Improve description of -trusted, -srvcert, -recipient, and -expect_sender CMP options

[openssl.git] / fuzz / README.md

diff --git a/fuzz/README.md b/fuzz/README.md
index dadf87469125c5f6908cda82b7d3181a4295dd26..c8dbf454b0064a4afeef7b7a6ad995dd9842f4e3 100644 (file)
--- a/fuzz/README.md
+++ b/fuzz/README.md
@@ -1,7 +1,10 @@
-# I Can Haz Fuzz?
+Fuzzing OpenSSL
+===============
+
+OpenSSL can use either LibFuzzer or AFL to do fuzzing.
 
 LibFuzzer
-=========
+---------
 
 How to fuzz OpenSSL with [libfuzzer](http://llvm.org/docs/LibFuzzer.html),
 starting from a vanilla+OpenSSH server Ubuntu install.
@@ -12,14 +15,14 @@ With `clang` from a package manager
 Install `clang`, which [ships with `libfuzzer`](http://llvm.org/docs/LibFuzzer.html#fuzzer-usage)
 since version 6.0:
 
-    $ sudo apt-get install clang
+    sudo apt-get install clang
 
 Configure `openssl` for fuzzing. For now, you'll still need to pass in the path
 to the `libFuzzer` library file while configuring; this is represented as
 `$PATH_TO_LIBFUZZER` below. A typical value would be
-`/usr/lib/llvm-6.0/lib/clang/6.0.0/lib/linux/libclang_rt.fuzzer-x86_64.a`.
+`/usr/lib/llvm-7/lib/clang/7.0.1/lib/linux/libclang_rt.fuzzer-x86_64.a`.
 
-    $ CC=clang ./config enable-fuzz-libfuzzer \
+    CC=clang ./config enable-fuzz-libfuzzer \
             --with-fuzzer-lib=$PATH_TO_LIBFUZZER \
             -DPEDANTIC enable-asan enable-ubsan no-shared \
             -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \
@@ -31,14 +34,16 @@ to the `libFuzzer` library file while configuring; this is represented as
 
 Compile:
 
-    $ sudo apt-get install make
-    $ LDCMD=clang++ make -j
+    sudo apt-get install make
+    make clean
+    LDCMD=clang++ make -j4
 
 Finally, perform the actual fuzzing:
 
-    $ fuzz/helper.py $FUZZER
+    fuzz/helper.py $FUZZER
 
 where $FUZZER is one of the executables in `fuzz/`.
+It will run until you stop it.
 
 If you get a crash, you should find a corresponding input file in
 `fuzz/corpora/$FUZZER-crash/`.
@@ -54,7 +59,7 @@ fuzzing is the same, except that you also need to specify
 a `--with-fuzzer-include` option, which should be the parent directory of the
 prebuilt fuzzer library. This is represented as `$PATH_TO_LIBFUZZER_DIR` below.
 
-    $ CC=clang ./config enable-fuzz-libfuzzer \
+    CC=clang ./config enable-fuzz-libfuzzer \
             --with-fuzzer-include=$PATH_TO_LIBFUZZER_DIR \
             --with-fuzzer-lib=$PATH_TO_LIBFUZZER \
             -DPEDANTIC enable-asan enable-ubsan no-shared \
@@ -66,28 +71,31 @@ prebuilt fuzzer library. This is represented as `$PATH_TO_LIBFUZZER_DIR` below.
             --debug
 
 AFL
-===
+---
+
+This is an alternative to using LibFuzzer.
 
 Configure for fuzzing:
 
-    $ sudo apt-get install afl-clang
-    $ CC=afl-clang-fast ./config enable-fuzz-afl no-shared no-module \
+    sudo apt-get install afl-clang
+    CC=afl-clang-fast ./config enable-fuzz-afl no-shared no-module \
         -DPEDANTIC enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 \
         enable-md2 enable-ssl3 enable-ssl3-method enable-nextprotoneg \
         enable-ec_nistp_64_gcc_128 -fno-sanitize=alignment \
         --debug
-    $ make
+    make clean
+    make
 
 The following options can also be enabled: enable-asan, enable-ubsan, enable-msan
 
 Run one of the fuzzers:
 
-    $ afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER
+    afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER
 
 Where $FUZZER is one of the executables in `fuzz/`.
 
 Reproducing issues
-==================
+------------------
 
 If a fuzzer generates a reproducible error, you can reproduce the problem using
 the fuzz/*-test binaries and the file generated by the fuzzer. They binaries
@@ -100,10 +108,10 @@ reproduce the generated random numbers.
 
 To reproduce the crash you can run:
 
-    $ fuzz/$FUZZER-test $file
+    fuzz/$FUZZER-test $file
 
 Random numbers
-==============
+--------------
 
 The client and server fuzzer normally generate random numbers as part of the TLS
 connection setup. This results in the coverage of the fuzzing corpus changing
@@ -122,16 +130,17 @@ the same client hello with the same random number in it, and so the server, as
 emulated by the file, can be generated for that client hello.
 
 Coverage changes
-================
+----------------
 
 Since the corpus depends on the default behaviour of the client and the server,
 changes in what they send by default will have an impact on the coverage. The
 corpus will need to be updated in that case.
 
 Updating the corpus
-===================
+-------------------
 
 The client and server corpus is generated with multiple config options:
+
 - The options as documented above
 - Without enable-ec_nistp_64_gcc_128 and without --debug
 - With no-asm
@@ -140,3 +149,13 @@ The client and server corpus is generated with multiple config options:
 
 The libfuzzer merge option is used to add the additional coverage
 from each config to the minimal set.
+
+Minimizing the corpus
+---------------------
+
+When you have gathered corpus data from more than one fuzzer run
+or for any other reason want to to minimize the data
+in some corpus subdirectory `fuzz/corpora/DIR` this can be done as follows:
+
+    mkdir fuzz/corpora/NEWDIR
+    fuzz/$FUZZER -merge=1 fuzz/corpora/NEWDIR fuzz/corpora/DIR