Updated key gen (#895)

* Updated keygen.sh script to use saner parameters

* Added RecordSizeLimitExtensionMessage constructor

* Added a warning on an infinite loop if we are auto creating 0 byte records

* Removed a deprecated test

Author: ic0ns

TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/protocol/message/extension/RecordSizeLimitExtensionMessage.java

@@ -12,6 +12,7 @@
 import de.rub.nds.modifiablevariable.ModifiableVariableFactory;
 import de.rub.nds.modifiablevariable.ModifiableVariableProperty;
 import de.rub.nds.modifiablevariable.bytearray.ModifiableByteArray;
+import de.rub.nds.tlsattacker.core.config.Config;
 import de.rub.nds.tlsattacker.core.constants.ExtensionType;
 import javax.xml.bind.annotation.XmlRootElement;
 
@@ -24,6 +25,10 @@ public class RecordSizeLimitExtensionMessage extends ExtensionMessage {
     @ModifiableVariableProperty
     private ModifiableByteArray recordSizeLimit;
 
+    public RecordSizeLimitExtensionMessage(Config config) {
+        super(ExtensionType.RECORD_SIZE_LIMIT);
+    }
+
     public RecordSizeLimitExtensionMessage() {
         super(ExtensionType.RECORD_SIZE_LIMIT);
     }

TLS-Core/src/main/java/de/rub/nds/tlsattacker/core/workflow/action/executor/SendMessageHelper.java

@@ -260,6 +260,10 @@ private List<AbstractRecord> getEnoughRecords(int length, int position, List<Abs
             toFillList.add(record);
             if (record.getMaxRecordLengthConfig() == null) {
                 record.setMaxRecordLengthConfig(context.getChooser().getOutboundMaxRecordDataSize());
+                if (context.getChooser().getOutboundMaxRecordDataSize() == 0) {
+                    LOGGER.warn("OutboundMaxRecordDataSize is 0. This is an endless loop. Aborting");
+                    break;
+                }
             }
             recordLength += record.getMaxRecordLengthConfig();
             position++;

TLS-Core/src/test/java/de/rub/nds/tlsattacker/core/config/delegate/ClientDelegateTest.java

@@ -71,29 +71,6 @@ public void testSetHost() {
         assertTrue(delegate.getHost().equals("123456"));
     }
 
-    /**
-     * Test of applyDelegate method, of class ClientDelegate.
-     */
-    @Test
-    public void testApplyDelegate() {
-        Config config = Config.createConfig();
-        args = new String[2];
-        args[0] = "-connect";
-        args[1] = "99.99.99.99:1448";
-
-        jcommander.parse(args);
-        delegate.applyDelegate(config);
-
-        AliasedConnection actual = config.getDefaultClientConnection();
-        assertNotNull(actual);
-        assertThat(actual.getHostname(), equalTo("99.99.99.99"));
-        assertThat(actual.getPort(), equalTo(1448));
-        assertThat(actual.getLocalConnectionEndType(), equalTo(ConnectionEndType.CLIENT));
-    }
-
-    /**
-     * Make sure that applying with host = null fails properly.
-     */
     @Test
     public void testApplyDelegateNullHost() {
         Config config = Config.createConfig();

resources/keygen.sh

@@ -1,24 +1,37 @@
-#!/bin/sh
-
-for len in 512 1024 2048
+#!/bin/bash
+for len in 512 1024 2048 3072
 do
   openssl genpkey -genparam -algorithm DSA -out dsap${len}.pem -pkeyopt dsa_paramgen_bits:${len}
-  openssl genpkey -paramfile dsap${len}.pem -out dsa${len}key.pem
-  openssl req -key dsa${len}key.pem -new -x509 -days 365 -out dsa${len}cert.pem -subj "/C=DE/ST=NRW/L=Bochum/O=<script>alert('TLS-Attacker')<\/script>/CN=tls-attacker.de"
-  rm dsap${len}.pem
-  cat dsa${len}key.pem dsa${len}cert.pem > dsa${len}.pem
+  openssl genpkey -paramfile dsap${len}.pem -out dsa${len}_key.pem
+  openssl req -key dsa${len}_key.pem -new -x509 -days 2000 -out dsa${len}_cert.pem -subj "/CN=tls-attacker.com"
 done
-
 for len in 512 1024 2048 4096
 do
-  openssl genpkey -algorithm RSA -out rsa${len}key.pem -pkeyopt rsa_keygen_bits:${len} 
-  openssl req -key rsa${len}key.pem -new -x509 -days 365 -out rsa${len}cert.pem -subj "/C=DE/ST=NRW/L=Bochum/O=<script>alert('TLS-Attacker')<\/script>/CN=tls-attacker.de"
-  cat rsa${len}key.pem rsa${len}cert.pem > rsa${len}.pem
+  openssl genpkey -algorithm RSA -out rsa${len}_key.pem -pkeyopt rsa_keygen_bits:${len} 
+  openssl req -key rsa${len}_key.pem -new -x509 -days 2000 -out rsa${len}_cert.pem -subj "/CN=tls-attacker.com"
+done
+for named_curve in secp160k1 secp160r1 secp160r2 secp192k1 secp224k1 secp224r1 secp256k1 secp384r1 secp521r1 sect163k1 sect163r1 sect163r2 sect193r1 sect193r2 sect233k1 sect233r1 sect239k1 sect283k1 sect283r1 sect409k1 sect409r1 sect571k1 sect571r1
+do
+  openssl ecparam -name ${named_curve} -genkey -out ec_${named_curve}_key.pem
+  openssl req -key ec_${named_curve}_key.pem -new -x509 -days 2000 -out ec_${named_curve}_cert.pem -subj "/CN=tls-attacker.com"
 done
 
-for len in 192 256 384 521
+
+openssl req -x509 -new -nodes -extensions v3_ca -key rsa2048_key.pem -days 2000 -out rsa_ca.pem -sha256 -subj "/CN=TLS-Attacker CA"
+openssl req -x509 -new -nodes -extensions v3_ca -key dsa1024_key.pem -days 2000 -out dsa_ca.pem -sha256 -subj "/CN=TLS-Attacker CA"
+
+openssl dhparam -out dhparam.pem 1024
+openssl genpkey -paramfile dhparam.pem -out dhkey.pem
+openssl pkey -in dhkey.pem -pubout -out dhpubkey.pem
+openssl req -new -key rsa2048_key.pem -out rsa.csr -subj "/CN=tls-attacker.com"
+openssl x509 -req -in rsa.csr -CAkey rsa2048_key.pem -CA rsa_ca.pem -force_pubkey dhpubkey.pem -outrsa_dhcert.pem -CAcreateserial
+openssl req -new -key dsa1024_key.pem -out dsa.csr -subj "/CN=tls-attacker.com"
+openssl x509 -req -in dsa.csr -CAkey dsa1024_key.pem -CA dsa_ca.pem -force_pubkey dhpubkey.pem -out 
+dsa_dhcert.pem -CAcreateserial
+for named_curve in secp160k1 secp160r1 secp160r2 secp192k1 secp224k1 secp224r1 secp256k1 secp384r1 secp521r1 sect163k1 sect163r1 sect163r2 sect193r1 sect193r2 sect233k1 sect233r1 sect239k1 sect283k1 sect283r1 sect409k1 sect409r1 sect571k1 sect571r1
 do
-  openssl genpkey -algorithm EC -out ec${len}key.pem -pkeyopt ec_paramgen_curve:P-${len} -pkeyopt ec_param_enc:named_curve
-  openssl req -key ec${len}key.pem -new -x509 -days 365 -out ec${len}cert.pem -subj "/C=DE/ST=NRW/L=Bochum/O=<script>alert('TLS-Attacker')<\/script>/CN=tls-attacker.de"
-  cat ec${len}key.pem ec${len}cert.pem > ec${len}.pem
-done
+    openssl ecparam -out ec_param_${named_curve}.pem -name ${named_curve}
+	openssl genpkey -paramfile ec_param_${named_curve}.pem -out ec_rsa_private_key_${named_curve}.pem
+    openssl pkey -in ec_rsa_private_key_${named_curve}.pem -pubout -out ec_rsa_public_key_${named_curve}.pem
+	openssl x509 -req -in rsa.csr -CAkey rsa2048_key.pem -CA rsa_ca.pem -force_pubkey ec_rsa_public_key_${named_curve}.pem -out ec_rsa_cert_${named_curve}.pem -CAcreateserial
+done