mirror of
https://github.com/tendermint/tendermint.git
synced 2026-01-07 13:55:17 +00:00
197b746f8d
Co-authored-by: Emmanuel T Odeke <emmanuel@orijtech.com> Closes #5907 - add init-corpus to blockchain reactor - remove validator-set FromBytes test now that we have proto, we don't need to test it! bye amino - simplify mempool test do we want to test remote ABCI app? - do not recreate mux on every crash in jsonrpc test - update p2p pex reactor test - remove p2p/listener test the API has changed + I did not understand what it's tested anyway - update secretconnection test - add readme and makefile - list inputs in readme - add nightly workflow - remove blockchain fuzz test EncodeMsg / DecodeMsg no longer exist
73 lines
2.1 KiB
Markdown
73 lines
2.1 KiB
Markdown
# fuzz
|
|
|
|
Fuzzing for various packages in Tendermint using [go-fuzz](https://github.com/dvyukov/go-fuzz) library.
|
|
|
|
Inputs:
|
|
|
|
- mempool `CheckTx` (using kvstore in-process ABCI app)
|
|
- p2p `Addrbook#AddAddress`
|
|
- p2p `pex.Reactor#Receive`
|
|
- p2p `SecretConnection#Read` and `SecretConnection#Write`
|
|
- rpc jsonrpc server
|
|
|
|
## Directory structure
|
|
|
|
```
|
|
| test
|
|
| |- corpus/
|
|
| |- crashers/
|
|
| |- init-corpus/
|
|
| |- suppressions/
|
|
| |- testdata/
|
|
| |- <testname>.go
|
|
```
|
|
|
|
`/corpus` directory contains corpus data. The idea is to help the fuzzier to
|
|
understand what bytes sequences are semantically valid (e.g. if we're testing
|
|
PNG decoder, then we would put black-white PNG into corpus directory; with
|
|
blockchain reactor - we would put blockchain messages into corpus).
|
|
|
|
`/init-corpus` (if present) contains a script for generating corpus data.
|
|
|
|
`/testdata` directory may contain an additional data (like `addrbook.json`).
|
|
|
|
Upon running the fuzzier, `/crashers` and `/suppressions` dirs will be created,
|
|
along with <testname>.zip archive. `/crashers` will show any inputs, which have
|
|
lead to panics (plus a trace). `/suppressions` will show any suppressed inputs.
|
|
|
|
## Running
|
|
|
|
```sh
|
|
make fuzz-mempool
|
|
make fuzz-p2p-addrbook
|
|
make fuzz-p2p-pex
|
|
make fuzz-p2p-sc
|
|
make fuzz-rpc-server
|
|
```
|
|
|
|
Each command will create corpus data (if needed), generate a fuzz archive and
|
|
call `go-fuzz` executable.
|
|
|
|
Then watch out for the respective outputs in the fuzzer output to announce new
|
|
crashers which can be found in the directory `crashers`.
|
|
|
|
For example if we find
|
|
|
|
```sh
|
|
ls crashers/
|
|
61bde465f47c93254d64d643c3b2480e0a54666e
|
|
61bde465f47c93254d64d643c3b2480e0a54666e.output
|
|
61bde465f47c93254d64d643c3b2480e0a54666e.quoted
|
|
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
|
da39a3ee5e6b4b0d3255bfef95601890afd80709.output
|
|
da39a3ee5e6b4b0d3255bfef95601890afd80709.quoted
|
|
```
|
|
|
|
the crashing bytes generated by the fuzzer will be in
|
|
`61bde465f47c93254d64d643c3b2480e0a54666e` the respective crash report in
|
|
`61bde465f47c93254d64d643c3b2480e0a54666e.output`
|
|
|
|
and the bug report can be created by retrieving the bytes in
|
|
`61bde465f47c93254d64d643c3b2480e0a54666e` and feeding those back into the
|
|
`Fuzz` function.
|