Fuzz Testing of Envoy
summary
Envoy adds coverage-guided fuzzers using OSS-Fuzz continuous fuzzing and ClusterFuzz, feeding proto-defined input schemas and initial corpora into instrumented binaries with sanitizers; utility and HTTP-filter fuzzers exercise parsers like the access logger and HTTP codecs. Fuzzing finds memory/logic bugs early — over 1000+ bugs found since integration, about ~100 open issues now — and discovered multiple CVE-class bugs from 2019; workflow auto-files reproducing inputs for triage and regression.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:00How does fuzzing work?
- 1:55Fuzz Test Goals
- 3:06Library Under Test
- 3:59Fuzz Schema
- 8:06Initial Corpus
- 8:50Example Mutation
- 10:57Development Workflow
- 12:11What to Fuzz in Envoy?
- 14:43Levels of Fuzzing in Envoy
- 16:37Fuzzer Tradeoffs
- 19:05Who Can Write Fuzz Tests?
- 20:07Community Help
- 22:07Future Work
related talks
05mLightning Talk: Securing Envoy: Catching Vulnerabilities With Continuous Fuzz Testing
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
31m“Fuzz or lose..."
39mMaking Fuzzing Part of Your Software Development Lifecycle
25mHow fuzzing helps to find bugs
01h 15mMake your programs more reliable with Fuzzing
36mFuzzing the CNCF Landscape
01h 39mFuzzing in the open: Integrate your project in OSS-Fuzz for continuous fuzzing