Fuzzing a DNS parser written in Go

https://blog.cloudflare.com/dns-parser-meet-go-fuzzer/

by jgrahamc • 11 years ago

165 39 11 years ago

blog.cloudflare.com

artursapek• 11 years ago

CloudFlare has a constant stream of quality articles about Go, I've really been enjoying them.

brobinson3• 11 years ago

They are probably pushing more traffic through Go than any other group on the planet. It's nice of them to share what they come across, and it's also good PR for them. Hell, even I want to work for them now.

eastdakota• 11 years ago

We're hiring in San Francisco, London, and Singapore:

https://www.cloudflare.com/join-our-team

jacquesm2• 11 years ago

With the exception of Google.

maxmcd• 11 years ago

The CloudFlare blog is not written in Chinese :)

https://www.google.com/trends/explore#q=golang

amichal• 11 years ago

It's amusing that one of the bugs they found and fixed was a buffer reuse bug -- similar to what caused heartbleed -- will help in my 'memory safe languages are not magic bullets' rebuttals.

hueving• 11 years ago

So is your rebuttal that since there are some reuse bugs, reading out of bounds is ok?

tedunangst2• 11 years ago

How does one go from "memory safe languages are not magic bullets" to "reading out of bounds is ok"? That's not a type safe argument.

Taek• 11 years ago

A big mistake I made early on was assuming garbage collected meant no memory leaks. But alas, you can keep pointers to objects you don't need anymore.

For go in particular, I make mistakes when passing slices to multiple objects. Memory safety slip because the slices are 'passed by value', but underneath they point to the same data. Easy to forget.

_paulc• 11 years ago

For dnslib [1] I use a much simpler fuzzer as part of the test suite [2] - this is nothing like as sophisticated as afl-fuzz or go-fuzz in terms of understanding and exercising code paths (just takes a DNS record and randomly mutates it - though still found a number of bugs).

Does anyone know if there is anything similar to afl-fuzz/go-fuzz for python?

[1] https://bitbucket.org/paulc/dnslib/ [2] https://bitbucket.org/paulc/dnslib/src/22cff0cd3e13098c00107...

foote• 11 years ago

https://bitbucket.org/jwilk/python-afl

dkubb• 11 years ago

I'd also recommend introducing mutation testing in addition to fuzz testing.

There is some overlap between the two techniques, but they approach the problem from completely different directions. Fuzz testing randomly generates inputs and uses that to find bugs where the input is improperly handled. Mutation testing randomly changes the code to make sure the tests themselves cover all the code that is written.

A good approach is to use mutation testing to make sure the existing code is fully covered by the tests. Then use fuzz testing to identify new failing test cases that need to be written. Once the implementation handles the new test cases, mutation test that code to make sure there aren't any untested code paths.

I used this same approach on an Relational Algebra + SQL generator lib I wrote a while ago and the result was something that was very stable -- the only bugs were due to flaws in my own understanding of the specification, not bugs in the implementation.

eru3• 11 years ago

I'd be interested to read a more detailed write up of the process.

thomseddon• 11 years ago

There really aren't many freely available DNS servers that have seen serious production usage - I'm really excited to see RRDNS open sourced as previously hinted at, does anyone know if there is a timeline for this?

haberman4• 11 years ago

Never listen to anyone who tells you that parsers are easy.

Parsers that work on simple input are easy. Parsers that get all the edge cases and diabolical input right are stupidly difficult.

tomjakubowski• 11 years ago

Parsers that work on simple input are easy. Parsers that get all the edge cases and diabolical input right are stupidly difficult.

Not to mention parsers which work on a vague and totally unspecified grammar - like "real world" HTTP and HTML parsers, which have to account for misbehaving clients and servers or malformed web pages (is this what you meant by 'diabolical input'?).

haberman4• 11 years ago

is this what you meant by 'diabolical input'

Not exactly what I meant, but that's a good point too!

By diabolical input, I mean things specifically designed to stress the parser, like ("{" * 100000) in JSON.

eru3• 11 years ago

Parsers can be simple, if the language you are parsing is simple.

That's why you should make your languages / protocols as `weak' as possible. Prefer a finite language over a regular language over a context free language, and avoid context sensitive languages like the plague.

tikhonj2• 11 years ago

Parsers are easy. It's the grammars that are complicated.

Seriously: seemingly simple things designed and described informally, in prose, can easily be incredibly complex when you expand all their details. That says a lot about those things, a little bit about the process and mindset that went into them and virtually nothing about parsing in general.

haberman4• 11 years ago

Parsers are easy. It's the grammars that are complicated.

What is this supposed to mean? It sounds something like "Programming is easy. It's the classes/objects that are complicated."

jrv2• 11 years ago

A Prometheus contributor also fuzzed our query language parser using go-fuzz and amongst other things discovered a really interesting Unicode-related parsing bug:

https://twitter.com/PrometheusIO/status/626187068356624384

Arnavion• 11 years ago

Is there anything available to fuzz parsers written in JavaScript? (I found tunz/afl-fuzz-js and some others but they seem to be for fuzzing parsers of JavaScript.)

Fuzzing a DNS parser written in Go

Related Stories