Add libfuzzer based test with (#443)

* Add option to link with libfuzzer Signed-off-by: Alan Jowett <[email protected]> * Build libfuzzer with coverage Signed-off-by: Alan Jowett <[email protected]> * Add code to run as JIT, but disable for now Signed-off-by: Alan Jowett <[email protected]> * Fix build break Signed-off-by: Alan Jowett <[email protected]> * Authorize push of updated corpus Signed-off-by: Alan Jowett <[email protected]> * Propogate GH token to permit push Signed-off-by: Alan Jowett <[email protected]> * Revert GH token secret changes Signed-off-by: Alan Jowett <[email protected]> * PR feedback Signed-off-by: Alan Jowett <[email protected]> --------- Signed-off-by: Alan Jowett <[email protected]> Signed-off-by: Alan Jowett <[email protected]> Co-authored-by: Alan Jowett <[email protected]>
iovisor · May 6, 2024 · 0a50b44 · 0a50b44
1 parent 664410c
commit 0a50b44
Show file tree

Hide file tree

Showing 10 changed files with 463 additions and 19 deletions.
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
@@ -0,0 +1,163 @@
+# Copyright (c) uBPF contributors
+# SPDX-License-Identifier: MIT
+
+name: Fuzzing
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      arch:
+        description: 'Architecture'
+        required: true
+        type: string
+
+      platform:
+        required: true
+        type: string
+
+jobs:
+  build:
+    runs-on: ${{ inputs.platform }}
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: 'recursive'
+
+    - name: Initialize CodeQL
+      if: inputs.build_codeql == true
+      uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14
+      with:
+        languages: 'cpp'
+
+    - name: Generate the cache key
+      id: cache_key
+      run: echo "VALUE=platform-${{ inputs.platform }}_arch=${{ inputs.arch }}_type=fuzzing" >> $GITHUB_OUTPUT
+
+    - name: Update the cache (ccache)
+      uses: actions/[email protected]
+      with:
+        path: ccache
+        key: ${{ steps.cache_key.outputs.VALUE }}_ccache
+
+    - name: Create the build folders
+      run: |
+        mkdir -p \
+          ccache
+
+    - name: Install system dependencies (Linux)
+      if: inputs.platform == 'ubuntu-latest'
+      run: |
+        sudo apt-get update
+
+        sudo apt-get install -y \
+          ccache \
+          ninja-build \
+          cmake \
+          lcov \
+          libboost-dev \
+          libboost-program-options-dev \
+          libboost-filesystem-dev \
+          libelf-dev
+
+        if [[ "${{ inputs.scan_build }}" == "true" ]] ; then
+          sudo apt-get install -y \
+            clang-tools
+        fi
+
+        if [[ "${{ inputs.arch }}" == "arm64" ]] ; then
+          sudo apt install -y \
+            g++-aarch64-linux-gnu \
+            gcc-aarch64-linux-gnu \
+            qemu-user
+        fi
+
+    - name: Build/install libbpf From Source
+      if: inputs.platform == 'ubuntu-latest'
+      run: ./.github/scripts/build-libbpf.sh
+      shell: bash
+
+    - name: Install system dependencies (macOS)
+      if: inputs.platform == 'macos-11'
+      run: |
+        brew install \
+          cmake \
+          ninja \
+          ccache \
+          lcov \
+          boost
+
+    - name: Configure uBPF
+      run: |
+        export CCACHE_DIR="$(pwd)/ccache"
+
+        ${command_prefix} cmake \
+          -G Ninja \
+          -S . \
+          -B build \
+          -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} \
+          -DCMAKE_C_COMPILER=clang \
+          -DCMAKE_CXX_COMPILER=clang++ \
+          -DUBPF_ENABLE_LIBFUZZER=1 \
+          -DCMAKE_BUILD_TYPE=Debug
+          ${arch_flags}
+
+    - name: Build uBPF
+      run: |
+        export CCACHE_DIR="$(pwd)/ccache"
+
+        if [[ "${{ inputs.scan_build }}" == "true" ]] ; then
+          command_prefix="scan-build -o scan_build_report"
+        fi
+
+        ${command_prefix} cmake \
+          --build build
+
+    - name: Upload fuzzer as artifacts
+      uses: actions/upload-artifact@v2
+      with:
+        name: fuzzer
+        path: build/bin/ubpf_fuzzer
+
+    - uses: actions/checkout@v4
+      with:
+        submodules: 'recursive'
+        ref: fuzz/corpus
+
+    - name: Download fuzzer artifacts
+      uses: actions/download-artifact@v2
+      with:
+        name: fuzzer
+
+    - name: Setup directory for fuzzing
+      run: |
+        ls -la
+        mkdir -p new_corpus
+        mkdir -p fuzz/corpus
+        cp -r fuzz/corpus/* new_corpus
+        mkdir -p artifacts
+        chmod a+x ubpf_fuzzer
+
+    - name: Run fuzzing
+      run: |
+        ./ubpf_fuzzer new_corpus -artifact_prefix=artifacts/ -use_value_profile=1 -max_total_time=300
+
+    - name: Merge corpus into fuzz/corpus
+      run: |
+        ./ubpf_fuzzer -merge=1 fuzz/corpus new_corpus
+        git add fuzz/corpus
+        git config --global user.email '[email protected]'
+        git config --global user.name 'Github Action'
+        git commit -sm "Update fuzzing corpus"
+        git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/iovisor/ubpf.git
+        git push
+
+    - name: Upload artifacts
+      if: always()
+      uses: actions/upload-artifact@v2
+      with:
+        name: fuzzing-artifacts
+        path: artifacts/
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -20,7 +20,7 @@ on:
 
   push:
     branches:
-      - '*'
+      - 'main'
 
   pull_request:
     branches:
@@ -310,6 +310,14 @@ jobs:
       enable_sanitizers: true
       disable_retpolines: true
 
+  # Run fuzzing on scheduled task only.
+  linux_fuzzing:
+    if: github.event_name == 'schedule'
+    uses: ./.github/workflows/fuzzing.yml
+    with:
+      arch: x86_64
+      platform: ubuntu-latest
+
   # Disabled until https://github.com/iovisor/ubpf/issues/155 is resolved.
   # linux_debug_arm64_sanitizers:
   #   uses: ./.github/workflows/posix.yml

diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -41,3 +41,6 @@ if(UBPF_ENABLE_PACKAGE)
   include("cmake/packaging.cmake")
 endif()
 
+if (UBPF_ENABLE_LIBFUZZER)
+  add_subdirectory("libfuzzer")
+endif()
diff --git a/cmake/options.cmake b/cmake/options.cmake
@@ -9,6 +9,7 @@
 if(PLATFORM_LINUX OR PLATFORM_MACOS)
   option(UBPF_ENABLE_COVERAGE "Set to true to enable coverage flags")
   option(UBPF_ENABLE_SANITIZERS "Set to true to enable the address and undefined sanitizers")
+  option(UBPF_ENABLE_LIBFUZZER "Set to true to enable the libfuzzer")
 endif()
 
 option(UBPF_DISABLE_RETPOLINES "Disable retpoline security on indirect calls and jumps")

diff --git a/cmake/settings.cmake b/cmake/settings.cmake
@@ -64,6 +64,28 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
       )
     endif()
 
+    if(UBPF_ENABLE_LIBFUZZER)
+      set(fuzzer_flags
+        -g
+        -O0
+        -fsanitize=fuzzer
+        -fsanitize=address
+        -fsanitize-coverage=edge,indirect-calls,trace-cmp,trace-div,trace-gep
+        )
+
+      # Check if compiler is clang and emit error if not
+        if(NOT CMAKE_C_COMPILER_ID STREQUAL "Clang")
+            message(FATAL_ERROR "LibFuzzer is only supported with Clang")
+        endif()
+
+        target_compile_options("ubpf_settings" INTERFACE
+            ${fuzzer_flags}
+        )
+
+        target_link_options("ubpf_settings" INTERFACE
+            ${fuzzer_flags}
+        )
+    endif()
   elseif(PLATFORM_WINDOWS)
     set(CMAKE_VS_WINDOWS_TARGET_PLATFORM_VERSION "8.1")
 

diff --git a/libfuzzer/CMakeLists.txt b/libfuzzer/CMakeLists.txt
@@ -0,0 +1,29 @@
+# Copyright (c) Microsoft Corporation
+# SPDX-License-Identifier: Apache-2.0
+
+if (UBPF_SKIP_EXTERNAL)
+    message(WARNING "Skipping configuration of tests that require external package support.")
+    return()
+endif()
+
+set(CMAKE_CXX_STANDARD 20)
+
+add_executable(
+    ubpf_fuzzer
+    libfuzz_harness.cc
+)
+
+target_include_directories("ubpf_fuzzer" PRIVATE
+    "${CMAKE_SOURCE_DIR}/vm"
+    "${CMAKE_BINARY_DIR}/vm"
+    "${CMAKE_SOURCE_DIR}/vm/inc"
+    "${CMAKE_BINARY_DIR}/vm/inc"
+    "${CMAKE_SOURCE_DIR}/ubpf_plugin"
+)
+
+target_link_libraries(
+    ubpf_fuzzer
+    ubpf
+    ubpf_settings
+)
+