Niko Marmeladkov
3bf13fa488
- internal/{address,identity,protocol,tce,transport,verify} -> pkg/ so
external Go projects can import the verified core; invariant tests
updated for the new paths
- Config.TrustProxy: key rate limiting by X-Forwarded-For when the relay
sits behind a reverse proxy (off by default, header never trusted
otherwise)
- examples/service + examples/approve: complete passwordless login round
trip (mint request -> wallet approves -> local verify), run live in CI
- docs/SERVICE-GUIDE.md: the integration recipe
50 lines
1.6 KiB
Go
50 lines
1.6 KiB
Go
//go:build gofuzz
|
|
|
|
package protocol
|
|
|
|
import "bytes"
|
|
|
|
// Fuzz is the OSS-Fuzz entry point for the six protocol objects. It asserts the
|
|
// injection property of PROTOCOL.md section 12.4: any byte string that decodes
|
|
// must be exactly the canonical encoding of the object decoded from it, so a
|
|
// signature cannot be transplanted between two byte strings that denote one
|
|
// object (encode(decode(b)) == b). The decoder is total: a decode error never
|
|
// yields a usable object.
|
|
//
|
|
// Compiled only under the "gofuzz" build tag (go-fuzz / OSS-Fuzz); the
|
|
// testing.F-based targets in the package's test files are excluded there.
|
|
func Fuzz(data []byte) int {
|
|
interesting := 0
|
|
|
|
if o, err := DecodeIdentity(data); err == nil {
|
|
if out, e := EncodeIdentity(o); e == nil && bytes.Equal(out, data) {
|
|
interesting = 1
|
|
}
|
|
}
|
|
if o, err := DecodeClaim(data); err == nil {
|
|
if out, e := EncodeClaim(o); e == nil && bytes.Equal(out, data) {
|
|
interesting = 1
|
|
}
|
|
}
|
|
if o, err := DecodeRevocation(data); err == nil {
|
|
if out, e := EncodeRevocation(o); e == nil && bytes.Equal(out, data) {
|
|
interesting = 1
|
|
}
|
|
}
|
|
if o, err := DecodeApprovalRequest(data); err == nil {
|
|
if out, e := EncodeApprovalRequest(o); e == nil && bytes.Equal(out, data) {
|
|
interesting = 1
|
|
}
|
|
}
|
|
if o, err := DecodeApprovalResponse(data); err == nil {
|
|
if out, e := EncodeApprovalResponse(o); e == nil && bytes.Equal(out, data) {
|
|
interesting = 1
|
|
}
|
|
}
|
|
if o, err := DecodeAuthAssertion(data); err == nil {
|
|
if out, e := EncodeAuthAssertion(o); e == nil && bytes.Equal(out, data) {
|
|
interesting = 1
|
|
}
|
|
}
|
|
return interesting
|
|
}
|