From f99f20faa95ff5094fb37965521092dd6938ee87 Mon Sep 17 00:00:00 2001 From: Alex Hultman Date: Wed, 26 Aug 2020 04:47:11 +0200 Subject: [PATCH] Update README.md --- fuzzing/README.md | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) diff --git a/fuzzing/README.md b/fuzzing/README.md index 85f67d0..bda6a47 100644 --- a/fuzzing/README.md +++ b/fuzzing/README.md @@ -1,4 +1,4 @@ -# Fuzz-testing of various parsers and mocked examples +# Fuzz-testing of various parsers, mocked examples and system libraries A secure web server must be capable of receiving mass amount of malicious input without misbehaving or performing illegal actions, such as stepping outside of a memory block or otherwise spilling the beans. @@ -7,31 +7,21 @@ A secure web server must be capable of receiving mass amount of malicious input * AddressSanitizer * MemorySanitizer +### Overall coverage is about 95% for both uSockets and uWebSockets, all source code included +* No defects or outstanding bugs +* No timeouts, OOM, crashes or other issues +* Transparent reporting of found issues: https://bugs.chromium.org/p/oss-fuzz/issues/list?q=label%3AProj-uwebsockets&can=1 + ### Currently the following parts are individually fuzzed: * WebSocket handshake generator * WebSocket message parser * WebSocket extensions parser & negotiator * WebSocket permessage-deflate compression/inflation helper -* Http parser +* Http parser (with and without Proxy Protocol v2) * Http method/url router * Pub/sub "topic tree" -### While entire (mocked) examples are fuzzed: - -* HelloWorld -* EchoServer -* BroadcastingEchoServer - -### Fuzzing at the syscall level is done using libEpollFuzzer for: - -* EchoServer - -No defects or issues are left unfixed, covered up or otherwise neglected. In fact we **cannot** cover up security issues as OSS-Fuzz automatically and publicly reports security issues as they happen. - -Here is the list of public issues (issues are kept private for 90 days or until fixed): https://bugs.chromium.org/p/oss-fuzz/issues/list?q=label%3AProj-uwebsockets&can=1 - -Currently we are at **99.5%** function coverage, **~90%** line coverage and OSS-Fuzz is reporting **zero** issues in our codebase whatsoever. The goal is to approach 100% total coverage. - -### Security rewards -Google have sent us thousands of USD for the integration with OSS-Fuzz - we continue working on bettering the testing with every new release. +### While some targets are entire (mocked) example apps +* libEpollFuzzer mocks the kernel syscalls and allows to cover a lot of uSockets source code. +* A mock implementation of uSockets allows to cover a lot of the inbetween logic of uWebSockets.