masktest

package
v0.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 7, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Documentation

Overview

Package masktest generates seeded log corpora with planted canaries (synthetic personal values and secrets, in every position and encoding) and scans bytes for any of them: the leak harness of design §4.7. Everything here is synthetic.

Index

Constants

View Source
const Positions = 11

Lines generates n lines: every kind, in every position (JSON value, nested value, key, number, array item, logfmt value, free text) and every encoding, in turn. Positions is the number of places Lines plants a canary in.

View Source
const RulesForCorpus = "[[mask]]\nfield = \"cust\"\nmode = \"pseudonym\"\n"

RulesForCorpus is the project rule file the corpus's rule positions assume.

Variables

View Source
var Encodings = []string{"raw", "percent", "double-percent", "json-u", "html", "fullwidth", "zero-width"}

Encodings a canary is written with.

View Source
var Kinds = []string{"email", "phone", "iban", "card", "be_niss", "fr_nir", "nl_bsn", "us_ssn", "secret", "ip", "person_name"}

Kinds the generator plants. Every one is covered by a lockkit detector ("secret" by the secret detector of step 1; "ip" and "person_name" by the value detectors of the same names, which a test must enable).

View Source
var ValueDetectors = []string{"email", "phone", "iban", "card", "be_niss", "fr_nir", "nl_bsn", "us_ssn", "ip", "person_name"}

ValueDetectors are the value detectors that cover every kind of Kinds but "secret". phone_loose plants nothing of its own: it widens phone to national numbers without a trunk 0, an opt-in for its false positives whose recall is lockkit's to test.

Functions

func Encode

func Encode(v, enc string) string

Encode writes v with encoding enc (every character for the escapes).

func Forms

func Forms(c Canary) []string

Forms are the forms of a canary the scan looks for: raw, lower case, percent-encoded, JSON-escaped, and its normalised form (no separators).

func SecretBody

func SecretBody(v string) string

SecretBody is the part of a synthetic secret after its fixed prefix.

func SecretNameForCorpus

func SecretNameForCorpus(name string) bool

SecretNameForCorpus is the secret-name test the corpus's secret positions assume.

func WordForms

func WordForms(c Canary) []string

WordForms are the forms of a canary the scan looks for as whole words: each part of a person's name (a masker hiding the given name but showing the surname leaks).

Types

type Canary

type Canary struct {
	Kind  string
	Value string
}

Canary is one planted value: its kind and its clear form.

type Gen

type Gen struct {
	// contains filtered or unexported fields
}

Gen generates canaries and lines from a seed.

func New

func New(seed uint64) *Gen

New returns a generator for seed.

func (*Gen) Lines

func (g *Gen) Lines(n int) []Line

func (*Gen) Value

func (g *Gen) Value(kind string) string

Value returns a fresh valid value of kind.

type Hit

type Hit struct {
	Canary Canary
	Form   string
	Where  string
}

Hit is a canary form found in scanned bytes.

func Scan

func Scan(where string, out []byte, cs []Canary) []Hit

Scan returns every form of every canary found in out, also once out is decoded (percent, JSON escapes, HTML references, two rounds), NFKC-normalised and stripped of invisible and replacement characters: an encoded canary that survived is found too.

type Line

type Line struct {
	Text     string
	Format   string // json, logfmt, plain
	Canaries []Canary
	// Position and Encoding index Positions and Encodings.
	Position, Encoding int
}

Line is one generated log line and the canaries planted in it.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL