xref: /xnu-11215.1.10/tests/IP6_EXTHDR_CHECK_61873584.c (revision 8d741a5de7ff4191bf97d57b9f54c2f6d4a15585)
1*8d741a5dSApple OSS Distributions #include <errno.h>
2*8d741a5dSApple OSS Distributions #include <stdio.h>
3*8d741a5dSApple OSS Distributions #include <string.h>
4*8d741a5dSApple OSS Distributions #include <stdlib.h>
5*8d741a5dSApple OSS Distributions #include <unistd.h>
6*8d741a5dSApple OSS Distributions #include <arpa/inet.h>
7*8d741a5dSApple OSS Distributions #include <net/if_var.h>
8*8d741a5dSApple OSS Distributions #include <netinet/ip6.h>
9*8d741a5dSApple OSS Distributions #include <darwintest.h>
10*8d741a5dSApple OSS Distributions 
11*8d741a5dSApple OSS Distributions struct packet1 {
12*8d741a5dSApple OSS Distributions 	struct ip6_hbh hbh;
13*8d741a5dSApple OSS Distributions 	struct ip6_opt hbh_opt;
14*8d741a5dSApple OSS Distributions 	uint8_t hbh_pad[4];
15*8d741a5dSApple OSS Distributions 	struct ip6_frag frag;
16*8d741a5dSApple OSS Distributions 	struct ip6_dest dest;
17*8d741a5dSApple OSS Distributions 	struct ip6_opt dest_opt;
18*8d741a5dSApple OSS Distributions 	uint8_t dest_pad[4];
19*8d741a5dSApple OSS Distributions };
20*8d741a5dSApple OSS Distributions 
21*8d741a5dSApple OSS Distributions struct packet2 {
22*8d741a5dSApple OSS Distributions 	struct ip6_hbh hbh;
23*8d741a5dSApple OSS Distributions 	struct ip6_opt hbh_opt;
24*8d741a5dSApple OSS Distributions 	uint8_t hbh_pad[4];
25*8d741a5dSApple OSS Distributions 	struct ip6_frag frag;
26*8d741a5dSApple OSS Distributions 	struct ip6_opt dest_opt;
27*8d741a5dSApple OSS Distributions 	uint8_t dest_pad[6];
28*8d741a5dSApple OSS Distributions 	uint8_t payload[16];
29*8d741a5dSApple OSS Distributions };
30*8d741a5dSApple OSS Distributions 
31*8d741a5dSApple OSS Distributions T_DECL(IP6_EXTHDR_CHECK_ICMPV6_61873584, "ICMPv6 test for IP6_EXTHDR_CHECK stale mbuf pointer vulnerability", T_META("as_root", "true"), T_META_TAG_VM_PREFERRED)
32*8d741a5dSApple OSS Distributions {
33*8d741a5dSApple OSS Distributions 	struct sockaddr_in6 daddr;
34*8d741a5dSApple OSS Distributions 	struct packet1 packet1;
35*8d741a5dSApple OSS Distributions 	struct packet2 packet2;
36*8d741a5dSApple OSS Distributions 	int s, id, res;
37*8d741a5dSApple OSS Distributions 
38*8d741a5dSApple OSS Distributions 	srand(time(NULL));
39*8d741a5dSApple OSS Distributions 	id = rand();
40*8d741a5dSApple OSS Distributions 
41*8d741a5dSApple OSS Distributions 	T_SETUPBEGIN;
42*8d741a5dSApple OSS Distributions 	T_ASSERT_POSIX_SUCCESS(s = socket(AF_INET6, SOCK_RAW, IPPROTO_HOPOPTS), NULL);
43*8d741a5dSApple OSS Distributions 	T_SETUPEND;
44*8d741a5dSApple OSS Distributions 
45*8d741a5dSApple OSS Distributions 	memset(&daddr, 0, sizeof(daddr));
46*8d741a5dSApple OSS Distributions 	daddr.sin6_family = AF_INET6;
47*8d741a5dSApple OSS Distributions 	daddr.sin6_port = 0;
48*8d741a5dSApple OSS Distributions 	inet_pton(AF_INET6, "::1", &daddr.sin6_addr);
49*8d741a5dSApple OSS Distributions 
50*8d741a5dSApple OSS Distributions 	memset(&packet1, 'A', sizeof(struct packet1));
51*8d741a5dSApple OSS Distributions 	packet1.hbh.ip6h_nxt = IPPROTO_FRAGMENT;
52*8d741a5dSApple OSS Distributions 	packet1.hbh.ip6h_len = 0;
53*8d741a5dSApple OSS Distributions 	packet1.hbh_opt.ip6o_type = IP6OPT_PADN;
54*8d741a5dSApple OSS Distributions 	packet1.hbh_opt.ip6o_len = 4;
55*8d741a5dSApple OSS Distributions 	packet1.frag.ip6f_nxt = IPPROTO_DSTOPTS;
56*8d741a5dSApple OSS Distributions 	packet1.frag.ip6f_reserved = 0;
57*8d741a5dSApple OSS Distributions 	packet1.frag.ip6f_offlg = htons(0) | IP6F_MORE_FRAG;
58*8d741a5dSApple OSS Distributions 	packet1.frag.ip6f_ident = id;
59*8d741a5dSApple OSS Distributions 	// Use IPPROTO_RAW for "assertion failed: m->m_flags & M_PKTHDR" panic
60*8d741a5dSApple OSS Distributions 	// Use IPPROTO_ICMPV6 for "m_free: freeing an already freed mbuf" panic
61*8d741a5dSApple OSS Distributions 	packet1.dest.ip6d_nxt = IPPROTO_RAW;
62*8d741a5dSApple OSS Distributions 	packet1.dest.ip6d_len = 1;
63*8d741a5dSApple OSS Distributions 	packet1.dest_opt.ip6o_type = IP6OPT_PADN;
64*8d741a5dSApple OSS Distributions 	packet1.dest_opt.ip6o_len = 4;
65*8d741a5dSApple OSS Distributions 
66*8d741a5dSApple OSS Distributions 	memset(&packet2, 'B', sizeof(struct packet2));
67*8d741a5dSApple OSS Distributions 	packet2.hbh.ip6h_nxt = IPPROTO_FRAGMENT;
68*8d741a5dSApple OSS Distributions 	packet2.hbh.ip6h_len = 0;
69*8d741a5dSApple OSS Distributions 	packet2.hbh_opt.ip6o_type = IP6OPT_PADN;
70*8d741a5dSApple OSS Distributions 	packet2.hbh_opt.ip6o_len = 4;
71*8d741a5dSApple OSS Distributions 	packet2.frag.ip6f_nxt = IPPROTO_DSTOPTS;
72*8d741a5dSApple OSS Distributions 	packet2.frag.ip6f_reserved = 0;
73*8d741a5dSApple OSS Distributions 	packet2.frag.ip6f_offlg = htons(8);
74*8d741a5dSApple OSS Distributions 	packet2.frag.ip6f_ident = id;
75*8d741a5dSApple OSS Distributions 	packet2.dest_opt.ip6o_type = IP6OPT_PADN;
76*8d741a5dSApple OSS Distributions 	packet2.dest_opt.ip6o_len = 6;
77*8d741a5dSApple OSS Distributions 
78*8d741a5dSApple OSS Distributions 	T_ASSERT_POSIX_SUCCESS(res = sendto(s, (char *)&packet1, sizeof(packet1), 0,
79*8d741a5dSApple OSS Distributions 	    (struct sockaddr *)&daddr, (socklen_t)sizeof(daddr)), NULL);
80*8d741a5dSApple OSS Distributions 	T_ASSERT_POSIX_SUCCESS(res = sendto(s, (char *)&packet2, sizeof(packet2), 0,
81*8d741a5dSApple OSS Distributions 	    (struct sockaddr *)&daddr, (socklen_t)sizeof(daddr)), NULL);
82*8d741a5dSApple OSS Distributions 	T_ASSERT_POSIX_SUCCESS(res = close(s), NULL);
83*8d741a5dSApple OSS Distributions }
84