Documentation
¶
Overview ¶
Package masktest generates seeded log corpora with planted canaries (synthetic personal values and secrets, in every position and encoding) and scans bytes for any of them: the leak harness of design §4.7. Everything here is synthetic.
Index ¶
Constants ¶
const Positions = 11
Lines generates n lines: every kind, in every position (JSON value, nested value, key, number, array item, logfmt value, free text) and every encoding, in turn. Positions is the number of places Lines plants a canary in.
const RulesForCorpus = "[[mask]]\nfield = \"cust\"\nmode = \"pseudonym\"\n"
RulesForCorpus is the project rule file the corpus's rule positions assume.
Variables ¶
var Encodings = []string{"raw", "percent", "double-percent", "json-u", "html", "fullwidth", "zero-width"}
Encodings a canary is written with.
var Kinds = []string{"email", "phone", "iban", "card", "be_niss", "fr_nir", "nl_bsn", "us_ssn", "secret", "ip", "person_name"}
Kinds the generator plants. Every one is covered by a lockkit detector ("secret" by the secret detector of step 1; "ip" and "person_name" by the value detectors of the same names, which a test must enable).
var ValueDetectors = []string{"email", "phone", "iban", "card", "be_niss", "fr_nir", "nl_bsn", "us_ssn", "ip", "person_name"}
ValueDetectors are the value detectors that cover every kind of Kinds but "secret". phone_loose plants nothing of its own: it widens phone to national numbers without a trunk 0, an opt-in for its false positives whose recall is lockkit's to test.
Functions ¶
func Forms ¶
Forms are the forms of a canary the scan looks for: raw, lower case, percent-encoded, JSON-escaped, and its normalised form (no separators).
func SecretBody ¶
SecretBody is the part of a synthetic secret after its fixed prefix.
func SecretNameForCorpus ¶
SecretNameForCorpus is the secret-name test the corpus's secret positions assume.
Types ¶
type Gen ¶
type Gen struct {
// contains filtered or unexported fields
}
Gen generates canaries and lines from a seed.
type Hit ¶
Hit is a canary form found in scanned bytes.