1# Fuzz testing
2
3Modern fuzz testers are very effective and we wish to use them to ensure that no silly bugs creep into BoringSSL.
4
5We use Clang's [libFuzzer](http://llvm.org/docs/LibFuzzer.html) for fuzz testing and there are a number of fuzz testing functions in `fuzz/`. They are not built by default because they require that the rest of BoringSSL be built with some changes that make fuzzing much more effective, but are completely unsafe for real use.
6
7In order to build the fuzz tests you will need at least Clang 6.0. Pass `-DFUZZ=1` on the CMake command line to enable building BoringSSL with coverage and AddressSanitizer, and to build the fuzz test binaries. You'll probably need to set the `CC` and `CXX` environment variables too, like this:
8
9```
10mkdir build
11cd build
12CC=clang CXX=clang++ cmake -GNinja -DFUZZ=1 ..
13ninja
14```
15
16
17From the `build/` directory, you can then run the fuzzers. For example:
18
19```
20./fuzz/cert -max_len=10000 -jobs=32 -workers=32 ../fuzz/cert_corpus/
21```
22
23The arguments to `jobs` and `workers` should be the number of cores that you wish to dedicate to fuzzing. By default, libFuzzer uses the largest test in the corpus (or 64 if empty) as the maximum test case length. The `max_len` argument overrides this.
24
25The recommended values of `max_len` for each test are:
26
27| Test          | `max_len` value |
28|---------------|-----------------|
29| `bn_div`      | 384             |
30| `bn_mod_exp`  | 4096            |
31| `cert`        | 10000           |
32| `client`      | 20000           |
33| `pkcs8`       | 2048            |
34| `privkey`     | 2048            |
35| `server`      | 4096            |
36| `session`     | 8192            |
37| `spki`        | 1024            |
38| `read_pem`    | 512             |
39| `ssl_ctx_api` | 256             |
40
41These were determined by rounding up the length of the largest case in the corpus.
42
43There are directories in `fuzz/` for each of the fuzzing tests which contain seed files for fuzzing. Some of the seed files were generated manually but many of them are “interesting” results generated by the fuzzing itself. (Where “interesting” means that it triggered a previously unknown path in the code.)
44
45## Minimising the corpuses
46
47When a large number of new seeds are available, it's a good idea to minimise the corpus so that different seeds that trigger the same code paths can be deduplicated.
48
49In order to minimise all the corpuses, build for fuzzing and run `./fuzz/minimise_corpuses.sh`. Note that minimisation is, oddly, often not idempotent for unknown reasons.
50
51## Fuzzer mode
52
53When `-DFUZZ=1` is passed into CMake, BoringSSL builds with `BORINGSSL_UNSAFE_FUZZER_MODE` and `BORINGSSL_UNSAFE_DETERMINISTIC_MODE` defined. This modifies the library to be more friendly to fuzzers. If `BORINGSSL_UNSAFE_DETERMINISTIC_MODE` is set, BoringSSL will:
54
55* Replace `RAND_bytes` with a deterministic PRNG. Call `RAND_reset_for_fuzzing()` at the start of fuzzers which use `RAND_bytes` to reset the PRNG state.
56
57* Use a hard-coded time instead of the actual time.
58
59Additionally, if `BORINGSSL_UNSAFE_FUZZER_MODE` is set, BoringSSL will:
60
61* Modify the TLS stack to perform all signature checks (CertificateVerify and ServerKeyExchange) and the Finished check, but always act as if the check succeeded.
62
63* Treat every cipher as the NULL cipher.
64
65* Tickets are unencrypted and the MAC check is performed but ignored.
66
67* renegotiation\_info checks are ignored.
68
69This is to prevent the fuzzer from getting stuck at a cryptographic invariant in the protocol.
70
71## TLS transcripts
72
73The `client` and `server` corpora are seeded from the test suite. The test suite has a `-fuzzer` flag which mirrors the fuzzer mode changes above and a `-deterministic` flag which removes all non-determinism on the Go side. Not all tests pass, so `ssl/test/runner/fuzzer_mode.json` contains the necessary suppressions. The `run_tests` target will pass appropriate command-line flags.
74
75There are separate corpora, `client_corpus_no_fuzzer_mode` and `server_corpus_no_fuzzer_mode`. These are transcripts for fuzzers with only `BORINGSSL_UNSAFE_DETERMINISTIC_MODE` defined. To build in this mode, pass `-DNO_FUZZER_MODE=1` into CMake. This configuration is run in the same way but without `-fuzzer` and `-shim-config` flags.
76
77If both sets of tests pass, refresh the fuzzer corpora with `refresh_ssl_corpora.sh`:
78
79```
80cd fuzz
81./refresh_ssl_corpora.sh /path/to/fuzzer/mode/build /path/to/non/fuzzer/mode/build
82```
83