Automated fuzzing on Fuzzit

.travis.yml

@@ -1,5 +1,8 @@
 dist: xenial
 
+services:
+  - docker
+
 language: go
 go: "1.13.x"
 go_import_path: /skaffold
@@ -55,6 +58,19 @@ jobs:
       language: minimal
       script:
         - make integration-in-kind
+    - name: Fuzz regression
+      go: 1.12.x
+      dist: bionic
+      script:
+         - cd fuzz
+         - ./fuzzit.sh local-regression
+    - name: Fuzz
+      if: branch = master AND type IN (push)
+      go: 1.12.x
+      dist: bionic
+      script:
+        - cd fuzz
+        - ./fuzzit.sh fuzzing
       cache:
         directories:
           - $HOME/.cache/go-build

README.md

@@ -6,6 +6,7 @@
 [![Build Status](https://travis-ci.org/GoogleContainerTools/skaffold.svg?branch=master)](https://travis-ci.org/GoogleContainerTools/skaffold)
 [![Code Coverage](https://codecov.io/gh/GoogleContainerTools/skaffold/branch/master/graph/badge.svg)](https://codecov.io/gh/GoogleContainerTools/skaffold)
 [![Go Report Card](https://goreportcard.com/badge/GoogleContainerTools/skaffold)](https://goreportcard.com/report/GoogleContainerTools/skaffold)
+[![Fuzzit Status](https://app.fuzzit.dev/badge?org_id=skaffold)](https://app.fuzzit.dev/orgs/skaffold/dashboard)
 [![LICENSE](https://img.shields.io/github/license/GoogleContainerTools/skaffold.svg)](https://github.com/GoogleContainerTools/skaffold/blob/master/LICENSE)
 [![Releases](https://img.shields.io/github/release-pre/GoogleContainerTools/skaffold.svg)](https://github.com/GoogleContainerTools/skaffold/releases)
 

fuzz/config_fuzz.go

@@ -0,0 +1,49 @@
+// +build gofuzz
+
+/*
+Copyright 2019 The Skaffold Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzz
+
+import (
+	"io/ioutil"
+	"os"
+
+	"github.com/GoogleContainerTools/skaffold/pkg/skaffold/config"
+	_ "github.com/dvyukov/go-fuzz/go-fuzz-dep"
+)
+
+// FuzzParseConfig tests configuration file parsing.
+func FuzzParseConfig(fuzz []byte) int {
+	file, err := ioutil.TempFile("", "fuzzconfig")
+	if err != nil {
+		panic(err)
+	}
+	defer os.Remove(file.Name())
+	_, err = file.Write(fuzz)
+	if err != nil {
+		panic(err)
+	}
+	err = file.Close()
+	if err != nil {
+		panic(err)
+	}
+	_, err = config.ReadConfigFileNoCache(file.Name())
+	if err != nil {
+		return 0
+	}
+	return 1
+}

fuzz/fuzzit.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+
+# Copyright 2019 The Skaffold Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+set -xe
+
+# Validate arguments
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 <fuzz-type>"
+    exit 1
+fi
+
+# Configure
+NAME=skaffold
+ROOT=.
+TYPE=$1
+
+# Setup
+export GO111MODULE=on
+go install \
+    golang.org/x/net/proxy \
+    github.com/dvyukov/go-fuzz/go-fuzz \
+    github.com/dvyukov/go-fuzz/go-fuzz-build \
+    github.com/fuzzitdev/fuzzit/v2
+go mod vendor -v
+rm -rf gopath
+mkdir -p gopath/src
+mv vendor/* gopath/src
+rm -rf vendor
+export GOPATH=$PWD/gopath
+export GO111MODULE=off
+fuzzit --version
+
+# Fuzz
+function fuzz {
+    FUNC=Fuzz$1
+    TARGET=$2
+    go-fuzz-build -libfuzzer -func $FUNC -o fuzzer.a .
+    clang -fsanitize=fuzzer fuzzer.a -o fuzzer
+    fuzzit create job --type $TYPE $NAME/$TARGET fuzzer
+}
+fuzz ParseConfig parse-config
+fuzz ParseReference parse-reference
+fuzz ServerTCP control-api-tcp
+fuzz ServerHTTP control-api-http

fuzz/go.mod

@@ -0,0 +1,14 @@
+module fuzz.test/fuzz
+
+go 1.13
+
+replace github.com/GoogleContainerTools/skaffold => ../
+
+replace gopkg.in/russross/blackfriday.v2 v2.0.1 => github.com/russross/blackfriday/v2 v2.0.1
+
+require (
+	github.com/GoogleContainerTools/skaffold v0.0.0-00010101000000-000000000000
+	github.com/dvyukov/go-fuzz v0.0.0-20190808141544-193030f1cb16
+	github.com/fuzzitdev/fuzzit/v2 v2.4.46
+	golang.org/x/net v0.0.0-20190909003024-a7b16738d86b
+)

fuzz/reference_fuzz.go

@@ -0,0 +1,32 @@
+// +build gofuzz
+
+/*
+Copyright 2019 The Skaffold Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package fuzz
+
+import (
+	"github.com/GoogleContainerTools/skaffold/pkg/skaffold/docker"
+	_ "github.com/dvyukov/go-fuzz/go-fuzz-dep"
+)
+
+// FuzzParseReference tests Docker image reference parsing.
+func FuzzParseReference(data []byte) int {
+	if _, err := docker.ParseReference(string(data)); err != nil {
+		return 0
+	}
+	return 1
+}