Skip to content

Commit 1339df8

Browse files
committed
Implement fuzz testing
This commit implements fuzz testing through libFuzzer and the framework around it to continuously run the fuzzer in a Docker container, along with a service that checks for updates on the repo. The service builds the Docker image and launches the fuzzer, after which it waits for any update to the service. Given that the fuzzing corpus will remain in-place, whenever fuzzing is restarted for another service version, it will take off from the already existing cases. The Docker image has all the required components to run all the current providers - Mbed, PKCS11 and TPM - and to continuously fuzz the service through a stub version of the frontend handler. If a crash is detected, the fuzzer will notify the team and continue fuzzing. Signed-off-by: Ionut Mihalcea <[email protected]>
1 parent e3ce785 commit 1339df8

20 files changed

+1637
-0
lines changed

.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@
44
tags
55
*DS_Store
66
*.patch
7+
mappings/
8+
NVChip

Cargo.lock

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Cargo.toml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ tss-esapi = { version = "2.0.0", optional = true }
3030
bincode = "1.1.4"
3131
structopt = "0.3.5"
3232
derivative = "1.0.3"
33+
arbitrary = { version = "0.4.0", features = ["derive"], optional = true }
3334

3435
[dev-dependencies]
3536
parsec-client-test = { git = "https://github.com/parallaxsecond/parsec-client-test", tag = "0.1.13" }

README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,10 @@ This project uses the following third party crates:
104104
* bincode (MIT)
105105
* structopt (MIT and Apache-2.0)
106106
* derivative (MIT and Apache-2.0)
107+
* arbitrary (MIT and Apache-2.0)
108+
* libfuzzer-sys (MIT, Apache-2.0 and NCSA)
109+
* flexi_logger (MIT and Apache-2.0)
110+
* lazy_static (MIT and Apache-2.0)
107111

108112
This project uses the following third party libraries:
109113
* [Mbed Crypto](https://github.com/ARMmbed/mbed-crypto) (Apache-2.0)

fuzz.sh

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/usr/bin/env bash
2+
3+
# ------------------------------------------------------------------------------
4+
# Copyright (c) 2020, Arm Limited, All Rights Reserved
5+
# SPDX-License-Identifier: Apache-2.0
6+
#
7+
# Licensed under the Apache License, Version 2.0 (the "License"); you may
8+
# not use this file except in compliance with the License.
9+
# You may obtain a copy of the License at
10+
#
11+
# http:#www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
# ------------------------------------------------------------------------------
19+
20+
FUZZ_CONTAINER_NAME=parsec_fuzzer
21+
CLEANUP_CONTAINER_NAME=parsec_fuzzer_cleanup
22+
23+
set -e
24+
25+
if [[ "$1" == "run" ]]
26+
then
27+
# Set up fuzz folder
28+
docker run --rm -v $(pwd):/parsec -w /parsec/fuzz --name $CLEANUP_CONTAINER_NAME parsec/fuzz ./cleanup.sh
29+
# A copy of the config file is used because the file is modified during the run
30+
cp fuzz/config.toml fuzz/run_config.toml
31+
32+
# Build Docker image
33+
docker build fuzz/docker -t parsec/fuzz
34+
35+
# Stop previous container and run fuzzer
36+
docker kill $FUZZ_CONTAINER_NAME || true
37+
sleep 5s
38+
docker run -d --rm -v $(pwd):/parsec -w /parsec/fuzz --name $FUZZ_CONTAINER_NAME parsec/fuzz ./run_fuzz.sh
39+
elif [[ "$1" == "stop" ]]
40+
then
41+
docker kill $FUZZ_CONTAINER_NAME
42+
elif [[ "$1" == "follow" ]]
43+
then
44+
docker logs -f --tail 100 $FUZZ_CONTAINER_NAME
45+
elif [[ "$1" == "clean" ]]
46+
then
47+
# Cleanup is done via Docker because on some systems ACL settings prevent the user who
48+
# created a container from removing the files created by said container. Another one
49+
# is needed to do the cleanup.
50+
docker run -d --rm -v $(pwd):/parsec -w /parsec/fuzz --name $CLEANUP_CONTAINER_NAME parsec/fuzz ./cleanup.sh
51+
elif [[ "$1" == "erase" ]]
52+
then
53+
docker run -d --rm -v $(pwd):/parsec -w /parsec/fuzz -e "ERASE=true" --name $CLEANUP_CONTAINER_NAME parsec/fuzz ./cleanup.sh
54+
else
55+
echo "usage: ./fuzz.sh [COMMAND]
56+
57+
Commands:
58+
'run' - builds the fuzzing container and runs the fuzzer
59+
'stop' - stops the fuzzing container
60+
'follow' - prints and follows the log output of the fuzzing container
61+
'clean' - clean up the fuzzing environment (does not remove artifacts or the fuzz corpus)
62+
'erase' - fully clean the fuzzing environment - WARNING: this will remove all the results of previous runs"
63+
fi

fuzz/.gitignore

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
target
3+
corpus
4+
artifacts
5+
*.log
6+
run_config.toml
7+
NVChip

0 commit comments

Comments
 (0)