aptos-core
aptos-core copied to clipboard
Add API fuzzing using RESTler
Description
This PR adds API fuzzing using RESTler, from Microsoft.
Things still to do:
- In Compile/StdOut.txt, you can see that it doesn't understand unint64 or hex, and accordingly just uses regular strings for both. I need to make it understand that and probably add options to dict.json.
- Try and make more endpoints run. This means try and avoid 400s, which can be accomplished with better configuration of the fuzzing dictionary / value generators.
I'll open issues for these, I want to land this PR mostly as-is, I can't spend much more time on this right now.
Test Plan
Frst make sure you have an API running locally:
cargo run -p aptos -- node run-local-testnet --with-faucet --faucet-port 8081 --force-restart --assume-yes
And ensure that you have Docker running on your system. Then, run the following commands from the root of aptos-core:
api/fuzzing/fuzz_api.py -d compile
api/fuzzing/fuzz_api.py -d test --suite lean
The second command here should tell you where to look for the output of the fuzzing run.
After a 1 hour run (using --suite full), it didn't find any bugs, based on these checkers (given the above caveats): https://github.com/microsoft/restler-fuzzer/blob/main/docs/user-guide/Checkers.md. Good news! Though of course with more specific tuning we might find something.