DuProcess
9b0f09a8a8
Track B (milestone 5 / §16 hardening): - tests/hostile_network.rs: in-process UDP relay/shim between a test client and a real dosh-server that can drop, reorder, and duplicate datagrams, and rebind its upstream socket mid-session. Asserts: session survives loss/reorder, duplicated/replayed Input is applied at most once, stale packets after resume are ignored (not fatal), and a client source-address change preserves the session. - tests/parser_robustness.rs: deterministic randomized tests throwing garbage at every reachable public parser (packet decode, from_body for all protocol/native structs, authorized_keys, known_hosts, host-key line, ssh-ed25519 blob, bootstrap, attach ticket); asserts none panic. - fuzz/: standalone cargo-fuzz crate (own [workspace], non-default member) with libfuzzer-sys harnesses for packet decode, from_body, authorized_keys, known_hosts, handshake structs+verifiers, and attach tickets. README documents the run command. - .github/workflows/ci.yml: add fuzz-smoke job (nightly + cargo-fuzz, short -max_total_time per target, tolerant if tooling unavailable); existing fmt/test/build/bench steps unchanged. cargo fmt --check and cargo test are green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2.0 KiB
dosh fuzz targets
cargo-fuzz / libFuzzer harnesses for the dosh parsers and handshake verifiers
(spec milestone 5 / §16: "Fuzz packet parsing, authorized-key parsing,
known-host parsing, and handshake state", "Fuzz targets run in CI").
This is a standalone crate (its own [workspace]) so it never affects the
main crate's cargo build / cargo test / cargo fmt --check.
Targets
| Target | Parser(s) exercised |
|---|---|
packet_decode |
protocol::Header::parse, protocol::decode, protocol::decrypt_body |
from_body |
protocol::from_body::<T> for every protocol & native wire struct |
authorized_keys |
native::parse_authorized_keys, native::parse_ssh_ed25519_public_blob |
known_hosts |
native::parse_known_hosts, native::parse_host_public_key_line |
handshake_structs |
handshake struct decode + verify_server_hello, user_auth_transcript, verify_native_user_auth |
attach_ticket |
auth::open_attach_ticket, auth::verify_attach_ticket, auth::decode_bootstrap |
Every target's objective is the same: no panics on any input (a panic on untrusted bytes is a robustness/DoS bug per threat model §5).
Prerequisites
rustup toolchain install nightly
cargo install cargo-fuzz
cargo-fuzz requires a nightly toolchain (it builds with -Z sanitizer=address).
Run
From the repository root:
# List targets
cargo +nightly fuzz list --fuzz-dir fuzz
# Run a single target indefinitely
cargo +nightly fuzz run --fuzz-dir fuzz packet_decode
# Short, CI-style smoke run of one target (10 seconds)
cargo +nightly fuzz run --fuzz-dir fuzz packet_decode -- -max_total_time=10
Or from inside fuzz/:
cd fuzz
cargo +nightly fuzz run packet_decode -- -max_total_time=10
CI
.github/workflows/ci.yml has a fuzz-smoke job that installs nightly +
cargo-fuzz and runs each target briefly (-max_total_time). The job is tolerant
if the toolchain/tooling is unavailable so it never blocks the main test gate.