Shulou(Shulou.com)06/01 Report--

This article mainly explains "what are the new functions in Go". The content in the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "what are the new features in Go"?

What is a fuzzy test?

The fuzzy test fuzz testing (fuzzing) is to point your software to input unexpected data. Ideally, this test will cause your application to crash or perform unexpectedly. Putting aside the final results, you can get a lot of information from the program's processing of unexpected input data, so you can add some appropriate error handling.

Any software has instructions for receiving input or data from different sources, and the software will process the data and return the appropriate results. After software development, the team of test engineers tests it, finds out the errors in the software, gives the test report, and fixes it (by the developer). Usually the purpose of testing is to verify that the behavior of the software is in line with expectations. Testing can be subdivided into different types, such as functional testing, integration testing, performance testing, and so on. Each test method focuses on one aspect of the software's functionality in order to find errors or improve reliability or performance.

Fuzzy testing takes this testing process a step further, trying to input some "invalid" or "random" data into the software program. This input is intentional, and the expected result is a program crash or output exception, so that errors in the program can be exposed so that developers can fix them. Like other tests, there is little need for manual fuzzy testing, and there are a large number of fuzzy testing tools in the industry that can automate this process.

Software testing in Go

For example, if you want to test the Add () function in add.go, you can import the testing package into add_test.go and write the test body in a function that starts with TestXXX ().

Consider the following code:

Func Add (num1, num2 int) int {}

In the add_test.go file, you may have the following test code:

Import "testing" func TestAdd (t * testing.T) {}

Run the test:

$go test adds support for fuzzy testing

The Go team has accepted the proposal to add support for fuzzy testing to further advance this work. This involves adding a new testing.F type, a new FuzzXXX () function in the _ test.go file, and a new-fuzz option in the Go tool to perform these tests.

In the add_test.go file:

Func FuzzAdd (f * testing.F) {}

Execute the following code:

$go test-fuzz

At the time of this writing, this feature was experimental, but should be included in the 1.18 release. LCTT 1.18 has just been released and has included support for ambiguity testing.) at present, many features such as-keepfuzzing,-race, and so on are not supported. The Go team recently released a fuzzy testing tutorial that is worth reading.

Install gotip to get the latest features

If you are desperate to try these features before the official release, you can use gotip to test the upcoming Go features and give them feedback. You can use the following command to install gotip. After installation, you can compile and run the program with the gotip program instead of the previous go program.

$go install golang.org/dl/gotip@latest$ gotip download$ gotip versiongo version devel go1.18-f009910 Thu Jan 6 16:22:21 2022 + 0000 views of the linux/amd64 community on fuzzy testing

Fuzzy testing is often discussed in the software community, and different people have different views on fuzzy testing. Some people think that this is a useful technique to find errors, especially in the area of security. However, considering the resources needed for fuzzy testing (CPU, memory), some people think that this is a waste, and they prefer to use other testing methods. Even within the Go team, there is disagreement. We can see that Rob Pike, the co-founder of Go, is slightly skeptical about the use of fuzzy testing and its implementation in Go.

... Although fuzzy testing helps to find certain types of errors, it takes up a lot of CPU and storage resources, and the benefit-cost ratio is not clear. I'm worried about wasting energy writing fuzzy tests, or that git repositories are full of useless test data Rob Pike.

However, another member of the Go security team, Filo Sottile, seems optimistic about Go's new support for fuzzy testing, giving many examples to support it, and hopes that fuzzy testing will become part of the development process.

I would say that fuzzy tests can find errors in extreme cases. This is why we as a security team are interested in it: errors found in extreme cases can avoid becoming a weakness in a production environment.

We want fuzzy testing to be part of development-- not just build or security-- but the entire development process: it improves the quality of the relevant code.

Filo Sottile

Fuzzy Test in reality

To me, fuzzy testing seems to be very effective in finding errors and making the system safer and more resilient. For example, the Linux kernel also uses a tool called syzkaller for blur testing, which has found a lot of errors.

AFL is also a popular fuzzy testing tool, which is used to test programs written by C _ blank +.

There has also been a view of fuzzy testing of Go programs before, one of which is go-fuzz mentioned by Filo in the GitHub review.

Go-fuzz 's records provide startling evidence that obfuscation is good at finding errors that humans don't find. In my experience, we only need a little bit of CPU time to get very efficient test results in extreme cases.

Why add native support for fuzzy testing in Go

If our requirement is to vaguely test Go programs and previous tools like go-fuzz can be done, why add native support to the language? Some of the root causes of this are explained in the Go fuzzy test design draft. The idea of the design is to make the development process easier, because the tools mentioned above increase the developer's workload and lack of functionality. If you have not been exposed to fuzzy testing, then I suggest you read the design draft document.

Developers can use things such as go-fuzz or fzgo (based on go-fuzz) to address certain requirements. However, each of the existing solutions needs to do more on typical Go tests and lacks key functionality. Compared with other Go tests, such as benchmarking and unit testing, fuzzy testing should not be more complex or less functional than them. Existing solutions add additional overhead, such as custom command-line tools.

Fuzzy testing tool

Fuzziness testing is one of the popular items in the list of expected new features in the Go language. Although it is still experimental, it will become more powerful in the coming release. This gives us plenty of time to try it and explore its usage scenarios. We should not think of it as an overhead. If used properly, it can be a very efficient testing tool for finding errors. The team that uses Go should promote its use, developers can write simple fuzzy tests, and the test team will slowly expand to use its full capabilities.

Thank you for your reading, these are the contents of "what are the new features in Go". After the study of this article, I believe you have a deeper understanding of what the new features in Go are, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.