Term with payloads

crates/boringssl-src/src/lib.rs

@@ -1,6 +1,6 @@
 use std::{
  collections::HashSet,
- fs, io,
+ env, fs, io,
  io::ErrorKind,
  path::{Path, PathBuf},
  process::Command,
@@ -105,6 +105,13 @@ fn build_boringssl<P: AsRef<Path>>(dest: &P, options: &BoringSSLOptions) -> Path
  .define("CMAKE_BUILD_TYPE", "Release")
  .define("OPENSSL_NO_BUF_FREELISTS", "1");
 
+ if env::var("TARGET") == Ok("aarch64-apple-darwin".into()) {
+ // We rely on llvm installed with homebrew on Mac OS X since Xcode does not ship llvm with libfuzzer!
+ boring_conf
+ .define("CMAKE_C_COMPILER", "/opt/homebrew/opt/llvm/bin/clang")
+ .define("CMAKE_CXX_COMPILER", "/opt/homebrew/opt/llvm/bin/clang++");
+ }
+
  if options.deterministic {
  // FUZZ flag will enable deterministic mode in BoringSSL along with
  // disabling all encryption. To prevent BoringSSL from disabling encryption

puffin/Cargo.toml

@@ -29,6 +29,7 @@ libafl_targets = "0.10.1"
 
 # Logging
 log = { version = "0.4.17" }
+#features = ["release_max_level_off", "max_level_warn"]
 log4rs = "1.2.0"
 
 # Other Dependencies
@@ -45,6 +46,9 @@ cfg-if = "1.0.0"
 serde_json = "1.0.81" # Used for StatsMonitor TOOD: Hide behind feature flag
 ahash = "0.8.3"
 nix = "0.25.0"
+paste = "1.0"
+anyhow = "1.0"
+derivative = "2.2.0"
 
 [dev-dependencies]
 test-log = "0.2.10"

puffin/src/algebra/atoms.rs

@@ -109,6 +109,53 @@ impl Clone for Function {
 }
 
 impl Function {
+ /// Does the function symbol computes "opaque" message such as encryption, signature, MAC, AEAD, etc?
+ pub fn is_opaque(&self) -> bool {
+ // TODO: have protocol-dependent implementation for this
+ // debug!("Name: {}", self.fn_container.shape.name);
+ self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_encrypt_handshake" //TODO
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_encrypt_application"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_decrypt_application"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_encrypt12"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_derive_binder"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_derive_psk"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_decode_ecdh_pubkey"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_new_pubkey12"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_cert::fn_rsa_sign_server"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_cert::fn_rsa_sign_client"
+
+ // Get functions: opaque as they do not yield a bitstring containing all the bitstrings of their arguments
+ // (however needed for computing shifts in `replace_payloads`) TODO: improve this in the future
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_fields::fn_get_server_key_share"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_fields::fn_get_client_key_share"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_fields::fn_get_any_client_curve"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_get_ticket"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_get_ticket_age_add"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_get_ticket_nonce"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_cert::fn_get_context"
+ // Uses hashes
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_append_transcript"
+ // arg is not present
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_messages::fn_heartbeat_fake_length"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_fill_binder"
+ // Use enc
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_fields::fn_verify_data"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_fields::fn_verify_data_server"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_utils::fn_decrypt_handshake"
+ // Compute a deterministic key share... (TODO: WHY IS THAT?)
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_extensions::fn_key_share_deterministic_extension"
+ || self.fn_container.shape.name == "tlspuffin::tls::fn_impl::fn_extensions::fn_key_share_deterministic_server_extension"
+ // TODO:
+ // fn_signed_certificate_timestamp_extension is weird, it's encoding is empty....
+ }
+
+ /// Does the function symbol computes a list such as fn_append_certificate?
+ pub fn is_list(&self) -> bool {
+ // TODO: have protocol-dependent implementation for this
+ // debug!("Name: {}", self.fn_container.shape.name);
+ self.fn_container.shape.name.contains("_append")
+ }
+
  pub fn new(shape: DynamicFunctionShape, dynamic_fn: Box<dyn DynamicFunction>) -> Self {
  Self {
  unique_id: random(),