fuzz

package
v1.0.0-alpha.10.5 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 18, 2020 License: GPL-3.0 Imports: 25 Imported by: 0

README

Prysm Fuzz Testing

fuzzit

Adding a fuzz test

Fuzz testing attempts to find crash level bugs within the tested code paths, but could also be used as a sanity check certain logic.

1) Determining an ideal target

A fuzz test inputs pseudo-random data to a given method and attempts to find input data that tests as many code branches as possible. When choosing a target to test, consider that the method under test should be as stateless as possible. While stateful methods (i.e. methods that use a cache), can be tested, they are often hard to reproduce in a regression test. Consider disabling any caches or persistence layers if possible.

2) Writing a fuzz test

First, you need to determine in your input data. The current test suite uses SSZ encoded bytes to deserialize to input objects.

Example: Block header input data

type InputBlockHeader struct {
	StateID uint16
	Block   *ethpb.BeaconBlock
}

You'll also want to add that struct to //fuzz:ssz_generated_files to generate the custom fast SSZ methods for serialization to improve test performance.

Your fuzz test must accept a single argument of type []byte. The return types are ignored by libfuzzer, but might be useful for other applications such as beacon-fuzz. Be sure to name your test file with the _fuzz.go suffix for consistency.

func MyExampleFuzz(b []byte) {
    input := &MyFuzzInputData{}
    if err := ssz.Unmarshal(b, input); err != nil {
       return // Input bytes doesn't serialize to input object.
    }
    
    result, err := somePackage.MethodUnderTest(input)
    if err != nil {
       // Input was invalid for processing, but the method didn't panic so that's OK.
       return 
    }
    // Optional: sanity check the resulting data.
    if result < 0 {
       panic("MethodUnderTest should never return a negative number") // Fail!
    }
}
3) Add your fuzz target to fuzz/BUILD.bazel

Since we are using some custom rules to generate the fuzz test instrumentation and appropriate libfuzz testing suite, we cannot rely on gazelle to generate these targets for us.

go_fuzz_test(
    name = "example_fuzz_test",
    srcs = [
        "example_fuzz.go",
    ] + COMMON_SRCS, # common and input type files.
    corpus = "example_corpus",
    corpus_path = "fuzz/example_corpus", # Path from root of project
    func = "MyExampleFuzz",
    importpath = IMPORT_PATH,
    deps = [
        # Deps used in your fuzz test.
    ] + COMMON_DEPS,
)

Be sure to add your target to the test suite at //fuzz:fuzz_tests.

4) Run your fuzz test

To run your fuzz test you must manually target it with bazel test and run with the config flag --config=fuzz.

bazel test //fuzz:example_fuzz_test --config=fuzz

Running fuzzit regression tests

To run fuzzit regression tests, you can run the fuzz test suite with the 1--config=fuzzit` configuration flag. Note: This requires docker installed on your machine. See fuzzitdev/fuzzit#58.

bazel test //fuzz:fuzz_tests --config=fuzzit

If the same command above is run with the FUZZIT_API_KEY environment variable set, then the fuzzit test targets will be uploaded and restarted at https://app.fuzzit.dev.

Documentation

Overview

Code generated by fastssz. DO NOT EDIT.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func BeaconFuzzAttestation

func BeaconFuzzAttestation(b []byte) ([]byte, bool)

BeaconFuzzAttestation implements libfuzzer and beacon fuzz interface.

func BeaconFuzzAttesterSlashing

func BeaconFuzzAttesterSlashing(b []byte) ([]byte, bool)

BeaconFuzzAttesterSlashing implements libfuzzer and beacon fuzz interface.

func BeaconFuzzBlock

func BeaconFuzzBlock(b []byte) ([]byte, bool)

BeaconFuzzBlock using the corpora from sigp/beacon-fuzz.

func BeaconFuzzBlockHeader

func BeaconFuzzBlockHeader(b []byte) ([]byte, bool)

BeaconFuzzBlockHeader using the corpora from sigp/beacon-fuzz.

func BeaconFuzzDeposit

func BeaconFuzzDeposit(b []byte) ([]byte, bool)

BeaconFuzzDeposit implements libfuzzer and beacon fuzz interface.

func BeaconFuzzP2PRPCStatus

func BeaconFuzzP2PRPCStatus(b []byte)

BeaconFuzzP2PRPCStatus implements libfuzzer and beacon fuzz interface.

func BeaconFuzzSSZCache

func BeaconFuzzSSZCache(input []byte)

BeaconFuzzSSZCache for testing critical paths along the ssz cache for beacon state HTR.

func BeaconFuzzVoluntaryExit

func BeaconFuzzVoluntaryExit(b []byte) ([]byte, bool)

BeaconFuzzVoluntaryExit implements libfuzzer and beacon fuzz interface.

Types

type InputAttestationWrapper

type InputAttestationWrapper struct {
	StateID     uint16
	Attestation *ethpb.Attestation
}

InputAttestationWrapper for fuzz testing attestations.

func (*InputAttestationWrapper) MarshalSSZ

func (i *InputAttestationWrapper) MarshalSSZ() ([]byte, error)

MarshalSSZ ssz marshals the InputAttestationWrapper object

func (*InputAttestationWrapper) MarshalSSZTo

func (i *InputAttestationWrapper) MarshalSSZTo(dst []byte) ([]byte, error)

MarshalSSZTo ssz marshals the InputAttestationWrapper object to a target array

func (*InputAttestationWrapper) SizeSSZ

func (i *InputAttestationWrapper) SizeSSZ() (size int)

SizeSSZ returns the ssz encoded size in bytes for the InputAttestationWrapper object

func (*InputAttestationWrapper) UnmarshalSSZ

func (i *InputAttestationWrapper) UnmarshalSSZ(buf []byte) error

UnmarshalSSZ ssz unmarshals the InputAttestationWrapper object

type InputAttesterSlashingWrapper

type InputAttesterSlashingWrapper struct {
	StateID          uint16
	AttesterSlashing *ethpb.AttesterSlashing
}

InputAttesterSlashingWrapper for fuzz testing attester slashing.

func (*InputAttesterSlashingWrapper) MarshalSSZ

func (i *InputAttesterSlashingWrapper) MarshalSSZ() ([]byte, error)

MarshalSSZ ssz marshals the InputAttesterSlashingWrapper object

func (*InputAttesterSlashingWrapper) MarshalSSZTo

func (i *InputAttesterSlashingWrapper) MarshalSSZTo(dst []byte) ([]byte, error)

MarshalSSZTo ssz marshals the InputAttesterSlashingWrapper object to a target array

func (*InputAttesterSlashingWrapper) SizeSSZ

func (i *InputAttesterSlashingWrapper) SizeSSZ() (size int)

SizeSSZ returns the ssz encoded size in bytes for the InputAttesterSlashingWrapper object

func (*InputAttesterSlashingWrapper) UnmarshalSSZ

func (i *InputAttesterSlashingWrapper) UnmarshalSSZ(buf []byte) error

UnmarshalSSZ ssz unmarshals the InputAttesterSlashingWrapper object

type InputBlockHeader

type InputBlockHeader struct {
	StateID uint16
	Block   *ethpb.BeaconBlock
}

InputBlockHeader for fuzz testing beacon block headers.

func (*InputBlockHeader) MarshalSSZ

func (i *InputBlockHeader) MarshalSSZ() ([]byte, error)

MarshalSSZ ssz marshals the InputBlockHeader object

func (*InputBlockHeader) MarshalSSZTo

func (i *InputBlockHeader) MarshalSSZTo(dst []byte) ([]byte, error)

MarshalSSZTo ssz marshals the InputBlockHeader object to a target array

func (*InputBlockHeader) SizeSSZ

func (i *InputBlockHeader) SizeSSZ() (size int)

SizeSSZ returns the ssz encoded size in bytes for the InputBlockHeader object

func (*InputBlockHeader) UnmarshalSSZ

func (i *InputBlockHeader) UnmarshalSSZ(buf []byte) error

UnmarshalSSZ ssz unmarshals the InputBlockHeader object

type InputDepositWrapper

type InputDepositWrapper struct {
	StateID uint16
	Deposit *ethpb.Deposit
}

InputDepositWrapper for fuzz testing deposits.

func (*InputDepositWrapper) MarshalSSZ

func (i *InputDepositWrapper) MarshalSSZ() ([]byte, error)

MarshalSSZ ssz marshals the InputDepositWrapper object

func (*InputDepositWrapper) MarshalSSZTo

func (i *InputDepositWrapper) MarshalSSZTo(dst []byte) ([]byte, error)

MarshalSSZTo ssz marshals the InputDepositWrapper object to a target array

func (*InputDepositWrapper) SizeSSZ

func (i *InputDepositWrapper) SizeSSZ() (size int)

SizeSSZ returns the ssz encoded size in bytes for the InputDepositWrapper object

func (*InputDepositWrapper) UnmarshalSSZ

func (i *InputDepositWrapper) UnmarshalSSZ(buf []byte) error

UnmarshalSSZ ssz unmarshals the InputDepositWrapper object

type InputProposerSlashingWrapper

type InputProposerSlashingWrapper struct {
	StateID          uint16
	ProposerSlashing *ethpb.ProposerSlashing
}

InputProposerSlashingWrapper for fuzz testing proposer slashings.

func (*InputProposerSlashingWrapper) MarshalSSZ

func (i *InputProposerSlashingWrapper) MarshalSSZ() ([]byte, error)

MarshalSSZ ssz marshals the InputProposerSlashingWrapper object

func (*InputProposerSlashingWrapper) MarshalSSZTo

func (i *InputProposerSlashingWrapper) MarshalSSZTo(dst []byte) ([]byte, error)

MarshalSSZTo ssz marshals the InputProposerSlashingWrapper object to a target array

func (*InputProposerSlashingWrapper) SizeSSZ

func (i *InputProposerSlashingWrapper) SizeSSZ() (size int)

SizeSSZ returns the ssz encoded size in bytes for the InputProposerSlashingWrapper object

func (*InputProposerSlashingWrapper) UnmarshalSSZ

func (i *InputProposerSlashingWrapper) UnmarshalSSZ(buf []byte) error

UnmarshalSSZ ssz unmarshals the InputProposerSlashingWrapper object

type InputVoluntaryExitWrapper

type InputVoluntaryExitWrapper struct {
	StateID       uint16
	VoluntaryExit *ethpb.VoluntaryExit
}

InputVoluntaryExitWrapper for fuzz testing voluntary exits.

func (*InputVoluntaryExitWrapper) MarshalSSZ

func (i *InputVoluntaryExitWrapper) MarshalSSZ() ([]byte, error)

MarshalSSZ ssz marshals the InputVoluntaryExitWrapper object

func (*InputVoluntaryExitWrapper) MarshalSSZTo

func (i *InputVoluntaryExitWrapper) MarshalSSZTo(dst []byte) ([]byte, error)

MarshalSSZTo ssz marshals the InputVoluntaryExitWrapper object to a target array

func (*InputVoluntaryExitWrapper) SizeSSZ

func (i *InputVoluntaryExitWrapper) SizeSSZ() (size int)

SizeSSZ returns the ssz encoded size in bytes for the InputVoluntaryExitWrapper object

func (*InputVoluntaryExitWrapper) UnmarshalSSZ

func (i *InputVoluntaryExitWrapper) UnmarshalSSZ(buf []byte) error

UnmarshalSSZ ssz unmarshals the InputVoluntaryExitWrapper object

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL