[Fuzz] Network-layer filter generic fuzzer

api/envoy/extensions/filters/network/client_ssl_auth/v3/client_ssl_auth.proto

@@ -29,7 +29,8 @@ message ClientSSLAuth {
   // the authentication service. The filter will connect to the service every 60s to fetch the list
   // of principals. The service must support the expected :ref:`REST API
   // <config_network_filters_client_ssl_auth_rest_api>`.
-  string auth_api_cluster = 1 [(validate.rules).string = {min_bytes: 1}];
+  string auth_api_cluster = 1
+      [(validate.rules).string = {min_bytes: 1 well_known_regex: HTTP_HEADER_VALUE strict: false}];
 
   // The prefix to use when emitting :ref:`statistics
   // <config_network_filters_client_ssl_auth_stats>`.

source/extensions/all_extensions.bzl

@@ -38,3 +38,12 @@ def envoy_all_http_filters():
     all_extensions = dicts.add(_required_extensions, EXTENSIONS)
 
     return [v for k, v in all_extensions.items() if k.startswith(_http_filter_prefix)]
+
+# All network-layer filters are extensions with names that have the following prefix.
+_network_filter_prefix = "envoy.filters.network"
+
+# Return all network-layer filter extensions to be compiled into network-layer filter generic fuzzer.
+def envoy_all_network_filters():
+    all_extensions = dicts.add(_required_extensions, EXTENSIONS)
+
+    return [v for k, v in all_extensions.items() if k.startswith(_network_filter_prefix)]

test/extensions/filters/network/common/fuzz/BUILD

@@ -0,0 +1,58 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_fuzz_test",
+    "envoy_cc_test_library",
+    "envoy_package",
+    "envoy_proto_library",
+)
+load(
+    "//source/extensions:all_extensions.bzl",
+    "envoy_all_network_filters",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+envoy_proto_library(
+    name = "network_readfilter_fuzz_proto",
+    srcs = ["network_readfilter_fuzz.proto"],
+    deps = [
+        "//test/fuzz:common_proto",
+        "@envoy_api//envoy/config/listener/v3:pkg",
+    ],
+)
+
+envoy_cc_test_library(
+    name = "uber_readfilter_lib",
+    srcs = [
+        "uber_per_readfilter.cc",
+        "uber_readfilter.cc",
+    ],
+    hdrs = ["uber_readfilter.h"],
+    deps = [
+        ":network_readfilter_fuzz_proto_cc_proto",
+        "//source/common/config:utility_lib",
+        "//source/extensions/filters/network:well_known_names",
+        "//source/extensions/filters/network/common:utility_lib",
+        "//test/extensions/filters/common/ext_authz:ext_authz_test_common",
+        "//test/extensions/filters/network/common/fuzz/utils:network_filter_fuzzer_fakes_lib",
+        "//test/fuzz:utility_lib",
+        "//test/mocks/network:network_mocks",
+        "@envoy_api//envoy/extensions/filters/network/direct_response/v3:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/filters/network/local_ratelimit/v3:pkg_cc_proto",
+    ],
+)
+
+envoy_cc_fuzz_test(
+    name = "network_readfilter_fuzz_test",
+    srcs = ["network_readfilter_fuzz_test.cc"],
+    corpus = "network_readfilter_corpus",
+    # All Envoy network filters must be linked to the test in order for the fuzzer to pick
+    # these up via the NamedNetworkFilterConfigFactory.
+    deps = [
+        ":uber_readfilter_lib",
+        "//source/common/config:utility_lib",
+        "//test/config:utility_lib",
+    ] + envoy_all_network_filters(),
+)