Commit Graph

719 Commits

Author SHA1 Message Date
324f812bb8 cleanup syncdir events (#740) 2021-03-26 21:53:55 -04:00
dc9b6fa1b0 address telemetry log message locality (#736) 2021-03-26 18:45:36 -04:00
5c149413a5 Enable coverage module filtering (only) for both platforms (#733)
- Add coverage filtering to Windows generic coverage recording
- Temporarily disable deserialization of symbol filter rules
2021-03-26 15:16:28 -07:00
cf0d047a23 bubble out invalid messages on input queues (#731) 2021-03-26 15:50:48 +00:00
2a0365b9a2 Adding timeout to local run (#735) 2021-03-25 19:07:38 -04:00
5f10169783 simplify returns (#732) 2021-03-25 12:27:31 -04:00
c02ede76b3 fix local generic analysis (#729) 2021-03-24 22:03:34 -04:00
fd6f9eb0c3 add symbol and module names to StackFrame (#723)
This exposes the module_info and symbol name from debugger in the StackFrame.  This enables the stack minimization function work on function names.
2021-03-24 19:07:28 +00:00
5fcb777799 update AFL++ to 3.12c (#728) 2021-03-24 12:30:07 -04:00
c06d439c92 update azure-cli, azure-cli-core, and msal (#721) 2021-03-23 20:22:54 -04:00
50ce56f754 update to include regexes from google/clusterfuzz #2282 (#722) 2021-03-23 19:43:21 -04:00
d6b2ff9bae hardcode wget to use TLSv1.2 (#717) 2021-03-23 19:21:13 -04:00
92b5139a0a Removing UserInfo from notifications logging (#724) 2021-03-23 18:47:05 -04:00
1706a91291 Removing UserInfo from 'created task' logging (#725) 2021-03-23 18:45:18 -04:00
de5c843eb5 work around AAD service principal race condition (#716)
This works around an issue in AAD service principal creation.  The race condition in AAD shows up as:

```
INFO:deploy:checking if RBAC already exists
INFO:deploy:creating Application registration
INFO:deploy:creating service principal
Traceback (most recent call last):
  File "deploy.py", line 926, in <module>
    main()
  File "deploy.py", line 920, in main
    state[1](client)
  File "deploy.py", line 303, in setup_rbac
    client.service_principals.create(service_principal_params)
  File "/tmp/tmpp2x7ybfg/deploy-venv/lib/python3.8/site-packages/azure/graphrbac/operations/service_principals_operations.py", line 87, in create
    raise models.GraphErrorException(self._deserialize, response)
azure.graphrbac.models.graph_error_py3.GraphErrorException: When using this permission, the backing application of the service principal being created must in the local tenant
```

The azure-cli has the same issue, as seen in https://github.com/Azure/azure-cli/issues/14767
2021-03-23 21:02:36 +00:00
3ef7db64c3 Update Windows generic coverage recording (#699)
- Reimplement Windows generic coverage using new coverage format
- Remove old format
- Update and unify examples
2021-03-23 13:07:57 -07:00
7522bfd3ab release 2.10.0 (#720) 2.10.0 2021-03-23 12:56:39 -04:00
e80b658a1a expose new minimized stack fields in the crash report model (#719) 2021-03-23 12:29:08 -04:00
2b61256001 run until end of LLVMFuzzerTestOneInput for collecting coverage (#713) 2021-03-23 11:08:00 -04:00
516b1e000e expose minimized_stack_depth functionality in the CLI/API (#715) 2021-03-23 10:09:34 -04:00
92d8299412 make asan_log optional in CrashReport (#714) 2021-03-23 02:36:20 -04:00
24a20b6c28 automatically retry supervisor requests (#704)
## Summary of the Pull Request

closes #677
2021-03-23 06:08:09 +00:00
3113f887c4 remove generic- from the command prefixes (#710) 2021-03-22 20:39:32 -04:00
b4e0d89329 enable stack minimization for all crash dumps (#705)
This builds upon #591 to expand the stack minimization to crash reporting mechanisms.

Example (see #703 for an example without the new functionality):

```
$ onefuzz-agent local test-input /tmp/fuzz.exe /etc/passwd
{
  "crash_report": {
    "input_sha256": "a35b3ce1038750e9175a6dcd3f64c8d4e85720affb12cc11f5d0b6889274d06e",
    "executable": "/tmp/fuzz.exe",
    "crash_type": "SIGABRT",
    "crash_site": "0x7ffff7e0d18b in gsignal+0xcb (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4618b)",
    "call_stack": [
      "#0 0x7ffff7e0d18b in gsignal+0xcb (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4618b)",
      "#1 0x7ffff7dec859 in abort+0x12b (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x25859)",
      "#2 0x7ffff7e573ee in <unknown> (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x903ee)",
      "#3 0x7ffff7ef9b4a in __fortify_fail+0x2a (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x132b4a)",
      "#4 0x7ffff7ef83e6 in __chk_fail+0x16 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x1313e6)",
      "#5 0x7ffff7ef7e09 in __strncpy_chk+0x19 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x130e09)",
      "#6 0x400a54 in from_file+0xa4 (/tmp/fuzz.exe+0xa54)",
      "#7 0x7ffff7dee0b3 in __libc_start_main+0xf3 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x270b3)",
      "#8 0x40077a in _start+0x2a (/tmp/fuzz.exe+0x77a)"
    ],
    "call_stack_sha256": "99625a7c103136e02910b65c7b60f1bbd1a7612242d6838da52d968369039409",
    "minimized_stack": [
      "__fortify_fail",
      "__chk_fail",
      "from_file"
    ],
    "minimized_stack_sha256": "237f13bfa384c6c2bc06369099373efbb36995a9ad00fd5469d354b5fc672ba1",
    "minimized_stack_function_names": [
      "__fortify_fail",
      "__chk_fail",
      "from_file"
    ],
    "minimized_stack_function_names_sha256": "237f13bfa384c6c2bc06369099373efbb36995a9ad00fd5469d354b5fc672ba1",
    "asan_log": "",
    "task_id": "00000000-0000-0000-0000-000000000000",
    "job_id": "00000000-0000-0000-0000-000000000000"
  }
}
$
```
2021-03-23 00:13:28 +00:00
8250007294 Fix parsing of list of synced dir (#711) 2021-03-22 17:04:00 -04:00
16d3f3cf10 show the full error on proxy loop failure (#702) 2021-03-22 19:55:28 +00:00
02c92bfb1f add second resolution to log timestamp and print to stdout logs (#709) 2021-03-22 14:32:49 -04:00
7be4f3bbc1 add a single-shot crash report utility (#703)
Adds `test-input` and `test-input-libfuzzer`, which print the CrashTestResult in json form.

While many of the existing tasks make sense running in a managed loop, crash report generation is something that having a single one-off is useful.

Example:
```
$ onefuzz-agent local test-input /tmp/fuzz.exe /tmp/crash.txt
{
  "crash_report": {
    "input_sha256": "a35b3ce1038750e9175a6dcd3f64c8d4e85720affb12cc11f5d0b6889274d06e",
    "executable": "/tmp/fuzz.exe",
    "crash_type": "SIGABRT",
    "crash_site": "0x7f0d9d4ad18b in gsignal+0xcb (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4618b)",
    "call_stack": [
      "#0 0x7f0d9d4ad18b in gsignal+0xcb (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x4618b)",
      "#1 0x7f0d9d48c859 in abort+0x12b (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x25859)",
      "#2 0x7f0d9d4f73ee in <unknown> (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x903ee)",
      "#3 0x7f0d9d599b4a in __fortify_fail+0x2a (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x132b4a)",
      "#4 0x7f0d9d5983e6 in __chk_fail+0x16 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x1313e6)",
      "#5 0x7f0d9d597e09 in __strncpy_chk+0x19 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x130e09)",
      "#6 0x400a54 in from_file+0xa4 (/tmp/fuzz.exe+0xa54)",
      "#7 0x7f0d9d48e0b3 in __libc_start_main+0xf3 (/usr/lib/x86_64-linux-gnu/libc-2.31.so+0x270b3)",
      "#8 0x40077a in _start+0x2a (/tmp/fuzz.exe+0x77a)"
    ],
    "call_stack_sha256": "6906234fb235690cc2843a1a55f49ff68b424e54bec55f9b8258415d97b3e638",
    "task_id": "00000000-0000-0000-0000-000000000000",
    "job_id": "00000000-0000-0000-0000-000000000000"
  }
}
$
```
2021-03-22 17:46:33 +00:00
cf6c4e5632 add regexes from STACK_FRAME_IGNORE_REGEXES_IF_SYMBOLIZED (#706) 2021-03-22 16:13:41 +00:00
c0d7381427 add clusterfuzz's stack-trace dataset (#707) 2021-03-22 11:52:33 -04:00
71f487506f update pydantic to 1.8.1 (#698) 2021-03-19 18:02:03 -04:00
14b295f337 add privacy statement to CLI (#695) 2021-03-19 12:52:37 -04:00
d57abb6956 include the full failure when we give up from retrying (#696) 2021-03-19 11:37:43 -04:00
e38281face rename salvo telemetry to "upcoming feature" (#693)
Until salvo is released, this should be "upcoming feature" to avoid questions.
2021-03-19 14:59:08 +00:00
769b614367 add git-bisect howto (#691) 2021-03-19 14:26:20 +00:00
2417c37a60 add LoadLibrary integration test (#689) 2021-03-19 09:46:26 -04:00
3d226391fd update azure-mgmt-network to 18.0.0 (#687) 2021-03-19 09:49:42 +00:00
6b9ee20364 simplify config update notification (#683) 2021-03-18 20:26:30 -04:00
6e60a8cf10 add regression testing tasks (#664) 2021-03-18 15:37:19 -04:00
34b2a739cb provide parsed call stack details asan logs (#591)
For a given entry in a call stack, this parses out the following: line, function name, function offset, source file name, source file line, module path, and module offset.

Additionally, this provides a code-generated libclusterfuzz port of the regular expressions used for stack minimization.

For an example of the minimization, instead of:
```json
[
"#0 0x56512a9c1418 in __sanitizer_print_stack_trace /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/asan/asan_stack.cpp:86:3",
"#1 0x56512aaaa42d in fuzzer::PrintStackTrace() third_party/libFuzzer/src/FuzzerUtil.cpp:205:5",
"#2 0x56512aa6a85e in fuzzer::Fuzzer::CrashCallback() third_party/libFuzzer/src/FuzzerLoop.cpp:232:3",
"#3 0x56512aa6a7df in fuzzer::Fuzzer::StaticCrashSignalCallback() third_party/libFuzzer/src/FuzzerLoop.cpp:203:6",
"#4 0x56512aaab948 in fuzzer::CrashHandler(int, siginfo_t*, void*) third_party/libFuzzer/src/FuzzerUtilPosix.cpp:46:3",
"#5 0x7f1ee3f0188f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1288f)",
"#6 0x56512a9e5aa1 in Json::OurReader::parse(char const*, char const*, Json::Value&, bool) third_party/jsoncpp/source/src/lib_json/json_reader.cpp:1062:10",
"#7 0x56512a9eedb4 in Json::OurCharReader::parse(char const*, char const*, Json::Value*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char> >*) third_party/jsoncpp/source/src/lib_json/json_reader.cpp:1899:23",
"#8 0x56512a9e03a3 in LLVMFuzzerTestOneInput third_party/jsoncpp/fuzzers/json_fuzzer.cc:39:24",
"#9 0x56512aa6d0cf in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:556:15",
"#10 0x56512aa3b7da in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:292:6",
"#11 0x56512aa4108a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:774:9","#12 0x56512aa821ac in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10",
"#13 0x7f1ee3361b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310",
]
```

The minimized call stack is:
```json
[
"Json::OurReader::parse(char const*, char const*, Json::Value&, bool)", 
"Json::OurCharReader::parse(char const*, char const*, Json::Value*, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char> >*)",
"json_fuzzer.cc"
]
```

This also provides a naïve function name list, which comes close to Clusterfuzz's function identification.

This would result in:
```json
[
    "Json::OurReader::parse",
    "Json::OurCharReader::parse",
    "json_fuzzer.cc"
]
```

Lastly, for our `stack hash` functionality used by the crash reporting task, those now provide the ability to specify the number of frames to include when building the hash.
2021-03-18 17:25:12 +00:00
1174162af9 enable generic-analysis as an optional component of libfuzzer local tasks (#688) 2021-03-18 12:24:12 -04:00
ac958494b6 Install VC Redistributables (#686)
## Summary of the Pull Request
Add PS function to install VC Redistributables


## PR Checklist
* [X] Applies to work item: 556
* [X] CLA signed. If not, go over [here](https://cla.opensource.microsoft.com/microsoft/onefuzz) and sign the CLI.
* [X] Tests added/passed
* [X] Requires documentation to be updated
* [X] I've discussed this with core contributors already. If not checked, I'm ready to accept this work might be rejected in favor of a different grand plan. Issue number where discussion took place: #xxx

## Info on Pull Request
Added another PS function invoked from the setup.ps script

## Validation Steps Performed
Tested the change and verified by Jordyn Puryear
2021-03-18 13:18:50 +00:00
779d8971c1 add error message when failing due to pre-existing workset configs (#685) 2021-03-17 16:57:37 -04:00
f41f110af8 libfuzzer library integration tests (#681) 2021-03-17 16:18:10 -04:00
4b07fdc455 local_run refactoring (#508)
## Summary of the Pull Request

This is a refactoring of the local debugging.
- The input queue as been abstracted and can now be locally 
- The SyncDir can now sync a local directory
- Added the ability to monitor a local directory with a queue

## Reviewers Notes
The most import part of the PR are 
- The queue abstraction and implementations 
    - src/agent/storage-queue/src/azure_queue.rs
    - src/agent/storage-queue/src/local_queue.rs
    - src/agent/storage-queue/src/lib.rs
- Changes to support local files in 
    - src/agent/onefuzz/src/syncdir.rs
- Example of how those abstractions are used to link task together
    - src/agent/onefuzz-agent/src/local/libfuzzer_fuzz.rs
    - src/agent/onefuzz-agent/src/local/common.rs

## Validation Steps Performed

_How does someone test & validate?_
2021-03-17 19:32:45 +00:00
85335d462c Fix copy/paste error (#684) 2021-03-17 10:49:14 -07:00
4ad52c80aa Add 'setup_dir' to LD_LIBRARY_PATH for unix based libfuzzer targets (#682) 2021-03-17 12:40:05 -04:00
cd6621bb89 address latest clippy warnings (#679) 2021-03-17 15:13:43 +00:00
f62cc3b365 add setup_dir to the PATH for libfuzzer (#680) 2021-03-16 22:35:55 -04:00
7d087f3a75 release 2.9.0 (#678) 2.9.0 2021-03-16 15:01:37 -04:00