test(test): Adding fuzzer for ContainerPolicy

[prady0t]

Purpose of PR?:

This is a fuzzer for ContainerPolicy

KubeArmor/KubeArmor/policy/policy.go

Line 24 in a5f584c

func (p *PolicyServer) ContainerPolicy(c context.Context, data *pb.Policy) (*pb.Response, error) {

For seed corpus I referred to this policy and removed Metadata.Name from it.
With this we are testing if invalid policy results in PolicyStatus_Invalid or not.
To run the fuzz test,

cd KubeArmor/policy
go test -fuzz=Fuzz

Addresses #1367

Does this PR introduce a breaking change?
NO

[prady0t]

Already found an issue with this. I ran the fuzzer for a while and It failed for this input :

{
    "0000": "00000000000000",
    "oBjeCt": {
        "metAdAtA": {
            "nAme": "0"
        }
    }
}

Which is totally understandable. To fix this we can also have a condition in fuzzer to check for status as Applied if we have policyEvent.Object.Metadata.Name != "" . Here's the log :

--- FAIL: FuzzContainerPolicy (0.00s)
    --- FAIL: FuzzContainerPolicy/69798181ccc6962d (0.00s)
        ContainerPoilcy_fuzz_test.go:58: Unexpected status: Applied, [123 32 32 32 32 34 48 48 48 48 34 58 32 34 48 48 48 48 48 48 48 48 48 48 48 48 48 48 34 44 32 32 32 32 34 111 66 106 101 67 116 34 58 32 123 32 32 32 32 32 34 109 101 116 65 100 65 116 65 34 58 32 123 32 32 32 32 32 32 34 110 65 109 101 34 58 32 34 48 34 125 125 125]
FAIL
exit status 1
FAIL    github.com/kubearmor/KubeArmor/KubeArmor/policy 0.011s

Marking this as a draft for now.

[prady0t]

I've added a check for pb.PolicyStatus_Applied as well for JSON inputs with Object.Metadata.Name != "". With this, our fuzzer should run until it finds an edge case where input results in Unexpected Status. We could have also added a condition to check if we get a pb.PolicyStatus_Applied status when Object.Metadata.Name != "" inside the fuzzer itself, instead of just the AND condition. But that would require to unmarshal the data and would be kind of meta (testing json.Unmarshal with json.Unmarshal).

If you think it's testing something useful, we can go ahead and merge it. Once we have this inside KubeArmor codebase, we can try writing config files so that we can integrate it with oss-fuzz. Running it locally won't give much fruitful results.
In the cilium fuzz testing report (mentioned in the upstream issue comments), we can see fuzzers run for 1000s of hours :

Running our fuzzers with oss fuzz will help us improve it even better. We may also find some crucial bugs. This could be a starting point for how we can add more fuzzer.

@daemon1024 @DelusionalOptimist Do let me know what you guys think of this.

[nyrahul]

Thank you for the PR

[nyrahul]

I think this PR and the resultant image could be uses as input for OSS-Fuzz. How long did you test it on your local system? @prady0t

[prady0t]

I think this PR and the resultant image could be uses as input for OSS-Fuzz. How long did you test it on your local system? @prady0t

For about an hour. Do you want me to run it overnight? It might help us find any early bug or any problems with the fuzzer.

[nyrahul]

Running it in current state won't result in anything since the primary function is stubbed out.

[nyrahul]

The primary updates I made using the last commit is:

• Using the real ParseAndUpdateContainerSecurityPolicy to fuzz test. Removed the stubbed UpdateContainerPolicy.
• Fixing the fuzz test initial data

This is already showing up some issues during fuzz ... We need to check if those are genuine issues or need stubbing.

[prady0t]

Thanks a Lot for these changes! This makes much more sense now. Let me try to run these locally

[prady0t]

Sorry for the late reply. Fuzzer is failing for this input :

[]byte("{\"oBjeCt\":{\"metAdAtA\":{\"nAme\":\"0\"},\"speC\":{\"seleCtor\":{\"mAtChLABels\":{\"\":\"\"}}}}}")

@nyrahul did you find similar results locally?

JSON format :

{
  "oBjeCt": {
    "metAdAtA": {
      "nAme": "0"
    },
    "speC": {
      "seleCtor": {
        "mAtChLABels": {
          "": ""
        }
      }
    }
  }
}

[prady0t]

The fuzzer is now running. Would like your reviews @nyrahul @daemon1024 @DelusionalOptimist

[daemon1024]

Let's use varied kinds of policy including file, network as seed values. https://github.com/kubearmor/KubeArmor/tree/main/tests/k8s_env/ksp/multiubuntu

[daemon1024]

We already found a bug and fixed it, Nice 🔥