  Remote Procedure Call (RPC) is a communication protocol to support
client-server interactions among services over a network. RPC is widely applied
in industry for building large-scale distributed systems, such as
Microservices. Modern RPC frameworks include for example Thrift, gRPC, SOFARPC
and Dubbo. Testing such systems is very challenging, due to the complexity of
distributed systems and various RPC frameworks the system could employ. To the
best of our knowledge, there does not exist any tool or solution that could
enable automated testing of modern RPC-based services. To fill this gap, in
this paper we propose the first approach in the literature, together with an
open-source tool, for white-box fuzzing modern RPC-based APIs with search. To
assess our novel approach, we conducted an empirical study with two artificial
and four industrial APIs selected by our industrial partner. The tool has been
integrated into a real industrial pipeline, and could be applied to real
industrial development process for fuzzing RPC-based APIs. To further
demonstrate its effectiveness and application in industrial settings, we also
report results of employing our tool for fuzzing another 50 industrial APIs
autonomously conducted by our industrial partner in their testing processes.
Results show that our novel approach is capable of enabling automated test case
generation for industrial RPC-based APIs (i.e., two artificial and 54
industrial). We also compared with a simple grey-box technique and existing
manually written tests. Our white-box solution achieves significant
improvements on code coverage. Regarding fault detection, by conducting a
careful review with our industrial partner of the tests generated by our novel
approach in the selected four industrial APIs, a total of 41 real faults were
identified, which have now been fixed. Another 8,377 detected faults are
currently under investigation.
