• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1# I Can Haz Fuzz?
2
3LibFuzzer
4=========
5
6Or, how to fuzz OpenSSL with [libfuzzer](http://llvm.org/docs/LibFuzzer.html).
7
8Starting from a vanilla+OpenSSH server Ubuntu install.
9
10Use Chrome's handy recent build of clang. Older versions may also work.
11
12    $ sudo apt-get install git
13    $ mkdir git-work
14    $ git clone https://chromium.googlesource.com/chromium/src/tools/clang
15    $ clang/scripts/update.py
16
17You may want to git pull and re-run the update from time to time.
18
19Update your path:
20
21    $ PATH=~/third_party/llvm-build/Release+Asserts/bin/:$PATH
22
23Get and build libFuzzer (there is a git mirror at
24https://github.com/llvm-mirror/llvm/tree/master/lib/Fuzzer if you prefer):
25
26    $ cd
27    $ sudo apt-get install subversion
28    $ mkdir svn-work
29    $ cd svn-work
30    $ svn co https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer Fuzzer
31    $ cd Fuzzer
32    $ clang++ -c -g -O2 -std=c++11 *.cpp
33    $ ar r libFuzzer.a *.o
34    $ ranlib libFuzzer.a
35
36Configure for fuzzing:
37
38    $ CC=clang ./config enable-fuzz-libfuzzer \
39            --with-fuzzer-include=../../svn-work/Fuzzer \
40            --with-fuzzer-lib=../../svn-work/Fuzzer/libFuzzer.a \
41            -DPEDANTIC enable-asan enable-ubsan no-shared \
42            -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \
43            -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp \
44            enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment enable-tls1_3 \
45            enable-weak-ssl-ciphers enable-rc5 enable-md2 \
46            enable-ssl3 enable-ssl3-method enable-nextprotoneg \
47            --debug
48    $ sudo apt-get install make
49    $ LDCMD=clang++ make -j
50    $ fuzz/helper.py $FUZZER
51
52Where $FUZZER is one of the executables in `fuzz/`.
53
54If you get a crash, you should find a corresponding input file in
55`fuzz/corpora/$FUZZER-crash/`.
56
57AFL
58===
59
60Configure for fuzzing:
61
62    $ sudo apt-get install afl-clang
63    $ CC=afl-clang-fast ./config enable-fuzz-afl no-shared -DPEDANTIC \
64        enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 \
65        enable-ssl3 enable-ssl3-method enable-nextprotoneg \
66        enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment \
67        --debug
68    $ make
69
70The following options can also be enabled: enable-asan, enable-ubsan, enable-msan
71
72Run one of the fuzzers:
73
74    $ afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER
75
76Where $FUZZER is one of the executables in `fuzz/`.
77
78Reproducing issues
79==================
80
81If a fuzzer generates a reproducible error, you can reproduce the problem using
82the fuzz/*-test binaries and the file generated by the fuzzer. They binaries
83don't need to be build for fuzzing, there is no need to set CC or the call
84config with enable-fuzz-* or -fsanitize-coverage, but some of the other options
85above might be needed. For instance the enable-asan or enable-ubsan option might
86be useful to show you when the problem happens. For the client and server fuzzer
87it might be needed to use -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to
88reproduce the generated random numbers.
89
90To reproduce the crash you can run:
91
92    $ fuzz/$FUZZER-test $file
93
94Random numbers
95==============
96
97The client and server fuzzer normally generate random numbers as part of the TLS
98connection setup. This results in the coverage of the fuzzing corpus changing
99depending on the random numbers. This also has an effect for coverage of the
100rest of the test suite and you see the coverage change for each commit even when
101no code has been modified.
102
103Since we want to maximize the coverage of the fuzzing corpus, the client and
104server fuzzer will use predictable numbers instead of the random numbers. This
105is controlled by the FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION define.
106
107The coverage depends on the way the numbers are generated. We don't disable any
108check of hashes, but the corpus has the correct hash in it for the random
109numbers that were generated. For instance the client fuzzer will always generate
110the same client hello with the same random number in it, and so the server, as
111emulated by the file, can be generated for that client hello.
112
113Coverage changes
114================
115
116Since the corpus depends on the default behaviour of the client and the server,
117changes in what they send by default will have an impact on the coverage. The
118corpus will need to be updated in that case.
119
120Updating the corpus
121===================
122
123The client and server corpus is generated with multiple config options:
124- The options as documented above
125- Without enable-ec_nistp_64_gcc_128 and without --debug
126- With no-asm
127- Using 32 bit
128- A default config, plus options needed to generate the fuzzer.
129
130The libfuzzer merge option is used to add the additional coverage
131from each config to the minimal set.
132