aws / s2n-tls

An implementation of the TLS/SSL protocols
https://aws.github.io/s2n-tls/usage-guide/
Apache License 2.0
4.52k stars 704 forks source link

ci: add more libcryptos for fuzz batch #4795

Open jouho opened 1 week ago

jouho commented 1 week ago

Resolved issues:

  1. The current fuzz batch jobs are built with awslc and openssl-3.0. This PR adds additional supported libcrypto versions to increase coverage.
  2. Test executables and override libraries are currently generated under the tests/fuzz and tests/fuzz/LD_PRELOAD folders. We should follow cmake build idioms (w.r.t binary location & library location)

Description of changes:

Call-outs:

I attempted to add awslc-fips to the batch job, but it failed during the compile. Link to Failed CodeBuild job I also tried awslc-fips-2022, which compiled successfully but failed to find the libcrypto. Link to CodeBuild job

I have created new issue to investigate this: https://github.com/aws/s2n-tls/issues/4800

After this PR is merged, I will also update s2nOmnibus to include these libcrypto versions to ensure that the patches won’t break anything.

Testing:

Tested by overriding s2nFuzzBatch job against this PR, and they are finding correct libcrypto versions: Link to CodeBuild job

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

jouho commented 5 days ago

I'd like to run runFuzzTest.sh locally, using the syntax it'll be called with...

You could run the same command we have in buildspec_fuzz.yml, which is

cmake . -Bbuild \
-DCMAKE_PREFIX_PATH=/usr/local/$S2N_LIBCRYPTO \
-DS2N_FUZZ_TEST=on

Then

cmake --build ./build -- -j $(nproc)

And then

cmake --build build/ --target test -- ARGS="-L fuzz --output-on-failure"