|
| 1 | +diff -ruN TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/dtls/FragmentManager.java TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/dtls/FragmentManager.java |
| 2 | +--- TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/dtls/FragmentManager.java 2025-02-20 15:19:04.898118063 +0100 |
| 3 | ++++ TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/dtls/FragmentManager.java 2025-02-20 15:38:12.424092502 +0100 |
| 4 | +@@ -23,7 +23,6 @@ |
| 5 | + |
| 6 | + private Map<FragmentKey, FragmentCollector> fragments; |
| 7 | + private Config config; |
| 8 | +- private int lastInterpretedMessageSeq = -1; |
| 9 | + |
| 10 | + public FragmentManager(Config config) { |
| 11 | + fragments = new HashMap<>(); |
| 12 | +@@ -69,21 +68,6 @@ |
| 13 | + boolean onlyIfComplete, boolean skipMessageSequences) { |
| 14 | + List<DtlsHandshakeMessageFragment> handshakeFragmentList = new LinkedList<>(); |
| 15 | + List<FragmentKey> orderedFragmentKeys = new ArrayList<>(fragments.keySet()); |
| 16 | +- orderedFragmentKeys.sort( |
| 17 | +- new Comparator<FragmentKey>() { |
| 18 | +- @Override |
| 19 | +- public int compare(FragmentKey fragmentKey1, FragmentKey fragmentKey2) { |
| 20 | +- if (fragmentKey1.getEpoch() > fragmentKey2.getEpoch()) { |
| 21 | +- return -1; |
| 22 | +- } else if (fragmentKey1.getEpoch() < fragmentKey2.getEpoch()) { |
| 23 | +- return 1; |
| 24 | +- } else { |
| 25 | +- return fragmentKey1 |
| 26 | +- .getMessageSeq() |
| 27 | +- .compareTo(fragmentKey2.getMessageSeq()); |
| 28 | +- } |
| 29 | +- } |
| 30 | +- }); |
| 31 | + |
| 32 | + for (FragmentKey key : orderedFragmentKeys) { |
| 33 | + FragmentCollector fragmentCollector = fragments.get(key); |
| 34 | +@@ -100,11 +84,6 @@ |
| 35 | + } |
| 36 | + } |
| 37 | + if (!fragmentCollector.isInterpreted()) { |
| 38 | +- if (!skipMessageSequences |
| 39 | +- && key.getMessageSeq() != lastInterpretedMessageSeq + 1 |
| 40 | +- && !fragmentCollector.isRetransmission()) { |
| 41 | +- break; |
| 42 | +- } |
| 43 | + if (onlyIfComplete && !fragmentCollector.isMessageComplete()) { |
| 44 | + LOGGER.debug( |
| 45 | + "Incomplete message. Not processing: msg_sqn: " |
| 46 | +@@ -114,7 +93,7 @@ |
| 47 | + } else { |
| 48 | + handshakeFragmentList.add(fragmentCollector.buildCombinedFragment()); |
| 49 | + fragmentCollector.setInterpreted(true); |
| 50 | +- lastInterpretedMessageSeq = key.getMessageSeq(); |
| 51 | ++ clearFragmentedMessage(key.getMessageSeq(), key.getEpoch()); |
| 52 | + } |
| 53 | + } |
| 54 | + } |
| 55 | +diff -ruN TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/LayerStackFactory.java TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/LayerStackFactory.java |
| 56 | +--- TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/LayerStackFactory.java 2025-02-20 15:19:04.907853961 +0100 |
| 57 | ++++ TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/LayerStackFactory.java 2025-02-20 15:38:28.834162918 +0100 |
| 58 | +@@ -32,7 +32,7 @@ |
| 59 | + new MessageLayer(context), |
| 60 | + new DtlsFragmentLayer(context), |
| 61 | + new RecordLayer(context), |
| 62 | +- new UdpLayer(context)); |
| 63 | ++ new FirstCachedUdpLayer(context)); |
| 64 | + case QUIC: |
| 65 | + return new LayerStack( |
| 66 | + context, |
| 67 | +diff -ruN TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/impl/FirstCachedUdpLayer.java TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/impl/FirstCachedUdpLayer.java |
| 68 | +--- TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/impl/FirstCachedUdpLayer.java 1970-01-01 01:00:00.000000000 +0100 |
| 69 | ++++ TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/impl/FirstCachedUdpLayer.java 2025-02-20 15:40:32.718070889 +0100 |
| 70 | +@@ -0,0 +1,64 @@ |
| 71 | ++/* |
| 72 | ++ * TLS-Attacker - A Modular Penetration Testing Framework for TLS |
| 73 | ++ * |
| 74 | ++ * Copyright 2014-2023 Ruhr University Bochum, Paderborn University, Technology Innovation Institute, and Hackmanit GmbH |
| 75 | ++ * |
| 76 | ++ * Licensed under Apache License, Version 2.0 |
| 77 | ++ * http://www.apache.org/licenses/LICENSE-2.0.txt |
| 78 | ++ */ |
| 79 | ++package de.rub.nds.tlsattacker.core.layer.impl; |
| 80 | ++ |
| 81 | ++import de.rub.nds.tlsattacker.core.layer.hints.LayerProcessingHint; |
| 82 | ++import de.rub.nds.tlsattacker.core.layer.stream.HintedLayerInputStream; |
| 83 | ++import de.rub.nds.tlsattacker.core.state.Context; |
| 84 | ++import de.rub.nds.tlsattacker.core.udp.UdpDataPacket; |
| 85 | ++import java.io.ByteArrayInputStream; |
| 86 | ++import java.io.IOException; |
| 87 | ++ |
| 88 | ++/** |
| 89 | ++ * The UDP layer is a wrapper around an underlying UDP socket. It forwards the sockets InputStream |
| 90 | ++ * for reading and sends any data over the UDP layer without modifications. |
| 91 | ++ */ |
| 92 | ++public class FirstCachedUdpLayer extends UdpLayer { |
| 93 | ++ |
| 94 | ++ private byte[] firstClientHello = null; |
| 95 | ++ private boolean isFirstClientHelloConsumed = false; |
| 96 | ++ |
| 97 | ++ public boolean isFuzzingClient = false; |
| 98 | ++ |
| 99 | ++ public FirstCachedUdpLayer(Context context) { |
| 100 | ++ super(context); |
| 101 | ++ } |
| 102 | ++ |
| 103 | ++ public void setFirstClientHelo(byte[] bytes) { |
| 104 | ++ this.firstClientHello = bytes; |
| 105 | ++ } |
| 106 | ++ |
| 107 | ++ public byte[] getFirstClientHelo() { |
| 108 | ++ return this.firstClientHello; |
| 109 | ++ } |
| 110 | ++ |
| 111 | ++ @Override |
| 112 | ++ public void receiveMoreDataForHint(LayerProcessingHint hint) throws IOException { |
| 113 | ++ byte[] receivedPacket = null; |
| 114 | ++ if (!isFirstClientHelloConsumed && isFuzzingClient) { |
| 115 | ++ receivedPacket = firstClientHello; |
| 116 | ++ isFirstClientHelloConsumed = true; |
| 117 | ++ } else { |
| 118 | ++ receivedPacket = getTransportHandler().fetchData(); |
| 119 | ++ } |
| 120 | ++ UdpDataPacket udpDataPacket = new UdpDataPacket(); |
| 121 | ++ udpDataPacket |
| 122 | ++ .getParser(context, new ByteArrayInputStream(receivedPacket)) |
| 123 | ++ .parse(udpDataPacket); |
| 124 | ++ udpDataPacket.getPreparator(context).prepareAfterParse(); |
| 125 | ++ udpDataPacket.getHandler(context).adjustContext(udpDataPacket); |
| 126 | ++ addProducedContainer(udpDataPacket); |
| 127 | ++ if (currentInputStream == null) { |
| 128 | ++ currentInputStream = new HintedLayerInputStream(null, this); |
| 129 | ++ currentInputStream.extendStream(receivedPacket); |
| 130 | ++ } else { |
| 131 | ++ currentInputStream.extendStream(receivedPacket); |
| 132 | ++ } |
| 133 | ++ } |
| 134 | ++} |
| 135 | +diff -ruN TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/impl/UdpLayer.java TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/impl/UdpLayer.java |
| 136 | +--- TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/impl/UdpLayer.java 2025-02-20 15:19:04.907853961 +0100 |
| 137 | ++++ TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/layer/impl/UdpLayer.java 2025-02-20 15:42:08.984094197 +0100 |
| 138 | +@@ -26,7 +26,7 @@ |
| 139 | + */ |
| 140 | + public class UdpLayer extends ProtocolLayer<LayerProcessingHint, UdpDataPacket> { |
| 141 | + |
| 142 | +- private final Context context; |
| 143 | ++ protected final Context context; |
| 144 | + |
| 145 | + public UdpLayer(Context context) { |
| 146 | + super(ImplementedLayers.UDP); |
| 147 | +@@ -88,7 +88,7 @@ |
| 148 | + return new LayerProcessingResult<UdpDataPacket>(null, getLayerType(), true); |
| 149 | + } |
| 150 | + |
| 151 | +- private UdpTransportHandler getTransportHandler() { |
| 152 | ++ protected UdpTransportHandler getTransportHandler() { |
| 153 | + if (context.getTransportHandler() == null) { |
| 154 | + throw new RuntimeException("TransportHandler is not set in context!"); |
| 155 | + } |
| 156 | +diff -ruN TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/protocol/preparator/CertificateMessagePreparator.java TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/protocol/preparator/CertificateMessagePreparator.java |
| 157 | +--- TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/protocol/preparator/CertificateMessagePreparator.java 2025-02-20 15:19:04.917589863 +0100 |
| 158 | ++++ TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/protocol/preparator/CertificateMessagePreparator.java 2025-02-24 17:22:35.965169130 +0100 |
| 159 | +@@ -147,13 +147,20 @@ |
| 160 | + } |
| 161 | + prepareFromEntryList(msg); |
| 162 | + } else { |
| 163 | +- entryList = new LinkedList<>(); |
| 164 | +- for (CertificateBytes certificateBytes : |
| 165 | +- chooser.getConfig().getDefaultExplicitCertificateChain()) { |
| 166 | +- CertificateEntry entry = new CertificateEntry(certificateBytes.getBytes()); |
| 167 | +- entryList.add(entry); |
| 168 | ++ if (entryList != null) { |
| 169 | ++ // Generate EMPTY_CERTIFICATE |
| 170 | ++ preparePredefinedCerts(entryList); |
| 171 | ++ } else { |
| 172 | ++ // Generate CERTIFICATE |
| 173 | ++ entryList = new LinkedList<>(); |
| 174 | ++ for (CertificateBytes certificateBytes : |
| 175 | ++ chooser.getConfig().getDefaultExplicitCertificateChain()) { |
| 176 | ++ CertificateEntry entry = |
| 177 | ++ new CertificateEntry(certificateBytes.getBytes()); |
| 178 | ++ entryList.add(entry); |
| 179 | ++ } |
| 180 | ++ msg.setCertificateEntryList(entryList); |
| 181 | + } |
| 182 | +- msg.setCertificateEntryList(entryList); |
| 183 | + prepareFromEntryList(msg); |
| 184 | + } |
| 185 | + LOGGER.debug( |
| 186 | +@@ -223,7 +230,6 @@ |
| 187 | + prepareCert(entryList, x509Context, certConfig, i); |
| 188 | + } |
| 189 | + } |
| 190 | +- chooser.getContext().getTlsContext().setTalkingX509Context(x509Context); |
| 191 | + } |
| 192 | + |
| 193 | + private void prepareCert( |
| 194 | +diff -ruN TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/record/crypto/RecordDecryptor.java TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/record/crypto/RecordDecryptor.java |
| 195 | +--- TLS-Attacker/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/record/crypto/RecordDecryptor.java 2025-02-20 15:19:04.927325762 +0100 |
| 196 | ++++ TLS-Attacker_patched/TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/record/crypto/RecordDecryptor.java 2025-02-20 15:48:31.109280624 +0100 |
| 197 | +@@ -8,6 +8,7 @@ |
| 198 | + */ |
| 199 | + package de.rub.nds.tlsattacker.core.record.crypto; |
| 200 | + |
| 201 | ++import de.rub.nds.protocol.exception.EndOfStreamException; |
| 202 | + import de.rub.nds.protocol.exception.ParserException; |
| 203 | + import de.rub.nds.tlsattacker.core.constants.ProtocolMessageType; |
| 204 | + import de.rub.nds.tlsattacker.core.constants.ProtocolVersion; |
| 205 | +@@ -55,7 +56,7 @@ |
| 206 | + || record.getContentMessageType() != ProtocolMessageType.CHANGE_CIPHER_SPEC) { |
| 207 | + try { |
| 208 | + recordCipher.decrypt(record); |
| 209 | +- } catch (ParserException | CryptoException ex) { |
| 210 | ++ } catch (ParserException | CryptoException | EndOfStreamException ex) { |
| 211 | + if (recordCipherList.indexOf(recordCipher) > 0) { |
| 212 | + LOGGER.warn( |
| 213 | + "Failed to decrypt record, will try to process with previous cipher"); |
0 commit comments