istio.io/istio@v0.0.0-20240520182934-d79c90f27776/pkg/fuzz/README.md (about)

     1  # Fuzzing Istio Code
     2  
     3  The Istio (Go) code base is fuzzed using native Go fuzzing.
     4  For general docs on how to fuzz in Go, see [Getting started with fuzzing](https://go.dev/doc/tutorial/fuzz).
     5  
     6  ## Writing a test
     7  
     8  Generally, writing a fuzz test for Istio is the same as any other Go program.
     9  However, because most of our fuzzing is based on complex structs rather than the primitives Go supports natively,
    10  the `pkg/fuzz` package contains a number of helpers to fuzz.
    11  
    12  Here is an example:
    13  
    14  ```go
    15  // Define a new fuzzer. Must have Fuzz prefix
    16  func FuzzBuildHTTP(f *testing.F) {
    17    fuzz.Fuzz(f, func(fg fuzz.Helper) {
    18      // Setup a few structs for testing
    19      bundle := fuzz.Struct[trustdomain.Bundle](fg)
    20          // This one has a custom validator
    21      push := fuzz.Struct[*model.PushContext](fg, validatePush)
    22          // *model.Proxy, and other types, implement the fuzz.Validator interface and already validate some basics.
    23      node := fuzz.Struct[*model.Proxy](fg)
    24      selectionOpts := model.WorkloadSelectionOpts{
    25        Namespace:       node.ConfigNamespace,
    26        WorkloadLabels:  node.Labels,
    27      }
    28      option := fuzz.Struct[Option](fg)
    29  
    30      // Run our actual test code. In this case, we are just checking nothing crashes.
    31      // In other tests, explicit assertions may be helpful.
    32      policies := push.AuthzPolicies.ListAuthorizationPolicies(selectionOpts)
    33      New(bundle, push, policies, option).BuildHTTP()
    34    })
    35  }
    36  ```
    37  
    38  ## Running tests
    39  
    40  Fuzz tests can be run using standard Go tooling:
    41  
    42  ```shell
    43  go test ./path/to/pkg -v -run=^$ -fuzz=Fuzz
    44  ```
    45  
    46  ## CI testing
    47  
    48  Go fuzzers are run as part of standard unit tests against known test cases (from `f.Add` (which `fuzz.BaseCases` calls), or `testdata`).
    49  For continuous fuzzing, [`OSS-Fuzz`](https://github.com/google/oss-fuzz) continually builds and runs the fuzzers and reports any failures.
    50  These results are private to the Istio Product Security WG until disclosed.