Fuzz Testing of Envoy - Ensuring Security and Correctness

Explore fuzz testing techniques for Envoy in this 28-minute conference talk by Google engineers Adi Peleg and Teju Nareddy. Gain insights into ensuring the correctness and safety of Envoy parsers and state machines against untrusted or adversarial inputs. Learn about automated software testing methods that use randomized inputs to uncover complex edge cases and potential vulnerabilities. Discover various fuzzers used in Envoy, the OSS-Fuzz infrastructure, and real-world examples of bugs discovered through fuzz testing. Delve into the creation of specific fuzz tests for ESF components in Envoy, and understand the different levels of fuzzing, their tradeoffs, and the development workflow. Get an overview of what to fuzz in Envoy, who can write fuzz tests, and how the community can contribute to this crucial aspect of software security.

Intro
How does fuzzing work?
Fuzz Test Goals
Library Under Test
Fuzz Schema
Initial Corpus
Example Mutation
Development Workflow
What to Fuzz in Envoy?
Levels of Fuzzing in Envoy
Fuzzer Tradeoffs
Who Can Write Fuzz Tests?
Community Help
Future Work