move more fuzzers over to native fuzzers (#40029)

* move more fuzzers over to native fuzzers

* banner

* lint

pilot/pkg/config/kube/gateway/conversion.go

@@ -1770,3 +1770,42 @@ func toNamespaceSet(name string, labels map[string]string) klabels.Set {
 	ret[NamespaceNameLabel] = name
 	return ret
 }
+
+func (r KubernetesResources) FuzzValidate() bool {
+	for _, gwc := range r.GatewayClass {
+		if gwc.Spec == nil {
+			return false
+		}
+	}
+	for _, rp := range r.ReferencePolicy {
+		if rp.Spec == nil {
+			return false
+		}
+	}
+	for _, rp := range r.ReferenceGrant {
+		if rp.Spec == nil {
+			return false
+		}
+	}
+	for _, hr := range r.HTTPRoute {
+		if hr.Spec == nil {
+			return false
+		}
+	}
+	for _, tr := range r.TLSRoute {
+		if tr.Spec == nil {
+			return false
+		}
+	}
+	for _, g := range r.Gateway {
+		if g.Spec == nil {
+			return false
+		}
+	}
+	for _, tr := range r.TCPRoute {
+		if tr.Spec == nil {
+			return false
+		}
+	}
+	return true
+}

pilot/pkg/config/kube/gateway/fuzz_test.go

@@ -0,0 +1,30 @@
+// Copyright Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gateway
+
+import (
+	"testing"
+
+	"istio.io/istio/pkg/fuzz"
+)
+
+func FuzzConvertResources(f *testing.F) {
+	fuzz.BaseCases(f)
+	f.Fuzz(func(t *testing.T, data []byte) {
+		fg := fuzz.New(t, data)
+		r := fuzz.Struct[KubernetesResources](fg)
+		convertResources(r)
+	})
+}

pilot/pkg/model/context.go

@@ -1122,6 +1122,13 @@ func (node *Proxy) IsProxylessGrpc() bool {
 	return node.Metadata != nil && node.Metadata.Generator == "grpc"
 }
 
+func (node *Proxy) FuzzValidate() bool {
+	if node.Metadata == nil {
+		return false
+	}
+	return len(node.IPAddresses) != 0
+}
+
 type GatewayController interface {
 	ConfigStoreController
 	// Recompute updates the internal state of the gateway controller for a given input. This should be

pilot/pkg/networking/core/v1alpha3/envoyfilter/fuzz_test.go

@@ -0,0 +1,45 @@
+// Copyright Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package envoyfilter
+
+import (
+	"testing"
+
+	cluster "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+
+	meshconfig "istio.io/api/mesh/v1alpha1"
+	networking "istio.io/api/networking/v1alpha3"
+	"istio.io/istio/pilot/pkg/model"
+	"istio.io/istio/pilot/pkg/serviceregistry/memory"
+	"istio.io/istio/pkg/config/host"
+	"istio.io/istio/pkg/fuzz"
+)
+
+func FuzzApplyClusterMerge(f *testing.F) {
+	f.Fuzz(func(t *testing.T, patchCount int, hostname string, data []byte) {
+		fg := fuzz.New(t, data)
+		patches := fuzz.Slice[*networking.EnvoyFilter_EnvoyConfigObjectPatch](fg, patchCount%30)
+		proxy := fuzz.Struct[*model.Proxy](fg)
+		mesh := fuzz.Struct[*meshconfig.MeshConfig](fg)
+		c := fuzz.Struct[*cluster.Cluster](fg)
+
+		serviceDiscovery := memory.NewServiceDiscovery()
+		env := newTestEnvironment(serviceDiscovery, mesh, buildEnvoyFilterConfigStore(patches))
+		push := model.NewPushContext()
+		push.InitContext(env, nil, nil)
+		efw := push.EnvoyFilters(proxy)
+		ApplyClusterMerge(networking.EnvoyFilter_GATEWAY, efw, c, []host.Name{host.Name(hostname)})
+	})
+}

pilot/pkg/networking/core/v1alpha3/fake.go

@@ -85,6 +85,20 @@ type TestOptions struct {
 	ClusterID cluster2.ID
 }
 
+func (to TestOptions) FuzzValidate() bool {
+	for _, csc := range to.ConfigStoreCaches {
+		if csc == nil {
+			return false
+		}
+	}
+	for _, sr := range to.ServiceRegistries {
+		if sr == nil {
+			return false
+		}
+	}
+	return true
+}
+
 type ConfigGenTest struct {
 	t                    test.Failer
 	pushContextLock      *sync.RWMutex

pilot/pkg/networking/core/v1alpha3/fuzz_test.go

@@ -0,0 +1,62 @@
+// Copyright Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1alpha3
+
+import (
+	"testing"
+
+	route "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+
+	"istio.io/istio/pilot/pkg/model"
+	"istio.io/istio/pkg/fuzz"
+)
+
+func FuzzBuildGatewayListeners(f *testing.F) {
+	f.Fuzz(func(t *testing.T, patchCount int, hostname string, data []byte) {
+		fg := fuzz.New(t, data)
+		proxy := fuzz.Struct[*model.Proxy](fg)
+		to := fuzz.Struct[TestOptions](fg)
+		lb := fuzz.Struct[*ListenerBuilder](fg)
+		cg := NewConfigGenTest(t, to)
+		lb.node = cg.SetupProxy(proxy)
+		lb.push = cg.PushContext()
+		cg.ConfigGen.buildGatewayListeners(lb)
+	})
+}
+
+func FuzzBuildSidecarOutboundHTTPRouteConfig(f *testing.F) {
+	f.Fuzz(func(t *testing.T, patchCount int, hostname string, data []byte) {
+		fg := fuzz.New(t, data)
+		proxy := fuzz.Struct[*model.Proxy](fg)
+		to := fuzz.Struct[TestOptions](fg)
+		cg := NewConfigGenTest(t, to)
+		req := fuzz.Struct[*model.PushRequest](fg)
+		req.Push = cg.PushContext()
+		vHostCache := make(map[int][]*route.VirtualHost)
+		cg.ConfigGen.buildSidecarOutboundHTTPRouteConfig(cg.SetupProxy(proxy), req, "80", vHostCache, nil, nil)
+	})
+}
+
+func FuzzBuildSidecarOutboundListeners(f *testing.F) {
+	f.Fuzz(func(t *testing.T, patchCount int, hostname string, data []byte) {
+		fg := fuzz.New(t, data)
+		proxy := fuzz.Struct[*model.Proxy](fg)
+		to := fuzz.Struct[TestOptions](fg)
+		cg := NewConfigGenTest(t, to)
+		req := fuzz.Struct[*model.PushRequest](fg)
+		req.Push = cg.PushContext()
+		NewListenerBuilder(proxy, cg.env.PushContext).buildSidecarOutboundListeners(cg.SetupProxy(proxy), cg.env.PushContext)
+	})
+}

pilot/pkg/security/authz/builder/fuzz_test.go

@@ -0,0 +1,59 @@
+// Copyright Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package builder
+
+import (
+	"testing"
+
+	"istio.io/istio/pilot/pkg/model"
+	"istio.io/istio/pilot/pkg/security/trustdomain"
+	"istio.io/istio/pkg/fuzz"
+)
+
+func FuzzBuildHTTP(f *testing.F) {
+	fuzz.BaseCases(f)
+	f.Fuzz(func(t *testing.T, data []byte) {
+		fg := fuzz.New(t, data)
+		bundle := fuzz.Struct[trustdomain.Bundle](fg)
+		push := fuzz.Struct[*model.PushContext](fg, validatePush)
+		node := fuzz.Struct[*model.Proxy](fg)
+		policies := push.AuthzPolicies.ListAuthorizationPolicies(node.ConfigNamespace, node.Metadata.Labels)
+		option := fuzz.Struct[Option](fg)
+		New(bundle, push, policies, option).BuildHTTP()
+	})
+}
+
+func FuzzBuildTCP(f *testing.F) {
+	fuzz.BaseCases(f)
+	f.Fuzz(func(t *testing.T, data []byte) {
+		fg := fuzz.New(t, data)
+		bundle := fuzz.Struct[trustdomain.Bundle](fg)
+		push := fuzz.Struct[*model.PushContext](fg, validatePush)
+		node := fuzz.Struct[*model.Proxy](fg)
+		policies := push.AuthzPolicies.ListAuthorizationPolicies(node.ConfigNamespace, node.Metadata.Labels)
+		option := fuzz.Struct[Option](fg)
+		New(bundle, push, policies, option).BuildTCP()
+	})
+}
+
+func validatePush(in *model.PushContext) bool {
+	if in == nil {
+		return false
+	}
+	if in.AuthzPolicies == nil {
+		return false
+	}
+	return true
+}

pilot/pkg/serviceregistry/kube/controller/fuzz_test.go

@@ -0,0 +1,44 @@
+// Copyright Istio Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package controller
+
+import (
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+
+	"istio.io/istio/pilot/pkg/model"
+	"istio.io/istio/pkg/fuzz"
+	"istio.io/istio/pkg/network"
+)
+
+func FuzzKubeController(f *testing.F) {
+	fuzz.BaseCases(f)
+	f.Fuzz(func(t *testing.T, data []byte) {
+		fg := fuzz.New(t, data)
+		networkID := network.ID("fakeNetwork")
+		fco := fuzz.Struct[FakeControllerOptions](fg)
+		fco.SkipRun = true
+		controller, _ := NewFakeControllerWithOptions(t, fco)
+		controller.network = networkID
+
+		p := fuzz.Struct[*corev1.Pod](fg)
+		controller.pods.onEvent(p, model.EventAdd)
+		s := fuzz.Struct[*corev1.Service](fg)
+		controller.onServiceEvent(s, model.EventAdd)
+		e := fuzz.Struct[*corev1.Endpoints](fg)
+		controller.endpoints.onEvent(e, model.EventAdd)
+	})
+}

pkg/fuzz/README.md

@@ -0,0 +1,48 @@
+# Fuzzing Istio Code
+
+The Istio (Go) code base is fuzzed using native Go fuzzing.
+For general docs on how to fuzz in Go, see [Getting started with fuzzing](https://go.dev/doc/tutorial/fuzz).
+
+## Writing a test
+
+Generally, writing a fuzz test for Istio is the same as any other Go program.
+However, because most of our fuzzing is based on complex structs rather than the primitives Go supports natively,
+the `pkg/fuzz` package contains a number of helpers to fuzz.
+
+Here is an example:
+
+```go
+// Define a new fuzzer. Must have Fuzz prefix
+func FuzzBuildHTTP(f *testing.F) {
+  fuzz.BaseCases(f) // Insert basic cases so a few trivial cases run in presubmit
+  f.Fuzz(func(t *testing.T, data []byte) {
+    fg := fuzz.New(t, data)
+    // Setup a few structs for testing
+    bundle := fuzz.Struct[trustdomain.Bundle](fg)
+        // This one has a custom validator
+    push := fuzz.Struct[*model.PushContext](fg, validatePush)
+        // *model.Proxy, and other types, implement the fuzz.Validator interface and already validate some basics.
+    node := fuzz.Struct[*model.Proxy](fg)
+    option := fuzz.Struct[Option](fg)
+
+    // Run our actual test code. In this case, we are just checking nothing crashes.
+    // In other tests, explicit assertions may be helpful.
+    policies := push.AuthzPolicies.ListAuthorizationPolicies(node.ConfigNamespace, node.Metadata.Labels)
+    New(bundle, push, policies, option).BuildHTTP()
+  })
+}
+```
+
+## Running tests
+
+Fuzz tests can be run using standard Go tooling:
+
+```shell
+go test ./path/to/pkg -v -run=^$ -fuzz=Fuzz
+```
+
+## CI testing
+
+Go fuzzers are run as part of standard unit tests against known test cases (from `f.Add` (which `fuzz.BaseCases` calls), or `testdata`).
+For continuous fuzzing, [`OSS-Fuzz`](https://github.com/google/oss-fuzz) continually builds and runs the fuzzers and reports any failures.
+These results are private to the Istio Product Security WG until disclosed.