Skip to content

Commit

Permalink
[Fuzzing] Migrate client and server_fuzzer to structured fuzzing (grp…
Browse files Browse the repository at this point in the history
…c#32878)

- Added `fuzzer_input.proto` and `NetworkInput` proto message
- Migrated client_fuzzer and server_fuzzer to proto fuzzer
- Migrated the existing corpus and verified that the code coverage (e.g.
chttp2) stays the same

Probably need to cherrypick due to amount of files changed.

<!--

If you know who should review your pull request, please assign it to
that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the
appropriate
lang label.

-->
  • Loading branch information
yijiem authored Apr 19, 2023
1 parent c57c27f commit 1d10ca7
Show file tree
Hide file tree
Showing 1,244 changed files with 290 additions and 127 deletions.
21 changes: 18 additions & 3 deletions test/core/end2end/fuzzers/BUILD
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
# limitations under the License.

load("//bazel:grpc_build_system.bzl", "grpc_cc_library", "grpc_package", "grpc_proto_library")
load("//test/core/util:grpc_fuzzer.bzl", "grpc_fuzzer", "grpc_proto_fuzzer")
load("//test/core/util:grpc_fuzzer.bzl", "grpc_proto_fuzzer")

grpc_package(name = "test/core/end2end/fuzzers")

Expand Down Expand Up @@ -70,15 +70,28 @@ grpc_proto_fuzzer(
],
)

grpc_fuzzer(
grpc_proto_library(
name = "fuzzer_input_proto",
srcs = ["fuzzer_input.proto"],
has_services = False,
deps = [
"api_fuzzer_proto",
"//test/core/event_engine/fuzzing_event_engine:fuzzing_event_engine_proto",
"//test/core/util:fuzz_config_vars_proto",
],
)

grpc_proto_fuzzer(
name = "client_fuzzer",
srcs = ["client_fuzzer.cc"],
corpus = "client_fuzzer_corpus",
language = "C++",
proto = None,
tags = ["no_windows"],
uses_event_engine = False,
uses_polling = False,
deps = [
"fuzzer_input_proto",
"//:gpr",
"//:grpc",
"//src/core:channel_args",
Expand All @@ -88,15 +101,17 @@ grpc_fuzzer(
],
)

grpc_fuzzer(
grpc_proto_fuzzer(
name = "server_fuzzer",
srcs = ["server_fuzzer.cc"],
corpus = "server_fuzzer_corpus",
language = "C++",
proto = None,
tags = ["no_windows"],
uses_event_engine = False,
uses_polling = False,
deps = [
"fuzzer_input_proto",
"//:gpr",
"//:grpc",
"//src/core:channel_args",
Expand Down
22 changes: 11 additions & 11 deletions test/core/end2end/fuzzers/client_fuzzer.cc
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
//
//
// Copyright 2016 gRPC authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
Expand All @@ -13,11 +11,8 @@
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
//

#include <stdint.h>
#include <stdlib.h>
#include <string.h>

#include <initializer_list>
Expand Down Expand Up @@ -49,6 +44,8 @@
#include "src/core/lib/surface/channel_stack_type.h"
#include "src/core/lib/surface/event_string.h"
#include "src/core/lib/transport/transport_fwd.h"
#include "src/libfuzzer/libfuzzer_macro.h"
#include "test/core/end2end/fuzzers/fuzzer_input.pb.h"
#include "test/core/util/mock_endpoint.h"

bool squelch = true;
Expand All @@ -60,7 +57,7 @@ static void* tag(intptr_t t) { return reinterpret_cast<void*>(t); }

static void dont_log(gpr_log_func_args* /*args*/) {}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
DEFINE_PROTO_FUZZER(const fuzzer_input::Msg& msg) {
if (squelch && !grpc_core::GetEnv("GRPC_TRACE_FUZZER").has_value()) {
gpr_set_log_function(dont_log);
}
Expand Down Expand Up @@ -131,13 +128,17 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
op->flags = 0;
op->reserved = nullptr;
op++;
grpc_call_error error =
grpc_call_start_batch(call, ops, (size_t)(op - ops), tag(1), nullptr);
grpc_call_error error = grpc_call_start_batch(
call, ops, static_cast<size_t>(op - ops), tag(1), nullptr);
int requested_calls = 1;
GPR_ASSERT(GRPC_CALL_OK == error);

grpc_mock_endpoint_put_read(
mock_endpoint, grpc_slice_from_copied_buffer((const char*)data, size));
if (msg.network_input().has_single_read_bytes()) {
grpc_mock_endpoint_put_read(
mock_endpoint, grpc_slice_from_copied_buffer(
msg.network_input().single_read_bytes().data(),
msg.network_input().single_read_bytes().size()));
}

grpc_event ev;
while (true) {
Expand Down Expand Up @@ -189,5 +190,4 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
}
}
grpc_shutdown();
return 0;
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!�!��NN
network_input {
single_read_bytes: "\x21\x91\x21\x91\x91\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!�N
network_input {
single_read_bytes: "\x21\x91\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
���N
network_input {
single_read_bytes: "\xa9\xa1\x91\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!mm!N!mmN���!�m!�NN'�)����!�m!�NNN�NNN'�)��N�NNN
network_input {
single_read_bytes: "\x21\x6d\x6d\x01\x21\x4e\x21\x6d\x6d\x01\x4e\x95\x91\x91\x21\x91\x6d\x21\x91\x4e\x4e\x27\x91\x29\x91\x91\x95\x91\x21\x91\x6d\x21\x91\x4e\x4e\x4e\x91\x4e\x4e\x4e\x27\x91\x29\x91\x91\x4e\x91\x4e\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
!mm!N!mm�!m)m!��N!��N�NN)�
�a����NNN���!�m!)��'NN����!�Nm!N�NNNN�NNN'�)��N�NNN
network_input {
single_read_bytes: "\x21\x6d\x6d\x01\x21\x4e\x21\x6d\x6d\xff\x01\x21\x6d\x29\x04\x6d\x21\x91\x91\x4e\x21\x91\x91\x4e\xf0\x91\x4e\x4e\x29\x91\x0a\x91\x61\x91\x91\x91\x91\x4e\x4e\x4e\x95\x91\x91\x21\x91\x6d\x21\x29\x91\x91\x27\x4e\x4e\x91\x91\x95\x91\x21\x91\x4e\x6d\x21\x4e\x91\x4e\x4e\x4e\x4e\x91\x4e\x4e\x4e\x27\x91\x29\x91\x91\x4e\x91\x4e\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!m��!��������
network_input {
single_read_bytes: "\x21\x6d\xeb\x01\xa2\x21\x0e\xff\xff\xff\xff\xff\xff\xff\x85"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!mm ��N!��N�N'�)��NN
network_input {
single_read_bytes: "\x21\x6d\x6d\x09\x91\x95\x4e\x21\x91\x91\x4e\xff\x4e\x27\x91\x29\x91\x91\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
!mm!N!mm!m)m!��N!��N�NN)�
�a����NNN���!�m!)��'NN����!�Nm!N�NNNN�NNN'�)��N�NNN
network_input {
single_read_bytes: "\x21\x6d\x6d\x01\x21\x4e\x21\x6d\x6d\x01\x21\x6d\x29\x04\x6d\x21\x91\x91\x4e\x21\x91\x91\x4e\xf0\x91\x4e\x4e\x29\x91\x0a\x91\x61\x91\x91\x91\x91\x4e\x4e\x4e\x95\x91\x91\x21\x91\x6d\x21\x29\x91\x91\x27\x4e\x4e\x91\x91\x95\x91\x21\x91\x4e\x6d\x21\x4e\x91\x4e\x4e\x4e\x4e\x91\x4e\x4e\x4e\x27\x91\x29\x91\x91\x4e\x91\x4e\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
!mm!N1mm!m)m!��N!��N�NN)�
�a����NNN���!�m!���N'N���!�mNN!�NNN�NNN'�)��N�NNN
network_input {
single_read_bytes: "\x21\x6d\x6d\x01\x21\x4e\x31\x6d\x6d\x01\x21\x6d\x29\x04\x6d\x21\x91\x91\x4e\x21\x91\x91\x4e\xf0\x91\x4e\x4e\x29\x91\x0a\x91\x61\x91\x91\x91\x91\x4e\x4e\x4e\x95\x91\x91\x21\x91\x6d\x21\x91\x91\x91\x4e\x27\x4e\x91\x95\x91\x21\x91\x6d\x4e\x4e\x21\x91\x4e\x4e\x4e\x91\x4e\x4e\x4e\x27\xd1\x29\x91\x91\x4e\x91\x4e\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
!mm!N!mm��!m)m!��N!��N�NN)�
�a����NNN���!�m!)��'NN��)��!�Nm!N�NJNN�NNN�'�)��N�NNN
network_input {
single_read_bytes: "\x21\x6d\x6d\x01\x21\x4e\x21\x6d\x6d\xff\xff\x01\x21\x6d\x29\x04\x6d\x21\x91\x91\x4e\x21\x91\xb1\x4e\xf0\x91\x4e\x4e\x29\x91\x0a\x91\x61\x91\x91\x91\x91\x4e\x4e\x4e\x95\x91\x91\x21\x91\x6d\x21\x29\x91\x91\x27\x4e\x4e\x91\x91\x29\x95\x91\x21\x91\x4e\x6d\x21\x4e\x91\x4e\x4a\x4e\x4e\x91\x4e\x4e\x4e\x96\x27\x91\x29\x91\x91\x4e\x91\x4e\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
!mm!mm!N����m!�NN'�)*�����!�m!�NNN�N!m)m!��N!��N�NN)�NN'�)��N
�a��N���NNNNNNN
network_input {
single_read_bytes: "\x21\x6d\x6d\x01\x01\x21\x6d\x6d\x01\x21\x4e\x95\x91\x91\x91\x6d\x21\x91\x4e\x4e\x27\x91\x29\x2a\x91\x91\x95\x91\x91\x21\x91\x6d\x21\x91\x4e\x4e\x4e\x91\x4e\x21\x6d\x29\x04\x6d\x21\x91\x91\x4e\x21\x91\x91\x4e\xf0\x91\x4e\x4e\x29\x91\x4e\x4e\x27\x91\x29\x91\x91\x4e\x0a\x91\x61\x91\x91\x4e\x91\x91\x91\x4e\x4e\x4e\x4e\x4e\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!�!!��NN
network_input {
single_read_bytes: "\x21\x91\x21\x21\x91\x91\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
!mm!N!mm!m)m!��N!��N�NN)�
�a����NNN���!�m!)��'NN����!�mNNN!�NNN�NNN'�)��N�NNN
network_input {
single_read_bytes: "\x21\x6d\x6d\x01\x21\x4e\x21\x6d\x6d\x01\x21\x6d\x29\x04\x6d\x21\x91\x91\x4e\x21\x91\x91\x4e\xf0\x91\x4e\x4e\x29\x91\x0a\x91\x61\x91\x91\x91\x91\x4e\x4e\x4e\x95\x91\x91\x21\x91\x6d\x21\x29\x91\x91\x27\x4e\x4e\x91\x91\x95\x91\x21\x91\x6d\x4e\x4e\x4e\x21\x91\x4e\x4e\x4e\x91\x4e\x4e\x4e\x27\x91\x29\x91\x91\x4e\x91\x4e\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!mm��N!��NN'�)��NN
network_input {
single_read_bytes: "\x21\x6d\x6d\x01\x91\x95\x4e\x21\x91\x91\x4e\x4e\x27\x91\x29\x91\x91\x4e\x4e"
}
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!;m��N�'N��!)��NN
network_input {
single_read_bytes: "\x21\x3b\x6d\x01\x91\x95\x4e\x91\x27\x4e\x83\x91\x21\x29\x91\x11\x91\x4e\x4e"
}
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
!mmR!�N���!:�m!�NN'�)����NNNN
network_input {
single_read_bytes: "\x21\x6d\x6d\x08\x01\x01\x52\x21\x91\x4e\x95\x91\x91\x21\x3a\x91\x6d\x21\x91\x4e\x4e\x27\x91\x29\x91\x91\x91\x91\x4e\x4e\x4e\x4e"
}
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Loading

0 comments on commit 1d10ca7

Please sign in to comment.