|
1 | | -# automotive-fuzzing-example |
2 | | -For the demo: |
3 | | -- Initialize Project |
4 | | -- Create fuzz test for a function |
5 | | -- To compile it the "extern" functions need to be implemented for this use the scripts in fuzzing/auto-mock-fuzz: |
6 | | -- ```python3 gen_template.py /path_to_project/automotive-fuzzing-example/modules/*/src/*.c /path_to_project/automotive-fuzzing-example/modules/*/src/*.h``` |
7 | | -- This will create two excel sheets. The Sheet called testgen_mocks.xlsx will contain information about the functions that are declared as extern |
8 | | -- Fill in the excel sheet like this: |
9 | | - |
10 | | -| int GPS_driver_obtain_current_position(uint8_t * position_as_bytes, uint8_t * hmac_as_bytes) | return: RETURN_INT(int) | position_as_bytes: WRITE_BYTES(12) | hmac_as_bytes: WRITE_BYTES(64) | | | |
11 | | -|---------------------------------------------------------------------------------------------------------------------------|-----------------------------|------------------------------------|--------------------------------|------------------------|-----------------------| |
12 | | -| int third_party_library_calc_hmac(uint8_t * const message, int len, char * const key, char * const nonce, uint8_t * hmac) | return: RETURN_INT(int) | message: WRITE_BYTES(len) | key: WRITE_BYTES(64) | nonce: WRITE_BYTES(64) | hmac: WRITE_BYTES(64) | |
13 | | -| uint8_t HSM_get_random_byte() | return: RETURN_INT(uint8_t) | | | | | |
14 | | -| int driver_get_current_time() | return: RETURN_INT(int) | | | | | |
15 | | -- Run the second script to generate the mocking library from this: |
16 | | -- ```python3 gen_tests.py mocklib gen_template/testgen_mocks.xlsx ../mocks``` |
17 | | -- This creates mocklib.h and mocklib.cpp in fuzzing/mocks |
18 | | -- Add the mocklib.cpp to the compiler options and also add the include path fuzzing/mocks |
19 | | -- In the fuzztest you need to create a FuzzedDataProvider object and give a pointer to it to the mocking library. Add the following to the beginning of the FUZZ function: |
20 | | -```FuzzedDataProvider fuzz_data(Data, Size);``` |
21 | | -```mocklib_set_data(&fuzz_data);``` |
22 | | -- You also need to include the FuzzedDataProvider.h and mocklib.h in the fuzztest |
23 | | -- Now the fuzz test can run |
24 | | -- To create a fuzz test for all the functions fill in the excel sheet testgen_functions.xlsx like this: |
25 | | - |
26 | | -| enum crypto_return_status crypto_calculate_hmac(const uint8_t * message, int len, crypto_hmac * hmac) | message: ARG_DATA() | len: ARG_SIZE() | hmac: ARG_STRUCT_PTR(crypto_hmac) | | |
27 | | -|-------------------------------------------------------------------------------------------------------|----------------------------------------|--------------------|-----------------------------------|---| |
28 | | -| enum crypto_return_status crypto_set_key(crypto_key key) | key: ARG_STRUCT(crypto_key) | | | | |
29 | | -| enum crypto_return_status crypto_set_nonce(crypto_nonce nonce) | nonce: ARG_STRUCT(crypto_nonce) | | | | |
30 | | -| enum crypto_return_status crypto_verify_hmac(const uint8_t * message, int len, crypto_hmac * hmac) | message: ARG_DATA() | len: ARG_SIZE() | hmac: ARG_STRUCT_PTR(crypto_hmac) | | |
31 | | -| enum crypto_return_status crypto_verify_key(crypto_key key) | key: ARG_STRUCT(crypto_key) | | | | |
32 | | -| enum crypto_return_status crypto_verify_nonce(crypto_nonce * nonce) | nonce: ARG_STRUCT_PTR(crypto_nonce) | | | | |
33 | | -| uint8_t * generate_random_bytes(uint8_t * buffer, uint8_t length) | buffer: ARG_DATA() | length: ARG_SIZE() | | | |
34 | | -| enum GPS_return_status get_current_position(GPS_position * position) | position: ARG_STRUCT_PTR(GPS_position) | | | | |
35 | | -| void key_management_create_key(uint8_t * key, uint8_t length) | key: ARG_DATA() | length: ARG_SIZE() | | | |
36 | | -| void key_management_create_nonce(uint8_t * nonce, uint8_t length) | nonce: ARG_DATA() | length: ARG_SIZE() | | | |
37 | | -| enum GPS_return_status set_destination_postition(GPS_position position) | position: ARG_STRUCT(GPS_position) | | | | |
38 | | -| enum crypto_state crypto_get_state() | | | | | |
39 | | -| void crypto_init() | | | | | |
40 | | -| GPS_position get_destination_position() | | | | | |
41 | | -| enum GPS_return_status init_crypto_module() | | | | | |
42 | | -| int time_current_time() | | | | | |
43 | | -- Then generate the fuzz test with the following command: |
44 | | -- ```python3 gen_tests.py fuzztests gen_template/testgen_functions.xlsx .``` |
45 | | -- This will create a file fuzztest.c. Copy its content to your own fuzztest |
46 | | -- Include crypto_module_types.h and GPS_module_types.h in the fuzztest |
47 | | -- Run the fuzztest |
| 1 | +<a href="https://www.code-intelligence.com/"> |
| 2 | +<img src="https://www.code-intelligence.com/hubfs/Logos/CI%20Logos/Logo_quer_white.png" alt="Code Intelligence logo" width="450px"> |
| 3 | +</a> |
48 | 4 |
|
| 5 | +# Testing C/C++ for Security and Reliability |
| 6 | +Building robust C/C++ applications is a highly challenging endeavor that requires thorough testing. |
| 7 | +While C/C++ enables us to write high-performance code, the memory-unsafety nature of the language |
| 8 | +brings a broad spectrum of security risks. Memory corruption issues constitute the vast majority of |
| 9 | +bugs and security vulnerabilities found in C/C++ projects, and their impact is best demonstrated by the |
| 10 | +[Heartbleed](https://en.wikipedia.org/wiki/Heartbleed) bug on OpenSSL. |
| 11 | +Regular unit and integration tests are essential to test that our code functions correctly, |
| 12 | +they are not enough to uncover memory-corruption bugs. |
| 13 | +On the other hand, fuzz testing has established itself as the best practical method to find these |
| 14 | +issues in large code bases such as Google Chrome. |
49 | 15 |
|
| 16 | +In this example, we demonstrate how you can use CI Fuzz to integrate fuzz testing into your |
| 17 | +C/C++ projects. The example project uses [CMake](https://cmake.org/) as the build system and contains |
| 18 | +the following three use cases: |
| 19 | +* [Simple Checks Example](src/explore_me/explore_me.cpp#L10): |
| 20 | +A simple example that triggers a buffer over when the input parameters satisfy certain criteria. |
| 21 | +We show that CI Fuzz can quickly generate a test case that trigger this bug. |
| 22 | +* [Complex Checks Example](src/explore_me/explore_me.cpp#L22): |
| 23 | +A more complex example that triggers a use-after-free bug when the input parameters satisfy |
| 24 | +certain criteria. In this example, the checks are more complex and involve Base64 encoding |
| 25 | +and XORing with constant value, making it more challenging to find the correct combination of |
| 26 | +input parameters that trigger the bug. |
| 27 | +* [Automotive Example](src/automotive): |
| 28 | +An example that demonstrates the challenges of creating high-quality fuzz tests for complex |
| 29 | +projects with a large public API. We demonstrate how we can automate most of this task with CI Spark. |
0 commit comments