aptos-core icon indicating copy to clipboard operation
aptos-core copied to clipboard

Add API fuzzing using RESTler

Open banool opened this issue 3 years ago • 0 comments

Description

This PR adds API fuzzing using RESTler, from Microsoft.

Things still to do:

  • In Compile/StdOut.txt, you can see that it doesn't understand unint64 or hex, and accordingly just uses regular strings for both. I need to make it understand that and probably add options to dict.json.
  • Try and make more endpoints run. This means try and avoid 400s, which can be accomplished with better configuration of the fuzzing dictionary / value generators.

I'll open issues for these, I want to land this PR mostly as-is, I can't spend much more time on this right now.

Test Plan

Frst make sure you have an API running locally:

cargo run -p aptos -- node run-local-testnet --with-faucet --faucet-port 8081 --force-restart --assume-yes

And ensure that you have Docker running on your system. Then, run the following commands from the root of aptos-core:

api/fuzzing/fuzz_api.py -d compile
api/fuzzing/fuzz_api.py -d test --suite lean

The second command here should tell you where to look for the output of the fuzzing run.

After a 1 hour run (using --suite full), it didn't find any bugs, based on these checkers (given the above caveats): https://github.com/microsoft/restler-fuzzer/blob/main/docs/user-guide/Checkers.md. Good news! Though of course with more specific tuning we might find something.


This change is Reviewable

banool avatar Sep 12 '22 22:09 banool