Add HekaDrop — cross-platform Quick Share Rust implementation

[YatogamiRaito]

Project description

HekaDrop is a cross-platform Rust implementation of Google Quick Share (Nearby Share). It allows Android devices to send files to macOS/Linux/Windows over LAN without installing any app on the phone — the Android side uses the stock Quick Share that ships on all Android devices.

Language: Rust
Repo: https://github.com/YatogamiRaito/HekaDrop
License: MIT

Security relevance

The project implements a non-trivial cryptographic protocol:

• UKEY2 handshake — P-256 ECDH + HKDF-SHA256 key derivation
• Secure channel — AES-256-CBC + HMAC-SHA256 (Encrypt-then-MAC)
• Chunk-HMAC (RFC-0003) — per-chunk HMAC-SHA256 tags for storage integrity
• Protobuf parsing — both Google's Nearby protocol and our extensions

All of these operate on attacker-controlled input from the network. A bug in any of these paths is a pre-auth DoS or worse.

Fuzz targets (10)

Target	What it tests
fuzz_ukey2_client_init	process_client_init — raw bytes → UKEY2 parse
fuzz_ukey2_client_finish	process_client_finish — ECDH commitment verify
fuzz_frame_decode	Magic-prefix dispatch + OfflineFrame + HekaDropFrame decode
fuzz_secure_decrypt	SecureCtx::decrypt — AES-256-CBC + HMAC-SHA256
fuzz_payload_header	PayloadHeader/Chunk/TransferFrame protobuf decode
fuzz_payload_assembler	PayloadAssembler::ingest state machine
fuzz_chunk_hmac	compute_tag + verify_tag + mutated-body rejection
fuzz_resume_meta	Resume session_id + meta_filename computation
fuzz_protobuf_frames	All hekadrop_ext types (ChunkIntegrity, ResumeHint, FolderManifest)
fuzz_endpoint_info	mDNS endpoint_info bitmap + device name parse

CI status

All 10 targets compile and run crash-free (verified locally with libFuzzer, 764k+ runs/10s).

Contact

Primary contact: destek@sourvice.com

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[github-actions]

YatogamiRaito is integrating a new project:
- Main repo: https://github.com/YatogamiRaito/HekaDrop
- Criticality score: 0.17266

[YatogamiRaito]

I have signed the CLA. Please re-check.

[YatogamiRaito]

I have signed the CLA. Please re-check.

[DavidKorczynski]

Thanks! The project looks too immature for OSS-Fuzz. I would advice using ClusterFuzzLite: https://google.github.io/clusterfuzzlite/