mirror of
https://boringssl.googlesource.com/boringssl
synced 2026-07-21 14:43:51 +00:00
David Benjamin
56383dabf4
Instead of having a pair of bespoke build definitions use the standard FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION toggle. We actually originated the idea of a fuzzing-specific build toggle, and then libFuzzer standardized a toggle when we talked to them about what we were doing. The problem is our fuzzer mode toggle substantially changed the TLS stack behavior, such that downstream code would likely go haywire. So we couldn't easily fold into the standard one, and all of BoringSSL's downstream fuzzer builds were messy. Instead, make a few changes: 1. Switch BORINGSSL_UNSAFE_DETERMINISTIC_MODE to FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION. That flag is not expected to cause downstream issues as it just makes the PRNG deterministic. 2. Replace BORINGSSL_UNSAFE_FUZZER_MODE with a runtime toggle that is only available when building with FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION. 3. Instead of the no_fuzzer_mode fuzzers being special corpora for the client and server fuzzers, they're now just separate fuzzerrs and follow the usual naming conventions between fuzzers and their corpora. Update-Note: Downstream fuzzer builds can now be simplified. If the fuzzing infrastructure already builds with FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION, the separate boringssl_fuzz (or whatever) target can be removed. Bug: 42290128 Change-Id: Ia1e479777f366908951e15067c96c9767c229f0a Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/77749 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com>
100 lines
2.9 KiB
Bash
Executable File
100 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# Copyright 2016 The BoringSSL Authors
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# https://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
set -ex
|
|
|
|
if [[ $# -ne 1 ]]; then
|
|
echo "Usage: $0 build_dir"
|
|
exit 1
|
|
fi
|
|
|
|
build_dir=$1
|
|
|
|
|
|
# Sanity-check the build directory.
|
|
|
|
if ! grep -q '^FUZZ:' "$build_dir/CMakeCache.txt"; then
|
|
echo "$build_dir was not built with -DFUZZ=1"
|
|
exit 1
|
|
fi
|
|
|
|
# Sanity-check the current working directory.
|
|
|
|
assert_directory() {
|
|
if [[ ! -d $1 ]]; then
|
|
echo "$1 not found."
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
assert_directory client_corpus
|
|
assert_directory client_no_fuzzer_mode_corpus
|
|
assert_directory server_corpus
|
|
assert_directory server_no_fuzzer_mode_corpus
|
|
assert_directory dtls_client_corpus
|
|
assert_directory dtls_server_corpus
|
|
|
|
|
|
# Gather new transcripts. Ignore errors in running the tests.
|
|
|
|
shim="$(readlink -f "$build_dir")/ssl/test/bssl_shim"
|
|
handshaker="$(readlink -f "$build_dir")/ssl/test/handshaker"
|
|
|
|
fuzzer_mode_transcripts=$(mktemp -d '/tmp/boringssl-transcript-fuzzer-mode.XXXXXX')
|
|
no_fuzzer_mode_transcripts=$(mktemp -d '/tmp/boringssl-transcript-no-fuzzer-mode.XXXXXX')
|
|
|
|
echo Recording fuzzer-mode transcripts
|
|
(cd ../ssl/test/runner/ && go test \
|
|
-shim-path "$shim" \
|
|
-handshaker-path "$handshaker" \
|
|
-transcript-dir "$fuzzer_mode_transcripts" \
|
|
-fuzzer \
|
|
-deterministic) || true
|
|
|
|
echo Recording non-fuzzer-mode transcripts
|
|
(cd ../ssl/test/runner/ && go test \
|
|
-shim-path "$shim" \
|
|
-handshaker-path "$handshaker" \
|
|
-transcript-dir "$no_fuzzer_mode_transcripts" \
|
|
-deterministic)
|
|
|
|
|
|
# Update corpora.
|
|
|
|
update_corpus() {
|
|
local fuzzer_name="$1"
|
|
local transcript_dir="$2"
|
|
|
|
local fuzzer="$build_dir/fuzz/$fuzzer_name"
|
|
local corpus="${fuzzer_name}_corpus"
|
|
|
|
echo "Minimizing ${corpus}"
|
|
mv "$corpus" "${corpus}_old"
|
|
mkdir "$corpus"
|
|
"$fuzzer" -max_len=50000 -merge=1 "$corpus" "${corpus}_old"
|
|
rm -Rf "${corpus}_old"
|
|
|
|
echo "Merging transcripts from ${transcript_dir} into ${corpus}"
|
|
"$fuzzer" -max_len=50000 -merge=1 "$corpus" "$transcript_dir"
|
|
}
|
|
|
|
update_corpus client "${fuzzer_mode_transcripts}/tls/client"
|
|
update_corpus server "${fuzzer_mode_transcripts}/tls/server"
|
|
update_corpus client_no_fuzzer_mode "${no_fuzzer_mode_transcripts}/tls/client"
|
|
update_corpus server_no_fuzzer_mode "${no_fuzzer_mode_transcripts}/tls/server"
|
|
update_corpus dtls_client "${fuzzer_mode_transcripts}/dtls/client"
|
|
update_corpus dtls_server "${fuzzer_mode_transcripts}/dtls/server"
|
|
update_corpus decode_client_hello_inner "${fuzzer_mode_transcripts}/decode_client_hello_inner"
|