|
|
|
|
# Copyright 2016 gRPC authors.
|
|
|
|
|
#
|
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
|
# you may not use this file except in compliance with the License.
|
|
|
|
|
# You may obtain a copy of the License at
|
|
|
|
|
#
|
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
#
|
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
|
# See the License for the specific language governing permissions and
|
|
|
|
|
# limitations under the License.
|
|
|
|
|
|
|
|
|
|
"""
|
|
|
|
|
Includes fuzzer rules.
|
|
|
|
|
"""
|
|
|
|
|
|
|
|
|
|
load("//bazel:grpc_build_system.bzl", "grpc_cc_test", "grpc_proto_library")
|
|
|
|
|
|
|
|
|
|
def grpc_fuzzer(name, corpus, owner = "grpc", srcs = [], tags = [], external_deps = [], deps = [], data = [], size = "large", **kwargs):
|
|
|
|
|
"""Instantiates a fuzzer test.
|
|
|
|
|
|
|
|
|
|
Args:
|
|
|
|
|
name: The name of the test.
|
|
|
|
|
corpus: The corpus for the test.
|
|
|
|
|
srcs: The source files for the test.
|
|
|
|
|
external_deps: External deps.
|
|
|
|
|
deps: The dependencies of the test.
|
|
|
|
|
data: The data dependencies of the test.
|
|
|
|
|
size: The size of the test.
|
|
|
|
|
tags: The tags for the test.
|
|
|
|
|
owner: The owning team of the test (for auto-bug-filing).
|
|
|
|
|
**kwargs: Other arguments to supply to the test.
|
|
|
|
|
"""
|
|
|
|
|
CORPUS_DIR = native.package_name() + "/" + corpus
|
|
|
|
|
grpc_cc_test(
|
|
|
|
|
name = name,
|
|
|
|
|
srcs = srcs,
|
|
|
|
|
tags = tags + ["grpc-fuzzer", "no-cache"],
|
|
|
|
|
deps = deps + select({
|
|
|
|
|
"//:grpc_build_fuzzers": [],
|
|
|
|
|
"//conditions:default": ["//test/core/util:fuzzer_corpus_test"],
|
|
|
|
|
}),
|
|
|
|
|
data = data + native.glob([corpus + "/**"]),
|
|
|
|
|
external_deps = external_deps + [
|
|
|
|
|
"gtest",
|
|
|
|
|
],
|
|
|
|
|
size = size,
|
|
|
|
|
args = select({
|
|
|
|
|
"//:grpc_build_fuzzers": [CORPUS_DIR, "-runs=20000", "-max_total_time=300"],
|
|
|
|
|
"//conditions:default": ["--directory=" + CORPUS_DIR],
|
|
|
|
|
}),
|
|
|
|
|
**kwargs
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
def grpc_proto_fuzzer(name, corpus, proto, owner = "grpc", proto_deps = [], external_deps = [], srcs = [], tags = [], deps = [], data = [], size = "large", **kwargs):
|
|
|
|
|
"""Instantiates a protobuf mutator fuzzer test.
|
|
|
|
|
|
|
|
|
|
Args:
|
|
|
|
|
name: The name of the test.
|
|
|
|
|
corpus: The corpus for the test.
|
|
|
|
|
proto: The proto for the test. If empty, it assumes the proto dependency
|
|
|
|
|
is already included in the target deps. Otherwise it creates a
|
|
|
|
|
new grpc_proto_library with name "_{name}_proto" and makes the
|
|
|
|
|
fuzz target depend on it.
|
|
|
|
|
proto_deps: Deps for proto. Only used if proto is not empty.
|
|
|
|
|
external_deps: External deps.
|
|
|
|
|
srcs: The source files for the test.
|
|
|
|
|
deps: The dependencies of the test.
|
|
|
|
|
data: The data dependencies of the test.
|
|
|
|
|
size: The size of the test.
|
|
|
|
|
tags: The tags for the test.
|
|
|
|
|
owner: The owning team of the test (for auto-bug-filing).
|
|
|
|
|
**kwargs: Other arguments to supply to the test.
|
|
|
|
|
"""
|
|
|
|
|
CORPUS_DIR = native.package_name() + "/" + corpus
|
|
|
|
|
deps = deps + ["@com_google_libprotobuf_mutator//:libprotobuf_mutator"]
|
|
|
|
|
|
[fuzz] Turn core end2end tests into fuzzers (#33013)
Add a new binary that runs all core end2end tests in fuzzing mode.
In this mode FuzzingEventEngine is substituted for the default event
engine. This means that time is simulated, as is IO. The FEE gets
control of callback delays also.
In our tests the `Step()` function becomes, instead of a single call to
`completion_queue_next`, a series of calls to that function and
`FuzzingEventEngine::Tick`, driving forward the event loop until
progress can be made.
PR guide:
---
**New binaries**
`core_end2end_test_fuzzer` - the new fuzzer itself
`seed_end2end_corpus` - a tool that produces an interesting seed corpus
**Config changes for safe fuzzing**
The implementation tries to use the config fuzzing work we've previously
deployed in api_fuzzer to fuzz across experiments. Since some
experiments are far too experimental to be safe in such fuzzing (and
this will always be the case):
- a new flag is added to experiments to opt-out of this fuzzing
- a new hook is added to the config system to allow variables to
re-write their inputs before setting them during the fuzz
**Event manager/IO changes**
Changes are made to the event engine shims so that tcp_server_posix can
run with a non-FD carrying EventEngine. These are in my mind a bit
clunky, but they work and they're in code that we expect to delete in
the medium term, so I think overall the approach is good.
**Changes to time**
A small tweak is made to fix a bug initializing time for fuzzers in
time.cc - we were previously failing to initialize
`g_process_epoch_cycles`
**Changes to `Crash`**
A version that prints to stdio is added so that we can reliably print a
crash from the fuzzer.
**Changes to CqVerifier**
Hooks are added to allow the top level loop to hook the verification
functions with a function that steps time between CQ polls.
**Changes to end2end fixtures**
State machinery moves from the fixture to the test infra, to keep the
customizations for fuzzing or not in one place. This means that fixtures
are now just client/server factories, which is overall nice.
It did necessitate moving some bespoke machinery into
h2_ssl_cert_test.cc - this file is beginning to be problematic in
borrowing parts but not all of the e2e test machinery. Some future PR
needs to solve this.
A cq arg is added to the Make functions since the cq is now owned by the
test and not the fixture.
**Changes to test registration**
`TEST_P` is replaced by `CORE_END2END_TEST` and our own test registry is
used as a first depot for test information.
The gtest version of these tests: queries that registry to manually
register tests with gtest. This ultimately changes the name of our tests
again (I think for the last time) - the new names are shorter and more
readable, so I don't count this as a regression.
The fuzzer version of these tests: constructs a database of fuzzable
tests that it can consult to look up a particular suite/test/config
combination specified by the fuzzer to fuzz against. This gives us a
single fuzzer that can test all 3k-ish fuzzing ready tests and cross
polinate configuration between them.
**Changes to test config**
The zero size registry stuff was causing some problems with the event
engine feature macros, so instead I've removed those and used GTEST_SKIP
in the problematic tests. I think that's the approach we move towards in
the future.
**Which tests are included**
Configs that are compatible - those that do not do fd manipulation
directly (these are incompatible with FuzzingEventEngine), and those
that do not join threads on their shutdown path (as these are
incompatible with our cq wait methodology). Each we can talk about in
the future - fd manipulation would be a significant expansion of
FuzzingEventEngine, and is probably not worth it, however many uses of
background threads now should probably evolve to be EventEngine::Run
calls in the future, and then would be trivially enabled in the fuzzers.
Some tests currently fail in the fuzzing environment, a
`SKIP_IF_FUZZING` macro is used for these few to disable them if in the
fuzzing environment. We'll burn these down in the future.
**Changes to fuzzing_event_engine**
Changes are made to time: an exponential sweep forward is used now -
this catches small time precision things early, but makes decade long
timers (we have them) able to be used right now. In the future we'll
just skip time forward to the next scheduled timer, but that approach
doesn't yet work due to legacy timer system interactions.
Changes to port assignment: we ensure that ports are legal numbers
before assigning them via `grpc_pick_port_or_die`.
A race condition between time checking and io is fixed.
---------
Co-authored-by: ctiller <ctiller@users.noreply.github.com>
2 years ago
|
|
|
if "gtest" not in external_deps:
|
|
|
|
|
external_deps = external_deps + ["gtest"]
|
|
|
|
|
|
|
|
|
|
if proto != None:
|
|
|
|
|
PROTO_LIBRARY = "_%s_proto" % name
|
|
|
|
|
grpc_proto_library(
|
|
|
|
|
name = PROTO_LIBRARY,
|
|
|
|
|
srcs = [proto],
|
|
|
|
|
deps = proto_deps,
|
|
|
|
|
has_services = False,
|
|
|
|
|
)
|
|
|
|
|
deps = deps + [PROTO_LIBRARY]
|
|
|
|
|
|
|
|
|
|
grpc_cc_test(
|
|
|
|
|
name = name,
|
|
|
|
|
srcs = srcs,
|
|
|
|
|
tags = tags + ["grpc-fuzzer", "no-cache"],
|
|
|
|
|
deps = deps + select({
|
|
|
|
|
"//:grpc_build_fuzzers": [],
|
|
|
|
|
"//conditions:default": ["//test/core/util:fuzzer_corpus_test"],
|
|
|
|
|
}),
|
|
|
|
|
data = data + native.glob([corpus + "/**"]),
|
[fuzz] Turn core end2end tests into fuzzers (#33013)
Add a new binary that runs all core end2end tests in fuzzing mode.
In this mode FuzzingEventEngine is substituted for the default event
engine. This means that time is simulated, as is IO. The FEE gets
control of callback delays also.
In our tests the `Step()` function becomes, instead of a single call to
`completion_queue_next`, a series of calls to that function and
`FuzzingEventEngine::Tick`, driving forward the event loop until
progress can be made.
PR guide:
---
**New binaries**
`core_end2end_test_fuzzer` - the new fuzzer itself
`seed_end2end_corpus` - a tool that produces an interesting seed corpus
**Config changes for safe fuzzing**
The implementation tries to use the config fuzzing work we've previously
deployed in api_fuzzer to fuzz across experiments. Since some
experiments are far too experimental to be safe in such fuzzing (and
this will always be the case):
- a new flag is added to experiments to opt-out of this fuzzing
- a new hook is added to the config system to allow variables to
re-write their inputs before setting them during the fuzz
**Event manager/IO changes**
Changes are made to the event engine shims so that tcp_server_posix can
run with a non-FD carrying EventEngine. These are in my mind a bit
clunky, but they work and they're in code that we expect to delete in
the medium term, so I think overall the approach is good.
**Changes to time**
A small tweak is made to fix a bug initializing time for fuzzers in
time.cc - we were previously failing to initialize
`g_process_epoch_cycles`
**Changes to `Crash`**
A version that prints to stdio is added so that we can reliably print a
crash from the fuzzer.
**Changes to CqVerifier**
Hooks are added to allow the top level loop to hook the verification
functions with a function that steps time between CQ polls.
**Changes to end2end fixtures**
State machinery moves from the fixture to the test infra, to keep the
customizations for fuzzing or not in one place. This means that fixtures
are now just client/server factories, which is overall nice.
It did necessitate moving some bespoke machinery into
h2_ssl_cert_test.cc - this file is beginning to be problematic in
borrowing parts but not all of the e2e test machinery. Some future PR
needs to solve this.
A cq arg is added to the Make functions since the cq is now owned by the
test and not the fixture.
**Changes to test registration**
`TEST_P` is replaced by `CORE_END2END_TEST` and our own test registry is
used as a first depot for test information.
The gtest version of these tests: queries that registry to manually
register tests with gtest. This ultimately changes the name of our tests
again (I think for the last time) - the new names are shorter and more
readable, so I don't count this as a regression.
The fuzzer version of these tests: constructs a database of fuzzable
tests that it can consult to look up a particular suite/test/config
combination specified by the fuzzer to fuzz against. This gives us a
single fuzzer that can test all 3k-ish fuzzing ready tests and cross
polinate configuration between them.
**Changes to test config**
The zero size registry stuff was causing some problems with the event
engine feature macros, so instead I've removed those and used GTEST_SKIP
in the problematic tests. I think that's the approach we move towards in
the future.
**Which tests are included**
Configs that are compatible - those that do not do fd manipulation
directly (these are incompatible with FuzzingEventEngine), and those
that do not join threads on their shutdown path (as these are
incompatible with our cq wait methodology). Each we can talk about in
the future - fd manipulation would be a significant expansion of
FuzzingEventEngine, and is probably not worth it, however many uses of
background threads now should probably evolve to be EventEngine::Run
calls in the future, and then would be trivially enabled in the fuzzers.
Some tests currently fail in the fuzzing environment, a
`SKIP_IF_FUZZING` macro is used for these few to disable them if in the
fuzzing environment. We'll burn these down in the future.
**Changes to fuzzing_event_engine**
Changes are made to time: an exponential sweep forward is used now -
this catches small time precision things early, but makes decade long
timers (we have them) able to be used right now. In the future we'll
just skip time forward to the next scheduled timer, but that approach
doesn't yet work due to legacy timer system interactions.
Changes to port assignment: we ensure that ports are legal numbers
before assigning them via `grpc_pick_port_or_die`.
A race condition between time checking and io is fixed.
---------
Co-authored-by: ctiller <ctiller@users.noreply.github.com>
2 years ago
|
|
|
external_deps = external_deps,
|
|
|
|
|
size = size,
|
|
|
|
|
args = select({
|
|
|
|
|
"//:grpc_build_fuzzers": [CORPUS_DIR, "-runs=20000", "-max_total_time=300"],
|
|
|
|
|
"//conditions:default": ["--directory=" + CORPUS_DIR],
|
|
|
|
|
}),
|
|
|
|
|
**kwargs
|
|
|
|
|
)
|
