6 How to fuzz OpenSSL with [libfuzzer](http://llvm.org/docs/LibFuzzer.html),
7 starting from a vanilla+OpenSSH server Ubuntu install.
9 With `clang` from a package manager
10 -----------------------------------
12 Install `clang`, which [ships with `libfuzzer`](http://llvm.org/docs/LibFuzzer.html#fuzzer-usage)
15 sudo apt-get install clang
17 Configure `openssl` for fuzzing. For now, you'll still need to pass in the path
18 to the `libFuzzer` library file while configuring; this is represented as
19 `$PATH_TO_LIBFUZZER` below. A typical value would be
20 `/usr/lib/llvm-7/lib/clang/7.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a`.
22 CC=clang ./config enable-fuzz-libfuzzer \
23 --with-fuzzer-lib=$PATH_TO_LIBFUZZER \
24 -DPEDANTIC enable-asan enable-ubsan no-shared \
25 -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \
26 -fsanitize=fuzzer-no-link \
27 enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment \
28 enable-weak-ssl-ciphers enable-rc5 enable-md2 \
29 enable-ssl3 enable-ssl3-method enable-nextprotoneg \
34 sudo apt-get install make
36 LDCMD=clang++ make -j4
38 Finally, perform the actual fuzzing:
40 fuzz/helper.py $FUZZER
42 where $FUZZER is one of the executables in `fuzz/`.
43 It will run until you stop it.
45 If you get a crash, you should find a corresponding input file in
46 `fuzz/corpora/$FUZZER-crash/`.
48 With `clang` from source/pre-built binaries
49 -------------------------------------------
51 You may also wish to use a pre-built binary from the [LLVM Download
52 site](http://releases.llvm.org/download.html), or to [build `clang` from
53 source](https://clang.llvm.org/get_started.html). After adding `clang` to your
54 path and locating the `libfuzzer` library file, the procedure for configuring
55 fuzzing is the same, except that you also need to specify
56 a `--with-fuzzer-include` option, which should be the parent directory of the
57 prebuilt fuzzer library. This is represented as `$PATH_TO_LIBFUZZER_DIR` below.
59 CC=clang ./config enable-fuzz-libfuzzer \
60 --with-fuzzer-include=$PATH_TO_LIBFUZZER_DIR \
61 --with-fuzzer-lib=$PATH_TO_LIBFUZZER \
62 -DPEDANTIC enable-asan enable-ubsan no-shared \
63 -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \
64 -fsanitize=fuzzer-no-link \
65 enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment \
66 enable-weak-ssl-ciphers enable-rc5 enable-md2 \
67 enable-ssl3 enable-ssl3-method enable-nextprotoneg \
73 This is an alternative to using LibFuzzer.
75 Configure for fuzzing:
77 sudo apt-get install afl-clang
78 CC=afl-clang-fast ./config enable-fuzz-afl no-shared no-module \
79 -DPEDANTIC enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 \
80 enable-md2 enable-ssl3 enable-ssl3-method enable-nextprotoneg \
81 enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment \
86 The following options can also be enabled: enable-asan, enable-ubsan, enable-msan
88 Run one of the fuzzers:
90 afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER
92 Where $FUZZER is one of the executables in `fuzz/`.
97 If a fuzzer generates a reproducible error, you can reproduce the problem using
98 the fuzz/*-test binaries and the file generated by the fuzzer. They binaries
99 don't need to be build for fuzzing, there is no need to set CC or the call
100 config with enable-fuzz-* or -fsanitize-coverage, but some of the other options
101 above might be needed. For instance the enable-asan or enable-ubsan option might
102 be useful to show you when the problem happens. For the client and server fuzzer
103 it might be needed to use -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to
104 reproduce the generated random numbers.
106 To reproduce the crash you can run:
108 fuzz/$FUZZER-test $file
113 The client and server fuzzer normally generate random numbers as part of the TLS
114 connection setup. This results in the coverage of the fuzzing corpus changing
115 depending on the random numbers. This also has an effect for coverage of the
116 rest of the test suite and you see the coverage change for each commit even when
117 no code has been modified.
119 Since we want to maximize the coverage of the fuzzing corpus, the client and
120 server fuzzer will use predictable numbers instead of the random numbers. This
121 is controlled by the FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION define.
123 The coverage depends on the way the numbers are generated. We don't disable any
124 check of hashes, but the corpus has the correct hash in it for the random
125 numbers that were generated. For instance the client fuzzer will always generate
126 the same client hello with the same random number in it, and so the server, as
127 emulated by the file, can be generated for that client hello.
132 Since the corpus depends on the default behaviour of the client and the server,
133 changes in what they send by default will have an impact on the coverage. The
134 corpus will need to be updated in that case.
139 The client and server corpus is generated with multiple config options:
140 - The options as documented above
141 - Without enable-ec_nistp_64_gcc_128 and without --debug
144 - A default config, plus options needed to generate the fuzzer.
146 The libfuzzer merge option is used to add the additional coverage
147 from each config to the minimal set.
149 Minimizing the corpus
150 =====================
152 When you have gathered corpus data from more than one fuzzer run
153 or for any other reason want to to minimize the data
154 in some corpus subdirectory `fuzz/corpora/DIR` this can be done as follows:
156 mkdir fuzz/corpora/NEWDIR
157 fuzz/$FUZZER -merge=1 fuzz/corpora/NEWDIR fuzz/corpora/DIR