[filters] Add RBAC condition fuzzer (CEL expressions)

bazel/repository_locations.bzl

@@ -94,10 +94,10 @@ REPOSITORY_LOCATIONS = dict(
         urls = ["https://github.com/gabime/spdlog/archive/v1.3.1.tar.gz"],
     ),
     com_github_google_libprotobuf_mutator = dict(
-        sha256 = "f45c3ad82376d891cd0bcaa7165e83efd90e0014b00aebf0cbaf07eb05a1d3f9",
-        strip_prefix = "libprotobuf-mutator-d1fe8a7d8ae18f3d454f055eba5213c291986f21",
-        # 2019-07-10
-        urls = ["https://github.com/google/libprotobuf-mutator/archive/d1fe8a7d8ae18f3d454f055eba5213c291986f21.tar.gz"],
+        sha256 = "54597f640c0ab5e5d783d2f3d3cfe8ad6da999ef1a194d89c2c5ab89a1fd8e13",
+        strip_prefix = "libprotobuf-mutator-dd89da92b59b1714bab6e2a135093948a1cf1c6a",
+        # 2019-10-08
+        urls = ["https://github.com/google/libprotobuf-mutator/archive/dd89da92b59b1714bab6e2a135093948a1cf1c6a.tar.gz"],
     ),
     com_github_gperftools_gperftools = dict(
         # TODO(cmluciano): Bump to release 2.8

source/extensions/filters/common/expr/evaluator.cc

@@ -49,7 +49,7 @@ BuilderPtr createBuilder(Protobuf::Arena* arena) {
   auto register_status =
       google::api::expr::runtime::RegisterBuiltinFunctions(builder->GetRegistry(), options);
   if (!register_status.ok()) {
-    throw EnvoyException(
+    throw CelException(
         absl::StrCat("failed to register built-in functions: ", register_status.message()));
   }
   return builder;
@@ -59,7 +59,7 @@ ExpressionPtr createExpression(Builder& builder, const google::api::expr::v1alph
   google::api::expr::v1alpha1::SourceInfo source_info;
   auto cel_expression_status = builder.CreateExpression(&expr, &source_info);
   if (!cel_expression_status.ok()) {
-    throw EnvoyException(
+    throw CelException(
         absl::StrCat("failed to create an expression: ", cel_expression_status.status().message()));
   }
   return std::move(cel_expression_status.ValueOrDie());

source/extensions/filters/common/expr/evaluator.h

@@ -52,6 +52,12 @@ absl::optional<CelValue> evaluate(const Expression& expr, Protobuf::Arena* arena
 bool matches(const Expression& expr, const StreamInfo::StreamInfo& info,
              const Http::HeaderMap& headers);
 
+// Thrown when there is an CEL library error.
+class CelException : public EnvoyException {
+public:
+  CelException(const std::string& what) : EnvoyException(what) {}
+};
+
 } // namespace Expr
 } // namespace Common
 } // namespace Filters

test/extensions/filters/common/expr/BUILD

@@ -2,7 +2,9 @@ licenses(["notice"])  # Apache 2
 
 load(
     "//bazel:envoy_build_system.bzl",
+    "envoy_cc_fuzz_test",
     "envoy_package",
+    "envoy_proto_library",
 )
 load(
     "//test/extensions:extensions_build_system.bzl",
@@ -23,3 +25,25 @@ envoy_extension_cc_test(
         "//test/test_common:utility_lib",
     ],
 )
+
+envoy_proto_library(
+    name = "evaluator_fuzz_proto",
+    srcs = ["evaluator_fuzz.proto"],
+    deps = [
+        "//test/fuzz:common_proto",
+        "@com_google_googleapis//google/api/expr/v1alpha1:syntax_proto",
+    ],
+)
+
+envoy_cc_fuzz_test(
+    name = "evaluator_fuzz_test",
+    srcs = ["evaluator_fuzz_test.cc"],
+    corpus = ":evaluator_corpus",
+    deps = [
+        ":evaluator_fuzz_proto_cc_proto",
+        "//source/extensions/filters/common/expr:evaluator_lib",
+        "//test/common/stream_info:test_util",
+        "//test/fuzz:utility_lib",
+        "//test/test_common:utility_lib",
+    ],
+)