Fix It

Overview

In the Fix It phase, you will be given access to all breaks against your initial implementation from Build It, and you are now responsible for fixing them.

The Fix It phase is an opportunity to gain points back that you lost during the Break It phase. You can do this by identifying breaks from multiple teams that all targeted the same bug/vulnerability and then fixing it. If T teams all exploited the same bug with a break type worth P points, then in the Break It phase, you lost T*P points. If you fix the underlying bug, you will regain (T-1)*P points, so that in effect, you will have only lost points once for the bug, rather than T times.

Setup

In the Fix It AutoLab assignment, you will find a handout with all of the breaks that were discovered during the Break It phase. You can find the ones targeting your team in the directory with your team’s name.

For this phase, you should setup your code as follows. Create a fresh git repo (via git init). In the base of this repo, check in your code from the Build It phase. Specifically, you should look in the handout from the Break It phase, and commit the files from the dist/YourTeamName/code/ directory into the base of your newly created repo.

Fix Submission

For each break against your team’s original code, you must prepare a small patch that fixes it. Each patch should only fix one bug (though fixing that one bug may fix many break reports).

To prepare your patch, change your code in your git repo to implement your fix, and then run git diff > patch-name.patch. Once you’ve generated your patch, you can commit these changes and start on your next fix.

Your submission to AutoLab should be a tar file that contains a collection of patch files (created as described above), and a JSON file named handin.json with metadata indicating which break(s) each fix addresses. Each fix will then be tested to confirm it resolves the underlying break. The JSON file should be formatted as follows. Please check the formatting of your JSON file before submitting (for instance, by using https://jsonlint.com/ to ensure that your submission is a valid JSON file).

{
  "team": "YOUR_TEAM_NAME",
  "fixes": [
    {
      "patch": "patch_file_1.patch",
      "breaks": ["break-003.json", "break-013.json"]
    },
    {
      FIX 2
    },
    ...
    {
      FIX N
    }
  ]
}

In summary, you must have an ordered array of fixes. Each fix will specify the corresponding “patch” file that you created, as well as an array of “breaks” the patch resolves. You must also include an entry with your team name.

The AutoLab infrastucture will iterate through the list of fixes. For each fix, it will apply the patch and then evaluate the break(s) to see whether they still succeed. Note that the patches will be applied cumulatively, so you should account for that when preparing them.

Deliverables

You must fix each of the breaks reported against your team, and demonstrate the success of your fix via your submission to AutoLab.

You should also submit a Fix It report to Gradescope. The report should organize your fixes into categories (e.g., these three fixes address buffer overflows). Explain how you developed the fixes, and your level of confidence that these fixes address all such bugs in your program.

You will be graded on:

The proportion of breaks fixed
The explanation of each fix
The organization of fixes into general categories (i.e. don’t explain a buffer overflow, then an integrity fix, then another buffer overflow)
The general clarity and presentation of the writeup
Ensuring that your names, Andrew IDs, and group name are included in the writeup

For each fix, please:

Explain what the issue was
Explain how the attack impacted your system/what the security risks were
Explain in text how it was corrected. You can include pseudocode, a small snippet of actual code, and/or a pointer to the fix patch to help illustrate your explanation.
Explain why it defends against all bugs of the same class
Explain your development process to fix the break
If you claimed that you defended against it in the Build It phase, explain why your defense wasn’t enough

Grading