Commit Graph

613 Commits

Author SHA1 Message Date
c02ede76b3 fix local generic analysis (#729) 2021-03-24 22:03:34 -04:00
fd6f9eb0c3 add symbol and module names to StackFrame (#723)
This exposes the module_info and symbol name from debugger in the StackFrame.  This enables the stack minimization function work on function names.
2021-03-24 19:07:28 +00:00
5fcb777799 update AFL++ to 3.12c (#728) 2021-03-24 12:30:07 -04:00
c06d439c92 update azure-cli, azure-cli-core, and msal (#721) 2021-03-23 20:22:54 -04:00
50ce56f754 update to include regexes from google/clusterfuzz #2282 (#722) 2021-03-23 19:43:21 -04:00
d6b2ff9bae hardcode wget to use TLSv1.2 (#717) 2021-03-23 19:21:13 -04:00
92b5139a0a Removing UserInfo from notifications logging (#724) 2021-03-23 18:47:05 -04:00
1706a91291 Removing UserInfo from 'created task' logging (#725) 2021-03-23 18:45:18 -04:00
de5c843eb5 work around AAD service principal race condition (#716)
This works around an issue in AAD service principal creation.  The race condition in AAD shows up as:

```
INFO:deploy:checking if RBAC already exists
INFO:deploy:creating Application registration
INFO:deploy:creating service principal
Traceback (most recent call last):
  File "deploy.py", line 926, in <module>
    main()
  File "deploy.py", line 920, in main
    state[1](client)
  File "deploy.py", line 303, in setup_rbac
    client.service_principals.create(service_principal_params)
  File "/tmp/tmpp2x7ybfg/deploy-venv/lib/python3.8/site-packages/azure/graphrbac/operations/service_principals_operations.py", line 87, in create
    raise models.GraphErrorException(self._deserialize, response)
azure.graphrbac.models.graph_error_py3.GraphErrorException: When using this permission, the backing application of the service principal being created must in the local tenant
```

The azure-cli has the same issue, as seen in https://github.com/Azure/azure-cli/issues/14767
2021-03-23 21:02:36 +00:00
3ef7db64c3 Update Windows generic coverage recording (#699)
- Reimplement Windows generic coverage using new coverage format
- Remove old format
- Update and unify examples
2021-03-23 13:07:57 -07:00
7522bfd3ab release 2.10.0 (#720) 2.10.0 2021-03-23 12:56:39 -04:00
e80b658a1a expose new minimized stack fields in the crash report model (#719) 2021-03-23 12:29:08 -04:00
2b61256001 run until end of LLVMFuzzerTestOneInput for collecting coverage (#713) 2021-03-23 11:08:00 -04:00
516b1e000e expose minimized_stack_depth functionality in the CLI/API (#715) 2021-03-23 10:09:34 -04:00
92d8299412 make asan_log optional in CrashReport (#714) 2021-03-23 02:36:20 -04:00
24a20b6c28 automatically retry supervisor requests (#704)
## Summary of the Pull Request

closes #677
2021-03-23 06:08:09 +00:00
3113f887c4 remove generic- from the command prefixes (#710) 2021-03-22 20:39:32 -04:00
b4e0d89329 enable stack minimization for all crash dumps (#705)
This builds upon #591 to expand the stack minimization to crash reporting mechanisms.

Example (see #703 for an example without the new functionality):

```
$ onefuzz-agent local test-input /tmp/fuzz.exe /etc/passwd
{
  "crash_report": {
    "input_sha256": "a35b3ce1038750e9175a6dcd3f64c8d4e85720affb12cc11f5d0b6889274d06e",
    "executable": "/tmp/fuzz.exe",
    "crash_type": "SIGABRT",
    "crash_site": "0x7ffff7e0d18b in gsignal+0xcb (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4618b)",
    "call_stack": [
      "#0 0x7ffff7e0d18b in gsignal+0xcb (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4618b)",
      "#1 0x7ffff7dec859 in abort+0x12b (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x25859)",
      "#2 0x7ffff7e573ee in <unknown> (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x903ee)",
      "#3 0x7ffff7ef9b4a in __fortify_fail+0x2a (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x132b4a)",
      "#4 0x7ffff7ef83e6 in __chk_fail+0x16 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x1313e6)",
      "#5 0x7ffff7ef7e09 in __strncpy_chk+0x19 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x130e09)",
      "#6 0x400a54 in from_file+0xa4 (/tmp/fuzz.exe+0xa54)",
      "#7 0x7ffff7dee0b3 in __libc_start_main+0xf3 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x270b3)",
      "#8 0x40077a in _start+0x2a (/tmp/fuzz.exe+0x77a)"
    ],
    "call_stack_sha256": "99625a7c103136e02910b65c7b60f1bbd1a7612242d6838da52d968369039409",
    "minimized_stack": [
      "__fortify_fail",
      "__chk_fail",
      "from_file"
    ],
    "minimized_stack_sha256": "237f13bfa384c6c2bc06369099373efbb36995a9ad00fd5469d354b5fc672ba1",
    "minimized_stack_function_names": [
      "__fortify_fail",
      "__chk_fail",
      "from_file"
    ],
    "minimized_stack_function_names_sha256": "237f13bfa384c6c2bc06369099373efbb36995a9ad00fd5469d354b5fc672ba1",
    "asan_log": "",
    "task_id": "00000000-0000-0000-0000-000000000000",
    "job_id": "00000000-0000-0000-0000-000000000000"
  }
}
$
```
2021-03-23 00:13:28 +00:00
8250007294 Fix parsing of list of synced dir (#711) 2021-03-22 17:04:00 -04:00
16d3f3cf10 show the full error on proxy loop failure (#702) 2021-03-22 19:55:28 +00:00
02c92bfb1f add second resolution to log timestamp and print to stdout logs (#709) 2021-03-22 14:32:49 -04:00
7be4f3bbc1 add a single-shot crash report utility (#703)
Adds `test-input` and `test-input-libfuzzer`, which print the CrashTestResult in json form.

While many of the existing tasks make sense running in a managed loop, crash report generation is something that having a single one-off is useful.

Example:
```
$ onefuzz-agent local test-input /tmp/fuzz.exe /tmp/crash.txt
{
  "crash_report": {
    "input_sha256": "a35b3ce1038750e9175a6dcd3f64c8d4e85720affb12cc11f5d0b6889274d06e",
    "executable": "/tmp/fuzz.exe",
    "crash_type": "SIGABRT",
    "crash_site": "0x7f0d9d4ad18b in gsignal+0xcb (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4618b)",
    "call_stack": [
      "#0 0x7f0d9d4ad18b in gsignal+0xcb (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4618b)",
      "#1 0x7f0d9d48c859 in abort+0x12b (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x25859)",
      "#2 0x7f0d9d4f73ee in <unknown> (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x903ee)",
      "#3 0x7f0d9d599b4a in __fortify_fail+0x2a (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x132b4a)",
      "#4 0x7f0d9d5983e6 in __chk_fail+0x16 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x1313e6)",
      "#5 0x7f0d9d597e09 in __strncpy_chk+0x19 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x130e09)",
      "#6 0x400a54 in from_file+0xa4 (/tmp/fuzz.exe+0xa54)",
      "#7 0x7f0d9d48e0b3 in __libc_start_main+0xf3 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x270b3)",
      "#8 0x40077a in _start+0x2a (/tmp/fuzz.exe+0x77a)"
    ],
    "call_stack_sha256": "6906234fb235690cc2843a1a55f49ff68b424e54bec55f9b8258415d97b3e638",
    "task_id": "00000000-0000-0000-0000-000000000000",
    "job_id": "00000000-0000-0000-0000-000000000000"
  }
}
$
```
2021-03-22 17:46:33 +00:00
cf6c4e5632 add regexes from STACK_FRAME_IGNORE_REGEXES_IF_SYMBOLIZED (#706) 2021-03-22 16:13:41 +00:00
c0d7381427 add clusterfuzz's stack-trace dataset (#707) 2021-03-22 11:52:33 -04:00
71f487506f update pydantic to 1.8.1 (#698) 2021-03-19 18:02:03 -04:00
14b295f337 add privacy statement to CLI (#695) 2021-03-19 12:52:37 -04:00
d57abb6956 include the full failure when we give up from retrying (#696) 2021-03-19 11:37:43 -04:00
e38281face rename salvo telemetry to "upcoming feature" (#693)
Until salvo is released, this should be "upcoming feature" to avoid questions.
2021-03-19 14:59:08 +00:00
769b614367 add git-bisect howto (#691) 2021-03-19 14:26:20 +00:00
2417c37a60 add LoadLibrary integration test (#689) 2021-03-19 09:46:26 -04:00
3d226391fd update azure-mgmt-network to 18.0.0 (#687) 2021-03-19 09:49:42 +00:00
6b9ee20364 simplify config update notification (#683) 2021-03-18 20:26:30 -04:00
6e60a8cf10 add regression testing tasks (#664) 2021-03-18 15:37:19 -04:00
34b2a739cb provide parsed call stack details asan logs (#591)
For a given entry in a call stack, this parses out the following: line, function name, function offset, source file name, source file line, module path, and module offset.

Additionally, this provides a code-generated libclusterfuzz port of the regular expressions used for stack minimization.

For an example of the minimization, instead of:
```json
[
"#0 0x56512a9c1418 in __sanitizer_print_stack_trace /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_stack.cpp:86:3",
"#1 0x56512aaaa42d in fuzzer::PrintStackTrace() third_party/libFuzzer/src/FuzzerUtil.cpp:205:5",
"#2 0x56512aa6a85e in fuzzer::Fuzzer::CrashCallback() third_party/libFuzzer/src/FuzzerLoop.cpp:232:3",
"#3 0x56512aa6a7df in fuzzer::Fuzzer::StaticCrashSignalCallback() third_party/libFuzzer/src/FuzzerLoop.cpp:203:6",
"#4 0x56512aaab948 in fuzzer::CrashHandler(int, siginfo_t*, void*) third_party/libFuzzer/src/FuzzerUtilPosix.cpp:46:3",
"#5 0x7f1ee3f0188f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1288f)",
"#6 0x56512a9e5aa1 in Json::OurReader::parse(char const*, char const*, Json::Value&, bool) third_party/jsoncpp/source/src/lib_json/json_reader.cpp:1062:10",
"#7 0x56512a9eedb4 in Json::OurCharReader::parse(char const*, char const*, Json::Value*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char> >*) third_party/jsoncpp/source/src/lib_json/json_reader.cpp:1899:23",
"#8 0x56512a9e03a3 in LLVMFuzzerTestOneInput third_party/jsoncpp/fuzzers/json_fuzzer.cc:39:24",
"#9 0x56512aa6d0cf in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:556:15",
"#10 0x56512aa3b7da in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:292:6",
"#11 0x56512aa4108a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:774:9","#12 0x56512aa821ac in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10",
"#13 0x7f1ee3361b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310",
]
```

The minimized call stack is:
```json
[
"Json::OurReader::parse(char const*, char const*, Json::Value&, bool)", 
"Json::OurCharReader::parse(char const*, char const*, Json::Value*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char> >*)",
"json_fuzzer.cc"
]
```

This also provides a naïve function name list, which comes close to Clusterfuzz's function identification.

This would result in:
```json
[
    "Json::OurReader::parse",
    "Json::OurCharReader::parse",
    "json_fuzzer.cc"
]
```

Lastly, for our `stack hash` functionality used by the crash reporting task, those now provide the ability to specify the number of frames to include when building the hash.
2021-03-18 17:25:12 +00:00
1174162af9 enable generic-analysis as an optional component of libfuzzer local tasks (#688) 2021-03-18 12:24:12 -04:00
ac958494b6 Install VC Redistributables (#686)
## Summary of the Pull Request
Add PS function to install VC Redistributables


## PR Checklist
* [X] Applies to work item: 556
* [X] CLA signed. If not, go over [here](https://cla.opensource.microsoft.com/microsoft/onefuzz) and sign the CLI.
* [X] Tests added/passed
* [X] Requires documentation to be updated
* [X] I've discussed this with core contributors already. If not checked, I'm ready to accept this work might be rejected in favor of a different grand plan. Issue number where discussion took place: #xxx

## Info on Pull Request
Added another PS function invoked from the setup.ps script

## Validation Steps Performed
Tested the change and verified by Jordyn Puryear
2021-03-18 13:18:50 +00:00
779d8971c1 add error message when failing due to pre-existing workset configs (#685) 2021-03-17 16:57:37 -04:00
f41f110af8 libfuzzer library integration tests (#681) 2021-03-17 16:18:10 -04:00
4b07fdc455 local_run refactoring (#508)
## Summary of the Pull Request

This is a refactoring of the local debugging.
- The input queue as been abstracted and can now be locally 
- The SyncDir can now sync a local directory
- Added the ability to monitor a local directory with a queue

## Reviewers Notes
The most import part of the PR are 
- The queue abstraction and implementations 
    - src/agent/storage-queue/src/azure_queue.rs
    - src/agent/storage-queue/src/local_queue.rs
    - src/agent/storage-queue/src/lib.rs
- Changes to support local files in 
    - src/agent/onefuzz/src/syncdir.rs
- Example of how those abstractions are used to link task together
    - src/agent/onefuzz-agent/src/local/libfuzzer_fuzz.rs
    - src/agent/onefuzz-agent/src/local/common.rs

## Validation Steps Performed

_How does someone test & validate?_
2021-03-17 19:32:45 +00:00
85335d462c Fix copy/paste error (#684) 2021-03-17 10:49:14 -07:00
4ad52c80aa Add 'setup_dir' to LD_LIBRARY_PATH for unix based libfuzzer targets (#682) 2021-03-17 12:40:05 -04:00
cd6621bb89 address latest clippy warnings (#679) 2021-03-17 15:13:43 +00:00
f62cc3b365 add setup_dir to the PATH for libfuzzer (#680) 2021-03-16 22:35:55 -04:00
7d087f3a75 release 2.9.0 (#678) 2.9.0 2021-03-16 15:01:37 -04:00
fd0820f1a1 Updated AFL++ to 3.11c. (#675) 2021-03-16 16:51:56 +00:00
f0e5823c0a add retry to download_input (#676) 2021-03-16 12:17:28 -04:00
7ebdeac537 Added UserInfo Filter Logging Function (#661)
## Summary of the Pull Request

_What is this about?_
Due to our GDPR privacy requirements, we decided that it would be best to completely purge personal identifiable information from our AppInsights telemetry and logging. Instead of just removing all of the logging statements with personal info, I created a filter function that logs telemetry after it's been run through a recursive scrubbing function. This PR includes this new scrubbing function. 

## PR Checklist
* [x] Applies to work item: #660
* [ ] CLA signed. If not, go over [here](https://cla.opensource.microsoft.com/microsoft/onefuzz) and sign the CLI.
* [ ] Tests added/passed
* [ ] Requires documentation to be updated
* [x] I've discussed this with core contributors already. If not checked, I'm ready to accept this work might be rejected in favor of a different grand plan. Issue number where discussion took place: #xxx

## Info on Pull Request

_What does this include?_
Includes changes to events.py in onefuzzlib. I've implemented functionality - log_event() - to recursively check Event structures for UserInfo before logging to AppInsights. 

## Validation Steps Performed
I run local tests using a script I created with test events. 

_How does someone test & validate?_
I can provide local testing script. If that is insufficient, I can write a unit test that will run against this code.
2021-03-15 23:56:00 +00:00
09e4afcbce retry any failed request regardless of status (#674) 2021-03-15 19:10:24 -04:00
a3fdc74c53 handle exception related to manually deleted scalesets (#672)
If a user manually deletes a scaleset managed by OneFuzz, then `get_vmss_size` returns None.

When this happens, `Scaleset.shutdown` generates an exception from the `logging.info` call on line 573.

This PR handles this edge condition.
2021-03-15 14:18:59 +00:00
9ee114ff71 Make fields of JobStats public (#673) 2021-03-12 22:44:03 -08:00