ad/ctf-ad-mirror-tool-rust
1
0
Fork 0
mirror of https://github.com/mrvasil/ctf-ad-mirror-tool-rust.git synced 2026-10-23 21:42:07 +00:00
Code Issues Packages Projects Releases 2 Wiki Activity
8dcd1feaf1
ctf-ad-mirror-tool-rust/docs/flag-protection-verification.md

2.0 KiB
Raw Blame History

Flag tokenization verification — 2026-10-23

Final source uses SQLite synchronous=EXTRA. Fresh root checks:

  • macOS arm64: cargo fmt --check; cargo clippy --all-targets --locked -- -D warnings; cargo test --all-targets --locked — 49 passed; cargo build --release --locked; node --check web/app.js.
  • Orb Linux amd64: cargo test --all-targets --locked — 50 passed, including Linux loopback behavior; cargo build --release --locked.
  • Updated both ignored dist binaries and verified SHA256SUMS.

Eight flag integration tests plus the vault expiry unit test cover omitted opt-in=false, missing vault rejection, format validation, every two-way split, binary integrity, unknown output, EOF, partial timeout, concurrent reuse, encrypted persistence/restart, wrong key/damage, per-service isolation, capacity and disk failure, identical primary/replica tokens, restored reply, per-connection toggle and HTTP length preservation. Existing forwarding and control tests also pass.

Chrome isolated panel16900: settings checkbox initially off; enable/save shows indicator, reopening shows checked and disk state is true. Synthetic TCP echo returns exact original bytes. Disable/save removes indicator, disk state is false. No visual redesign. Screenshot from this feature pass is locally ignored at test-results/flags-toggle-off.png.

Persistent demo16700 now runs the final native release with a local synthetic vault configured. Settings shows enabled checkbox control with value false. Pre/post upgrade topology compares identical. Demo18081 and isolated18281 each return all32802 test bytes exactly after TCP half-close while protection is off. Both release hashes verify. Isolated fixture is stopped after verification; live demo remains.

No load/soak test, real tournament hosts or real flags used. No claim of universal protocol transparency: candidate tails can wait/timeout, TLS/compression/signatures need adapters, TTL/key loss affects restoration, and all clients receive reverse translation. New flag mappings incur durable-write latency; disabled sessions bypass transformation.