Skip to content

DO NOT SUBMIT: P4 fuzzer from sonic-pins attacks 4ward#665

Draft
smolkaj wants to merge 1 commit into
mainfrom
p4-fuzzer
Draft

DO NOT SUBMIT: P4 fuzzer from sonic-pins attacks 4ward#665
smolkaj wants to merge 1 commit into
mainfrom
p4-fuzzer

Conversation

@smolkaj

@smolkaj smolkaj commented May 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

Wires up sonic-net/sonic-pins' P4 fuzzer as a cc_test that spawns a FourwardServer, pushes a pipeline, and runs 10,000 iterations of random WriteRequests validated by the P4Runtime spec oracle.

Results: 10,000 iterations, 406,842 updates, 0 oracle failures.

Also fixes two validation ordering issues the fuzzer surfaced:

  • Unknown table IDs now return INVALID_ARGUMENT (was NOT_FOUND). A table ID that doesn't exist in the P4Info is a malformed request, not a "not found" condition.
  • Match field validation on DELETEs now runs before existence checking. Structurally invalid entries (missing/duplicate match fields) are rejected with INVALID_ARGUMENT rather than falling through to NOT_FOUND.

What's here

File What
e2e_tests/p4_fuzzer/fuzzer_table.p4 Minimal v1model program with @proto_id annotations (required by PDPI)
e2e_tests/p4_fuzzer/p4_fuzzer_test.cc The fuzzer loop: generate → send → oracle-validate → update state
e2e_tests/p4_fuzzer/BUILD.bazel Test target with sonic_pins fuzzer library deps
MODULE.bazel sonic_pins + gutil as dev dependencies
grpc/WriteValidator.kt Match field validation before DELETE early return; INVALID_ARGUMENT for unknown table IDs
grpc/*.kt golden/test updates Updated 4 test files + 1 golden for the error code change

Known limitations

  • MODIFY operations and mutated DELETEs are filtered out — the upstream oracle doesn't handle them correctly
  • Only exercises basic_table-shaped programs; action selectors would need a second fixture

Test plan

  • bazel test //e2e_tests/p4_fuzzer:p4_fuzzer_test — 10k iterations, 0 failures, ~5.5 min
  • bazel test //grpc:WriteValidatorTest //grpc:P4RuntimeConformanceTest //grpc:GoldenErrorTest //grpc:P4RuntimeWriteErrorTest — all pass
  • CI green

🤖 Generated with Claude Code

@smolkaj smolkaj changed the title e2e_tests: P4 fuzzer from sonic-pins attacks 4ward DO NOT SUBMIT: P4 fuzzer from sonic-pins attacks 4ward May 14, 2026
Wire up sonic-net/sonic-pins' P4 fuzzer as a cc_test that spawns a
FourwardServer, pushes a pipeline, and runs 10,000 iterations of
random WriteRequests with three layers of validation:

1. Spec oracle: validates response status codes against the P4RT spec.
2. Read-back: every 500 iterations, reads all entries and verifies
   they match the SwitchState mirror (~1,792 entries across 3 tables).
3. Crash detection: any unhandled exception or server crash fails.

Results: 10,000 iterations, 413,032 updates, 0 oracle failures,
21 read-back checks passed.

The fixture program (fuzzer_table.p4) has three tables exercising
different match kinds: exact, ternary, and LPM. All tables and action
refs have @proto_id annotations required by PDPI.

Also fixes 4ward's validation ordering to match the spec:
- Unknown table IDs now return INVALID_ARGUMENT (was NOT_FOUND).
- Match field validation runs before existence checking on DELETEs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
smolkaj added a commit that referenced this pull request May 28, 2026
## Summary

- update TESTING_STRATEGY to describe the merged BMv2 P4Runtime diff
suite
- document PR #665 as a proven but intentionally unmerged fuzzer
validation artifact
- reframe the remaining P4Runtime validation risk as scoped breadth, not
absence of independent oracles

## Testing

- `git diff --check`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant