Repository navigation
corpus: add privacy and DNS library checks - #34
Merged
Merged
Conversation
A string default such as '203.0.113.17' passed the DDL literal check and reached the output unchanged. Defaults are now limited to short numbers, dates and the existing allowlist. Distinct source usernames could map to one name. On the 2.41 production copy, 23 distinct usernames became 22. Each source name now gets its own. Relative record names are resolved against their zone the way v2's export qualifies them, so a relative owner maps to the same name as its absolute form. Single-label zones keep their suffix. The corpus targets move below help so bare make prints help again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ALTER TABLE foreign keys now render only validated column names, so text after a known column no longer passes through to the corpus. IPv6 maps nibble by nibble from the source prefix. A reverse zone maps to the prefix of every mapped address inside it, and relative PTR owners keep their nibbles. SPF ip6: operands map as addresses. The corpus compose file overrides root-user-init and the record library too, so a run against other checkouts never mounts the workspace ones. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Distinct source /24s and addresses could map to one output, and two reverse zones could share a name. The last octet now probes to a free value, and a /8 or /16 that cannot fit stops the run. The legacy test setup rewrites t/test.cfg, t/test-rest.cfg and api/t/test.cfg. A run now mounts throwaway copies over them, so the workspace stack keeps its own credentials. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A null MX or SRV target of "." became ".test.". CAA tags such as issue were replaced as free text. Two source zones that map to one name, such as two global /32 ip6.arpa zones, now stop the run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A and AAAA addresses and nameserver address fields were left out of the private-source comparison. Putting an original private address back into a corpus passed both checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A zone-relative SOA mailbox such as hostmaster gained a synthetic suffix, so it no longer matched its absolute form. The DNS check qualified relative targets without their zone, turning mail into mail. and @ into an invalid @. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Group.pm writes an empty usable_ns for a group with no nameservers, and the anonymizer refused it. default_group was mapped as one label while a dotted group name was mapped as a host, so the option named no group and unqualified logins failed after restore. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An email field without an @ was copied to the corpus unchanged, and a numeric one also slipped past the source comparison as a safe literal. Such values now map like usernames, and personal fields are compared with the source even when they look numeric. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Text such as a MAC address matched the IPv6 pattern, failed to parse, and was kept verbatim behind its placeholder. The source comparison skipped it too. It now maps digit for digit and counts as a candidate. SSHFP fingerprints map the same way, so they stay valid hex. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The parser drops the dump's NO_AUTO_VALUE_ON_ZERO and the output never set it again, so a restored zero id became a new one while references still said zero. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Appending a TLD to every single-label host turned a nameserver called ns1 into ns1.test. Zones still map as absolute names, so a single-label zone stays the suffix of the names inside it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aberoham
force-pushed
the
corpus-harness
branch
from
October 12, 2026 05:13
603b9bd to
9d4bc58
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add fail-closed 2.34/2.41 dump anonymization, source audits and isolated upgrade tests. Use NicTool's DNS libraries to compare source and mapped records. SQL and private inputs stay out of git.
These are local tools. The README says corpora stay on the machine that made them. The audit catches known leak shapes but doesn't prove a corpus is anonymous. It skips the options table and most record types, lets numbers and common words through, and copies timestamps.
Since the first push, review fixed collisions between usernames, zones and IPv4 prefixes. It also fixed relative names, IPv6 prefixes, hex values, zero ids and dangling history rows.
Tests: 87 workspace, 120 corpus python and 8 JavaScript checks pass. The JavaScript checks need dns-resource-record#69. A 2.41 corpus rebuilt from a production copy passes the source audit, the v3 api tests and the v2 SOAP and REST tests.
t/26_import_bind.tfails twice because it expects a nameserver the data doesn't have.