diff --git a/source/extensions/filters/http/admission_control/config.cc b/source/extensions/filters/http/admission_control/config.cc index fcd8c42fcc9b4..27b7f9f1eb253 100644 --- a/source/extensions/filters/http/admission_control/config.cc +++ b/source/extensions/filters/http/admission_control/config.cc @@ -22,8 +22,8 @@ Http::FilterFactoryCb AdmissionControlFilterFactory::createFilterFactoryFromProt const envoy::extensions::filters::http::admission_control::v3alpha::AdmissionControl& config, const std::string& stats_prefix, Server::Configuration::FactoryContext& context) { - if (config.has_sr_threshold() && config.sr_threshold().default_value().value() == 0) { - throw EnvoyException("Success Rate Threshold cannot be zero percent"); + if (config.has_sr_threshold() && config.sr_threshold().default_value().value() < 1.0) { + throw EnvoyException("Success rate threshold cannot be less than 1.0%."); } const std::string prefix = stats_prefix + "admission_control."; diff --git a/test/extensions/filters/http/admission_control/config_test.cc b/test/extensions/filters/http/admission_control/config_test.cc index c5cc6917f8de9..13d73551462ea 100644 --- a/test/extensions/filters/http/admission_control/config_test.cc +++ b/test/extensions/filters/http/admission_control/config_test.cc @@ -50,7 +50,7 @@ class AdmissionControlConfigTest : public testing::Test { // Ensure the filter ingest throws an exception if it is passed a config with a default value of 0 // for sr_threshold If exception was not thrown, a default value of 0 for sr_threshold induces a -// divide by zero error +// divide by zero error. TEST_F(AdmissionControlConfigTest, ZeroSuccessRateThreshold) { AdmissionControlFilterFactory admission_control_filter_factory; const std::string yaml = R"EOF( @@ -75,7 +75,34 @@ sampling_window: 1337s NiceMock factory_context; EXPECT_THROW_WITH_MESSAGE(admission_control_filter_factory.createFilterFactoryFromProtoTyped( proto, "whatever", factory_context), - EnvoyException, "Success Rate Threshold cannot be zero percent"); + EnvoyException, "Success rate threshold cannot be less than 1.0%."); +} + +TEST_F(AdmissionControlConfigTest, SmallSuccessRateThreshold) { + AdmissionControlFilterFactory admission_control_filter_factory; + const std::string yaml = R"EOF( +enabled: + default_value: false + runtime_key: "foo.enabled" +sampling_window: 1337s +sr_threshold: + default_value: + value: 1.22e-22 + runtime_key: "foo.sr_threshold" +aggression: + default_value: 4.2 + runtime_key: "foo.aggression" +success_criteria: + http_criteria: + grpc_criteria: +)EOF"; + + AdmissionControlProto proto; + TestUtility::loadFromYamlAndValidate(yaml, proto); + NiceMock factory_context; + EXPECT_THROW_WITH_MESSAGE(admission_control_filter_factory.createFilterFactoryFromProtoTyped( + proto, "whatever", factory_context), + EnvoyException, "Success rate threshold cannot be less than 1.0%."); } // Verify the configuration when all fields are set. diff --git a/test/extensions/filters/http/common/fuzz/BUILD b/test/extensions/filters/http/common/fuzz/BUILD index ffc67eb4a2321..e647e4354c4bf 100644 --- a/test/extensions/filters/http/common/fuzz/BUILD +++ b/test/extensions/filters/http/common/fuzz/BUILD @@ -55,6 +55,7 @@ envoy_cc_test_library( "//test/mocks/http:http_mocks", "//test/mocks/server:factory_context_mocks", "//test/proto:bookstore_proto_cc_proto", + "//test/test_common:test_runtime_lib", "@envoy_api//envoy/extensions/filters/http/grpc_json_transcoder/v3:pkg_cc_proto", "@envoy_api//envoy/extensions/filters/http/jwt_authn/v3:pkg_cc_proto", "@envoy_api//envoy/extensions/filters/http/squash/v3:pkg_cc_proto", diff --git a/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-4784906297278464 b/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-4784906297278464 new file mode 100644 index 0000000000000..c91cc6a64987e --- /dev/null +++ b/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-4784906297278464 @@ -0,0 +1,23 @@ +config { + name: "envoy.filters.http.admission_control" + typed_config { + type_url: "type.googleapis.com/envoy.extensions.filters.http.admission_control.v3alpha.AdmissionControl" + value: "\022\000\032\002\020\002*\016\n\t\t+\000\000\000\000\000\000\000\022\001$" + } +} +data { + headers { + } + http_body { + data: "\037\000\000\000\000\000\000\000" + } +} +upstream_data { + headers { + } + http_body { + data: "=" + data: "=" + data: "?" + } +} \ No newline at end of file diff --git a/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-6484279454466048 b/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-6484279454466048 new file mode 100644 index 0000000000000..2d9ce470aa1b4 --- /dev/null +++ b/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-6484279454466048 @@ -0,0 +1,13 @@ +config { + name: "envoy.filters.http.ratelimit" + typed_config { + type_url: "type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit" + value: "\n\001\021(\0010\001:\376\001\022\373\001\022\370\001\n\001T\022\002\n\000\032\003\n\001~\032\256\0012\253\001\032\250\001\nHtype.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit\022\\\n\001\021(\0010\001:Q\022O\022M\n\001T\022\002\n\000\032\005\"\003\n\001!\032\0022\000\032\005\"\003\n\001>\032\007\032\005\"003\n\032\002\022\000\032\n\"\010\n\001>\020\200\200\254\001\"\027envoy\000\000\000\027ters.http.rbac2\000H\001\032\005\"\003\n\001>\032\007\032\005\"003\n\032\002\022\000\032\n\"\010\n\001>\020\200\200\254\001\"\027envoy\000\000\000\027ters.http.rbac2\000H\001" + } +} +data { + http_body { + data: "\021" + data: "!" + } +} \ No newline at end of file diff --git a/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-6550085676695552 b/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-6550085676695552 new file mode 100644 index 0000000000000..d443f6dee7290 --- /dev/null +++ b/test/extensions/filters/http/common/fuzz/filter_corpus/clusterfuzz-testcase-minimized-filter_fuzz_test-6550085676695552 @@ -0,0 +1 @@ +config { name: "envoy.filters.http.wasm" } \ No newline at end of file diff --git a/test/extensions/filters/http/common/fuzz/filter_fuzz_test.cc b/test/extensions/filters/http/common/fuzz/filter_fuzz_test.cc index 7e773b4f13115..429e34191ba16 100644 --- a/test/extensions/filters/http/common/fuzz/filter_fuzz_test.cc +++ b/test/extensions/filters/http/common/fuzz/filter_fuzz_test.cc @@ -48,6 +48,7 @@ DEFINE_PROTO_FUZZER(const test::extensions::filters::http::FilterFuzzTestCase& i try { // Catch invalid header characters. TestUtility::validate(input); + ENVOY_LOG_MISC(debug, "Filter configuration: {}", input.config().DebugString()); // Fuzz filter. static UberFilterFuzzer fuzzer; fuzzer.fuzz(input.config(), input.data(), input.upstream_data()); diff --git a/test/extensions/filters/http/common/fuzz/uber_filter.h b/test/extensions/filters/http/common/fuzz/uber_filter.h index 8bcef67d6afa9..f89338c54148d 100644 --- a/test/extensions/filters/http/common/fuzz/uber_filter.h +++ b/test/extensions/filters/http/common/fuzz/uber_filter.h @@ -4,6 +4,7 @@ #include "test/mocks/http/mocks.h" #include "test/mocks/server/factory_context.h" #include "test/mocks/stream_info/mocks.h" +#include "test/test_common/test_runtime.h" namespace Envoy { namespace Extensions { @@ -39,7 +40,9 @@ class UberFilterFuzzer : public HttpFilterFuzzer { Network::Address::InstanceConstSharedPtr addr_; NiceMock cluster_manager_; NiceMock async_request_; + envoy::config::core::v3::Metadata listener_metadata_; NiceMock stream_info_; + TestScopedRuntime scoped_runtime_; // Filter constructed from the config. Http::StreamDecoderFilterSharedPtr decoder_filter_; diff --git a/test/extensions/filters/http/common/fuzz/uber_per_filter.cc b/test/extensions/filters/http/common/fuzz/uber_per_filter.cc index 9ca63f3e236b8..a3fb4e769f7d8 100644 --- a/test/extensions/filters/http/common/fuzz/uber_per_filter.cc +++ b/test/extensions/filters/http/common/fuzz/uber_per_filter.cc @@ -148,6 +148,10 @@ void UberFilterFuzzer::perFilterSetup() { ON_CALL(factory_context_, admin()).WillByDefault(testing::ReturnRef(factory_context_.admin_)); ON_CALL(factory_context_.admin_, addHandler(_, _, _, _, _)).WillByDefault(testing::Return(true)); ON_CALL(factory_context_.admin_, removeHandler(_)).WillByDefault(testing::Return(true)); + + // Prepare expectations for WASM filter. + ON_CALL(factory_context_, listenerMetadata()) + .WillByDefault(testing::ReturnRef(listener_metadata_)); } } // namespace HttpFilters