Offensive security — SOTA survey (offensive-r0-sota-survey)¶

Goal: offensive_security · Session: d6142e7a-d613-41cb-a295-4f5ffe1d2c5f · Run: security_auditor-1779904309903
Agent: security_auditor · Mode: study-only (posture validity locked; no weakening li_stricter)
North star: secure pillar — fuzz + tier5 exploits + CWE feed vs nginx stricter-or-equal
Preflight: benchmarks/data/latest/security-cwe-feed-delta.json @ 2026-05-27T17:51Z · httpd plan

Problem¶

Li’s security posture combines compile-time rejection (borrowck, path gates, proved bounds) with runtime exploit parity against nginx on build/li-httpd. Industry practice for web servers relies on years of CVE patches, module-specific checks, and continuous fuzzing (libFuzzer, AFL++, protocol fuzzers). Li must close the gap between MITRE CWE Top 25 coverage in security/cve-catalog.json and live tier5 exploit rows without trading exploit expectations for bench throughput.

Learned from (SOTA)¶

1. MITRE CWE Top 25 (2024) — ranked weakness classes for appsec prioritization.
2. List: https://cwe.mitre.org/top25/

3. Takeaway: Catalog must represent Top 25 CWE ids honestly (needsWeb rows) or document compile-time N/A with li-tests/security/* obligations in cwe-to-li-tests.toml.

4. OWASP Top 10 (2021) — web abuse classes (injection, broken access control, SSRF).

5. https://owasp.org/Top10/

6. Takeaway: Tier5 exploit TOML already tags owasp = [...] (e.g. path_traversal → A01); expand rows for CWE-79/89/352 gaps per httpd plan gap-exploit-owasp-cwe-suite.

7. nginx security model — distributed checks, merge_slashes, request-line limits, module CVE history; fuzzed for decades.

8. Docs: https://nginx.org/en/docs/http/ngx_http_core_module.html

9. Takeaway: Li maps nginx mitigations in benchmarks/tier5_http/nginx_mitigations.toml (~34 rows); every exploit cites mitigation_id and requires li_behavior = "stricter" on [expect].

10. libFuzzer / AFL++ — in-process coverage-guided fuzzing for parsers and protocol state machines.

11. LLVM: https://llvm.org/docs/LibFuzzer.html · AFL++: https://github.com/AFLplusplus/AFLplusplus

12. Takeaway: Parser fuzz lives at compiler/fuzz/parse_fuzz.cpp with corpus compiler/fuzz/corpus/; httpd plan calls for standalone http_parse_fuzz + nightly corpus merge (scripts/merge_fuzz_corpus.sh). Fuzz throughput is documented only — not traded for posture.

13. tlsfuzzer / h2spec — TLS record and HTTP/2 violation testing (M2 surfaces).

14. tlsfuzzer: https://github.com/tlsfuzzer/tlsfuzzer · h2spec: https://github.com/summerwind/h2spec
15. Takeaway: Tier5 [attack] driver = tlsfuzzer for M2 TLS; RNG exploit rows (rng_*) gate when touching li-rng / li-tls.

Li inventory (2026-05-27)¶

Briefing: catalog_gaps (li-tests path coverage) = 0; Top25 vs catalog gap = 19 (web/app CWE classes not yet in cve-catalog.json).

SOTA → Li mapping (CWE Top 25)¶

Tier5 exploit contract (stricter-or-equal)¶

Every row follows the machine contract:

[expect]
no_crash = true
reject_or_close_attack = true
legitimate_client_ok = true
li_behavior = "stricter"

Example: request_smuggling_cl_te (CWE-444, CVE-2019-20372) — live build/li-httpd vs nginx on static_small scenario. Gate: m1-exploit-runtime and httpd plan gap-phase2-exploit-nginx-regression require all enabled rows green; no nginx-pass/li-fail regressions.

Open plan gaps (httpd): gap-phase2-mitigation-exploits (empty exploit for some nginx_mitigations.toml rows), gap-exploit-owasp-cwe-suite, standalone http_parse_fuzz nightly.

Fuzz campaign map¶

Grade matrix¶

Tradeoffs¶

• Locked: security posture (exploit expectations, li_stricter, no new trusted.lean axioms)
• Improved: SOTA map + Top25→action table for li_gap_analysis step
• Deferred: Catalog row authoring for 19 CWEs (human/CVE process); multi-repo httpd fixes → code_implementer

Evidence¶

export LIC_ROOT=/path/to/lic
cd benchmarks
python3 scripts/security-cwe-feed-sync.py
cat data/latest/security-cwe-feed-delta.json
# security-cwe-audit.py requires gh API for org workflow scan
cd "$LIC_ROOT" && SECURITY_RESEARCH_BACKLOG_STUDY_ONLY=1 ./scripts/security-research-gates.sh