Fuzzing #191
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) uBPF contributors | |
| # SPDX-License-Identifier: MIT | |
| name: Fuzzing | |
| permissions: | |
| contents: write | |
| on: | |
| schedule: # Run every day at 21:00 UTC | |
| - cron: '00 21 * * *' | |
| workflow_dispatch: # Run manually | |
| workflow_call: | |
| jobs: | |
| build-posix: | |
| strategy: | |
| matrix: | |
| platform: | |
| - ubuntu-24.04 | |
| arch: | |
| - x86_64 | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| submodules: 'recursive' | |
| - name: Generate the cache key | |
| id: cache_key | |
| run: echo "VALUE=platform-${{ matrix.platform }}_arch=${{ matrix.arch }}_type=fuzzing" >> $GITHUB_OUTPUT | |
| - name: Update the cache (ccache) | |
| uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2 | |
| with: | |
| path: ccache | |
| key: ${{ steps.cache_key.outputs.VALUE }}_ccache | |
| - name: Create the build folders | |
| run: | | |
| mkdir -p \ | |
| ccache | |
| - name: Install system dependencies (Linux) | |
| if: matrix.platform == 'ubuntu-24.04' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| ccache \ | |
| ninja-build \ | |
| cmake \ | |
| lcov \ | |
| libboost-dev \ | |
| libboost-program-options-dev \ | |
| libboost-filesystem-dev \ | |
| libelf-dev \ | |
| libyaml-cpp-dev | |
| if [[ "${{ matrix.arch }}" == "arm64" ]] ; then | |
| sudo apt install -y \ | |
| g++-aarch64-linux-gnu \ | |
| gcc-aarch64-linux-gnu \ | |
| qemu-user | |
| fi | |
| - name: Build/install libbpf From Source | |
| if: matrix.platform == 'ubuntu-24.04' | |
| run: ./.github/scripts/build-libbpf.sh | |
| shell: bash | |
| - name: Install system dependencies (macOS) | |
| if: matrix.platform == 'macos-latest' | |
| run: | | |
| brew install \ | |
| cmake \ | |
| ninja \ | |
| ccache \ | |
| lcov \ | |
| boost | |
| - name: Configure uBPF | |
| run: | | |
| export CCACHE_DIR="$(pwd)/ccache" | |
| ${command_prefix} cmake \ | |
| -G Ninja \ | |
| -S . \ | |
| -B build \ | |
| -DCMAKE_BUILD_TYPE=RelWithDebInfo \ | |
| -DCMAKE_C_COMPILER=clang \ | |
| -DCMAKE_CXX_COMPILER=clang++ \ | |
| -DUBPF_ENABLE_LIBFUZZER=1 \ | |
| ${arch_flags} | |
| - name: Build uBPF | |
| run: | | |
| export CCACHE_DIR="$(pwd)/ccache" | |
| ${command_prefix} cmake \ | |
| --build build | |
| - name: Generate dictionary | |
| run: | | |
| python ubpf/dictionary_generator.py >build/bin/dictionary.txt | |
| - name: Upload fuzzer as artifacts | |
| uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
| with: | |
| name: fuzzer-${{ matrix.platform }}-${{ matrix.arch }} | |
| path: build/bin/* | |
| build-windows: | |
| strategy: | |
| matrix: | |
| platform: | |
| - windows-latest | |
| arch: | |
| - x86_64 | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| submodules: 'recursive' | |
| - name: Cache the build folder | |
| uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a | |
| env: | |
| cache-name: cache-nuget-modules | |
| with: | |
| path: build | |
| key: ${{ matrix.platform }}-${{ matrix.arch }}-${{ hashFiles('**/CMakeLists.txt') }} | |
| - name: Configure uBPF | |
| run: | | |
| cmake -S . -B build -DUBPF_ENABLE_LIBFUZZER=1 | |
| - name: Build uBPF | |
| run: | | |
| cmake --build build --config RelWithDebInfo | |
| - name: Generate dictionary | |
| run: | | |
| python ubpf\dictionary_generator.py >build\bin\RelWithDebInfo\dictionary.txt | |
| - name: Gather dependencies | |
| shell: cmd | |
| run: | | |
| dir "C:\Program Files\Microsoft Visual Studio\2022" | |
| call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat" | |
| copy "%VCToolsInstallDir%"\bin\hostx64\x64\clang* build\bin\RelWithDebInfo | |
| copy "%VCToolsRedistDir%\x64\Microsoft.VC143.CRT" build\bin\RelWithDebInfo | |
| dir build\bin\RelWithDebInfo | |
| - name: Upload fuzzer as artifacts | |
| uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
| with: | |
| name: fuzzer-${{ matrix.platform }}-${{ matrix.arch }} | |
| path: | | |
| build/bin/RelWithDebInfo | |
| run_fuzzer: | |
| needs: | |
| - build-posix | |
| - build-windows | |
| strategy: | |
| matrix: | |
| platform: | |
| - ubuntu-24.04 | |
| - windows-latest | |
| arch: | |
| - x86_64 | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| submodules: 'recursive' | |
| ref: fuzz/corpus | |
| - name: Install system dependencies (Linux) | |
| if: matrix.platform == 'ubuntu-24.04' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y \ | |
| libboost-dev \ | |
| libboost-program-options-dev \ | |
| libboost-filesystem-dev \ | |
| libelf-dev \ | |
| libyaml-cpp-dev | |
| - name: Download fuzzer artifacts | |
| uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 | |
| with: | |
| name: fuzzer-${{ matrix.platform }}-${{ matrix.arch }} | |
| - name: Setup directory for fuzzing | |
| run: | | |
| ls | |
| mkdir -p new_corpus | |
| cp -r fuzz/corpus/* new_corpus | |
| mkdir -p artifacts | |
| - name: Make fuzzer executable | |
| if: matrix.platform == 'ubuntu-24.04' | |
| run: chmod a+x ubpf_fuzzer | |
| - name: Run fuzzing | |
| if: matrix.platform == 'ubuntu-24.04' | |
| run: | | |
| ls | |
| ./ubpf_fuzzer new_corpus -artifact_prefix=artifacts/ -use_value_profile=1 -max_total_time=300 -dict=dictionary.txt | |
| - name: Run fuzzing | |
| if: matrix.platform == 'windows-latest' | |
| run: | | |
| ls | |
| ./ubpf_fuzzer new_corpus -artifact_prefix=artifacts/ -use_value_profile=1 -max_total_time=300 | |
| - name: Merge corpus into fuzz/corpus | |
| if: ${{ github.event_name == 'schedule' }} | |
| run: | | |
| ./ubpf_fuzzer -merge=1 fuzz/corpus new_corpus | |
| git add fuzz/corpus | |
| git config --global user.email 'ubpf@users.noreply.github.com' | |
| git config --global user.name 'Github Action' | |
| git commit -sm "Update fuzzing corpus" | |
| git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{github.repository}}.git | |
| git push | |
| - name: Upload artifacts | |
| if: always() | |
| uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 | |
| with: | |
| name: fuzzing-artifacts-${{ matrix.platform }}-${{ matrix.arch }} | |
| path: artifacts/ | |