Passphrase-based peer rendezvous for iroh-gossip swarms over the public Mainline DHT. Two nodes that share a passphrase + application salt find each other and join the same gossip topic — no bootstrap server, no prior knowledge of peer addresses. The algorithm is a clock-free variant of HyParView-style partition healing on BEP 44 mutable items, with K-sharded slots, logical aging with random-tie eviction, vouching of up to V neighbors at age 1, and a two-layer AEAD record envelope. Full spec in PROTOCOL.md. Ships with: * 119 tests (unit / property / integration / doctest) all green * 100% mutation-testing catch rate (cargo-mutants) * cargo-fuzz harnesses for the parse surface * Kani proofs of no-UB / no-panic on crypto::epoch_of and wire::decode_entries across their full symbolic input spaces * Stateright distributed-system model: safety invariants S1 + S2 proved exhaustively for N ≤ 6, K ≤ 3; liveness witness under weak fairness * Miri green on the synchronous modules * cargo-deny + cargo-audit clean * criterion benches * Full-matrix CI (Linux + macOS + Windows × stable + MSRV 1.93.0) * Dedicated nightly lane for Miri / mutation / fuzz / Kani / Stateright Pinned iroh 0.98.x. License MIT. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
18 lines
677 B
Rust
18 lines
677 B
Rust
//! Fuzz the crypto-envelope parser via arbitrary bytes. We don't expose
|
|
//! `crypto::open` publicly (it's a crate internal); instead we drive
|
|
//! the comparable "decode arbitrary bytes as if they were an envelope"
|
|
//! path through [`InMemoryDht`] writes — which themselves must handle
|
|
//! malformed signatures cleanly.
|
|
|
|
#![no_main]
|
|
|
|
use iroh_gossip_rendezvous::sim::decode_entries;
|
|
use libfuzzer_sys::fuzz_target;
|
|
|
|
fuzz_target!(|data: &[u8]| {
|
|
// Minimum fuzz: decode_entries never panics on arbitrary bytes.
|
|
// crypto::open is covered indirectly — any bytes that decode to
|
|
// "entries" without panicking are a safe path.
|
|
let _ = decode_entries(data);
|
|
});
|