Repository navigation
Fuzz the token check every night - #3
Merged
Merged
Conversation
Two cargo-fuzz targets read what any client may present to the cloud and its relays. ticket_forged checks that any text is refused as either kind at any time. ticket_altered overwrites bytes of a token the cloud signed and checks that it passes only as it was issued, with the claims it was issued with. The fuzz workflow runs each target for a minute on pull requests that touch the token check and for a quarter of an hour every night, keeps the corpus in the Actions cache and attaches a breaking input as an artifact. CI checks the targets' formatting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The token check reads whatever any client sends: the cloud runs it on every request, the relay on every endpoint that connects. This puts it under cargo-fuzz on a schedule, the same way anyplaynet/network#5 does for the network's parsers.
What
fuzz/, its own workspace with two targets, both signing with a fixed key that exists only in the targets:ticket_forged: any UTF-8 text as a token is refused, as either kind, at any time.ticket_altered: a token the cloud signed (access or relay, picked by the first byte), with bytes overwritten at positions the input chooses. It passes only when it is still exactly the issued token, and then with exactly the issued claims; the unaltered token always passes. This catches malleable encodings as well as forgeries..github/workflows/fuzz.yml: a minute per target on pull requests that touchcrates/ticketorfuzz/; a quarter of an hour per target every night;workflow_dispatchtakes the seconds. It checks outnetworkbesidecloud, as CI does. Corpus in the Actions cache,cminon the nightly run, a breaking input attached ascrash-<target>. cargo-fuzz pinned to 0.13.2.ci.ymlalso checks the targets' formatting;fuzz/README.md; a row in the README table (now headed "Path", sincedeploy/andfuzz/are not crates).Checked
cargo fmt(CI's-plist and the fuzz manifest),cargo clippy --workspace --all-targets -- -D warnings,cargo test --workspace: clean.cargo clippy --all-targets -- -D warningswith libFuzzer's link step turned off (libFuzzer does not build on windows-gnu); the real runs are this PR's fuzz jobs.