Combining fuzzer with test infrastructure

[DavidKorczynski]

Hi,

I am working with a project where there is a large test infrastructure. I want to use utilities and helper functions from this testing infrastructure in my fuzzers, and I would also like to be able to build the fuzzers, i.e. cargo +nightly fuzz build. I am unsure how to do this - as the testing infrastructure only gets compiled when I run cargo test. Is it possible to create a set up where the fuzzer can use the testing infrastructure which is guarded by #[cfg(test)] and dev-dependencies?

[fitzgen]

cargo fuzz already enables cfg(fuzzing) when building projects so you can do something like:

#[cfg(any(test, fuzzing))]
mod test_utils {
    // ...
}

[DavidKorczynski]

Thanks a lot - that works smoothly! My follow-up is then about dev-dependencies. When I build my fuzzers cargo +nightly fuzz build the packages listed in [dev-dependencies] will not be used, is that correctly understood? If so, is there an easy way to do that?

[fitzgen]

The best solution is to use a cargo feature to enable optional dependencies.

[DavidKorczynski]

Thanks a lot!

[evverx]

@DavidKorczynski I wonder what the project you were working with was. Could you point me in the right direction?

Assuming it had something to do with OSS-Fuzz I wonder if it is possible to update https://google.github.io/oss-fuzz/getting-started/new-project-guide/rust-lang/ so that it would be easier for new Rust projects to be integrated properly. Thanks!

[DavidKorczynski]

It was Linkerd2-proxy https://github.com/linkerd/linkerd2-proxy

• Documentaion about it on the Linkerd2 repository: https://github.com/linkerd/linkerd2-proxy/blob/main/docs/FUZZING.md
• Full PDF report: https://github.com/linkerd/linkerd2-proxy/blob/main/docs/reports/linkerd2-proxy-fuzzing-report.pdf
• Blog post on Linkerd's blog: https://linkerd.io/2021/05/07/fuzz-testing-for-linkerd/

Although the solution worked with [cfg(any(test, fuzzing))], I ended up doing it slightly different and instead place modules in the various crates that contained the fuzzing logic, e.g.:

#[cfg(fuzzing)]
pub mod fuzz_logic {

https://github.com/linkerd/linkerd2-proxy/blob/27b6af383fd22fcaf59e98ec939fde4d19a63522/linkerd/addr/src/lib.rs#L326

and I would then simply call into these modules from my fuzzers. This meant the majority of the fuzzing logic is placed in the same files as the code they target while still keeping the fuzzers in separate folders.

The only place I had to use #[cfg(any(test, fuzzing))] was here: https://github.com/linkerd/linkerd2-proxy/blob/d4f72c1aa4555f395007b628145b6b27707602c2/linkerd/app/inbound/src/lib.rs#L16

I would be happy to update the OSS-Fuzz documentation. I think to keep things condensed, the most important bit to mention is that you can use the cfg(fuzzing) to include code only in fuzz builds, with that knowledge others should be able to proceed on as they prefer - agreed? (let me do an oss-fuzz PR and we can take that discussion there).