Skip to content
This repository has been archived by the owner on Apr 17, 2019. It is now read-only.

Add fuzzing for BlockLoader endpoints #1839

Merged
merged 5 commits into from
Nov 14, 2018
Merged

Add fuzzing for BlockLoader endpoints #1839

merged 5 commits into from
Nov 14, 2018

Conversation

luckychess
Copy link
Contributor

@luckychess luckychess commented Nov 8, 2018

Description of the Change

Fuzzing for block loader endpoints (retrieveBlock and retrieveBlocks).

Benefits

Another endpoint is covered by fuzzing.

Possible Drawbacks

Hard to support until fuzzing in CI is not ready.

Usage Examples or Tests

cmake -DCMAKE_C_COMPILER=/usr/local/opt/llvm/bin/clang -DCMAKE_CXX_COMPILER=/usr/local/opt/llvm/bin/clang++  -DFUZZING=ON ..
make retrieve_block_fuzz
make retrieve_blocks_fuzz

iroha::network::proto::BlocksRequest request;
if (protobuf_mutator::libfuzzer::LoadProtoInput(true, data, size, &request)) {
grpc::ServerContext context;
MockServerWriter writer;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ServerWriter cannot be mocked :( I've tried with ServerWriterInterface, but it cannot be casted safely (e.g only via reinterpret_cast. Here's an example of such mock (path test/module/vendor/grpc/grpc_mocks.hpp):

class MockServerWriter
    : public grpc::ServerWriterInterface<iroha::protocol::ToriiResponse> {
  MOCK_METHOD1(Write, void(iroha::protocol::ToriiResponse));
  MOCK_METHOD2(Write,
               bool(const iroha::protocol::ToriiResponse &,
                    grpc::WriteOptions));
  MOCK_METHOD0(SendInitialMetadata, void());
  MOCK_METHOD1(NextMessageSize, bool(uint32_t *));
};

But it's not really a good idea to use it. Need to think about that issue

@l4l l4l added needs-review pr awaits review from maintainers security labels Nov 8, 2018
Copy link
Contributor

@igor-egorov igor-egorov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Works inside run-iroha-dev.sh container

test/fuzzing/retrieve_blocks_fuzz.cpp Outdated Show resolved Hide resolved
@@ -15,7 +26,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, std::size_t size) {
iroha::network::proto::BlocksRequest request;
if (protobuf_mutator::libfuzzer::LoadProtoInput(true, data, size, &request)) {
grpc::ServerContext context;
fixture.block_loader_service_->retrieveBlocks(&context, &request, nullptr);
fuzzing::MockServerWriter serverWriter;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be static, I guess
Moreover some calls probably should be mocked (particularly the ones that return boolean)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it should be static - we pass a non-const raw point to it and have no idea what will happen with it inside.
I'm not sure what call do you mean - the only one which returns boolean is Write with 2 args but we are not interested in it.

Signed-off-by: Konstantin Munichev <[email protected]>
Signed-off-by: Konstantin Munichev <[email protected]>
Signed-off-by: Konstantin Munichev <[email protected]>
Signed-off-by: Konstantin Munichev <[email protected]>
Signed-off-by: Konstantin Munichev <[email protected]>
@l4l l4l removed the needs-review pr awaits review from maintainers label Nov 13, 2018
@luckychess luckychess merged commit 6720b84 into dev Nov 14, 2018
@luckychess luckychess deleted the feature/bl_fuzzing branch November 14, 2018 08:52
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants