Skip to content

Commit e04b890

Browse files
sudden6sudden6
committed
add scripts to run the fuzzing process
This adds scripts and Dockerfiles to run the fuzzing process standalone or with OSS-Fuzz/ClusterFuzzLite integrations.
1 parent 7dd8dbd commit e04b890

File tree

10 files changed

+287
-25
lines changed

10 files changed

+287
-25
lines changed

‎.clusterfuzzlite/Dockerfile‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# c-toxcore Clusterfuzzlite build environment
2+
3+
# We want to use the latest tools always
4+
FROM gcr.io/oss-fuzz-base/base-builder:latest
5+
6+
RUN apt-get update && \
7+
apt-get -y install --no-install-suggests --no-install-recommends \
8+
cmake libtool autoconf automake pkg-config \
9+
&& apt-get clean \
10+
&& rm -rf /var/lib/apt/lists/*
11+
12+
13+
RUN git clone --depth 1 --branch 1.0.18 https://github.com/jedisct1/libsodium libsodium
14+
WORKDIR $SRC/libsodium
15+
RUN ./autogen.sh && ./configure --enable-shared=no && make install
16+
17+
# Copy your project's source code.
18+
COPY . $SRC/c-toxcore
19+
# Working directory for build.sh.
20+
WORKDIR $SRC/c-toxcore
21+
# Copy build.sh into $SRC dir.
22+
COPY ./.clusterfuzzlite/build.sh $SRC/

‎.clusterfuzzlite/build.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash -eu
2+
3+
# out of tree build
4+
cd "$WORK"
5+
6+
ls /usr/local/lib/
7+
8+
# Debug build for asserts
9+
cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER="$CC" \
10+
-DCMAKE_CXX_COMPILER="$CXX" \
11+
-DCMAKE_C_FLAGS="$CFLAGS" \
12+
-DCMAKE_CXX_FLAGS="$CXXFLAGS" \
13+
-DCMAKE_EXE_LINKER_FLAGS="$LIB_FUZZING_ENGINE" \
14+
-DBUILD_TOXAV=OFF -DENABLE_SHARED=NO -DBUILD_FUZZ_TESTS=ON \
15+
-DDHT_BOOTSTRAP=OFF -DBOOTSTRAP_DAEMON=OFF "$SRC"/c-toxcore
16+
17+
# build fuzzer target
18+
cmake --build ./ --target bootstrap_fuzzer
19+
20+
# copy to output files
21+
cp "$WORK"/bootstrap_fuzzer "$OUT"/

‎.hadolint.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,4 @@ ignored:
44
- DL3008
55
- DL3013
66
- DL3018
7+
- DL3059

‎CMakeLists.txt‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -540,18 +540,18 @@ endif()
540540
# Enabling this breaks all other tests and no network connections will be possible
541541
option(BUILD_FUZZ_TESTS "Build fuzzing harnesses" OFF)
542542
if (BUILD_FUZZ_TESTS)
543-
# For coverage tests
544-
target_compile_definitions(toxcore_static PUBLIC "FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION")
543+
# For coverage tests
544+
target_compile_definitions(toxcore_static PUBLIC "FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION")
545545

546-
# Override network and random functions
547-
add_library(fuzz_adapter testing/fuzzing/fuzz_adapter.c)
546+
# Override network and random functions
547+
add_library(fuzz_adapter testing/fuzzing/fuzz_adapter.c)
548548

549-
# Fuzzes the toxsave API
550-
add_executable(toxsave_fuzzer testing/fuzzing/toxsave_harness.cc)
551-
target_link_libraries(toxsave_fuzzer toxcore_static fuzz_adapter -fsanitize=fuzzer)
549+
# Fuzzes the toxsave API
550+
add_executable(toxsave_fuzzer testing/fuzzing/toxsave_harness.cc)
551+
target_link_libraries(toxsave_fuzzer toxcore_static fuzz_adapter -fsanitize=fuzzer)
552552

553-
# Fuzzes the bootstrap process
554-
add_executable(bootstrap_fuzzer testing/fuzzing/bootstrap_harness.cc)
555-
target_link_libraries(bootstrap_fuzzer toxcore_static fuzz_adapter -fsanitize=fuzzer)
553+
# Fuzzes the bootstrap process
554+
add_executable(bootstrap_fuzzer testing/fuzzing/bootstrap_harness.cc)
555+
target_link_libraries(bootstrap_fuzzer toxcore_static fuzz_adapter -fsanitize=fuzzer)
556556
endif()
557557

‎other/analysis/gen-file.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ CPPFLAGS+=("-Iother")
77
CPPFLAGS+=("-Iother/bootstrap_daemon/src")
88
CPPFLAGS+=("-Iother/fun")
99
CPPFLAGS+=("-Itesting")
10+
CPPFLAGS+=("-Itesting/fuzzing")
1011
CPPFLAGS+=("-Itesting/groupchats")
1112
CPPFLAGS+=("-Itoxcore")
1213
CPPFLAGS+=("-Itoxav")
@@ -44,14 +45,17 @@ callmain() {
4445

4546
put auto_tests/check_compat.h
4647

48+
# Include all C and C++ code
4749
FIND_QUERY="find . '-(' -name '*.c' -or -name '*.cc' '-)'"
50+
# Excludes
4851
FIND_QUERY="$FIND_QUERY -and -not -wholename './_build/*'"
4952
FIND_QUERY="$FIND_QUERY -and -not -wholename './super_donators/*'"
5053
FIND_QUERY="$FIND_QUERY -and -not -name amalgamation.cc"
5154
FIND_QUERY="$FIND_QUERY -and -not -name av_test.c"
5255
FIND_QUERY="$FIND_QUERY -and -not -name dht_test.c"
5356
FIND_QUERY="$FIND_QUERY -and -not -name trace.cc"
5457
FIND_QUERY="$FIND_QUERY -and -not -name version_test.c"
58+
FIND_QUERY="$FIND_QUERY -and -not -wholename './testing/fuzzing/*'"
5559

5660
readarray -t FILES <<<"$(eval "$FIND_QUERY")"
5761

‎testing/BUILD.bazel‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,3 @@ cc_binary(
5656
"//c-toxcore/toxcore",
5757
],
5858
)
59-
60-
cc_binary(
61-
name = "afl_toxsave",
62-
srcs = ["afl_toxsave.c"],
63-
deps = [
64-
"//c-toxcore/toxcore",
65-
],
66-
)

‎testing/Dockerfile‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# based on https://github.com/AFLplusplus/AFLplusplus/blob/stable/Dockerfile
2+
3+
FROM ubuntu:20.04
4+
5+
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
6+
7+
ARG DEBIAN_FRONTEND=noninteractive
8+
9+
ENV NO_ARCH_OPT 1
10+
11+
RUN apt-get update && \
12+
apt-get -y install --no-install-suggests --no-install-recommends \
13+
automake \
14+
ninja-build \
15+
bison flex \
16+
build-essential \
17+
git \
18+
python3 python3-dev python3-setuptools python-is-python3 \
19+
libtool libtool-bin \
20+
libglib2.0-dev \
21+
wget vim jupp nano bash-completion less \
22+
apt-utils apt-transport-https ca-certificates gnupg dialog \
23+
libpixman-1-dev \
24+
gnuplot-nox \
25+
screen \
26+
cmake \
27+
parallel \
28+
libsodium-dev \
29+
ninja-build\
30+
&& rm -rf /var/lib/apt/lists/*
31+
32+
RUN echo "deb http://apt.llvm.org/focal/ llvm-toolchain-focal-12 main" >> /etc/apt/sources.list && \
33+
wget -qO - https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add -
34+
35+
RUN echo "deb http://ppa.launchpad.net/ubuntu-toolchain-r/test/ubuntu focal main" >> /etc/apt/sources.list && \
36+
apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 1E9377A2BA9EF27F
37+
38+
RUN apt-get update && apt-get full-upgrade -y && \
39+
apt-get -y install --no-install-suggests --no-install-recommends \
40+
gcc-10 g++-10 gcc-10-plugin-dev gcc-10-multilib gcc-multilib gdb lcov \
41+
clang-12 clang-tools-12 libc++1-12 libc++-12-dev \
42+
libc++abi1-12 libc++abi-12-dev libclang1-12 libclang-12-dev \
43+
libclang-common-12-dev libclang-cpp12 libclang-cpp12-dev liblld-12 \
44+
liblld-12-dev liblldb-12 liblldb-12-dev libllvm12 libomp-12-dev \
45+
libomp5-12 lld-12 lldb-12 llvm-12 llvm-12-dev llvm-12-runtime llvm-12-tools \
46+
&& rm -rf /var/lib/apt/lists/*
47+
48+
RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-10 0
49+
RUN update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-10 0
50+
51+
ENV LLVM_CONFIG=llvm-config-12
52+
ENV AFL_SKIP_CPUFREQ=1
53+
ENV AFL_TRY_AFFINITY=1
54+
ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
55+
56+
RUN git clone --depth=1 https://github.com/vanhauser-thc/afl-cov /afl-cov
57+
WORKDIR /afl-cov
58+
RUN make install
59+
60+
RUN git clone --depth=1 https://github.com/AFLplusplus/AFLplusplus /AFLplusplus
61+
WORKDIR /AFLplusplus
62+
RUN export CC=gcc-10 && export CXX=g++-10 && make install
63+
64+
RUN echo '. /etc/bash_completion' >> ~/.bashrc
65+
RUN echo 'alias joe="joe --wordwrap --joe_state -nobackup"' >> ~/.bashrc
66+
ENV IS_DOCKER="1"
67+
ENV CMAKE_GENERATOR=Ninja

‎testing/coverage_live.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/sh
2+
3+
# Move to repo root
4+
cd ../
5+
6+
# Run code coverage only on minized corpus to save time
7+
afl-cov --cover-corpus -d ./_afl_out --overwrite --live --coverage-cmd "_cov_build/bootstrap_fuzzer @@" --code-dir ../

‎testing/distill_corpus.sh‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/bin/sh
2+
3+
HARNESS_BIN="../_afl_build/bootstrap_fuzzer"
4+
COV_BIN="../_cov_build/bootstrap_fuzzer"
5+
# move to repo root
6+
cd ../
7+
8+
cd _afl_out/
9+
10+
# Perform corpus minimization
11+
mkdir -p corpus-cmin
12+
rm corpus-cmin/*
13+
14+
afl-cmin -i fuzz0/queue/ -o corpus-cmin/ -- "$HARNESS_BIN"
15+
16+
# Minimize each testcase
17+
mkdir -p corpus-tmin
18+
rm corpus-tmin/*
19+
20+
# afl-tmin is VERY slow
21+
# massive parallel bash piping for the rescue
22+
find corpus-cmin/ -maxdepth 1 -type f |
23+
parallel --bar --joblog ./parallel.log afl-tmin -i ./corpus-cmin/{/} -o ./corpus-tmin/{/} -- "$HARNESS_BIN"
24+
25+
# in case the tmin-process was aborted, just copy non-minimized files
26+
cp -n ./corpus-cmin/* ./corpus-tmin
27+
28+
# hack to let afl-cov run code coverage on our minimal corpus
29+
30+
rm -R corpus-cov
31+
mkdir -p corpus-cov/queue
32+
33+
cp corpus-tmin/* corpus-cov/queue
34+
35+
# Run code coverage only on minized corpus to save time
36+
afl-cov --cover-corpus -d ./corpus-cov --overwrite --coverage-cmd "$COV_BIN @@" --code-dir ../

‎testing/run_afl.sh‎

Lines changed: 119 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,126 @@
1-
#! /bin/sh
1+
#!/bin/sh
2+
3+
COMMON_CMAKE_OPTIONS="-DCMAKE_C_COMPILER=afl-clang-lto -DCMAKE_CXX_COMPILER=afl-clang-lto++ -DBUILD_TOXAV=OFF -DENABLE_SHARED=NO -DBUILD_FUZZ_TESTS=ON -DDHT_BOOTSTRAP=OFF -DBOOTSTRAP_DAEMON=OFF"
24

35
# move to repo root
46
cd ../
5-
rm -R _afl_build
6-
mkdir _afl_build
7+
8+
# build fuzzer target UBSAN
9+
mkdir -p _afl_build_ubsan
10+
cd _afl_build_ubsan
11+
12+
export AFL_USE_UBSAN=1
13+
14+
# build c-toxcore using afl instrumentation
15+
cmake -DCMAKE_BUILD_TYPE=Debug "$COMMON_CMAKE_OPTIONS" ..
16+
17+
# build fuzzer target
18+
cmake --build ./ --target bootstrap_fuzzer
19+
20+
unset AFL_USE_UBSAN
21+
22+
cd ..
23+
24+
# build fuzzer target MSAN
25+
mkdir -p _afl_build_msan
26+
cd _afl_build_msan
27+
28+
export AFL_USE_MSAN=1
29+
30+
# build c-toxcore using afl instrumentation
31+
cmake -DCMAKE_BUILD_TYPE=Debug "$COMMON_CMAKE_OPTIONS" ..
32+
33+
# build fuzzer target
34+
cmake --build ./ --target bootstrap_fuzzer
35+
36+
unset AFL_USE_MSAN
37+
38+
cd ..
39+
40+
# build fuzzer target ASAN
41+
mkdir -p _afl_build_asan
42+
cd _afl_build_asan
43+
44+
export AFL_USE_ASAN=1
45+
46+
# build c-toxcore using afl instrumentation
47+
cmake -DCMAKE_BUILD_TYPE=Debug "$COMMON_CMAKE_OPTIONS" ..
48+
49+
# build fuzzer target
50+
cmake --build ./ --target bootstrap_fuzzer
51+
52+
unset AFL_USE_ASAN
53+
54+
cd ..
55+
56+
# build fuzzer target without sanitizers for afl-tmin
57+
mkdir -p _afl_build
758
cd _afl_build
859

960
# build c-toxcore using afl instrumentation
10-
cmake -DCMAKE_C_COMPILER=afl-clang -DBUILD_MISC_TESTS=ON ..
11-
make
61+
cmake -DCMAKE_BUILD_TYPE=Debug "$COMMON_CMAKE_OPTIONS" ..
62+
63+
# build fuzzer target
64+
cmake --build ./ --target bootstrap_fuzzer
65+
66+
cd ..
67+
68+
# build fuzzer target with CmpLog
69+
mkdir -p _afl_build_cmplog
70+
cd _afl_build_cmplog
71+
72+
export AFL_LLVM_CMPLOG=1
73+
74+
# build c-toxcore using afl instrumentation
75+
cmake -DCMAKE_BUILD_TYPE=Debug "$COMMON_CMAKE_OPTIONS" ..
76+
77+
# build fuzzer target
78+
cmake --build ./ --target bootstrap_fuzzer
79+
80+
unset AFL_LLVM_CMPLOG
81+
82+
cd ..
83+
84+
# build fuzzer target for code coverage
85+
mkdir -p _cov_build
86+
cd _cov_build
87+
88+
# build c-toxcore using afl instrumentation
89+
cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_FLAGS="-fprofile-arcs -ftest-coverage" -DCMAKE_C_FLAGS="-fprofile-arcs -ftest-coverage" -DCMAKE_VERBOSE_MAKEFILE=ON "$COMMON_CMAKE_OPTIONS" ..
90+
91+
# build fuzzer target
92+
cmake --build ./ --target bootstrap_fuzzer
93+
94+
# back to repo root
95+
cd ../
96+
97+
# Create fuzzer working directory
98+
99+
mkdir -p _afl_out
100+
101+
AFL_ARGS='-i testing/afl_testdata/tox_bootstraps/ -o _afl_out'
102+
103+
export AFL_IMPORT_FIRST=1
104+
export AFL_AUTORESUME=1
105+
106+
# faster startup
107+
export AFL_FAST_CAL=1
108+
109+
echo "connect to the fuzzers using: screen -x fuzz"
110+
echo "if fuzzing doesn't start execute the following as root:"
111+
echo ""
112+
echo "echo core >/proc/sys/kernel/core_pattern"
113+
echo "echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor"
114+
115+
# Main fuzzer, keeps complete corpus
116+
screen -dmS fuzz afl-fuzz -M fuzz0 "$AFL_ARGS" -c ./_afl_build_cmplog/bootstrap_fuzzer ./_afl_build/bootstrap_fuzzer
117+
sleep 10s
118+
119+
# Secondary fuzzers
120+
screen -S fuzz -X screen afl-fuzz -S fuzz1 "$AFL_ARGS" -- ./_afl_build_msan/bootstrap_fuzzer
121+
sleep 1s
122+
123+
screen -S fuzz -X screen afl-fuzz -S fuzz2 "$AFL_ARGS" ./_afl_build_ubsan/bootstrap_fuzzer
124+
sleep 1s
12125

13-
# start fuzzing
14-
afl-fuzz -i ../testing/afl_testdata/tox_saves/ -o afl_out/ ./afl_toxsave @@
126+
screen -S fuzz -X screen afl-fuzz -S fuzz3 "$AFL_ARGS" ./_afl_build_asan/bootstrap_fuzzer

0 commit comments

Comments
 (0)