Skip to content
This repository has been archived by the owner on Apr 17, 2019. It is now read-only.

Ordering service fuzzing #1829

Merged
merged 7 commits into from
Nov 7, 2018
Merged

Ordering service fuzzing #1829

merged 7 commits into from
Nov 7, 2018

Conversation

luckychess
Copy link
Contributor

Description of the Change

This pull request adds 2 fuzzing targets for ordering service endpoints.

Benefits

One more possibility to find bugs and issues in the code.

Possible Drawbacks

Hard to support until we have fuzzing in CI.

Usage Examples or Tests

cmake -DCMAKE_C_COMPILER=/usr/local/opt/llvm/bin/clang -DCMAKE_CXX_COMPILER=/usr/local/opt/llvm/bin/clang++  -DFUZZING=ON ..
make send_batches_fuzz
make request_proposal_fuzz

@luckychess luckychess requested review from l4l and Akvinikym November 1, 2018 19:13
@l4l l4l mentioned this pull request Nov 3, 2018
@l4l l4l added needs-review pr awaits review from maintainers security labels Nov 3, 2018
std::shared_ptr<OnDemandOsServerGrpc> server_;

auto proposal_factory = std::make_unique<MockUnsafeProposalFactory>();
ordering_service_ = std::make_shared<OnDemandOrderingServiceImpl>(data[0], std::move(proposal_factory));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. transaction_limit has size_t, so it might be better give at least 2 bytes, instead of one
  2. there's number_of_proposals that also might be fuzzed
  3. might be initial_round is also applicable for a fuzzing as well, though not sure

Same for the next test

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, i thought about it. In my opinion the main purpose of fuzzing is to find ways how iroha could be broken via some malicious input. That means a typical ordering gate under attack will probably be initialised with more or less default parameter values.
Feel free to discuss though.

@l4l l4l added needs-correction pr/rfc is not completed and might be updated and removed needs-review pr awaits review from maintainers labels Nov 4, 2018
#include <gtest/gtest.h>
#include <libfuzzer/libfuzzer_macro.h>
#include "ordering/impl/on_demand_ordering_service_impl.hpp"
#include <memory>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and again wrong :( use this:

#include <memory>

#include <gtest/gtest.h>
#include <libfuzzer/libfuzzer_macro.h>

#include "backend/protobuf/proto_transport_factory.hpp"
...

@l4l l4l added needs-review pr awaits review from maintainers and removed needs-correction pr/rfc is not completed and might be updated labels Nov 6, 2018
@l4l l4l requested a review from Akvinikym November 6, 2018 17:59
Signed-off-by: luckychess <[email protected]>
@luckychess luckychess merged commit 6f57d24 into dev Nov 7, 2018
@luckychess luckychess deleted the feature/os_fuzzing branch November 7, 2018 10:08
@l4l l4l removed the needs-review pr awaits review from maintainers label Nov 7, 2018
igor-egorov pushed a commit that referenced this pull request Nov 12, 2018
* Add OS fuzzing for SendBatches endpoint
* Add fuzzing for request proposal endpoint

Signed-off-by: luckychess <[email protected]>
Signed-off-by: Konstantin Munichev <[email protected]>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants