Add Mutator Plugins as a Strategy

bot/inputs/mutator-plugins/README.md

@@ -0,0 +1 @@
+Placeholder for mutator plugins.

configs/test/project.yaml

@@ -70,6 +70,9 @@ env:
   # the testcases against the target application.
   FUZZ_LOGS_BUCKET: test-fuzz-logs-bucket
 
+  # Default bucket to store mutator plugins.
+  MUTATOR_PLUGINS_BUCKET: test-mutator-plugins-bucket
+
   # Default issue tracker name unless overridden in a job definition. Current only supports monorail
   # issue tracker (disabled by default).
   # ISSUE_TRACKER: issue-tracker-name

src/local/butler/create_config.py

@@ -253,6 +253,8 @@ def execute(args):
       ('test-shared-corpus-bucket',
        project_bucket(args.project_id, 'shared-corpus')),
       ('test-fuzz-logs-bucket', project_bucket(args.project_id, 'fuzz-logs')),
+      ('test-mutator-plugins-bucket',
+       project_bucket(args.project_id, 'mutator-plugins')),
   )
 
   # Write new configs.

src/local/butler/run_server.py

@@ -69,6 +69,8 @@ def bootstrap_gcs(storage_path):
                       config.get('env.SHARED_CORPUS_BUCKET'))
   create_local_bucket(local_gcs_buckets_path,
                       config.get('env.FUZZ_LOGS_BUCKET'))
+  create_local_bucket(local_gcs_buckets_path,
+                      config.get('env.MUTATOR_PLUGINS_BUCKET'))
 
   # Symlink local GCS bucket path to appengine src dir to bypass sandboxing
   # issues.

src/python/bot/fuzzers/libFuzzer/launcher.py

@@ -38,6 +38,7 @@
 from bot.fuzzers import dictionary_manager
 from bot.fuzzers import engine_common
 from bot.fuzzers import libfuzzer
+from bot.fuzzers import mutator_plugin
 from bot.fuzzers import strategy
 from bot.fuzzers import utils as fuzzer_utils
 from bot.fuzzers.ml.rnn import generator as ml_rnn_generator
@@ -100,6 +101,8 @@
 
 FORK_PROBABILITY = 0.1
 
+MUTATOR_PLUGIN_PROBABILITY = 0.50
+
 
 class Generator(object):
   """Generators we can use."""
@@ -174,6 +177,17 @@ def do_fork():
           strategy.FORK_STRATEGY, default=FORK_PROBABILITY))
 
 
+def do_mutator_plugin():
+  """Return whether or not to use a mutator_plugin."""
+  # TODO(metzman): Support Windows.
+  if environment.platform() == 'WINDOWS':
+    return False
+
+  return engine_common.decide_with_probability(
+      engine_common.get_strategy_probability(
+          strategy.MUTATOR_PLUGIN_STRATEGY, default=MUTATOR_PLUGIN_PROBABILITY))
+
+
 def add_recommended_dictionary(arguments, fuzzer_name, fuzzer_path):
   """Add recommended dictionary from GCS to existing .dict file or create
   a new one and update the arguments as needed.
@@ -815,11 +829,22 @@ def main(argv):
     fuzzing_strategies.append(
         '%s_%d' % (strategy.FORK_STRATEGY, num_fuzz_processes))
 
+  extra_env = {}
+  if do_mutator_plugin():
+    mutator_plugin_path = mutator_plugin.get_mutator_plugin(target_name)
+    logs.log('Using mutator plugin: %s' % mutator_plugin_path)
+    if mutator_plugin_path:
+      # TODO(metzman): Change the strategy to log which plugin was used, and not
+      # simply that a plugin was used.
+      fuzzing_strategies.append(strategy.MUTATOR_PLUGIN_STRATEGY)
+      extra_env['LD_PRELOAD'] = mutator_plugin_path
+
   # Execute the fuzzer binary with original arguments.
   fuzz_result = runner.fuzz(
       corpus_directories,
       fuzz_timeout=fuzz_timeout,
-      additional_args=arguments + [artifact_prefix])
+      additional_args=arguments + [artifact_prefix],
+      extra_env=extra_env)
 
   if (not use_minijail and
       fuzz_result.return_code == constants.LIBFUZZER_ERROR_EXITCODE):

src/python/bot/fuzzers/libFuzzer/stats.py

@@ -147,6 +147,8 @@ def parse_line_for_strategy_prefix(line, strategy_name):
     stats['strategy_corpus_mutations_radamsa'] = 1
   if strategy.CORPUS_MUTATION_ML_RNN_STRATEGY in strategies:
     stats['strategy_corpus_mutations_ml_rnn'] = 1
+  if strategy.MUTATOR_PLUGIN_STRATEGY in strategies:
+    stats['strategy_mutator_plugin'] = 1
   if strategy.RANDOM_MAX_LENGTH_STRATEGY in strategies:
     stats['strategy_random_max_len'] = 1
   if strategy.RECOMMENDED_DICTIONARY_STRATEGY in strategies:
@@ -189,6 +191,7 @@ def parse_performance_features(log_lines, strategies, arguments):
       'strategy_corpus_mutations_ml_rnn': 0,
       'strategy_corpus_subset': 0,
       'strategy_fork': 0,
+      'strategy_mutator_plugin': 0,
       'strategy_random_max_len': 0,
       'strategy_recommended_dict': 0,
       'strategy_value_profile': 0,

src/python/bot/fuzzers/libfuzzer.py

@@ -104,7 +104,8 @@ def fuzz(self,
            corpus_directories,
            fuzz_timeout,
            artifact_prefix=None,
-           additional_args=None):
+           additional_args=None,
+           extra_env=None):
     """Running fuzzing command.
 
     Args:
@@ -116,6 +117,8 @@ def fuzz(self,
           timeouts, slow units)
       additional_args: A sequence of additional arguments to be passed to the
           executable.
+      extra_env: A dictionary containing environment variables and their values.
+          These will be added to the environment of the new process.
 
     Returns:
       A process.ProcessResult.
@@ -147,7 +150,8 @@ def fuzz(self,
         timeout=fuzz_timeout - self.SIGTERM_WAIT_TIME,
         terminate_before_kill=True,
         terminate_wait_time=self.SIGTERM_WAIT_TIME,
-        max_stdout_len=MAX_OUTPUT_LEN)
+        max_stdout_len=MAX_OUTPUT_LEN,
+        extra_env=extra_env)
 
   def merge(self,
             corpus_directories,
@@ -309,14 +313,15 @@ def fuzz(self,
            corpus_directories,
            fuzz_timeout,
            artifact_prefix=None,
-           additional_args=None):
+           additional_args=None,
+           extra_env=None):
     """LibFuzzerCommon.fuzz override."""
     additional_args = copy.copy(additional_args)
     if additional_args is None:
       additional_args = []
 
     return LibFuzzerCommon.fuzz(self, corpus_directories, fuzz_timeout,
-                                artifact_prefix, additional_args)
+                                artifact_prefix, additional_args, extra_env)
 
 
 class MinijailLibFuzzerRunner(engine_common.MinijailEngineFuzzerRunner,
@@ -383,11 +388,12 @@ def fuzz(self,
            corpus_directories,
            fuzz_timeout,
            artifact_prefix=None,
-           additional_args=None):
+           additional_args=None,
+           extra_env=None):
     """LibFuzzerCommon.fuzz override."""
     corpus_directories = self._get_chroot_corpus_paths(corpus_directories)
     return LibFuzzerCommon.fuzz(self, corpus_directories, fuzz_timeout,
-                                artifact_prefix, additional_args)
+                                artifact_prefix, additional_args, extra_env)
 
   def merge(self,
             corpus_directories,

src/python/bot/fuzzers/mutator_plugin.py

@@ -0,0 +1,169 @@
+# Copyright 2019 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Getting and using custom mutator plugins for libFuzzer."""
+
+import os
+
+from base import utils
+from google_cloud_utils import storage
+from metrics import logs
+from system import archive
+from system import environment
+from system import shell
+
+MUTATOR_SHARED_OBJECT_FILENAME = 'mutator-plugin.so'
+ARCHIVES_SUBDIR_NAME = 'archives'
+PLUGINS_SUBDIR_NAME = 'plugins'
+
+
+def _get_mutator_plugins_bucket_url():
+  """Returns the url of the mutator plugin's cloud storage bucket."""
+  return 'gs://%s' % environment.get_value('MUTATOR_PLUGINS_BUCKET')
+
+
+def _get_mutator_plugins_subdir(subdir):
+  """Returns the path of the subdirectory named |subdir| in
+  MUTATOR_PLUGINS_DIR."""
+  return os.path.join(environment.get_value('MUTATOR_PLUGINS_DIR'), subdir)
+
+
+def _get_mutator_plugins_archives_dir():
+  """Returns path of the archives subdirectory in MUTATOR_PLUGINS_DIR"""
+  return _get_mutator_plugins_subdir(ARCHIVES_SUBDIR_NAME)
+
+
+def _get_mutator_plugins_unpacked_dir():
+  """Returns path of the unpacked plugins subdirectory in MUTATOR_PLUGINS_DIR"""
+  return _get_mutator_plugins_subdir(PLUGINS_SUBDIR_NAME)
+
+
+def _get_mutator_plugins_from_bucket():
+  """Returns list of the mutator plugin archives in the mutator plugin storage
+  bucket."""
+  return storage.list_blobs(_get_mutator_plugins_bucket_url())
+
+
+def _download_mutator_plugin_archive(mutator_plugin_archive):
+  """Downloads the |mutator_plugin_archive| from the mutator plugin storage
+  bucket to the plugin archives directory. Returns the path that the archive was
+  downloaded to."""
+  file_path = os.path.join(_get_mutator_plugins_archives_dir(),
+                           mutator_plugin_archive)
+  url = '%s/%s' % (_get_mutator_plugins_bucket_url(), mutator_plugin_archive)
+  if not storage.copy_file_from(url, file_path):
+    logs.log_error(
+        'Failed to copy plugin archive from %s to %s' % (url, file_path))
+    return None
+
+  return file_path
+
+
+def _unpack_mutator_plugin(mutator_plugin_archive_path):
+  """Unpacks |mutator_plugin_archive_path| in the unpacked plugins directory and
+  returns the path it was unpacked into."""
+  mutator_plugin_name = os.path.basename(
+      os.path.splitext(mutator_plugin_archive_path)[0])
+  unpacked_plugin_dir = os.path.join(_get_mutator_plugins_unpacked_dir(),
+                                     mutator_plugin_name)
+  archive.unpack(mutator_plugin_archive_path, unpacked_plugin_dir)
+  return unpacked_plugin_dir
+
+
+def _extract_name_from_archive(plugin_archive_filename):
+  """Parses |plugin_archive_filename| which should be named using the schema:
+  '$NAME-$JOB-$FUZZ_TARGET.zip'. Returns tuple containing
+  ($NAME, $JOB-$FUZZ_TARGET)."""
+  # TODO(metzman): Get rid of this when we create an upload page for custom
+  # mutator plugins.
+  plugin_archive_name = os.path.splitext(plugin_archive_filename)[0]
+  idx = plugin_archive_name.index('-')
+  plugin_name = plugin_archive_name[:idx]
+  return plugin_name, plugin_archive_name[idx + 1:]
+
+
+class PluginGetter(object):
+  """Class that gets a usable mutator plugin for |fuzzer_binary_name| from
+  GCS."""
+
+  def __init__(self, fuzzer_binary_name):
+    self.fuzzer_binary_name = fuzzer_binary_name
+    self.job_name = environment.get_value('JOB_NAME')
+    self.create_directories()
+
+  def create_directories(self):
+    """Creates directories needed to use mutator plugins."""
+
+    # TODO(320): Change mutator plugin downloads so that they don't need to be
+    # deleted and redownloaded on each run of launcher.py.
+    def recreate_directory(directory_path):
+      shell.create_directory_if_needed(
+          directory_path, create_intermediates=True)
+      shell.remove_directory(directory_path, recreate=True)
+
+    recreate_directory(environment.get_value('MUTATOR_PLUGINS_DIR'))
+    recreate_directory(_get_mutator_plugins_archives_dir())
+    recreate_directory(_get_mutator_plugins_unpacked_dir())
+
+  def _is_plugin_usable(self, plugin_archive_filename):
+    """Returns True if |plugin_archive_filename| is a usable plugin for this
+    job, fuzz target combination."""
+    _, plugin_job_and_fuzzer = _extract_name_from_archive(
+        plugin_archive_filename)
+    expected_name = '%s-%s' % (self.job_name, self.fuzzer_binary_name)
+    return expected_name == plugin_job_and_fuzzer
+
+  def get_mutator_plugin(self):
+    """Downloads and unpacks a usable mutator plugin for this job and fuzz
+    target if one is available in GCS"""
+    mutator_plugins = _get_mutator_plugins_from_bucket()
+    usable_mutator_plugins = [
+        plugin_archive for plugin_archive in mutator_plugins
+        if self._is_plugin_usable(plugin_archive)
+    ]
+
+    # Quit if no usable plugins are available.
+    if not usable_mutator_plugins:
+      return None
+
+    plugin_archive_name = utils.random_element_from_list(usable_mutator_plugins)
+
+    # Handle a failed download.
+    plugin_archive_path = _download_mutator_plugin_archive(plugin_archive_name)
+    if not plugin_archive_path:
+      return None
+
+    _unpack_mutator_plugin(plugin_archive_path)
+    mutator_plugin_path = find_mutator_plugin()
+    if mutator_plugin_path is None:
+      logs.log_error('Could not find plugin in %s' % plugin_archive_path)
+
+    return mutator_plugin_path
+
+
+def find_mutator_plugin():
+  """Sets LD_PRELOAD to the path of a usable mutator plugin shared object.
+  This should only be called after a call to get_mutator_plugin."""
+  paths = shell.get_files_list(_get_mutator_plugins_unpacked_dir())
+  # This function should not be called unless there is an unpacked plugin.
+  for path in paths:
+    if os.path.basename(path) == MUTATOR_SHARED_OBJECT_FILENAME:
+      return path
+  return None
+
+
+def get_mutator_plugin(fuzzer_binary_name):
+  """Downloads and unpacks a mutator plugin if a usable one for
+  |fuzzer_binary_name| is in the bucket."""
+  plugin_getter = PluginGetter(fuzzer_binary_name)
+  return plugin_getter.get_mutator_plugin()

src/python/bot/fuzzers/strategy.py

@@ -23,6 +23,7 @@
 CORPUS_MUTATION_ML_RNN_STRATEGY = 'corpus_mutations_ml_rnn'
 CORPUS_SUBSET_STRATEGY = 'corpus_subset'
 FORK_STRATEGY = 'fork'
+MUTATOR_PLUGIN_STRATEGY = 'mutator_plugin'
 RANDOM_MAX_LENGTH_STRATEGY = 'random_max_len'
 RECOMMENDED_DICTIONARY_STRATEGY = 'recommended_dict'
 VALUE_PROFILE_STRATEGY = 'value_profile'

src/python/bot/untrusted_runner/environment.py

@@ -31,6 +31,7 @@
         r'^ASAN_OPTIONS$',
         r'^BACKUP_BUCKET$',
         r'^CORPUS_BUCKET$',
+        r'^MUTATOR_PLUGINS_BUCKET$',
         r'^FUZZ_CORPUS_DIR$',
         r'^FUZZER_DIR$',
         r'^FUZZER_NAME_REGEX$',

src/python/system/environment.py

@@ -836,6 +836,8 @@ def set_bot_environment():
   os.environ['FUZZ_INPUTS_MEMORY'] = os.environ['FUZZ_INPUTS']
   os.environ['FUZZ_INPUTS_DISK'] = os.path.join(inputs_dir,
                                                 'fuzzer-testcases-disk')
+  os.environ['MUTATOR_PLUGINS_DIR'] = os.path.join(inputs_dir,
+                                                   'mutator-plugins')
   os.environ['FUZZ_DATA'] = os.path.join(inputs_dir,
                                          'fuzzer-common-data-bundles')
   os.environ['IMAGES_DIR'] = os.path.join(inputs_dir, 'images')

src/python/system/minijail.py

@@ -322,6 +322,7 @@ def get_command(self, additional_args=None):
   def run(self,
           additional_args=None,
           max_stdout_len=None,
+          extra_env=None,
           stdin=subprocess.PIPE,
           stdout=subprocess.PIPE,
           stderr=subprocess.STDOUT,
@@ -341,6 +342,9 @@ def run(self,
     passed_env = popen_args.pop('env', None)
     from bot.untrusted_runner import environment as untrusted_environment
     env = untrusted_environment.get_env_for_untrusted_process(passed_env)
+    if extra_env is not None:
+      env.update(extra_env)
+
     env['PATH'] = self.PATH_ENVIRONMENT_VALUE
 
     return MinijailChildProcess(