xref: /xnu-8792.61.2/tests/IP6_EXTHDR_CHECK_61873584.c (revision 42e220869062b56f8d7d0726fd4c88954f87902c)
1*42e22086SApple OSS Distributions #include <errno.h>
2*42e22086SApple OSS Distributions #include <stdio.h>
3*42e22086SApple OSS Distributions #include <string.h>
4*42e22086SApple OSS Distributions #include <stdlib.h>
5*42e22086SApple OSS Distributions #include <unistd.h>
6*42e22086SApple OSS Distributions #include <arpa/inet.h>
7*42e22086SApple OSS Distributions #include <net/if_var.h>
8*42e22086SApple OSS Distributions #include <netinet/ip6.h>
9*42e22086SApple OSS Distributions #include <darwintest.h>
10*42e22086SApple OSS Distributions 
11*42e22086SApple OSS Distributions struct packet1 {
12*42e22086SApple OSS Distributions 	struct ip6_hbh hbh;
13*42e22086SApple OSS Distributions 	struct ip6_opt hbh_opt;
14*42e22086SApple OSS Distributions 	uint8_t hbh_pad[4];
15*42e22086SApple OSS Distributions 	struct ip6_frag frag;
16*42e22086SApple OSS Distributions 	struct ip6_dest dest;
17*42e22086SApple OSS Distributions 	struct ip6_opt dest_opt;
18*42e22086SApple OSS Distributions 	uint8_t dest_pad[4];
19*42e22086SApple OSS Distributions };
20*42e22086SApple OSS Distributions 
21*42e22086SApple OSS Distributions struct packet2 {
22*42e22086SApple OSS Distributions 	struct ip6_hbh hbh;
23*42e22086SApple OSS Distributions 	struct ip6_opt hbh_opt;
24*42e22086SApple OSS Distributions 	uint8_t hbh_pad[4];
25*42e22086SApple OSS Distributions 	struct ip6_frag frag;
26*42e22086SApple OSS Distributions 	struct ip6_opt dest_opt;
27*42e22086SApple OSS Distributions 	uint8_t dest_pad[6];
28*42e22086SApple OSS Distributions 	uint8_t payload[16];
29*42e22086SApple OSS Distributions };
30*42e22086SApple OSS Distributions 
31*42e22086SApple OSS Distributions T_DECL(IP6_EXTHDR_CHECK_ICMPV6_61873584, "ICMPv6 test for IP6_EXTHDR_CHECK stale mbuf pointer vulnerability", T_META("as_root", "true"))
32*42e22086SApple OSS Distributions {
33*42e22086SApple OSS Distributions 	struct sockaddr_in6 daddr;
34*42e22086SApple OSS Distributions 	struct packet1 packet1;
35*42e22086SApple OSS Distributions 	struct packet2 packet2;
36*42e22086SApple OSS Distributions 	int s, id, res;
37*42e22086SApple OSS Distributions 
38*42e22086SApple OSS Distributions 	srand(time(NULL));
39*42e22086SApple OSS Distributions 	id = rand();
40*42e22086SApple OSS Distributions 
41*42e22086SApple OSS Distributions 	T_SETUPBEGIN;
42*42e22086SApple OSS Distributions 	T_ASSERT_POSIX_SUCCESS(s = socket(AF_INET6, SOCK_RAW, IPPROTO_HOPOPTS), NULL);
43*42e22086SApple OSS Distributions 	T_SETUPEND;
44*42e22086SApple OSS Distributions 
45*42e22086SApple OSS Distributions 	memset(&daddr, 0, sizeof(daddr));
46*42e22086SApple OSS Distributions 	daddr.sin6_family = AF_INET6;
47*42e22086SApple OSS Distributions 	daddr.sin6_port = 0;
48*42e22086SApple OSS Distributions 	inet_pton(AF_INET6, "::1", &daddr.sin6_addr);
49*42e22086SApple OSS Distributions 
50*42e22086SApple OSS Distributions 	memset(&packet1, 'A', sizeof(struct packet1));
51*42e22086SApple OSS Distributions 	packet1.hbh.ip6h_nxt = IPPROTO_FRAGMENT;
52*42e22086SApple OSS Distributions 	packet1.hbh.ip6h_len = 0;
53*42e22086SApple OSS Distributions 	packet1.hbh_opt.ip6o_type = IP6OPT_PADN;
54*42e22086SApple OSS Distributions 	packet1.hbh_opt.ip6o_len = 4;
55*42e22086SApple OSS Distributions 	packet1.frag.ip6f_nxt = IPPROTO_DSTOPTS;
56*42e22086SApple OSS Distributions 	packet1.frag.ip6f_reserved = 0;
57*42e22086SApple OSS Distributions 	packet1.frag.ip6f_offlg = htons(0) | IP6F_MORE_FRAG;
58*42e22086SApple OSS Distributions 	packet1.frag.ip6f_ident = id;
59*42e22086SApple OSS Distributions 	// Use IPPROTO_RAW for "assertion failed: m->m_flags & M_PKTHDR" panic
60*42e22086SApple OSS Distributions 	// Use IPPROTO_ICMPV6 for "m_free: freeing an already freed mbuf" panic
61*42e22086SApple OSS Distributions 	packet1.dest.ip6d_nxt = IPPROTO_RAW;
62*42e22086SApple OSS Distributions 	packet1.dest.ip6d_len = 1;
63*42e22086SApple OSS Distributions 	packet1.dest_opt.ip6o_type = IP6OPT_PADN;
64*42e22086SApple OSS Distributions 	packet1.dest_opt.ip6o_len = 4;
65*42e22086SApple OSS Distributions 
66*42e22086SApple OSS Distributions 	memset(&packet2, 'B', sizeof(struct packet2));
67*42e22086SApple OSS Distributions 	packet2.hbh.ip6h_nxt = IPPROTO_FRAGMENT;
68*42e22086SApple OSS Distributions 	packet2.hbh.ip6h_len = 0;
69*42e22086SApple OSS Distributions 	packet2.hbh_opt.ip6o_type = IP6OPT_PADN;
70*42e22086SApple OSS Distributions 	packet2.hbh_opt.ip6o_len = 4;
71*42e22086SApple OSS Distributions 	packet2.frag.ip6f_nxt = IPPROTO_DSTOPTS;
72*42e22086SApple OSS Distributions 	packet2.frag.ip6f_reserved = 0;
73*42e22086SApple OSS Distributions 	packet2.frag.ip6f_offlg = htons(8);
74*42e22086SApple OSS Distributions 	packet2.frag.ip6f_ident = id;
75*42e22086SApple OSS Distributions 	packet2.dest_opt.ip6o_type = IP6OPT_PADN;
76*42e22086SApple OSS Distributions 	packet2.dest_opt.ip6o_len = 6;
77*42e22086SApple OSS Distributions 
78*42e22086SApple OSS Distributions 	T_ASSERT_POSIX_SUCCESS(res = sendto(s, (char *)&packet1, sizeof(packet1), 0,
79*42e22086SApple OSS Distributions 	    (struct sockaddr *)&daddr, (socklen_t)sizeof(daddr)), NULL);
80*42e22086SApple OSS Distributions 	T_ASSERT_POSIX_SUCCESS(res = sendto(s, (char *)&packet2, sizeof(packet2), 0,
81*42e22086SApple OSS Distributions 	    (struct sockaddr *)&daddr, (socklen_t)sizeof(daddr)), NULL);
82*42e22086SApple OSS Distributions 	T_ASSERT_POSIX_SUCCESS(res = close(s), NULL);
83*42e22086SApple OSS Distributions }
84