工具为网络安全添加了模糊测试
adacore正在将Fuzz测试添加到其最新工具中的ADA语言，以识别嵌入式安全关键设计中的安全漏洞
Compiler-assisted fuzz testing can be used to detect software bugs and potentially exploitable vulnerabilities. An early beta test release of a fuzz testing tool called GNATfuzz will be made available to existing GNAT Pro subscribers as part of the GNAT Dynamic Analysis Suite for Linux platforms.
This suite is a bundle of analysis, testing, verification, and code coverage technologies to help Ada developers build safe, secure software as well as meet internal security and quality procedures.
Fuzz testing is an automated software testing method that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities including security loopholes. A fuzzing tool injects these inputs into the system and then monitors for exceptions such as crashes or information leakage.
This is increasingly important in the age of cybersecurity and is already required in DO-356 compliance (Airworthiness Security Methods and Considerations). It is also becoming mandatory as part of efforts to secure the software supply chain in the US. In Q2 2022 AdaCore will be issuing the beta release of a new fuzzing tool for Linux native platforms, which will be available for select GNAT Pro customers.
GNATfuzz automatically identifies “fuzzable subprograms” within an Ada application that can be used as fuzz test injection points and automates the production of fuzz test harnesses to wrap fuzzable Ada subprograms under test. The generated harness decodes mutated binary test case files and sends the data directly into the subprogram under test.
此外，还会自动生成支持构建，执行和覆盖分析基础架构。
Each fuzz testing campaign requires an initial set of input data known as the “Starting Corpus”. The aim with corpus generation is to provide a wide range of meaningful values in order to maximize the chances of each test case finding a new path of execution through a subprogram’s control flow graph. GNATfuzz can automate the generation of an Ada-aware Starting Corpus for Ada fuzz testing campaigns.
的一个关键设计要求GNATfuzz encapsulate the complexity of setting up and executing smart-grey-box fuzz tests through the use of automation and encapsulation.
Executing Ada fuzz testing campaigns through GNATfuzz is as simple as invoking “GNATfuzz fuzz” on the automatically generated test harness GPR file.
However, behind the scenes, GCC compiler passes are invoked on the user code to add instrumentation around the assembly level basic blocks. The back-end fuzzing engine is then invoked to mutate the generated Starting Corpus and inject new test cases into the automatically generated test harness.
找到新的执行路径的测试用例保留，并将进行进一步的突变。这确保了模糊能够更深入地进入代码基础，而不是其他形式的随机喷射测试。
If, during test execution, an anomaly is detected, the associated test case is kept. This ensures that software bugs, and therefore potential security vulnerabilities, can be easily reproduced and fixed.
GNATfuzz includes fully automated integration with GNATcoverage ensuring that a statement-coverage analysis of the fuzz testing campaign is made available in realtime.
The tool also allows the user to define a “Stopping Criteria” for each fuzzing campaign. This is used to stipulate the conditions under which sufficient evidence has been collated to argue a satisfactory level of security assurance has been observed.
GNAT工作室将GNATFUZZ直接集成到他们的开发环境中。该插件通过IDE上下文菜单提供所有GNATFuzz特征的简化调用，并提供了覆盖范围的实时视觉表示，并且还提供了在调试环境中重播测试用例的能力。
“从几十年的经验帮助客户构建关键的软件系统，我们知道最成功的工作流量包含多种测试方法，”Aradore产品工程领导的Arnaud Charlet“。“我们的新GNAT动态分析套件就是这样做的，在一个包中集成了我们的代码覆盖和单元测试工具，以及新兴的技术，如紫外线测试，即在近期路线图上。”
AdaCore tools have been used to develop and maintain a wide range of critical applications in commercial and military avionics, automotive, railway, space, defence systems, air traffic management/control, medical devices and financial services.
The GNAT Dynamic Analysis Suite is available as an add-on to GNAT Pro Enterprise and GNAT Pro Assurance subscriptions and can be used with all versions of the Ada language standard, as well as the formally analysable SPARK Ada subset. Some of its capabilities, such as structural code coverage, also support C.
