Initial fuzzing support and fixes

[szszszsz]

Add initial fuzzing support and fixes found during its executions.

Corpus generated with the pynitrokey API tests (not included here). Each input file contains single command only at this point. No new errors found after 20 minutes, with 11 jobs set. A fork of Flexiber was used, which had the crashing todo() replaced with returning Error code.

Future work / to discuss:

• might be worth to run it longer, or in CI
• extend the corpus to have more commands - Select, Validate, CalculateAll, SendRemaining
• disable not tested commands (as mentioned) skipped
• add coverage report generation
• extend the corpus to run multiple commands at a time
• dockerize/reuse fuzz setup
• something better than assertfn ?

Inspired by the opcard-rs fuzzing implementation.

Fixes #8

[szszszsz]

@sosthene-nitrokey Any ideas how to fix that?

$ cd fuzz && make fuzz-cov
# ...
Merging raw coverage data...
Coverage data merged and saved in "/home/sz/work/OTP/oath-authenticator/fuzz/coverage/fuzz_target_1/coverage.profdata".
llvm-cov show --format=html \
        --instr-profile=coverage/fuzz_target_1/coverage.profdata \
         /tmp/cargo/x86_64-unknown-linux-gnu/release/fuzz_target_1 \
        > fuzz_coverage.html
error: /tmp/cargo/x86_64-unknown-linux-gnu/release/fuzz_target_1: Failed to load coverage: unsupported instrumentation profile format version

[sosthene-nitrokey]

@sosthene-nitrokey Any ideas how to fix that?

$ cd fuzz && make fuzz-cov
# ...
Merging raw coverage data...
Coverage data merged and saved in "/home/sz/work/OTP/oath-authenticator/fuzz/coverage/fuzz_target_1/coverage.profdata".
llvm-cov show --format=html \
        --instr-profile=coverage/fuzz_target_1/coverage.profdata \
         /tmp/cargo/x86_64-unknown-linux-gnu/release/fuzz_target_1 \
        > fuzz_coverage.html
error: /tmp/cargo/x86_64-unknown-linux-gnu/release/fuzz_target_1: Failed to load coverage: unsupported instrumentation profile format version

I appear to have the same issue on my side with opcard.

Looking at it it's probably an issue of incompatible lllvm version. Current nightly rust uses LLVM 15, but most distros ship an older version (even Arch is on 14). The fix seems to be using the llvm-cov binary shipped with rustup's llvm-tools-preview component. For me that's ~/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/bin/llvm-cov

[sosthene-nitrokey]

The proper way to invoke it would probably be cargo-binutils, but I'm not sure if it's worth it adding it to the pipeline image

[szszszsz]

Yes, this worked for me, thanks!

[sosthene-nitrokey]

Is the empty lib.rs required?

[sosthene-nitrokey]

I think we want to be chain multiple commands within one round of fuzzing. Otherwise many code paths can't be explored, for example for authentication, and modification/deletion. You can use Arbitrary to get a vec of commands.

Also does Oath need authentication for some command? I think it would be very hard for the fuzzer find the correct password so it should probably be in a seed corpus.

[szszszsz]

1. Multiple commands - yes, that's already in the list. Will check your implementation with Arbitrary.
2. No need for authentication by default.
3. Removed the empty lib.rs.

While fuzzing is currently shallow due to causes you have mentioned, it already found problems within the binary parser, which I expect will be the only one found here.

[szszszsz]

Merging the current state, as it is required for the daily use at the moment. To be continued in the next PRs, as described earlier.