net/netip: add fuzz test comparing with net.ParseIP

[FiloSottile]

There is an excellent opportunity to write a fuzzer that compares the behaviors of net and netip, to find differences in parsing, serialization, validation, and IsFoo values. Although the internals are different, we probably want them to behave the same, and to document where they diverge intentionally.

It should also catch issues such as #49365.

/cc @katiehockman

[josharian]

There's an existing go-fuzz based fuzzer that does this and more at github.com/inetaf/netaddr. We should port it.

[katiehockman]

/cc @golang/fuzzing

[capnspacehook]

Is there still interest on getting this merged in during the freeze? I've never contributed to Go before but from what I understand, since this would just be adding a test it might still be acceptable to add now.

If so, I can work on this later this week.

[josharian]

I believe it should be fine, but it would be good to get confirmation from @golang/release before starting. Thanks for volunteering!

[dmitshur]

Confirmed, it should be okay and helpful!

As I understand, fuzz tests don't run automatically during all.bash, so this is really low-risk for the stability of the tree and the release. But running them manually can help catch previously-undetected issues sooner.

[katiehockman]

As I understand, fuzz tests don't run automatically during all.bash, so this is really low-risk for the stability of the tree and the release. But running them manually can help catch previously-undetected issues sooner.

That's not necessarily true. If there is any seed corpus (e.g. in the testdata directory for that fuzz test, or with calls to f.Add it would run with all.bash), those are run by default with go test. It won't fuzz by default though.
And even if there is no seed corpus, if anything fails before the f.Fuzz call, that would also fail all.bash.

That said, it is still a test, so I think it's still pretty low risk.

[capnspacehook]

Sweet, this should be a good way to get my feet wet contributing to Go :)

Speaking of the seed corpus, there is an existing corpus for this fuzz test at https://github.com/inetaf/netaddr-corpus, but I'm not sure if corpora should be included in the Go tree or not... Is there a policy for that?

[thepudds]

FWIW, #31215 is an older proposal to create a new repository such as x/fuzzdata for holding fuzzing corpora for the standard library

Personally, I think it still makes sense, including gaining experience with the standard library is one way to help cmd/go fuzzing mature, including hopefully around basic corpus management.

[katiehockman]

Speaking of the seed corpus, there is an existing corpus for this fuzz test at https://github.com/inetaf/netaddr-corpus, but I'm not sure if corpora should be included in the Go tree or not... Is there a policy for that?

There isn't such a policy for the standard library today.
For now, I suggest just writing and mailing the fuzz test without any seed corpus. It can always be added later, particularly when #48901 is done.

[gopherbot]

Change https://golang.org/cl/371055 mentions this issue: net/netip: add a fuzz test