Hi @cmainas and the urunc maintainers,
The CNCF LFX Mentorship issue (#852) highlights the critical need for robust validation around configuration parsing (e.g., config.json, urunc.json, and OCI annotations). Recent discussions have successfully surfaced isolated edge cases (such as the base64 decoding flaws and memory validation issues tracked in #909 and previous comments).
However, rather than addressing these parsing bugs individually, the project would benefit significantly from an automated, continuous fuzzing pipeline. This ensures that current and future regressions are caught systematically during the CI process.
Proposed Architecture
To fulfill the core deliverables of the mentorship, I propose integrating ClusterFuzzLite directly into the repository's GitHub Actions.
The implementation would consist of two primary components:
-
Continuous Fuzzing CI/CD Integration:
cflite_pr.yml: Executes a highly targeted fuzzing battery on every Pull Request.cflite_batch.yml: Executes extended, deep-fuzzing batch jobs on a daily cron schedule.cflite_build.yml: Validates that all Go fuzz targets compile successfully against the main branch.- Custom
Dockerfile and build.sh within .clusterfuzzlite/ tailored for the urunc Go environment.
-
Native Go Fuzz Targets:
As a foundational baseline, the initial integration will include native Go fuzz targets covering the most critical parsers:
FuzzUruncConfigFromMap: Validates map-to-struct configuration decoding.FuzzUnikernelConfigDecode: Validates base64 annotation decoding constraints.FuzzBytesToStringMB: Validates memory parsing bounds and truncation limits.FuzzSubnetMaskToCIDR: Validates CIDR calculations (targeting non-contiguous subnet mask edge cases).
Next Steps
I have successfully implemented and locally verified this infrastructure, including the native Go fuzz targets and the ClusterFuzzLite workflows.
If this architectural approach aligns with your vision for resolving #852, I would be glad to submit a Pull Request containing this foundation. Feedback and suggestions are highly welcome!
Hi @cmainas and the urunc maintainers,
The CNCF LFX Mentorship issue (#852) highlights the critical need for robust validation around configuration parsing (e.g.,
config.json,urunc.json, and OCI annotations). Recent discussions have successfully surfaced isolated edge cases (such as the base64 decoding flaws and memory validation issues tracked in #909 and previous comments).However, rather than addressing these parsing bugs individually, the project would benefit significantly from an automated, continuous fuzzing pipeline. This ensures that current and future regressions are caught systematically during the CI process.
Proposed Architecture
To fulfill the core deliverables of the mentorship, I propose integrating ClusterFuzzLite directly into the repository's GitHub Actions.
The implementation would consist of two primary components:
Continuous Fuzzing CI/CD Integration:
cflite_pr.yml: Executes a highly targeted fuzzing battery on every Pull Request.cflite_batch.yml: Executes extended, deep-fuzzing batch jobs on a daily cron schedule.cflite_build.yml: Validates that all Go fuzz targets compile successfully against themainbranch.Dockerfileandbuild.shwithin.clusterfuzzlite/tailored for theuruncGo environment.Native Go Fuzz Targets:
As a foundational baseline, the initial integration will include native Go fuzz targets covering the most critical parsers:
FuzzUruncConfigFromMap: Validates map-to-struct configuration decoding.FuzzUnikernelConfigDecode: Validates base64 annotation decoding constraints.FuzzBytesToStringMB: Validates memory parsing bounds and truncation limits.FuzzSubnetMaskToCIDR: Validates CIDR calculations (targeting non-contiguous subnet mask edge cases).Next Steps
I have successfully implemented and locally verified this infrastructure, including the native Go fuzz targets and the ClusterFuzzLite workflows.
If this architectural approach aligns with your vision for resolving #852, I would be glad to submit a Pull Request containing this foundation. Feedback and suggestions are highly welcome!