Skip to content

Commit e0e07b2

Browse files
xansecxansec
authored
Merge pull request #7 from ForAllSecure/ado
Ado
2 parents be3e6da + b46bd5c commit e0e07b2

11 files changed

Lines changed: 205 additions & 25 deletions

File tree

‎.github/workflows/mayhem.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
with:
5858
context: .
5959
push: true
60-
file: Dockerfile
60+
file: mayhem/Dockerfile
6161
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.BRANCH_NAME }}
6262
labels: ${{ steps.meta.outputs.labels }}
6363

@@ -72,8 +72,8 @@ jobs:
7272
fail-fast: false
7373
matrix:
7474
mayhemfile:
75-
- mayhem/Mayhemfile.lighttpd
76-
- mayhem/Mayhemfile.mayhemit
75+
- mayhem/lighttpd.mayhemfile
76+
- mayhem/mayhemit.mayhemfile
7777
# Specify one or many Mayhemfiles here
7878

7979
steps:

‎.gitlab-ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ mcode-test-job:
3535
- curl --no-progress-meter -Lo mayhem-cli ${MAYHEM_URL}/cli/Linux/mayhem && chmod +x mayhem-cli
3636
- MAYHEM_PROMPT=1 ./mayhem-cli login --url ${MAYHEM_URL} --token ${MAYHEM_TOKEN}
3737
# Execute Mayhem run and fail if no run was executed
38-
- run=$(./mayhem-cli --verbosity info run . --project forallsecure-demo/mcode-action-examples/${TARGET} --owner ${GITLAB_USERNAME} --image ${REGISTRY}/${LOWER_REPO_SLUG}:${CI_COMMIT_REF_NAME} --file mayhem/Mayhemfile.${TARGET} --duration 60 --branch-name ${CI_COMMIT_REF_NAME} --revision ${CI_COMMIT_SHA} --ci-url ${CI_PIPELINE_URL});
38+
- run=$(./mayhem-cli --verbosity info run . --project mcode-action-examples --owner ${GITLAB_USERNAME} --image ${REGISTRY}/${LOWER_REPO_SLUG}:${CI_COMMIT_REF_NAME} --file ${MAYHEMFILE} --duration 60 --branch-name ${CI_COMMIT_REF_NAME} --revision ${CI_COMMIT_SHA} --ci-url ${CI_PIPELINE_URL});
3939
- if [ -z "${run}" ]; then exit 1; fi
4040
# Otherwise, determine run name and wait for job to complete and artifacts to be ready
4141
- runName=$(echo ${run} | awk -F / '{ print $(NF-1) }');
@@ -44,7 +44,7 @@ mcode-test-job:
4444
- if [[ ${status} == *"stopped"* || ${status} == *"failed"* ]]; then exit 2; fi
4545
parallel:
4646
matrix:
47-
- TARGET: ['lighttpd', 'mayhemit']
47+
- MAYHEMFILE: ['mayhem/lighttpd.mayhemfile', 'mayhem/mayhemit.mayhemfile']
4848
artifacts:
4949
when: always
5050
paths:

‎.travis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ env:
2020
- REPO_SLUG=$(echo "$TRAVIS_REPO_SLUG" | tr '[:upper:]' '[:lower:]')
2121
jobs:
2222
# Specify one or more Mayhemfiles for testing
23-
- MAYHEMFILE=mayhem/Mayhemfile.lighttpd
24-
- MAYHEMFILE=mayhem/Mayhemfile.mayhemit
23+
- MAYHEMFILE=mayhem/lighttpd.mayhemfile
24+
- MAYHEMFILE=mayhem/mayhemit.mayhemfile
2525

2626
script:
2727
# Download Mayhem CLI and log in to Mayhem server
2828
- curl -Lo ~/bin/mayhem ${MAYHEM_URL}/cli/Linux/mayhem && chmod +x ~/bin/mayhem
2929
- mayhem login $MAYHEM_URL $MAYHEM_TOKEN
3030
# Execute Mayhem run and fail if no run was executed
31-
- run=$(mayhem --verbosity info run . --project $REPO_SLUG/${MAYHEMFILE} --owner forallsecure-demo --image ghcr.io/$REPO_SLUG:$TRAVIS_BRANCH --file ${MAYHEMFILE} --duration 60 --branch-name $TRAVIS_BRANCH --revision $TRAVIS_COMMIT --ci-url https://app.travis-ci.com/github/$TRAVIS_REPO_SLUG/jobs/$TRAVIS_JOB_ID 2>/dev/null);
31+
- run=$(mayhem --verbosity info run . --project $REPO_SLUG --owner forallsecure-demo --image ghcr.io/$REPO_SLUG:$TRAVIS_BRANCH --file ${MAYHEMFILE} --duration 60 --branch-name $TRAVIS_BRANCH --revision $TRAVIS_COMMIT --ci-url https://app.travis-ci.com/github/$TRAVIS_REPO_SLUG/jobs/$TRAVIS_JOB_ID 2>/dev/null);
3232
- if [ -z "${run}" ]; then exit 1; fi
3333
# Otherwise, determine run name and wait for job to complete
3434
- runName=$(echo ${run} | awk -F / '{ print $(NF-1) }');

‎Jenkinsfile‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ pipeline {
3939
agent any
4040
axes {
4141
axis {
42-
name 'TARGET'
43-
values 'lighttpd', 'mayhemit'
42+
name 'MAYHEMFILE'
43+
values 'mayhem/lighttpd.mayhemfile', 'mayhem/mayhemit.mayhemfile'
4444
}
4545
}
4646
stages {
@@ -52,7 +52,10 @@ pipeline {
5252
REGISTRY=\$(mayhem-\$(arch) docker-registry)
5353
5454
# Run Mayhem
55-
run=\$(mayhem-\$(arch) --verbosity info run . --project forallsecure-demo/mcode-action-examples/${TARGET} --owner forallsecure-demo --image \${REGISTRY}/lighttpd:${env.BRANCH_NAME} --file mayhem/Mayhemfile.${TARGET} --duration 60 --branch-name ${env.BRANCH_NAME} --revision ${env.GIT_COMMIT} 2>/dev/null);
55+
# removed --merge-base-branch-name
56+
# remove --ci-url
57+
echo "mayhem-\$(arch) --verbosity info run . --project mcode-action-examples --owner forallsecure-demo --image \${REGISTRY}/lighttpd:${env.BRANCH_NAME} --file ${MAYHEMFILE} --duration 60 --branch-name ${env.BRANCH_NAME} --revision ${env.GIT_COMMIT} 2>/dev/null"
58+
run=\$(mayhem-\$(arch) --verbosity info run . --project mcode-action-examples --owner forallsecure-demo --image \${REGISTRY}/lighttpd:${env.BRANCH_NAME} --file ${MAYHEMFILE} --duration 60 --branch-name ${env.BRANCH_NAME} --revision ${env.GIT_COMMIT} 2>/dev/null);
5659
# Fail if no output was given
5760
if [ -z "\${run}" ]; then exit 1; fi
5861

‎README.md‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,38 @@
1-
# Mayhem for Code: Example CI Integration
1+
# Mayhem: Example CI Integration
22

3-
[![Mayhem for Code](https://drive.google.com/uc?export=view&id=1JXEbfCDMMwwnDaOgs5-XlPWQwZR93fv4)](https://app.mayhem.security/)
3+
[![Mayhem](https://assets-global.website-files.com/640f25bd69d9b59a5b153b04/6436cb17ee81ff6c239cd8cc_Mayhem%20Logo.svg)](http://app.mayhem.security/)
44

5-
A GitHub Action walk through for using Mayhem for Code to check for reliability, performance, and security issues in your application binary (packaged as a containerized [Docker](https://docs.docker.com/get-started/overview/) image) as a part of a CI pipeline.
5+
A GitHub Action walk through for using Mayhem to check for reliability, performance, and security issues in your application binary (packaged as a containerized [Docker](https://docs.docker.com/get-started/overview/) image) as a part of a CI pipeline.
66

7-
Visit the [Mayhem for Code GitHub Action](https://github.com/ForAllSecure/mcode-action/) to get more details on integrating Mayhem into your CI pipeline!
7+
Visit the [Mayhem GitHub Action](https://github.com/ForAllSecure/mcode-action/) to get more details on integrating Mayhem into your CI pipeline!
88

99
## Example GitHub Actions Integration
1010

11-
In this example, we've provided two targets that will be built, fuzzed, and fixed/patched to showcase a multi-target Mayhem for Code Action workflow within a CI pipeline: [Lighttpd](https://www.lighttpd.net/) version `1.4.15` and one of our `mayhem-example` targets, [c-base-executable](https://github.com/ForAllSecure/mayhem-examples/tree/main/c/base-executable/c-base-executable).
11+
In this example, we've provided two targets that will be built, fuzzed, and fixed/patched to showcase a multi-target Mayhem Action workflow within a CI pipeline: [Lighttpd](https://www.lighttpd.net/) version `1.4.15` and one of our `mayhem-example` targets, [c-base-executable](https://github.com/ForAllSecure/mayhem-examples/tree/main/c/base-executable/c-base-executable).
1212

1313
In particular, `lighttpd` version `1.4.15` was found to have vulnerabilities in the past, which were fixed in subsequent updates such as `1.4.52`. In tandem, our `c-base-executable` target has a bug that performs an `abort()` once a test case containing the string `bug` is input to the program, which we'll also fix in this example. Ultimately, we'll be using Mayhem in a CI pipeline to simulate a typical developer workflow in which we build and fuzz targets within a workflow to find and prove vulnerabilities exist within a target application, and then submit a subsequent PR to fix these vulnerabilities, which are confirmed via Mayhem's regression testing (crashing test cases of previous Mayhem runs for a target application are re-used again in future Mayhem runs of the same target) and accompanied by new behavior testing for the updated target application.
1414

1515
We have two branches in this repository: `main` and `vulnerable`.
1616

17-
> When executing a new workflow/pipeline using the Mayhem for Code GitHub Action, the corresponding `lighttpd` and `c-base-executable` targets will be built within a Docker image, which is pushed to the GitHub Container Registry, and ingested by Mayhem to fuzz the containerized targets. This is done using a [multi-stage Docker image build](https://docs.docker.com/build/building/multi-stage/).
17+
> When executing a new workflow/pipeline using the Mayhem GitHub Action, the corresponding `lighttpd` and `c-base-executable` targets will be built within a Docker image, which is pushed to the GitHub Container Registry, and ingested by Mayhem to fuzz the containerized targets. This is done using a [multi-stage Docker image build](https://docs.docker.com/build/building/multi-stage/).
1818
1919
The `main` branch contains the following targets:
2020

2121
* **lighttpd 1.4.52**:
2222
* [lighttpd 1.4.52 Dockerfile](https://github.com/ForAllSecure/mcode-action-examples/blob/main/mayhem/Dockerfile): Build instructions for settings up a containerized `lighttpd 1.4.52` application.
23-
* [lighttpd 1.4.52 Mayhemfile](https://github.com/ForAllSecure/mcode-action-examples/blob/main/mayhem/Mayhemfile.lighttpd): Configuration options for the resulting `lighttpd 1.4.52` CI pipeline Mayhem run.
23+
* [lighttpd 1.4.52 Mayhemfile](https://github.com/ForAllSecure/mcode-action-examples/blob/main/mayhem/lighttpd.mayhemfile): Configuration options for the resulting `lighttpd 1.4.52` CI pipeline Mayhem run.
2424
* **c-base-executable**:
2525
* [c-base-executable Dockerfile](https://github.com/ForAllSecure/mcode-action-examples/blob/main/mayhem/Dockerfile): Build instructions for setting up a containerized `c-base-executable` application.
26-
* [c-base-executable Mayhemfile](https://github.com/ForAllSecure/mcode-action-examples/blob/main/mayhem/Mayhemfile.mayhemit): Configuration options for the resulting `c-base-executable` CI pipeline Mayhem run.
26+
* [c-base-executable Mayhemfile](https://github.com/ForAllSecure/mcode-action-examples/blob/main/mayhem/mayhemit.mayhemfile): Configuration options for the resulting `c-base-executable` CI pipeline Mayhem run.
2727

2828
The `vulnerable` branch contains the following vulnerable targets:
2929

3030
* **(vulnerable) lighttpd 1.4.15**:
3131
* [lighttpd 1.4.15 Dockerfile](https://github.com/ForAllSecure/mcode-action-examples/blob/vulnerable/mayhem/Dockerfile): Build instructions for setting up a containerized `lighttpd 1.4.15` application.
32-
* [lighttpd 1.4.15 Mayhemfile](https://github.com/ForAllSecure/mcode-action-examples/blob/vulnerable/mayhem/Mayhemfile.lighttpd): Configuration options for the resulting `lighttpd 1.4.15` CI pipeline Mayhem run.
32+
* [lighttpd 1.4.15 Mayhemfile](https://github.com/ForAllSecure/mcode-action-examples/blob/vulnerable/mayhem/lighttpd.mayhemfile): Configuration options for the resulting `lighttpd 1.4.15` CI pipeline Mayhem run.
3333
* **(vulnerable) c-base-executable**:
3434
* [c-base-executable Dockerfile](https://github.com/ForAllSecure/mcode-action-examples/blob/vulnerable/mayhem/Dockerfile): Build instructions for setting up a containerized (and vulnerable) `c-base-executable` application.
35-
* [c-base-executable Mayhemfile](https://github.com/ForAllSecure/mcode-action-examples/blob/vulnerable/mayhem/Mayhemfile.mayhemit): Configuration options for the resulting (vulnerable) `c-base-executable` CI pipeline Mayhem run.
35+
* [c-base-executable Mayhemfile](https://github.com/ForAllSecure/mcode-action-examples/blob/vulnerable/mayhem/mayhemit.mayhemfile): Configuration options for the resulting (vulnerable) `c-base-executable` CI pipeline Mayhem run.
3636

3737
## Getting Started
3838

@@ -53,7 +53,7 @@ The `vulnerable` branch contains the following vulnerable targets:
5353

5454
> **Note:** You may be required to set your package visibility settings to `Public` to give Mayhem permissions to ingest your Docker image from the GitHub Container Registry. Click on your package in the right-hand pane of your GitHub repository and go to *Package Settings*. Then, scroll down to *Package Visibility* and set the package to `Public`.
5555
56-
3. Now, switch to the `vulnerable` branch. Create a pull request and set the PR to merge to `main` (**for your forked repo**). The Mayhem for Code GitHub Action will automatically begin building and pushing the `(vulnerable) lighttpd 1.4.15` and `(vulnerable) c-base-executable` containerized applications to the GitHub Container Registry and use Mayhem to perform both regression testing and behavior testing for the updated target applications. Results can then be found in the PR or on the Mayhem server itself with more details about each specific run. Results can be found in the `Security` tab or on the Mayhem instance itself with more details about the specific run.
56+
3. Now, switch to the `vulnerable` branch. Create a pull request and set the PR to merge to `main` (**for your forked repo**). The Mayhem GitHub Action will automatically begin building and pushing the `(vulnerable) lighttpd 1.4.15` and `(vulnerable) c-base-executable` containerized applications to the GitHub Container Registry and use Mayhem to perform both regression testing and behavior testing for the updated target applications. Results can then be found in the PR or on the Mayhem server itself with more details about each specific run. Results can be found in the `Security` tab or on the Mayhem instance itself with more details about the specific run.
5757

5858
Congrats! You just integrated Mayhem in a multi-target CI pipeline for the `lighttpd` and `c-base-executable` applications! Extrapolating from this, you should now be able to incorporate the same steps to integrate Mayhem into your own CI pipeline for your custom code.
5959

‎azure/azure-pipelines.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Azure DevOps pipeline for Mayhem.
2+
#
3+
# Before running, define the following SECRET variables in the Azure DevOps
4+
# pipeline settings (Pipeline > Edit > Variables), or via a linked variable
5+
# group, and mark them as secret:
6+
# - MAYHEM_URL The Mayhem instance URL
7+
# - MAYHEM_TOKEN A Mayhem API token
8+
9+
trigger:
10+
branches:
11+
include:
12+
- main
13+
14+
pr:
15+
branches:
16+
include:
17+
- main
18+
19+
variables:
20+
imageRepository: 'lighttpd'
21+
branchName: $(Build.SourceBranchName)
22+
23+
stages:
24+
- stage: Build
25+
displayName: 'Build and push image'
26+
jobs:
27+
- job: build
28+
displayName: 'Build Docker image'
29+
pool:
30+
vmImage: 'ubuntu-latest'
31+
steps:
32+
- checkout: self
33+
submodules: recursive
34+
35+
- bash: |
36+
set -euo pipefail
37+
image="$(setup.registry)/${IMAGE_REPO}:${BRANCH_NAME}"
38+
docker build --platform=linux/amd64 -f mayhem/Dockerfile -t "${image}" .
39+
docker push "${image}"
40+
env:
41+
IMAGE_REPO: $(imageRepository)
42+
BRANCH_NAME: $(branchName)
43+
displayName: 'Build and push Docker image'
44+
45+
- stage: Mayhem
46+
displayName: 'Run Mayhem'
47+
dependsOn: Build
48+
jobs:
49+
- template: mayhem-template.yml
50+
parameters:
51+
project: 'mcode-action-examples'
52+
target: 'lighttpd'
53+
owner: 'forallsecure-demo'
54+
image: '$(imageRepository):$(branchName)'
55+
duration: 60
56+
57+
- template: mayhem-template.yml
58+
parameters:
59+
project: 'mcode-action-examples'
60+
target: 'mayhemit'
61+
owner: 'forallsecure-demo'
62+
image: '$(imageRepository):$(branchName)'
63+
duration: 60

‎azure/mayhem-template.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# Azure DevOps job template for running Mayhem.
2+
#
3+
# Expects the following pipeline-scoped secret variables to be defined:
4+
# - MAYHEM_URL The Mayhem instance URL (e.g. https://app.mayhem.security)
5+
# - MAYHEM_TOKEN A Mayhem API token
6+
#
7+
# The `image` parameter is the short image name and tag (e.g. `lighttpd:main`).
8+
# It is assumed to live in the Mayhem-managed Docker registry; the template
9+
# resolves the full registry URL from the Mayhem CLI at runtime.
10+
11+
parameters:
12+
- name: project
13+
type: string
14+
- name: target
15+
type: string
16+
- name: owner
17+
type: string
18+
- name: image
19+
type: string
20+
- name: duration
21+
type: number
22+
default: 60
23+
- name: mayhemfile
24+
type: string
25+
default: ''
26+
27+
jobs:
28+
- job: mayhem_${{ replace(parameters.target, '-', '_') }}
29+
displayName: 'Mayhem: ${{ parameters.target }}'
30+
pool:
31+
vmImage: 'ubuntu-latest'
32+
variables:
33+
mayhemfilePath: ${{ coalesce(parameters.mayhemfile, format('mayhem/{0}.mayhemfile', parameters.target)) }}
34+
steps:
35+
- checkout: self
36+
37+
- bash: |
38+
set -euo pipefail
39+
mkdir -p ~/bin
40+
curl --no-progress-meter -Lo ~/bin/mayhem-x86_64 "${MAYHEM_URL}/cli/Linux/mayhem"
41+
chmod +x ~/bin/mayhem-x86_64
42+
echo "##vso[task.prependpath]$HOME/bin"
43+
mayhem-x86_64 login --url "${MAYHEM_URL}" --token "${MAYHEM_TOKEN}"
44+
env:
45+
MAYHEM_URL: $(MAYHEM_URL)
46+
MAYHEM_TOKEN: $(MAYHEM_TOKEN)
47+
displayName: 'Install Mayhem CLI and login'
48+
49+
- bash: |
50+
set -euo pipefail
51+
52+
registry=$(mayhem-x86_64 docker-registry)
53+
fullImage="${registry}/${IMAGE}"
54+
55+
run=$(mayhem-x86_64 --verbosity info run . \
56+
--project "${PROJECT}" \
57+
--owner "${OWNER}" \
58+
--image "${fullImage}" \
59+
--file "${MAYHEMFILE}" \
60+
--duration "${DURATION}" \
61+
--branch-name "$(Build.SourceBranchName)" \
62+
--revision "$(Build.SourceVersion)" \
63+
--ci-url "$(System.CollectionUri)$(System.TeamProject)/_build/results?buildId=$(Build.BuildId)" \
64+
2>/dev/null)
65+
66+
if [ -z "${run}" ]; then
67+
echo "Mayhem run failed to start."
68+
exit 1
69+
fi
70+
71+
runName=$(echo "${run}" | awk -F / '{ print $(NF-1) }')
72+
echo "Started Mayhem run: ${run}"
73+
74+
mayhem-x86_64 --verbosity info wait "${run}" \
75+
--owner "${OWNER}" \
76+
--sarif "sarif-${runName}.sarif" \
77+
--junit "junit-${runName}.xml"
78+
79+
status=$(mayhem-x86_64 --verbosity info show --owner "${OWNER}" --format json "${run}" | jq -r '.[0].status')
80+
if [[ "${status}" == *"stopped"* || "${status}" == *"failed"* ]]; then
81+
echo "Mayhem run finished with status: ${status}"
82+
exit 2
83+
fi
84+
85+
defects=$(mayhem-x86_64 --verbosity info show --owner "${OWNER}" --format json "${run}" | jq '.[0].defects|tonumber')
86+
if [[ "${defects}" -gt 0 ]]; then
87+
echo "${defects} defects found!"
88+
exit 3
89+
fi
90+
env:
91+
MAYHEM_URL: $(MAYHEM_URL)
92+
MAYHEM_TOKEN: $(MAYHEM_TOKEN)
93+
PROJECT: ${{ parameters.project }}
94+
OWNER: ${{ parameters.owner }}
95+
IMAGE: ${{ parameters.image }}
96+
MAYHEMFILE: $(mayhemfilePath)
97+
DURATION: ${{ parameters.duration }}
98+
displayName: 'Run Mayhem on ${{ parameters.target }}'
99+
100+
- task: PublishPipelineArtifact@1
101+
condition: always()
102+
inputs:
103+
targetPath: '$(System.DefaultWorkingDirectory)'
104+
artifact: 'mayhem-${{ parameters.target }}-$(Build.BuildId)'
105+
publishLocation: 'pipeline'
106+
displayName: 'Publish SARIF and JUnit artifacts'
107+
108+
- task: PublishTestResults@2
109+
condition: always()
110+
inputs:
111+
testResultsFormat: 'JUnit'
112+
testResultsFiles: 'junit-*.xml'
113+
mergeTestResults: true
114+
testRunTitle: 'Mayhem ${{ parameters.target }}'
115+
displayName: 'Publish JUnit test results'

mayhemit-c/mayhemit.c renamed to fuzz/mayhemit.c

File renamed without changes.

Dockerfile renamed to mayhem/Dockerfile

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
FROM debian:buster-slim as builder1
22
RUN apt-get update && \
33
apt-get install -y gcc make libc6-dbg
4-
COPY mayhemit-c/mayhemit.c .
5-
6-
# compile with coverage
4+
COPY fuzz/mayhemit.c .
5+
# complile with coverage
76
RUN gcc -g mayhemit.c -o /mayhemit
87

98
FROM debian:10-slim as builder2

mayhem/Mayhemfile.lighttpd renamed to mayhem/lighttpd.mayhemfile

File renamed without changes.

0 commit comments

Comments
 (0)