Add corpora for fuzzers with fuzzer mode disabled. Fuzzer mode explores the handshake, but at the cost of losing coverage on the record layer. Add a separate build flag and client/server corpora for this mode. Note this requires tweaks in consumers' fuzzer build definitions. BUG=111 Change-Id: I1026dc7301645e165a761068a1daad6eedc9271e Reviewed-on: https://boringssl-review.googlesource.com/12108 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
diff --git a/FUZZING.md b/FUZZING.md index 1a21403..7f83a7d 100644 --- a/FUZZING.md +++ b/FUZZING.md
@@ -53,16 +53,18 @@ ## Fuzzer mode -When `-DFUZZ=1` is passed into CMake, BoringSSL builds with `BORINGSSL_UNSAFE_FUZZER_MODE` defined. This modifies the library, particularly the TLS stack, to be more friendly to fuzzers. It will: +When `-DFUZZ=1` is passed into CMake, BoringSSL builds with `BORINGSSL_UNSAFE_FUZZER_MODE` and `BORINGSSL_UNSAFE_DETERMINISTIC_MODE` defined. This modifies the library to be more friendly to fuzzers. If `BORINGSSL_UNSAFE_DETERMINISTIC_MODE` is set, BoringSSL will: * Replace `RAND_bytes` with a deterministic PRNG. Call `RAND_reset_for_fuzzing()` at the start of fuzzers which use `RAND_bytes` to reset the PRNG state. +* Use a hard-coded time instead of the actual time. + +Additionally, if `BORINGSSL_UNSAFE_FUZZER_MODE` is set, BoringSSL will: + * Modify the TLS stack to perform all signature checks (CertificateVerify and ServerKeyExchange) and the Finished check, but always act as if the check succeeded. * Treat every cipher as the NULL cipher. -* Use a hard-coded time instead of the actual time. - * Tickets are unencrypted and the MAC check is performed but ignored. This is to prevent the fuzzer from getting stuck at a cryptographic invariant in the protocol. @@ -89,3 +91,5 @@ ./fuzz/client -max_len=50000 -merge=1 ../fuzz/client_corpus /tmp/transcripts/tls/client ./fuzz/server -max_len=50000 -merge=1 ../fuzz/server_corpus /tmp/transcripts/tls/server ``` + +There are separate corpora, `fuzz/client_corpus_no_fuzzer_mode` and `fuzz/server_corpus_no_fuzzer_mode`. These are transcripts for fuzzers with only `BORINGSSL_UNSAFE_DETERMINISTIC_MODE` defined. To build in this mode, pass `-DNO_FUZZER_MODE=1` into CMake. These corpora are updated the same way, but without the `-fuzzer` and `-shim-config` flags.