fuzzing.yml

# Copyright (c) uBPF contributors
# SPDX-License-Identifier: MIT

name: Fuzzing

permissions:
  contents: write

on:
  schedule: # Run every day at 21:00 UTC
    - cron: '00 21 * * *'
  workflow_dispatch: # Run manually
  workflow_call:
    inputs:
      regression_test:
        description: 'Run the fuzzer over the corpus as a regression test.'
        required: false
        default: false
        type: boolean

jobs:
  build-posix:
    strategy:
      matrix:
        platform:
          - ubuntu-24.04
        arch:
          - x86_64

    runs-on: ${{ matrix.platform }}

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
      with:
        egress-policy: audit

    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        submodules: 'recursive'

    - name: Generate the cache key
      id: cache_key
      run: echo "VALUE=platform-${{ matrix.platform }}_arch=${{ matrix.arch }}_type=fuzzing" >> $GITHUB_OUTPUT

    - name: Update the cache (ccache)
      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
      with:
        path: ccache
        key: ${{ steps.cache_key.outputs.VALUE }}_ccache

    - name: Create the build folders
      run: |
        mkdir -p \
          ccache

    - name: Install system dependencies (Linux)
      if: matrix.platform == 'ubuntu-24.04'
      run: |
        sudo apt-get update

        sudo apt-get install -y \
          ccache \
          ninja-build \
          cmake \
          lcov \
          libboost-dev \
          libboost-program-options-dev \
          libboost-filesystem-dev \
          libelf-dev \
          libyaml-cpp-dev

        if [[ "${{ matrix.arch }}" == "arm64" ]] ; then
          sudo apt install -y \
            g++-aarch64-linux-gnu \
            gcc-aarch64-linux-gnu \
            qemu-user
        fi

    - name: Build/install libbpf From Source
      if: matrix.platform == 'ubuntu-24.04'
      run: ./.github/scripts/build-libbpf.sh
      shell: bash

    - name: Install system dependencies (macOS)
      if: matrix.platform == 'macos-latest'
      run: |
        brew install \
          cmake \
          ninja \
          ccache \
          lcov \
          boost

    - name: Configure uBPF
      run: |
        export CCACHE_DIR="$(pwd)/ccache"

        ${command_prefix} cmake \
          -G Ninja \
          -S . \
          -B build \
          -DCMAKE_BUILD_TYPE=RelWithDebInfo \
          -DCMAKE_C_COMPILER=clang \
          -DCMAKE_CXX_COMPILER=clang++ \
          -DUBPF_ENABLE_LIBFUZZER=1 \
          ${arch_flags}

    - name: Build uBPF
      run: |
        export CCACHE_DIR="$(pwd)/ccache"

        ${command_prefix} cmake \
          --build build

    - name: Generate dictionary
      run: |
        python ubpf/dictionary_generator.py >build/bin/dictionary.txt

    - name: Upload fuzzer as artifacts
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
      with:
        name: fuzzer-${{ matrix.platform }}-${{ matrix.arch }}
        path: build/bin/*

  build-windows:
    strategy:
      matrix:
        platform:
          - windows-latest
        arch:
          - x86_64

    runs-on: ${{ matrix.platform }}

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
      with:
        egress-policy: audit

    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        submodules: 'recursive'

    - name: Cache the build folder
      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a
      env:
        cache-name: cache-nuget-modules
      with:
        path: build
        key: ${{ matrix.platform }}-${{ matrix.arch }}-${{ hashFiles('**/CMakeLists.txt') }}

    - name: Configure uBPF
      run: |
        cmake -S . -B build -DUBPF_ENABLE_LIBFUZZER=1

    - name: Build uBPF
      run: |
        cmake --build build --config RelWithDebInfo

    - name: Generate dictionary
      run: |
        python ubpf\dictionary_generator.py >build\bin\RelWithDebInfo\dictionary.txt

    - name: Gather dependencies
      shell: cmd
      run: |
        dir "C:\Program Files\Microsoft Visual Studio\2022"
        call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat"
        copy "%VCToolsInstallDir%"\bin\hostx64\x64\clang* build\bin\RelWithDebInfo
        copy "%VCToolsRedistDir%\x64\Microsoft.VC143.CRT" build\bin\RelWithDebInfo
        dir build\bin\RelWithDebInfo

    - name: Upload fuzzer as artifacts
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
      with:
        name: fuzzer-${{ matrix.platform }}-${{ matrix.arch }}
        path: |
          build/bin/RelWithDebInfo

  run_fuzzer:
    needs:
      - build-posix
      - build-windows
    strategy:
      matrix:
        platform:
          - ubuntu-24.04
          - windows-latest
        arch:
          - x86_64

    runs-on: ${{ matrix.platform }}
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        submodules: 'recursive'
        ref: fuzz/corpus

    - name: Install system dependencies (Linux)
      if: matrix.platform == 'ubuntu-24.04'
      run: |
        sudo apt-get update

        sudo apt-get install -y \
          libboost-dev \
          libboost-program-options-dev \
          libboost-filesystem-dev \
          libelf-dev \
          libyaml-cpp-dev

    - name: Download fuzzer artifacts
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
      with:
        name: fuzzer-${{ matrix.platform }}-${{ matrix.arch }}

    - name: Setup directory for fuzzing
      run: |
        ls
        mkdir -p new_corpus
        cp -r fuzz/corpus/* new_corpus
        mkdir -p artifacts

    - name: Make fuzzer executable
      if: matrix.platform == 'ubuntu-24.04'
      run: chmod a+x ubpf_fuzzer

    # If this is a workflow call, run ubpf_fuzzer over each file in the corpus as a regression test.
    - name: Run fuzzing regression
      if: inputs.regression_test == true
      run: |
        ./ubpf_fuzzer -merge=1 fuzz/corpus new_corpus

    # If this is a scheduled run or a manual run, run ubpf_fuzzer to attempt to find new crashes. Runs for 2 hours.
    - name: Run fuzzing
      if: matrix.platform == 'ubuntu-24.04' && inputs.regression_test != true
      run: |
        ls
        UBPF_FUZZER_CONSTRAINT_CHECK=1 ./ubpf_fuzzer new_corpus -artifact_prefix=artifacts/ -use_value_profile=1 -max_total_time=3600 -dict=dictionary.txt -timeout=60

    # If this is a scheduled run or a manual run, run ubpf_fuzzer to attempt to find new crashes. Runs for 2 hours.
    - name: Run fuzzing
      if: matrix.platform == 'windows-latest' && inputs.regression_test != true
      run: |
        ls
        ./ubpf_fuzzer new_corpus -artifact_prefix=artifacts/ -use_value_profile=1 -max_total_time=3600 -timeout=60

    # Merge the new corpus into the existing corpus and push the changes to the repository.
    - name: Merge corpus into fuzz/corpus
      if: inputs.regression_test != true
      run: |
        ./ubpf_fuzzer -merge=1 fuzz/corpus new_corpus
        git pull
        git add fuzz/corpus
        git config --global user.email 'ubpf@users.noreply.github.com'
        git config --global user.name 'Github Action'
        git commit -sm "Update fuzzing corpus"
        git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{github.repository}}.git
        git push

    - name: Upload artifacts
      if: always()
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
      with:
        name: fuzzing-artifacts-${{ matrix.platform }}-${{ matrix.arch }}
        path: artifacts/