Description:

Envoy project has 20 network-layer filters now and may have more in the future. Writing dedicated fuzzers for each of them are kind of requiring ongoing work to create new fuzz targets as new filters are written. A good way to do this is to make it generic, and by doing this we will have as little amount of time and work as possible between the creation of a network filter fuzzer and it’s fuzzing.

I've written two network-layer filter fuzzers and they got merged
(#11702, #11608)

And I found they share a similar process which is init_with_config -> test_with_actions.

Since filters are all derivative from WriteFilter or ReadFilter, we could test those interfaces in a new filter without too much modification in the fuzz code.

As an example, the http-filter fuzzer is a generic one. (https://github.com/envoyproxy/envoy/blob/master/test/extensions/filters/http/common/fuzz/filter_fuzz_test.cc)

Currently I'm working to see the dependencies/mock behaviors that are needed for each of the filter. For some complex filters we may still need to write a dedicated fuzzer to increase the coverage. But for most of them I think a generic fuzzer should work.

Since the network-layer filter will deal with raw bytes from untrusted networks, a generic fuzzer will help find the security-critical issues in Envoy quickly, even when a network filter is newly added.

I'm also writing the code to cover the network filters in one fuzzer. Currently it can cover 8 filters. I will make several pull requests to extend the fuzzer to cover more network filters.

/cc @asraa
/cc @samkerner