Skip to content

Commit 4f81264

Browse files
david-a-wheelerdavid-a-wheeler
authored
Add first version of lab oob1 (#468)
Signed-off-by: David A. Wheeler <[email protected]>
1 parent e4ec10e commit 4f81264

File tree

2 files changed

+1867
-0
lines changed

2 files changed

+1867
-0
lines changed

‎docs/labs/oob1.html

Lines changed: 388 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,388 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
5+
<meta name="viewport" content="width=device-width, initial-scale=1">
6+
<link rel="stylesheet" href="https://best.openssf.org/assets/css/style.css">
7+
<link rel="stylesheet" href="checker.css">
8+
<script src="js-yaml.min.js"></script>
9+
<script src="checker.js"></script>
10+
<link rel="license" href="https://creativecommons.org/licenses/by/4.0/">
11+
12+
<!-- See create_labs.md for how to create your own lab! -->
13+
14+
<!-- Sample expected answer -->
15+
<script id="expected0" type="plain/text">
16+
if (1 + 2 + 16 > s->s3->rrec.length)
17+
return 0;
18+
</script>
19+
<!--
20+
-->
21+
<script id="expected1" type="plain/text">
22+
if (1 + 2 + payload + 16 > s->s3->rrec.length)
23+
return 0;
24+
</script>
25+
26+
<!-- Full pattern of correct answer -->
27+
<script id="correct0" type="plain/text">
28+
\s*
29+
if \s+ \(
30+
(1 \+ 2 \+ 16|19) > s -> s3 -> rrec \. length \)
31+
\s+ return \s+ 0 ;
32+
\s*
33+
</script>
34+
<script id="correct1" type="plain/text">
35+
\s*
36+
if \s+ \( (1 \+ 2|3) \+ payload \+ 16 > s -> s3 -> rrec \. length \)
37+
\s+ return \s+ 0 ;
38+
\s*
39+
</script>
40+
<!--
41+
\s* app \. use \( helmet \( \{
42+
contentSecurityPolicy: \{
43+
directives: \{
44+
"script-src": \[ "'self'" ,
45+
(["'`])https://example\.com\1 \] ,
46+
"style-src": \[ "'self'" \]
47+
\} ,
48+
\}
49+
\} \) \) ;
50+
-->
51+
52+
<script id="info" type="application/yaml">
53+
---
54+
hints:
55+
- absent: "if"
56+
text: Begin with "if" as we will return 0 when there is a problem.
57+
- absent: |
58+
\(
59+
text: Need "(...)" around the condition after an if statement.
60+
# - present: "import"
61+
# text: Yes, many JavaScript implementations support an import statement.
62+
# However, in this exercise we will use a require form. Please use that
63+
# instead.
64+
# examples:
65+
# - - 'import express from "express";'
66+
# - absent: "const"
67+
# text: Start with const.
68+
# - absent: 'const\s+helmet ='
69+
# text: Create a constant name named helmet using the form const helmet = ...
70+
# examples:
71+
# - - 'const'
72+
# - - 'consthelmet = '
73+
# - present: 'require \( helmet \)'
74+
# text: The parameter of a requirement statement must be string.
75+
# Surround the term helment with double-quotes.
76+
# examples:
77+
# - - ' const helmet = require(helmet);'
78+
# - absent: "; $"
79+
# text: JavaScript doesn''t require semicolon terminators, but the rest of
80+
# the code uses them. You should try to match a coding style when modifying
81+
# existing code unless there''s an important reason not to.
82+
# Please update the first statment.
83+
# examples:
84+
# - - ' const helmet = require("helmet")'
85+
# - absent: '\s* app \. use \( helmet \( \{'
86+
# index: 1
87+
# text: Your code should begin with app.use(helmet({
88+
# - absent: |
89+
# \s* app \. use \( helmet \( \{
90+
# contentSecurityPolicy: \{ \s*
91+
# index: 1
92+
# text: |
93+
# Your code should begin with:
94+
# app.use(helmet({
95+
# contentSecurityPolicy: {
96+
# - absent: |
97+
# \s* app \. use \( helmet \( \{
98+
# contentSecurityPolicy: \{
99+
# directives: \{ \s*
100+
# index: 1
101+
# text: |
102+
# Your code should begin with:
103+
# app.use(helmet({
104+
# contentSecurityPolicy: {
105+
# directives: {
106+
# - absent: |
107+
# \s* app \. use \( helmet \( \{
108+
# contentSecurityPolicy: \{
109+
# directives: \{
110+
# "script-src": \[ "'self'" , ["']https://example.com["'] \] , \s*
111+
# index: 1
112+
# text: |
113+
# Your code should continue with:
114+
# app.use(helmet({
115+
# contentSecurityPolicy: {
116+
# directives: {
117+
# "script-src": ["'self'", "https://example.com"],
118+
# - absent: |
119+
# "style-src": \[ "'self'" \]
120+
# index: 1
121+
# text: |
122+
# Don't forget to include "style-src": ["'self'"]
123+
# - absent: '; $'
124+
# index: 1
125+
# text: JavaScript doesn''t require semicolon terminators, but the rest of
126+
# the code uses them. You should try to match a coding style when modifying
127+
# existing code unless there''s an important reason not to.
128+
# Please update the second statment.
129+
# - text: I do not have more specific hints to provide. Please ensure that
130+
# the parentheses, braces, and brackets pair correctly.
131+
# # debug: true
132+
</script>
133+
</head>
134+
<body>
135+
<!-- For GitHub Pages formatting: -->
136+
<div class="container-lg px-3 my-5 markdown-body">
137+
<h1>Lab Exercise oob1</h1>
138+
<p>
139+
This is a lab exercise on developing secure software.
140+
For more information, see the <a href="introduction.html" target="_blank">introduction to
141+
the labs</a>.
142+
143+
<p>
144+
<h2>Task</h2>
145+
<p>
146+
<b>Please change the code below to fix this simplified version
147+
of the "Heartbleed" bug in OpenSSL, an example of a buffer overread.</b>
148+
149+
<p>
150+
<h2>Background</h2>
151+
<p>
152+
In almost all programming languages, the default response a program
153+
attempts to read or write outside
154+
of a buffer is either an attempt to resize the buffer or
155+
an error of some kind (e.g., raising an exception).
156+
That's because it's extremely easy to accidentally attempt to read
157+
or write outside of a buffer.
158+
<p>
159+
However, C and the built-in arrays of C++ are different.
160+
In C and C++, attempting to read or write outside a buffer is
161+
<i>undefined behavior</i> and <i>anything</i> is allowed to happen
162+
without any kind of protection.
163+
In practice, what often happens is a read or write (respectively) of
164+
other data.
165+
<p>
166+
The 2014 revelation of the Heartbleed vulnerability
167+
(CVE-2014-0160) is an example of a buffer overread vulnerability.
168+
Heartbleed was a vulnerability in OpenSSL, a widely-used toolkit
169+
that implements the cryptographic protocol Secure Sockets Layer
170+
(SSL) and its successor the Transport Layer Security (TLS).
171+
Heartbleed affected a huge number of popular websites, including
172+
Google, YouTube, Yahoo!, Pinterest, Blogspot, Instagram, Tumblr,
173+
Reddit, Netflix, Stack Overflow, Slate, GitHub, Yelp, Etsy, the
174+
U.S. Postal Service (USPS), Blogger, Dropbox, Wikipedia, and the
175+
Washington Post.
176+
See <a href="https://dwheeler.com/essays/heartbleed.html">here</a> for more.
177+
178+
<p>
179+
<h2>Task Information</h2>
180+
<p>
181+
We're going re-create the fix in OpenSSF for the Heartbleed vulnerability
182+
by modifying function <tt>dtls1_process_heartbeat</tt>.
183+
<p>
184+
At this point in the code, the construct
185+
<tt>s->s3->rrec.length</tt>
186+
indicates how many bytes are available.
187+
Modify the code below in two places.
188+
<p>
189+
First, modify the code so that
190+
if the minimum length of a response <tt>(1 + 2 + 16)</tt> is more than
191+
the length claimed by
192+
<tt>s->s3->rrec.length</tt>,
193+
return return 0 without sending a heartbeat,
194+
This will prevent trying to create a heartbeat when there's not enough
195+
room to create one.
196+
<p>
197+
Second, modify the code so that
198+
if the minimum length of a response with a payload
199+
<tt>(1 + 2 + payload + 16</tt>
200+
is more than the total length for a response given in
201+
<tt>s->s3->rrec.length</tt> then again
202+
return return 0 without sending a heartbeat,
203+
<p>
204+
This will prevent trying to create a heartbeat when there's not enough
205+
room to create one.
206+
<p>
207+
Note that this is not terribly difficult to fix.
208+
The problem is that reading and writing buffers is extremely common,
209+
but by default such accesses are unsafe in C and C++.
210+
In practice it is difficult to <i>always</i> check all ranges
211+
in all possible cases.
212+
<!--
213+
if (1 + 2 + 16 > s->s3->rrec.length)
214+
return 0; /* silently discard */
215+
-->
216+
217+
<p>
218+
<h2>Interactive Lab (<span id="grade"></span>)</h2>
219+
<p>
220+
<form id="lab">
221+
<pre><code
222+
>int
223+
dtls1_process_heartbeat(SSL *s)
224+
{
225+
unsigned char *p = &s->s3->rrec.data[0], *pl;
226+
unsigned short hbtype;
227+
unsigned int payload;
228+
unsigned int padding = 16; /* Use minimum padding */
229+
230+
// ... Some details omitted here
231+
232+
<textarea id="attempt0" rows="3" cols="60" spellcheck="false">
233+
if ()
234+
;
235+
</textarea>
236+
hbtype = *p++;
237+
n2s(p, payload);
238+
<textarea id="attempt1" rows="3" cols="60" spellcheck="false">
239+
if ()
240+
;
241+
</textarea>
242+
243+
// ... Later on there are these lines, which create a buffer
244+
// with enough room for a response, but uses a "memcpy" to
245+
// copy the payload data. At this point in the code it's assumed
246+
// that the payload's asserted length will fit in its created buffer.
247+
// buffer = OPENSSL_malloc(write_length);
248+
// bp = buffer;
249+
// *bp++ = TLS1_HB_RESPONSE;
250+
// s2n(payload, bp);
251+
// memcpy(bp, pl, payload);
252+
253+
</code></pre>
254+
<button type="button" class="hintButton">Hint</button>
255+
<button type="button" class="resetButton">Reset</button>
256+
<button type="button" class="giveUpButton">Give up</button>
257+
<br><br>
258+
<p>
259+
<details>
260+
<summary>Source: This example was extracted from
261+
<a href="https://github.com/openssl/openssl/blob/731f431497f463f3a2a97236fe0187b11c44aead/ssl/d1_both.c">OpenSSL file <tt>ssl/d1_both.c</tt>
262+
commit 731f431497f4</a>; you can see its full header by
263+
expanding details here.</summary>
264+
<pre>
265+
/* ssl/d1_both.c */
266+
/*
267+
* DTLS implementation written by Nagendra Modadugu
268+
* ([email protected]) for the OpenSSL project 2005.
269+
*/
270+
/* ====================================================================
271+
* Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved.
272+
*
273+
* Redistribution and use in source and binary forms, with or without
274+
* modification, are permitted provided that the following conditions
275+
* are met:
276+
*
277+
* 1. Redistributions of source code must retain the above copyright
278+
* notice, this list of conditions and the following disclaimer.
279+
*
280+
* 2. Redistributions in binary form must reproduce the above copyright
281+
* notice, this list of conditions and the following disclaimer in
282+
* the documentation and/or other materials provided with the
283+
* distribution.
284+
*
285+
* 3. All advertising materials mentioning features or use of this
286+
* software must display the following acknowledgment:
287+
* "This product includes software developed by the OpenSSL Project
288+
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
289+
*
290+
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
291+
* endorse or promote products derived from this software without
292+
* prior written permission. For written permission, please contact
293+
* [email protected].
294+
*
295+
* 5. Products derived from this software may not be called "OpenSSL"
296+
* nor may "OpenSSL" appear in their names without prior written
297+
* permission of the OpenSSL Project.
298+
*
299+
* 6. Redistributions of any form whatsoever must retain the following
300+
* acknowledgment:
301+
* "This product includes software developed by the OpenSSL Project
302+
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
303+
*
304+
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
305+
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
306+
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
307+
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
308+
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
309+
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
310+
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
311+
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
312+
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
313+
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
314+
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
315+
* OF THE POSSIBILITY OF SUCH DAMAGE.
316+
* ====================================================================
317+
*
318+
* This product includes cryptographic software written by Eric Young
319+
* ([email protected]). This product includes software written by Tim
320+
* Hudson ([email protected]).
321+
*
322+
*/
323+
/* Copyright (C) 1995-1998 Eric Young ([email protected])
324+
* All rights reserved.
325+
*
326+
* This package is an SSL implementation written
327+
* by Eric Young ([email protected]).
328+
* The implementation was written so as to conform with Netscapes SSL.
329+
*
330+
* This library is free for commercial and non-commercial use as long as
331+
* the following conditions are aheared to. The following conditions
332+
* apply to all code found in this distribution, be it the RC4, RSA,
333+
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
334+
* included with this distribution is covered by the same copyright terms
335+
* except that the holder is Tim Hudson ([email protected]).
336+
*
337+
* Copyright remains Eric Young's, and as such any Copyright notices in
338+
* the code are not to be removed.
339+
* If this package is used in a product, Eric Young should be given attribution
340+
* as the author of the parts of the library used.
341+
* This can be in the form of a textual message at program startup or
342+
* in documentation (online or textual) provided with the package.
343+
*
344+
* Redistribution and use in source and binary forms, with or without
345+
* modification, are permitted provided that the following conditions
346+
* are met:
347+
* 1. Redistributions of source code must retain the copyright
348+
* notice, this list of conditions and the following disclaimer.
349+
* 2. Redistributions in binary form must reproduce the above copyright
350+
* notice, this list of conditions and the following disclaimer in the
351+
* documentation and/or other materials provided with the distribution.
352+
* 3. All advertising materials mentioning features or use of this software
353+
* must display the following acknowledgement:
354+
* "This product includes cryptographic software written by
355+
* Eric Young ([email protected])"
356+
* The word 'cryptographic' can be left out if the rouines from the library
357+
* being used are not cryptographic related :-).
358+
* 4. If you include any Windows specific code (or a derivative thereof) from
359+
* the apps directory (application code) you must include an acknowledgement:
360+
* "This product includes software written by Tim Hudson ([email protected])"
361+
*
362+
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
363+
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
364+
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
365+
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
366+
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
367+
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
368+
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
369+
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
370+
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
371+
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
372+
* SUCH DAMAGE.
373+
*
374+
* The licence and distribution terms for any publically available version or
375+
* derivative of this code cannot be changed. i.e. this code cannot simply be
376+
* copied and put under another distribution licence
377+
* [including the GNU Public Licence.]
378+
*/
379+
</pre>
380+
</details>
381+
<br><br>
382+
<p id="correctStamp" class="small">
383+
<textarea id="debugData" class="displayNone" rows="20" cols="65" readonly>
384+
</textarea>
385+
</form>
386+
</div><!-- End GitHub pages formatting -->
387+
</body>
388+
</html>

0 commit comments

Comments
 (0)