949e// linters or alarm reviewers.

Tff7b72private Tff7b72fun Td2a8ffhostileStringTb4b4b4(Te6edf3randomTb4b4b4: Te6edf3RandomTb4b4b4)Tb4b4b4: Tffa657String Tff7b72= Tff7b72when Tb4b4b4(Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(T79c0ff4Tb4b4b4)Tb4b4b4) Tb4b4b4{

T79c0ff0 Tff7b72-Tff7b72> Te6edf3RTL_OVERRIDETb4b4b4.Te6edf3repeatTb4b4b4(Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(T79c0ff1Tb4b4b4, T79c0ff8Tb4b4b4)Tb4b4b4)

T8b949e// U+202E right-to-left override runs

T79c0ff1 Tff7b72-Tff7b72> Te6edf3FIRE_EMOJITb4b4b4.Te6edf3repeatTb4b4b4(Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(T79c0ff1Tb4b4b4, T79c0ff6T79c0ff4Tb4b4b4)Tb4b4b4)

T8b949e// astral emoji (surrogate pairs)

T79c0ff2 Tff7b72-Tff7b72> Ta5d6ff"Ta5d6ffATa5d6ff"Tb4b4b4.Te6edf3repeatTb4b4b4(Te6edf3randomTb4b4b4.Te6edf3nextIntTb4b4b4(Te6edf3MAX_NAME_LENTb4b4b4)Tb4b4b4)

T8b949e// oversized name

Tff7b72else Tff7b72-Tff7b72> Ta5d6ff"Ta5d6ff" T8b949e// empty

Tb4b4b4}

Tff7b72private Tff7b72val Te6edf3RTL_OVERRIDE Tff7b72= Tffa657CharTb4b4b4(T79c0ff0Te6edf3x202ETb4b4b4)Tb4b4b4.Te6edf3toStringTb4b4b4(Tb4b4b4)

Tff7b72private Tff7b72val Te6edf3FIRE_EMOJI Tff7b72= Ta5d6ff"Tffd700${Tffa657CharTb4b4b4(T79c0ff0Te6edf3xD83DTb4b4b4)Tffd700}Tffd700${Tffa657CharTb4b4b4(T79c0ff0Te6edf3xDD25Tb4b4b4)Tffd700}Ta5d6ff" T8b949e// U+1F525 as a UTF-16 surrogate pair

Tb4b4b4}