LFI: A practical and general library-level fault injector

Abstract

Fault injection, a critical aspect of testing robust systems, is often overlooked in the development of generalpurpose software. We believe this is due to the absence of easy-to-use tools and to the extensive manual labor required to perform fault injection tests. This paper introduces LFI (Library Fault Injector), a tool that automates the preparation of fault scenarios and their injection at the boundary between shared libraries and applications. LFI extends prior work by automatically profiling fault behaviors of libraries via static analysis of their binaries, thus reducing the dependence on human labor and perfect documentation. We present techniques for automatically generating injection scenarios and we describe a simple language for expressing such scenarios. LFI does not require access to libraries' source code and works for Linux, Windows, and Solaris on x86 and SPARC platforms.

Detecting vulnerabilities in C programs using trace-based testing

“…For example, if we derive constraints on library functions from documentation, there might be false negatives due to the inconsistency between the documentation and the actual implementation. We can use LFI to check such consistency [17]. Similarly, SecTAC will generate a false positive if (1) the theorem prover returns a solution when PC ∧¬ SC is not satisfiable or (2) the program and security constraints are extracted incorrectly.…”

Fast black-box testing of system recovery code

“…Figure 1. Part of the fault space created by LFI [16] for the ls utility. The horizontal axis represents functions in the C standard library that fail, and the vertical axis represents the tests in the default test suite for this utility.…”

“…In our evaluation we use LFI [16], a library fault injection tool that allows the developer to fine-tune the definition of an injection point according to their own needs. Since we aim to maximize the accuracy of our evaluation, we define an injection point as the tuple testID, functionName, callNumber .…”

“…Such ad-hoc approaches are typically based on a poor understanding of the space of possible faults and lead to poor-coverage testing. Recent tools, like LFI [16], improve the state of the art by offering the ability to simulate a wide variety of fine-grained faults that occur in a program's environment and become visible to applications through the application-library interface. Such tools offer developers better control over fault injection.…”

A Case for Virtual Machine Based Fault Injection in a High-Performance Computing Environment

“…In systems that support dynamic loading of shared libraries, a common approach is to use the LD_PRELOAD mechanism to interpose on library calls and introduce faults, e.g., library level fault injection (LFI) [9]. This is a generic approach that does not require source code modifications of the target, and allows for runtime additions via the shared library wrapper routines.…”