DuProcess
9b0f09a8a8
Track B (milestone 5 / §16 hardening): - tests/hostile_network.rs: in-process UDP relay/shim between a test client and a real dosh-server that can drop, reorder, and duplicate datagrams, and rebind its upstream socket mid-session. Asserts: session survives loss/reorder, duplicated/replayed Input is applied at most once, stale packets after resume are ignored (not fatal), and a client source-address change preserves the session. - tests/parser_robustness.rs: deterministic randomized tests throwing garbage at every reachable public parser (packet decode, from_body for all protocol/native structs, authorized_keys, known_hosts, host-key line, ssh-ed25519 blob, bootstrap, attach ticket); asserts none panic. - fuzz/: standalone cargo-fuzz crate (own [workspace], non-default member) with libfuzzer-sys harnesses for packet decode, from_body, authorized_keys, known_hosts, handshake structs+verifiers, and attach tickets. README documents the run command. - .github/workflows/ci.yml: add fuzz-smoke job (nightly + cargo-fuzz, short -max_total_time per target, tolerant if tooling unavailable); existing fmt/test/build/bench steps unchanged. cargo fmt --check and cargo test are green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
60 lines
2.0 KiB
Markdown
60 lines
2.0 KiB
Markdown
# dosh fuzz targets
|
|
|
|
cargo-fuzz / libFuzzer harnesses for the `dosh` parsers and handshake verifiers
|
|
(spec milestone 5 / §16: "Fuzz packet parsing, authorized-key parsing,
|
|
known-host parsing, and handshake state", "Fuzz targets run in CI").
|
|
|
|
This is a **standalone crate** (its own `[workspace]`) so it never affects the
|
|
main crate's `cargo build` / `cargo test` / `cargo fmt --check`.
|
|
|
|
## Targets
|
|
|
|
| Target | Parser(s) exercised |
|
|
| --- | --- |
|
|
| `packet_decode` | `protocol::Header::parse`, `protocol::decode`, `protocol::decrypt_body` |
|
|
| `from_body` | `protocol::from_body::<T>` for every protocol & native wire struct |
|
|
| `authorized_keys` | `native::parse_authorized_keys`, `native::parse_ssh_ed25519_public_blob` |
|
|
| `known_hosts` | `native::parse_known_hosts`, `native::parse_host_public_key_line` |
|
|
| `handshake_structs` | handshake struct decode + `verify_server_hello`, `user_auth_transcript`, `verify_native_user_auth` |
|
|
| `attach_ticket` | `auth::open_attach_ticket`, `auth::verify_attach_ticket`, `auth::decode_bootstrap` |
|
|
|
|
Every target's objective is the same: **no panics on any input** (a panic on
|
|
untrusted bytes is a robustness/DoS bug per threat model §5).
|
|
|
|
## Prerequisites
|
|
|
|
```sh
|
|
rustup toolchain install nightly
|
|
cargo install cargo-fuzz
|
|
```
|
|
|
|
cargo-fuzz requires a nightly toolchain (it builds with `-Z sanitizer=address`).
|
|
|
|
## Run
|
|
|
|
From the repository root:
|
|
|
|
```sh
|
|
# List targets
|
|
cargo +nightly fuzz list --fuzz-dir fuzz
|
|
|
|
# Run a single target indefinitely
|
|
cargo +nightly fuzz run --fuzz-dir fuzz packet_decode
|
|
|
|
# Short, CI-style smoke run of one target (10 seconds)
|
|
cargo +nightly fuzz run --fuzz-dir fuzz packet_decode -- -max_total_time=10
|
|
```
|
|
|
|
Or from inside `fuzz/`:
|
|
|
|
```sh
|
|
cd fuzz
|
|
cargo +nightly fuzz run packet_decode -- -max_total_time=10
|
|
```
|
|
|
|
## CI
|
|
|
|
`.github/workflows/ci.yml` has a `fuzz-smoke` job that installs nightly +
|
|
cargo-fuzz and runs each target briefly (`-max_total_time`). The job is tolerant
|
|
if the toolchain/tooling is unavailable so it never blocks the main test gate.
|