-# I Can Haz Fuzz?
+Fuzzing OpenSSL
+===============
+
+OpenSSL can use either LibFuzzer or AFL to do fuzzing.
LibFuzzer
-=========
+---------
How to fuzz OpenSSL with [libfuzzer](http://llvm.org/docs/LibFuzzer.html),
starting from a vanilla+OpenSSH server Ubuntu install.
--debug
AFL
-===
+---
This is an alternative to using LibFuzzer.
Where $FUZZER is one of the executables in `fuzz/`.
Reproducing issues
-==================
+------------------
If a fuzzer generates a reproducible error, you can reproduce the problem using
the fuzz/*-test binaries and the file generated by the fuzzer. They binaries
-don't need to be build for fuzzing, there is no need to set CC or the call
+don't need to be built for fuzzing, there is no need to set CC or the call
config with enable-fuzz-* or -fsanitize-coverage, but some of the other options
above might be needed. For instance the enable-asan or enable-ubsan option might
be useful to show you when the problem happens. For the client and server fuzzer
fuzz/$FUZZER-test $file
+To do all the tests of a specific fuzzer such as asn1 you can run
+
+ fuzz/asn1-test fuzz/corpora/asn1
+or
+ make test TESTS=fuzz_test_asn1
+
+To run several fuzz tests you can use for instance:
+
+ make test TESTS='test_fuzz_cmp test_fuzz_cms'
+
+To run all fuzz tests you can use:
+
+ make test TESTS='test_fuzz_*'
+
Random numbers
-==============
+--------------
The client and server fuzzer normally generate random numbers as part of the TLS
connection setup. This results in the coverage of the fuzzing corpus changing
emulated by the file, can be generated for that client hello.
Coverage changes
-================
+----------------
Since the corpus depends on the default behaviour of the client and the server,
changes in what they send by default will have an impact on the coverage. The
corpus will need to be updated in that case.
Updating the corpus
-===================
+-------------------
The client and server corpus is generated with multiple config options:
+
- The options as documented above
- Without enable-ec_nistp_64_gcc_128 and without --debug
- With no-asm
from each config to the minimal set.
Minimizing the corpus
-=====================
+---------------------
When you have gathered corpus data from more than one fuzzer run
-or for any other reason want to to minimize the data
+or for any other reason want to minimize the data
in some corpus subdirectory `fuzz/corpora/DIR` this can be done as follows:
mkdir fuzz/corpora/NEWDIR