Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
btwise
openssl
提交
f8d4b3be
O
openssl
项目概览
btwise
/
openssl
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
O
openssl
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
f8d4b3be
编写于
1月 05, 2017
作者:
K
Kurt Roeckx
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Update fuzz documentation
Reviewed-by:
N
Rich Salz
<
rsalz@openssl.org
>
GH: #2182
上级
68f4237c
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
48 addition
and
5 deletion
+48
-5
fuzz/README.md
fuzz/README.md
+48
-5
未找到文件。
fuzz/README.md
浏览文件 @
f8d4b3be
...
...
@@ -43,7 +43,8 @@ Configure for fuzzing:
-fsanitize-coverage=edge,indirect-calls,8bit-counters \
enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment enable-tls1_3 \
enable-weak-ssl-ciphers enable-rc5 enable-md2 \
enable-ssl3 enable-ssl3-method enable-nextprotoneg
enable-ssl3 enable-ssl3-method enable-nextprotoneg \
--debug
$ sudo apt-get install make
$ LDCMD=clang++ make -j
$ fuzz/helper.py $FUZZER
...
...
@@ -51,9 +52,7 @@ Configure for fuzzing:
Where $FUZZER is one of the executables in
`fuzz/`
.
If you get a crash, you should find a corresponding input file in
`fuzz/corpora/$FUZZER-crash/`
. You can reproduce the crash with
$ fuzz/$FUZZER <crashfile>
`fuzz/corpora/$FUZZER-crash/`
.
AFL
===
...
...
@@ -64,7 +63,8 @@ Configure for fuzzing:
$ CC=afl-clang-fast ./config enable-fuzz-afl no-shared -DPEDANTIC \
enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 \
enable-ssl3 enable-ssl3-method enable-nextprotoneg \
enable-ec_nistp_64_gcc_128
enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment \
--debug
$ make
The following options can also be enabled: enable-asan, enable-ubsan, enable-msan
...
...
@@ -74,3 +74,46 @@ Run one of the fuzzers:
$ afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER
Where $FUZZER is one of the executables in
`fuzz/`
.
Reproducing issues
==================
If a fuzzer generates a reproducible error, you can reproduce the problem using
the fuzz/
*
-test binaries and the file generated by the fuzzer. They binaries
don't need to be build for fuzzing, there is no need to set CC or the call
config with enable-fuzz-
*
or -fsanitize-coverage, but some of the other options
above might be needed. For instance the enable-asan or enable-ubsan option might
be useful to show you when the problem happens. For the client and server fuzzer
it might be needed to use -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to
reproduce the generated random numbers.
To reproduce the crash you can run:
$ fuzz/$FUZZER-test $file
Random numbers
==============
The client and server fuzzer normally generate random numbers as part of the TLS
connection setup. This results in the coverage of the fuzzing corpus changing
depending on the random numbers. This also has an effect for coverage of the
rest of the test suite and you see the coverage change for each commit even when
no code has been modified.
Since we want to maximize the coverage of the fuzzing corpus, the client and
server fuzzer will use predictable numbers instead of the random numbers. This
is controlled by the FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION define.
The coverage depends on the way the numbers are generated. We don't disable any
check of hashes, but the corpus has the correct hash in it for the random
numbers that were generated. For instance the client fuzzer will always generate
the same client hello with the same random number in it, and so the server, as
emulated by the file, can be generated for that client hello.
Coverage changes
================
Since the corpus depends on the default behaviour of the client and the server,
changes in what they send by default will have an impact on the coverage. The
corpus will need to be updated in that case.
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录