|
| 1 | +<?xml version="1.0" encoding="UTF-8" standalone="yes"?> |
| 2 | +<!-- A MITM trace to replay 0-RTT data |
| 3 | +
|
| 4 | +Run server using: |
| 5 | +openssl s_server -key rsa1024key.pem -cert rsa1024cert.pem -tls1_3 -early_data |
| 6 | +
|
| 7 | +Run client using: |
| 8 | +openssl s_client -connect 127.0.0.1:4433 -tls1_3 -early_data earlyDataFile -sess_out 0rtt.pem |
| 9 | +
|
| 10 | +Stop the client, start TlsAttacker using this trace and run client again using: |
| 11 | +openssl s_client -connect 127.0.0.1:4432 -tls1_3 -early_data earlyDataFile -sess_in 0rtt.pem |
| 12 | +
|
| 13 | +OpenSSL should accept and print the early data |
| 14 | +--> |
| 15 | +<workflowTrace> |
| 16 | + <OutboundConnection> |
| 17 | + <alias>mitm2server</alias> |
| 18 | + <port>4433</port> |
| 19 | + <hostname>localhost</hostname> |
| 20 | + <timeout>100</timeout> |
| 21 | + </OutboundConnection> |
| 22 | + <InboundConnection> |
| 23 | + <alias>client2mitm</alias> |
| 24 | + <port>4432</port> |
| 25 | + <timeout>100</timeout> |
| 26 | + </InboundConnection> |
| 27 | + <!-- Buffer incoming ClientHello and early data --> |
| 28 | + <BufferedGenericReceive> |
| 29 | + <connectionAlias>client2mitm</connectionAlias> |
| 30 | + <messages/> |
| 31 | + <records/> |
| 32 | + </BufferedGenericReceive> |
| 33 | + <!-- Copy buffers to send the messages to the server --> |
| 34 | + <DeepCopyBuffers> |
| 35 | + <from>client2mitm</from> |
| 36 | + <to>mitm2server</to> |
| 37 | + </DeepCopyBuffers> |
| 38 | + <!-- Send ClientHello to server --> |
| 39 | + <PopAndSendRecord> |
| 40 | + <connectionAlias>mitm2server</connectionAlias> |
| 41 | + </PopAndSendRecord> |
| 42 | + <!-- Send early data to server --> |
| 43 | + <PopAndSendRecord> |
| 44 | + <connectionAlias>mitm2server</connectionAlias> |
| 45 | + </PopAndSendRecord> |
| 46 | + <!-- Forward server's responses to client --> |
| 47 | + <ForwardRecords> |
| 48 | + <receiveFromAlias>mitm2server</receiveFromAlias> |
| 49 | + <forwardToAlias>client2mitm</forwardToAlias> |
| 50 | + </ForwardRecords> |
| 51 | + <!-- Forward client's EndOfEarlyData + Finished to Server --> |
| 52 | + <ForwardRecords> |
| 53 | + <receiveFromAlias>client2mitm</receiveFromAlias> |
| 54 | + <forwardToAlias>mitm2server</forwardToAlias> |
| 55 | + </ForwardRecords> |
| 56 | + <!-- Reset connection to server --> |
| 57 | + <ResetConnection> |
| 58 | + <connectionAlias>mitm2server</connectionAlias> |
| 59 | + </ResetConnection> |
| 60 | + <!-- Copy buffers from client's context again --> |
| 61 | + <CopyBuffers> |
| 62 | + <from>client2mitm</from> |
| 63 | + <to>mitm2server</to> |
| 64 | + </CopyBuffers> |
| 65 | + <!-- Execute the actual replay attack --> |
| 66 | + <PopAndSendRecord> |
| 67 | + <connectionAlias>mitm2server</connectionAlias> |
| 68 | + </PopAndSendRecord> |
| 69 | + <PopAndSendRecord> |
| 70 | + <connectionAlias>mitm2server</connectionAlias> |
| 71 | + </PopAndSendRecord> |
| 72 | +</workflowTrace> |
0 commit comments