forked from rlane/ubpf
-
Notifications
You must be signed in to change notification settings - Fork 129
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into stepsecurity_remediation_1709052077
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
- Loading branch information
Showing
50 changed files
with
2,734 additions
and
361 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,163 @@ | ||
| # Copyright (c) uBPF contributors | ||
| # SPDX-License-Identifier: MIT | ||
|
|
||
| name: Fuzzing | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| arch: | ||
| description: 'Architecture' | ||
| required: true | ||
| type: string | ||
|
|
||
| platform: | ||
| required: true | ||
| type: string | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ${{ inputs.platform }} | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| submodules: 'recursive' | ||
|
|
||
| - name: Initialize CodeQL | ||
| if: inputs.build_codeql == true | ||
| uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14 | ||
| with: | ||
| languages: 'cpp' | ||
|
|
||
| - name: Generate the cache key | ||
| id: cache_key | ||
| run: echo "VALUE=platform-${{ inputs.platform }}_arch=${{ inputs.arch }}_type=fuzzing" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: Update the cache (ccache) | ||
| uses: actions/cache@v4.0.2 | ||
| with: | ||
| path: ccache | ||
| key: ${{ steps.cache_key.outputs.VALUE }}_ccache | ||
|
|
||
| - name: Create the build folders | ||
| run: | | ||
| mkdir -p \ | ||
| ccache | ||
| - name: Install system dependencies (Linux) | ||
| if: inputs.platform == 'ubuntu-latest' | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y \ | ||
| ccache \ | ||
| ninja-build \ | ||
| cmake \ | ||
| lcov \ | ||
| libboost-dev \ | ||
| libboost-program-options-dev \ | ||
| libboost-filesystem-dev \ | ||
| libelf-dev | ||
| if [[ "${{ inputs.scan_build }}" == "true" ]] ; then | ||
| sudo apt-get install -y \ | ||
| clang-tools | ||
| fi | ||
| if [[ "${{ inputs.arch }}" == "arm64" ]] ; then | ||
| sudo apt install -y \ | ||
| g++-aarch64-linux-gnu \ | ||
| gcc-aarch64-linux-gnu \ | ||
| qemu-user | ||
| fi | ||
| - name: Build/install libbpf From Source | ||
| if: inputs.platform == 'ubuntu-latest' | ||
| run: ./.github/scripts/build-libbpf.sh | ||
| shell: bash | ||
|
|
||
| - name: Install system dependencies (macOS) | ||
| if: inputs.platform == 'macos-11' | ||
| run: | | ||
| brew install \ | ||
| cmake \ | ||
| ninja \ | ||
| ccache \ | ||
| lcov \ | ||
| boost | ||
| - name: Configure uBPF | ||
| run: | | ||
| export CCACHE_DIR="$(pwd)/ccache" | ||
| ${command_prefix} cmake \ | ||
| -G Ninja \ | ||
| -S . \ | ||
| -B build \ | ||
| -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} \ | ||
| -DCMAKE_C_COMPILER=clang \ | ||
| -DCMAKE_CXX_COMPILER=clang++ \ | ||
| -DUBPF_ENABLE_LIBFUZZER=1 \ | ||
| -DCMAKE_BUILD_TYPE=Debug | ||
| ${arch_flags} | ||
| - name: Build uBPF | ||
| run: | | ||
| export CCACHE_DIR="$(pwd)/ccache" | ||
| if [[ "${{ inputs.scan_build }}" == "true" ]] ; then | ||
| command_prefix="scan-build -o scan_build_report" | ||
| fi | ||
| ${command_prefix} cmake \ | ||
| --build build | ||
| - name: Upload fuzzer as artifacts | ||
| uses: actions/upload-artifact@v2 | ||
| with: | ||
| name: fuzzer | ||
| path: build/bin/ubpf_fuzzer | ||
|
|
||
| - uses: actions/checkout@v4 | ||
| with: | ||
| submodules: 'recursive' | ||
| ref: fuzz/corpus | ||
|
|
||
| - name: Download fuzzer artifacts | ||
| uses: actions/download-artifact@v2 | ||
| with: | ||
| name: fuzzer | ||
|
|
||
| - name: Setup directory for fuzzing | ||
| run: | | ||
| ls -la | ||
| mkdir -p new_corpus | ||
| mkdir -p fuzz/corpus | ||
| cp -r fuzz/corpus/* new_corpus | ||
| mkdir -p artifacts | ||
| chmod a+x ubpf_fuzzer | ||
| - name: Run fuzzing | ||
| run: | | ||
| ./ubpf_fuzzer new_corpus -artifact_prefix=artifacts/ -use_value_profile=1 -max_total_time=300 | ||
| - name: Merge corpus into fuzz/corpus | ||
| run: | | ||
| ./ubpf_fuzzer -merge=1 fuzz/corpus new_corpus | ||
| git add fuzz/corpus | ||
| git config --global user.email 'ubpf@users.noreply.github.com' | ||
| git config --global user.name 'Github Action' | ||
| git commit -sm "Update fuzzing corpus" | ||
| git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/iovisor/ubpf.git | ||
| git push | ||
| - name: Upload artifacts | ||
| if: always() | ||
| uses: actions/upload-artifact@v2 | ||
| with: | ||
| name: fuzzing-artifacts | ||
| path: artifacts/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| # Copyright (c) Microsoft Corporation | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| set(CMAKE_CXX_STANDARD 20) | ||
|
|
||
| file(GLOB test_descr_files ${CMAKE_SOURCE_DIR}/custom_tests/descrs/*.md) | ||
|
|
||
| add_library(ubpf_custom_test_support srcs/ubpf_custom_test_support.cc) | ||
|
|
||
| target_link_libraries( | ||
| ubpf_custom_test_support | ||
| ubpf | ||
| ubpf_settings | ||
| ) | ||
|
|
||
| target_include_directories(ubpf_custom_test_support PUBLIC ".srcs/") | ||
| target_include_directories(ubpf_custom_test_support PRIVATE | ||
| "${CMAKE_SOURCE_DIR}/vm" | ||
| "${CMAKE_BINARY_DIR}/vm" | ||
| "${CMAKE_SOURCE_DIR}/vm/inc" | ||
| "${CMAKE_BINARY_DIR}/vm/inc" | ||
| ) | ||
|
|
||
| set(QEMU_RUNNER "") | ||
| if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 AND (NOT CMAKE_HOST_SYSTEM_PROCESSOR STREQUAL aarch64)) | ||
| set(QEMU_RUNNER qemu-aarch64 -L /usr/aarch64-linux-gnu) | ||
| endif() | ||
|
|
||
| foreach(test_file ${test_descr_files}) | ||
| get_filename_component(test_name ${test_file} NAME_WE) | ||
| set(test_source_path "${CMAKE_SOURCE_DIR}/custom_tests/srcs/${test_name}.cc") | ||
|
|
||
| add_executable( | ||
| ${test_name} | ||
| ${test_source_path} | ||
| ) | ||
| target_include_directories(${test_name} PRIVATE | ||
| "${CMAKE_SOURCE_DIR}/vm" | ||
| "${CMAKE_BINARY_DIR}/vm" | ||
| "${CMAKE_SOURCE_DIR}/vm/inc" | ||
| "${CMAKE_BINARY_DIR}/vm/inc" | ||
| ) | ||
| target_link_libraries( | ||
| ${test_name} | ||
| ubpf | ||
| ubpf_custom_test_support | ||
| ubpf_settings | ||
| ) | ||
| set(potential_input_file ${CMAKE_SOURCE_DIR}/custom_tests/data/${test_name}.input) | ||
| if (EXISTS ${potential_input_file}) | ||
| list(JOIN QEMU_RUNNER " " QEMU_RUNNER_STR) | ||
| add_test( | ||
| NAME ${test_name}-Custom | ||
| COMMAND sh -c "cat ${potential_input_file} | ${QEMU_RUNNER_STR} $<TARGET_FILE:${test_name}>" | ||
| ) | ||
| else() | ||
| add_test( | ||
| NAME ${test_name}-Custom | ||
| COMMAND ${QEMU_RUNNER} $<TARGET_FILE:${test_name}> | ||
| ) | ||
| endif() | ||
| endforeach() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| ## Writing a uBPF Custom Tests | ||
|
|
||
| Custom tests are enabled by creating two (2) or three (3) different files in the `custom_tests` directory. | ||
|
|
||
| ### Files Of a uBPF Custom Test | ||
|
|
||
| #### Description Files | ||
|
|
||
| The first file to create is the Description File. The Description File is a file with a `.md` extension that resides in the `descrs` directory. The purpose of this file is to identify the name of the test (everything before the `.md` extension) and provide a place to document the purpose of the test. | ||
|
|
||
| #### Source Files | ||
|
|
||
| The second file to create is the Source File. The Source file should reside in the `srcs` directory and have a name that matches its Description File (with the `.cc` extension rather than the `.md` extension). | ||
|
|
||
| #### Input Files | ||
|
|
||
| The final file is optional. The Input File resides in the `data` directory and should have the same name as the other two (2) files but with an `.input` extension rather than `.cc` or `.md` for the Source and Description File respectively. If present, the contents of this file will be given to the executed custom test over standard input. | ||
|
|
||
| ### Building | ||
|
|
||
| The Source Files for a custom test are compiled using C++20 and are saved as an executable named according to the name of the test in the CMake build directory. | ||
|
|
||
| ### Return Values | ||
|
|
||
| All successful tests should return `0`. All failing tests should return something other than `0`. | ||
|
|
||
| ### Supporting Libraries | ||
|
|
||
| To reduce the boilerplate needed to write custom tests, there is a custom test library with several helpful functions. These functions are documented in the library's header file (`custom_tests/srcs/ubpf_custom_test_support.h`). | ||
|
|
||
| ### Putting It Together | ||
|
|
||
| After describing the test's purpose in a Markdown syntax in a file named, say, `test_example.md` and stored in the `descrs` directory, you can write the test's Source Code (in C++20) and give it the name `test_example.cc` in the `srcs` directory. If the test needs input, you can save that input in the tests Input File (`test_input.input`) in the `data` directory. | ||
|
|
||
| Because all the files are present, this test will be run when the CTest target is invoked. Because there the optional `test_input.input` file is present, the contents of that file will be given to the executable via standard input. |
1 change: 1 addition & 0 deletions
1
custom_tests/data/ubpf_test_external_dispatcher_context_overwrite.input
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| b7 01 00 00 01 02 03 04 85 00 00 00 01 00 00 00 95 00 00 00 00 00 00 00 |
Oops, something went wrong.