ocaml-docker/fuzz/ at main · gazagnaire.org/ocaml-docker · Tangled

gazagnaire.org / ocaml-docker

0

Docker Engine API types and codecs in pure OCaml

0

ocaml-docker / fuzz /

at main 4 files

Thomas Gazagnaire docker: reformat the proxy and its fuzz driver for ocamlformat 3w ago

docker: reformat the proxy and its fuzz driver for ocamlformat

3 weeks ago

docker-proxy: differential fuzz of the request parser, strict Content-Length Cross-check the proxy's hand-rolled request-head parser against the strict RFC 9112 parser in nox-http: for every generated request the proxy must never trust an n-byte body a strict parser frames differently (the smuggling root), and must refuse the ambiguous framings that parser rejects. Exposed via Proxy.classify. The fuzz immediately found the gap it was built for: content_length used int_of_string, which accepts 0x10, 5_0 and +5 -- none valid HTTP -- so the proxy trusted a length the daemon would reject. Content-Length is now parsed as a single run of ASCII digits, and a malformed or comma-list value is refused as invalid framing alongside the TE+CL and conflicting-length checks.

3 weeks ago

fuzz_docker_proxy.ml

docker: reformat the proxy and its fuzz driver for ocamlformat

3 weeks ago

fuzz_docker_proxy.mli

docker-proxy: differential fuzz of the request parser, strict Content-Length Cross-check the proxy's hand-rolled request-head parser against the strict RFC 9112 parser in nox-http: for every generated request the proxy must never trust an n-byte body a strict parser frames differently (the smuggling root), and must refuse the ambiguous framings that parser rejects. Exposed via Proxy.classify. The fuzz immediately found the gap it was built for: content_length used int_of_string, which accepts 0x10, 5_0 and +5 -- none valid HTTP -- so the proxy trusted a length the daemon would reject. Content-Length is now parsed as a single run of ASCII digits, and a malformed or comma-list value is refused as invalid framing alongside the TE+CL and conflicting-length checks.

3 weeks ago