aha-misc 0.0.2

Aha's Mischief Maker
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112

//! OpenSSL crates need some package installation,
//! please read https://docs.rs/openssl/latest/openssl/

use std::{io::Write, net::TcpStream, path::Path, sync::Arc, time::Duration};

use libafl::{executors::ExitKind, inputs::BytesInput};
use log::debug;
use openssl::ssl::{SslConnector, SslFiletype, SslMethod, SslOptions, SslStream, SslVerifyMode};

use crate::tavern::option;

/// Create an insecure SSL stream
pub fn create_insecure_ssl_stream(
    host: &str,
    port: u16,
    client_cert: Option<&Path>,
    client_key: Option<&Path>,
) -> Result<SslStream<TcpStream>, Box<dyn std::error::Error>> {
    let mut builder = SslConnector::builder(SslMethod::tls())?;

    // Disable certificate verification
    builder.set_verify(SslVerifyMode::NONE);
    builder.set_options(SslOptions::ALLOW_UNSAFE_LEGACY_RENEGOTIATION);

    if let (Some(cert_path), Some(key_path)) = (client_cert, client_key) {
        builder.set_certificate_file(cert_path, SslFiletype::PEM)?;
        builder.set_private_key_file(key_path, SslFiletype::PEM)?;

        // Check if the private key matches the certificate
        if let Err(e) = builder.check_private_key() {
            return Err(Box::new(e));
        }
    }

    let connector = builder.build();

    let stream = TcpStream::connect((host, port))?;

    let ssl_stream = connector
        .configure()?
        .verify_hostname(false)
        .connect(host, stream)?;

    Ok(ssl_stream)
}

/// An openssl harness
pub fn create_openssl_harness(
    network: option::NetworkClientOptions,
    ssl: option::SSLOptions,
) -> impl Fn(&BytesInput) -> ExitKind {
    let connector = {
        let mut builder = SslConnector::builder(SslMethod::tls()).unwrap();

        builder.set_verify(SslVerifyMode::NONE);

        builder.set_options(SslOptions::ALLOW_UNSAFE_LEGACY_RENEGOTIATION);

        if let (Some(cert_path), Some(key_path)) = (ssl.cert_file, ssl.key_file) {
            debug!("Loading client certificate: {:?}", cert_path);
            debug!("Loading client private key: {:?}", key_path);

            builder
                .set_certificate_file(&cert_path, SslFiletype::PEM)
                .expect("Failed to load client certificate file");
            builder
                .set_private_key_file(&key_path, SslFiletype::PEM)
                .expect("Failed to load client private key file");
            builder
                .check_private_key()
                .expect("Client private key is invalid");
        } else {
            debug!("No client certificate and key provided, continuing in client-only mode.");
        }

        Arc::new(builder.build())
    };

    let host_for_closure = network.host;

    move |input: &BytesInput| {
        let tcp_stream = match TcpStream::connect((host_for_closure.as_str(), network.port)) {
            Ok(stream) => stream,
            Err(e) => {
                panic!(
                    "Cannot connect to {}:{}: {}",
                    host_for_closure, network.port, e
                );
            }
        };

        let mut ssl_stream = match connector
            .configure()
            .unwrap()
            .verify_hostname(false)
            .connect(&host_for_closure, tcp_stream)
        {
            Ok(stream) => stream,
            Err(e) => {
                panic!("TLS handshake failed: {}", e);
            }
        };

        if let Err(e) = ssl_stream.write_all(input.as_ref()) {
            debug!("Send error:: {}", e);
        }

        std::thread::sleep(Duration::from_nanos(network.sleep));

        ExitKind::Ok
    }
}