Commander1024
8902b25d78
Add IPv6-aware Wi-Fi state, HTTPS/SSH listeners, mDNS service reconciliation, and browser Wi-Fi administration. Include a guarded build-local fix for mDNS 1.12.0 membership handling, focused regression suites, and Phase 12 acceptance documentation.
3.3 KiB
Web authentication parser host tests
Run from the repository root:
python3 tests/web_auth_parse/run.py
Requires Python 3 (standard library only) and a host cc supporting shared
libraries. The runner compiles the actual src/web_auth_parse.c with
-std=c11 -Wall -Wextra -Werror -shared -fPIC into a temporary directory, loads
it with ctypes, and removes build artifacts on exit. No firmware dependencies,
parser substitutes, network access, or persistent build artifacts are used.
Compilation errors and test failures produce nonzero exit status.
Tables cover DNS/IPv4 origin canonicalization, case folding and optional :443,
bracketed IPv6 canonicalization and malformed authorities/origins; selected cookie presence,
uniqueness, exact lowercase 64-digit hex and surrounding cookie syntax; strict
login JSON, both field orders, escapes, Unicode/surrogate pairs, invalid UTF-8,
NUL, duplicate/unknown fields, truncation and byte limits (512-byte body,
16-byte username, 64-byte password). Boundary cases include canonical origin
capacity and the 1024-byte Cookie header limit.
Inputs use exact byte spans without implicit terminators and never alias
outputs. Each output is first filled with 0xA5; every failed call must clear
all output bytes, including credential structure padding and unused array
bytes. Successful results check canonical/decoded bytes and termination.
Limitations
- This is a focused parser contract suite, not HTTP integration, authorization, CSRF/session, duplicate HTTP header-line, TLS, credential-policy, or hardware testing. Empty credentials are syntactically valid; database policy is separate.
- IPv6 tests check expanded/compressed/case/default-port equivalence, longest zero runs and ties, dotted tails, mapped-address separation from IPv4, DNS separation, mismatched addresses, zones, malformed groups/brackets/ports, userinfo, suffixes, controls and exact-span output wiping.
- Canonical IPv6 uses lowercase hex tails even for mapped addresses. No DNS resolution, scope inference or network reachability is involved.
- To additionally audit the installed ESP-IDF conversion implementation, run:
Adjust the path for your installation. This compiles the actual extracted
WEB_AUTH_LWIP_SOURCE=/home/mscholz/.platformio/packages/framework-espidf/components/lwip/lwip/src/core/ipv6/ip6_addr.c python3 tests/web_auth_parse/run.pyip6addr_atonbody with host type/byte-order adapters and the same temporary address-copy boundary aslwip_inet_pton. IPv4-tail and scope branches are disabled: production validates/replaces dotted tails before conversion and rejects zones. The production formatter is exercised, not substituted. This is not a target build or full lwIP networking test. - Python mirrors the public C struct and capacities; interface changes must update these tests. Shared-library loading assumes a Unix-like host/compiler.
- Tables are not exhaustive fuzzing, memory-safety instrumentation, or proof of constant-time behavior. Output wiping is observed after return; this does not establish erasure of internal temporaries or successful credentials. Test credentials/tokens are synthetic, not secrets.
- NULL output pointers and overlapping buffers are not exercised: valid, disjoint output storage is provided for every call.