Initial fuzzer integration (#961)

Adds a set of fuzzers for various `linkerd` crates. 

The goal of this PR is to create an initial fuzzer infrastructure as well as
fuzzers that can be integrated with OSS-Fuzz for continuous fuzzing. 

The way I set it up was to place the fuzzers for a given crate within the
crate folder itself. I then put in a `fuzz_logic` module in the source code
that is to be fuzzed, thus following the low of how the existing tests are
written. The majority of additions in this PR are independent of the
linkerd2-proxy source code, but there are a few changes.

Signed-off-by: davkor <[email protected]>

Author: DavidKorczynski

Cargo.toml

@@ -63,4 +63,4 @@ debug = false
 debug = false
 
 [patch.crates-io]
-webpki = { git = "https://github.com/linkerd/webpki", branch = "cert-dns-names-0.21", rev = "b2c3bb3" }
+webpki = { git = "https://github.com/linkerd/webpki", branch = "cert-dns-names-0.21" }

linkerd/addr/fuzz/.gitignore

@@ -0,0 +1,4 @@
+
+target
+corpus
+artifacts

linkerd/addr/fuzz/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "linkerd-addr-fuzz"
+version = "0.0.0"
+authors = ["Linkerd Developers <[email protected]>"]
+publish = false
+edition = "2018"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+
+[dependencies.linkerd-addr]
+path = ".."
+
+# Prevent this from interfering with workspaces
+[workspace]
+members = ["."]
+
+[features]
+fuzzing = []
+
+[[bin]]
+name = "fuzz_target_1"
+path = "fuzz_targets/fuzz_target_1.rs"
+required-features = ["fuzzing"]

linkerd/addr/fuzz/fuzz_targets/fuzz_target_1.rs

@@ -0,0 +1,9 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+
+fuzz_target!(|data: &[u8]| {
+    if let Ok(s) = std::str::from_utf8(data) {
+        linkerd_addr::fuzz_logic::fuzz_addr_1(s);
+    }
+});

linkerd/addr/src/lib.rs

@@ -258,3 +258,22 @@ mod tests {
         }
     }
 }
+
+#[cfg(fuzzing)]
+pub mod fuzz_logic {
+    use super::*;
+
+    pub fn fuzz_addr_1(fuzz_data: &str) {
+        if let Ok(addr) = Addr::from_str(fuzz_data) {
+            addr.is_loopback();
+            addr.to_http_authority();
+            addr.is_loopback();
+            addr.socket_addr();
+        }
+
+        if let Ok(name_addr) = NameAddr::from_str_and_port(fuzz_data, 1234) {
+            name_addr.port();
+            name_addr.as_http_authority();
+        }
+    }
+}

linkerd/dns/fuzz/.gitignore

@@ -0,0 +1,4 @@
+
+target
+corpus
+artifacts

linkerd/dns/fuzz/Cargo.toml

@@ -0,0 +1,31 @@
+
+[package]
+name = "linkerd-dns-fuzz"
+version = "0.0.0"
+authors = ["Linkerd Developers <[email protected]>"]
+publish = false
+edition = "2018"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+tokio = { version = "1", features = ["rt", "time", "io-util"] }
+
+[dependencies.linkerd-dns]
+path = ".."
+
+# Prevent this from interfering with workspaces
+[workspace]
+members = ["."]
+
+[features]
+fuzzing = []
+
+[[bin]]
+name = "fuzz_target_1"
+path = "fuzz_targets/fuzz_target_1.rs"
+test = false
+doc = false
+required-features = ["fuzzing"]

linkerd/dns/fuzz/fuzz_targets/fuzz_target_1.rs

@@ -0,0 +1,9 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    if let Ok(s) = std::str::from_utf8(data) {
+        let rt = tokio::runtime::Runtime::new().unwrap();
+        rt.block_on(linkerd_dns::fuzz_logic::fuzz_entry(s))
+    }
+});

linkerd/dns/src/lib.rs

@@ -246,3 +246,25 @@ mod tests {
         assert!(Suffix::from_str("").is_err(), "suffix must not be empty");
     }
 }
+
+#[cfg(fuzzing)]
+pub mod fuzz_logic {
+    use super::*;
+    use std::str::FromStr;
+    pub struct FuzzConfig {}
+
+    // Empty config resolver that we can use.
+    impl ConfigureResolver for FuzzConfig {
+        fn configure_resolver(&self, _opts: &mut ResolverOpts) {}
+    }
+
+    // Test the resolvers do not panic unexpectedly.
+    pub async fn fuzz_entry(fuzz_data: &str) {
+        if let Ok(name) = Name::from_str(fuzz_data) {
+            let fcon = FuzzConfig {};
+            let resolver = Resolver::from_system_config_with(&fcon).unwrap();
+            let _w = resolver.resolve_a(&name).await;
+            let _w2 = resolver.resolve_srv(&name).await;
+        }
+    }
+}

linkerd/proxy/http/Cargo.toml

@@ -39,6 +39,9 @@ tracing = "0.1.23"
 try-lock = "0.2"
 pin-project = "1"
 
+[target.'cfg(fuzzing)'.dependencies]
+tokio-test = "0.4"
+
 [dev-dependencies]
 tokio-test = "0.4"
 tracing-subscriber = "0.2.16"