-
-
Save xrivendell7/44780af4a9dededc5ff7a7c0583ce3f1 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// autogenerated by syzkaller (https://github.com/google/syzkaller) | |
#define _GNU_SOURCE | |
#include <arpa/inet.h> | |
#include <dirent.h> | |
#include <endian.h> | |
#include <errno.h> | |
#include <fcntl.h> | |
#include <net/if.h> | |
#include <net/if_arp.h> | |
#include <netinet/in.h> | |
#include <sched.h> | |
#include <setjmp.h> | |
#include <signal.h> | |
#include <stdarg.h> | |
#include <stdbool.h> | |
#include <stddef.h> | |
#include <stdint.h> | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <sys/ioctl.h> | |
#include <sys/mman.h> | |
#include <sys/mount.h> | |
#include <sys/prctl.h> | |
#include <sys/resource.h> | |
#include <sys/socket.h> | |
#include <sys/stat.h> | |
#include <sys/syscall.h> | |
#include <sys/time.h> | |
#include <sys/types.h> | |
#include <sys/uio.h> | |
#include <sys/wait.h> | |
#include <time.h> | |
#include <unistd.h> | |
#include <linux/capability.h> | |
#include <linux/genetlink.h> | |
#include <linux/if_addr.h> | |
#include <linux/if_ether.h> | |
#include <linux/if_link.h> | |
#include <linux/if_tun.h> | |
#include <linux/in6.h> | |
#include <linux/ip.h> | |
#include <linux/loop.h> | |
#include <linux/neighbour.h> | |
#include <linux/net.h> | |
#include <linux/netlink.h> | |
#include <linux/rtnetlink.h> | |
#include <linux/tcp.h> | |
#include <linux/veth.h> | |
#ifndef __NR_memfd_create | |
#define __NR_memfd_create 319 | |
#endif | |
static unsigned long long procid; | |
static __thread int clone_ongoing; | |
static __thread int skip_segv; | |
static __thread jmp_buf segv_env; | |
static void segv_handler(int sig, siginfo_t* info, void* ctx) | |
{ | |
if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) { | |
exit(sig); | |
} | |
uintptr_t addr = (uintptr_t)info->si_addr; | |
const uintptr_t prog_start = 1 << 20; | |
const uintptr_t prog_end = 100 << 20; | |
int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0; | |
int valid = addr < prog_start || addr > prog_end; | |
if (skip && valid) { | |
_longjmp(segv_env, 1); | |
} | |
exit(sig); | |
} | |
static void install_segv_handler(void) | |
{ | |
struct sigaction sa; | |
memset(&sa, 0, sizeof(sa)); | |
sa.sa_handler = SIG_IGN; | |
syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); | |
syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); | |
memset(&sa, 0, sizeof(sa)); | |
sa.sa_sigaction = segv_handler; | |
sa.sa_flags = SA_NODEFER | SA_SIGINFO; | |
sigaction(SIGSEGV, &sa, NULL); | |
sigaction(SIGBUS, &sa, NULL); | |
} | |
#define NONFAILING(...) ({ int ok = 1; __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); if (_setjmp(segv_env) == 0) { __VA_ARGS__; } else ok = 0; __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); ok; }) | |
static void sleep_ms(uint64_t ms) | |
{ | |
usleep(ms * 1000); | |
} | |
static uint64_t current_time_ms(void) | |
{ | |
struct timespec ts; | |
if (clock_gettime(CLOCK_MONOTONIC, &ts)) | |
exit(1); | |
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; | |
} | |
static void use_temporary_dir(void) | |
{ | |
char tmpdir_template[] = "./syzkaller.XXXXXX"; | |
char* tmpdir = mkdtemp(tmpdir_template); | |
if (!tmpdir) | |
exit(1); | |
if (chmod(tmpdir, 0777)) | |
exit(1); | |
if (chdir(tmpdir)) | |
exit(1); | |
} | |
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) | |
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) | |
struct csum_inet { | |
uint32_t acc; | |
}; | |
static void csum_inet_init(struct csum_inet* csum) | |
{ | |
csum->acc = 0; | |
} | |
static void csum_inet_update(struct csum_inet* csum, const uint8_t* data, size_t length) | |
{ | |
if (length == 0) | |
return; | |
size_t i = 0; | |
for (; i < length - 1; i += 2) | |
csum->acc += *(uint16_t*)&data[i]; | |
if (length & 1) | |
csum->acc += le16toh((uint16_t)data[length - 1]); | |
while (csum->acc > 0xffff) | |
csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16); | |
} | |
static uint16_t csum_inet_digest(struct csum_inet* csum) | |
{ | |
return ~csum->acc; | |
} | |
static bool write_file(const char* file, const char* what, ...) | |
{ | |
char buf[1024]; | |
va_list args; | |
va_start(args, what); | |
vsnprintf(buf, sizeof(buf), what, args); | |
va_end(args); | |
buf[sizeof(buf) - 1] = 0; | |
int len = strlen(buf); | |
int fd = open(file, O_WRONLY | O_CLOEXEC); | |
if (fd == -1) | |
return false; | |
if (write(fd, buf, len) != len) { | |
int err = errno; | |
close(fd); | |
errno = err; | |
return false; | |
} | |
close(fd); | |
return true; | |
} | |
struct nlmsg { | |
char* pos; | |
int nesting; | |
struct nlattr* nested[8]; | |
char buf[4096]; | |
}; | |
static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, | |
const void* data, int size) | |
{ | |
memset(nlmsg, 0, sizeof(*nlmsg)); | |
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; | |
hdr->nlmsg_type = typ; | |
hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; | |
memcpy(hdr + 1, data, size); | |
nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); | |
} | |
static void netlink_attr(struct nlmsg* nlmsg, int typ, | |
const void* data, int size) | |
{ | |
struct nlattr* attr = (struct nlattr*)nlmsg->pos; | |
attr->nla_len = sizeof(*attr) + size; | |
attr->nla_type = typ; | |
if (size > 0) | |
memcpy(attr + 1, data, size); | |
nlmsg->pos += NLMSG_ALIGN(attr->nla_len); | |
} | |
static void netlink_nest(struct nlmsg* nlmsg, int typ) | |
{ | |
struct nlattr* attr = (struct nlattr*)nlmsg->pos; | |
attr->nla_type = typ; | |
nlmsg->pos += sizeof(*attr); | |
nlmsg->nested[nlmsg->nesting++] = attr; | |
} | |
static void netlink_done(struct nlmsg* nlmsg) | |
{ | |
struct nlattr* attr = nlmsg->nested[--nlmsg->nesting]; | |
attr->nla_len = nlmsg->pos - (char*)attr; | |
} | |
static int netlink_send_ext(struct nlmsg* nlmsg, int sock, | |
uint16_t reply_type, int* reply_len, bool dofail) | |
{ | |
if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) | |
exit(1); | |
struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; | |
hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; | |
struct sockaddr_nl addr; | |
memset(&addr, 0, sizeof(addr)); | |
addr.nl_family = AF_NETLINK; | |
ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); | |
if (n != (ssize_t)hdr->nlmsg_len) { | |
if (dofail) | |
exit(1); | |
return -1; | |
} | |
n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); | |
if (reply_len) | |
*reply_len = 0; | |
if (n < 0) { | |
if (dofail) | |
exit(1); | |
return -1; | |
} | |
if (n < (ssize_t)sizeof(struct nlmsghdr)) { | |
errno = EINVAL; | |
if (dofail) | |
exit(1); | |
return -1; | |
} | |
if (hdr->nlmsg_type == NLMSG_DONE) | |
return 0; | |
if (reply_len && hdr->nlmsg_type == reply_type) { | |
*reply_len = n; | |
return 0; | |
} | |
if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { | |
errno = EINVAL; | |
if (dofail) | |
exit(1); | |
return -1; | |
} | |
if (hdr->nlmsg_type != NLMSG_ERROR) { | |
errno = EINVAL; | |
if (dofail) | |
exit(1); | |
return -1; | |
} | |
errno = -((struct nlmsgerr*)(hdr + 1))->error; | |
return -errno; | |
} | |
static int netlink_send(struct nlmsg* nlmsg, int sock) | |
{ | |
return netlink_send_ext(nlmsg, sock, 0, NULL, true); | |
} | |
static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) | |
{ | |
struct genlmsghdr genlhdr; | |
memset(&genlhdr, 0, sizeof(genlhdr)); | |
genlhdr.cmd = CTRL_CMD_GETFAMILY; | |
netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); | |
netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); | |
int n = 0; | |
int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); | |
if (err < 0) { | |
return -1; | |
} | |
uint16_t id = 0; | |
struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); | |
for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { | |
if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { | |
id = *(uint16_t*)(attr + 1); | |
break; | |
} | |
} | |
if (!id) { | |
errno = EINVAL; | |
return -1; | |
} | |
recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); | |
return id; | |
} | |
static int netlink_next_msg(struct nlmsg* nlmsg, unsigned int offset, | |
unsigned int total_len) | |
{ | |
struct nlmsghdr* hdr = (struct nlmsghdr*)(nlmsg->buf + offset); | |
if (offset == total_len || offset + hdr->nlmsg_len > total_len) | |
return -1; | |
return hdr->nlmsg_len; | |
} | |
static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type, | |
const char* name, bool up) | |
{ | |
struct ifinfomsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
if (up) | |
hdr.ifi_flags = hdr.ifi_change = IFF_UP; | |
netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); | |
if (name) | |
netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name)); | |
netlink_nest(nlmsg, IFLA_LINKINFO); | |
netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type)); | |
} | |
static void netlink_add_device(struct nlmsg* nlmsg, int sock, const char* type, | |
const char* name) | |
{ | |
netlink_add_device_impl(nlmsg, type, name, false); | |
netlink_done(nlmsg); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_veth(struct nlmsg* nlmsg, int sock, const char* name, | |
const char* peer) | |
{ | |
netlink_add_device_impl(nlmsg, "veth", name, false); | |
netlink_nest(nlmsg, IFLA_INFO_DATA); | |
netlink_nest(nlmsg, VETH_INFO_PEER); | |
nlmsg->pos += sizeof(struct ifinfomsg); | |
netlink_attr(nlmsg, IFLA_IFNAME, peer, strlen(peer)); | |
netlink_done(nlmsg); | |
netlink_done(nlmsg); | |
netlink_done(nlmsg); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_xfrm(struct nlmsg* nlmsg, int sock, const char* name) | |
{ | |
netlink_add_device_impl(nlmsg, "xfrm", name, true); | |
netlink_nest(nlmsg, IFLA_INFO_DATA); | |
int if_id = 1; | |
netlink_attr(nlmsg, 2, &if_id, sizeof(if_id)); | |
netlink_done(nlmsg); | |
netlink_done(nlmsg); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_hsr(struct nlmsg* nlmsg, int sock, const char* name, | |
const char* slave1, const char* slave2) | |
{ | |
netlink_add_device_impl(nlmsg, "hsr", name, false); | |
netlink_nest(nlmsg, IFLA_INFO_DATA); | |
int ifindex1 = if_nametoindex(slave1); | |
netlink_attr(nlmsg, IFLA_HSR_SLAVE1, &ifindex1, sizeof(ifindex1)); | |
int ifindex2 = if_nametoindex(slave2); | |
netlink_attr(nlmsg, IFLA_HSR_SLAVE2, &ifindex2, sizeof(ifindex2)); | |
netlink_done(nlmsg); | |
netlink_done(nlmsg); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_linked(struct nlmsg* nlmsg, int sock, const char* type, const char* name, const char* link) | |
{ | |
netlink_add_device_impl(nlmsg, type, name, false); | |
netlink_done(nlmsg); | |
int ifindex = if_nametoindex(link); | |
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_vlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t id, uint16_t proto) | |
{ | |
netlink_add_device_impl(nlmsg, "vlan", name, false); | |
netlink_nest(nlmsg, IFLA_INFO_DATA); | |
netlink_attr(nlmsg, IFLA_VLAN_ID, &id, sizeof(id)); | |
netlink_attr(nlmsg, IFLA_VLAN_PROTOCOL, &proto, sizeof(proto)); | |
netlink_done(nlmsg); | |
netlink_done(nlmsg); | |
int ifindex = if_nametoindex(link); | |
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_macvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link) | |
{ | |
netlink_add_device_impl(nlmsg, "macvlan", name, false); | |
netlink_nest(nlmsg, IFLA_INFO_DATA); | |
uint32_t mode = MACVLAN_MODE_BRIDGE; | |
netlink_attr(nlmsg, IFLA_MACVLAN_MODE, &mode, sizeof(mode)); | |
netlink_done(nlmsg); | |
netlink_done(nlmsg); | |
int ifindex = if_nametoindex(link); | |
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_geneve(struct nlmsg* nlmsg, int sock, const char* name, uint32_t vni, struct in_addr* addr4, struct in6_addr* addr6) | |
{ | |
netlink_add_device_impl(nlmsg, "geneve", name, false); | |
netlink_nest(nlmsg, IFLA_INFO_DATA); | |
netlink_attr(nlmsg, IFLA_GENEVE_ID, &vni, sizeof(vni)); | |
if (addr4) | |
netlink_attr(nlmsg, IFLA_GENEVE_REMOTE, addr4, sizeof(*addr4)); | |
if (addr6) | |
netlink_attr(nlmsg, IFLA_GENEVE_REMOTE6, addr6, sizeof(*addr6)); | |
netlink_done(nlmsg); | |
netlink_done(nlmsg); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
#define IFLA_IPVLAN_FLAGS 2 | |
#define IPVLAN_MODE_L3S 2 | |
#undef IPVLAN_F_VEPA | |
#define IPVLAN_F_VEPA 2 | |
static void netlink_add_ipvlan(struct nlmsg* nlmsg, int sock, const char* name, const char* link, uint16_t mode, uint16_t flags) | |
{ | |
netlink_add_device_impl(nlmsg, "ipvlan", name, false); | |
netlink_nest(nlmsg, IFLA_INFO_DATA); | |
netlink_attr(nlmsg, IFLA_IPVLAN_MODE, &mode, sizeof(mode)); | |
netlink_attr(nlmsg, IFLA_IPVLAN_FLAGS, &flags, sizeof(flags)); | |
netlink_done(nlmsg); | |
netlink_done(nlmsg); | |
int ifindex = if_nametoindex(link); | |
netlink_attr(nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex)); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up, | |
const char* master, const void* mac, int macsize, | |
const char* new_name) | |
{ | |
struct ifinfomsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
if (up) | |
hdr.ifi_flags = hdr.ifi_change = IFF_UP; | |
hdr.ifi_index = if_nametoindex(name); | |
netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); | |
if (new_name) | |
netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); | |
if (master) { | |
int ifindex = if_nametoindex(master); | |
netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); | |
} | |
if (macsize) | |
netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev, | |
const void* addr, int addrsize) | |
{ | |
struct ifaddrmsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; | |
hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; | |
hdr.ifa_scope = RT_SCOPE_UNIVERSE; | |
hdr.ifa_index = if_nametoindex(dev); | |
netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr)); | |
netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); | |
netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); | |
return netlink_send(nlmsg, sock); | |
} | |
static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, | |
const char* dev, const char* addr) | |
{ | |
struct in_addr in_addr; | |
inet_pton(AF_INET, addr, &in_addr); | |
int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, | |
const char* dev, const char* addr) | |
{ | |
struct in6_addr in6_addr; | |
inet_pton(AF_INET6, addr, &in6_addr); | |
int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); | |
if (err < 0) { | |
} | |
} | |
static void netlink_add_neigh(struct nlmsg* nlmsg, int sock, const char* name, | |
const void* addr, int addrsize, const void* mac, int macsize) | |
{ | |
struct ndmsg hdr; | |
memset(&hdr, 0, sizeof(hdr)); | |
hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6; | |
hdr.ndm_ifindex = if_nametoindex(name); | |
hdr.ndm_state = NUD_PERMANENT; | |
netlink_init(nlmsg, RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); | |
netlink_attr(nlmsg, NDA_DST, addr, addrsize); | |
netlink_attr(nlmsg, NDA_LLADDR, mac, macsize); | |
int err = netlink_send(nlmsg, sock); | |
if (err < 0) { | |
} | |
} | |
static struct nlmsg nlmsg; | |
static int tunfd = -1; | |
#define TUN_IFACE "syz_tun" | |
#define LOCAL_MAC 0xaaaaaaaaaaaa | |
#define REMOTE_MAC 0xaaaaaaaaaabb | |
#define LOCAL_IPV4 "172.20.20.170" | |
#define REMOTE_IPV4 "172.20.20.187" | |
#define LOCAL_IPV6 "fe80::aa" | |
#define REMOTE_IPV6 "fe80::bb" | |
#define IFF_NAPI 0x0010 | |
static void initialize_tun(void) | |
{ | |
tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); | |
if (tunfd == -1) { | |
printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n"); | |
printf("otherwise fuzzing or reproducing might not work as intended\n"); | |
return; | |
} | |
const int kTunFd = 200; | |
if (dup2(tunfd, kTunFd) < 0) | |
exit(1); | |
close(tunfd); | |
tunfd = kTunFd; | |
struct ifreq ifr; | |
memset(&ifr, 0, sizeof(ifr)); | |
strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ); | |
ifr.ifr_flags = IFF_TAP | IFF_NO_PI; | |
if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) { | |
exit(1); | |
} | |
char sysctl[64]; | |
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE); | |
write_file(sysctl, "0"); | |
sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE); | |
write_file(sysctl, "0"); | |
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); | |
if (sock == -1) | |
exit(1); | |
netlink_add_addr4(&nlmsg, sock, TUN_IFACE, LOCAL_IPV4); | |
netlink_add_addr6(&nlmsg, sock, TUN_IFACE, LOCAL_IPV6); | |
uint64_t macaddr = REMOTE_MAC; | |
struct in_addr in_addr; | |
inet_pton(AF_INET, REMOTE_IPV4, &in_addr); | |
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in_addr, sizeof(in_addr), &macaddr, ETH_ALEN); | |
struct in6_addr in6_addr; | |
inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr); | |
netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), &macaddr, ETH_ALEN); | |
macaddr = LOCAL_MAC; | |
netlink_device_change(&nlmsg, sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN, NULL); | |
close(sock); | |
} | |
#define DEVLINK_FAMILY_NAME "devlink" | |
#define DEVLINK_CMD_PORT_GET 5 | |
#define DEVLINK_ATTR_BUS_NAME 1 | |
#define DEVLINK_ATTR_DEV_NAME 2 | |
#define DEVLINK_ATTR_NETDEV_NAME 7 | |
static struct nlmsg nlmsg2; | |
static void initialize_devlink_ports(const char* bus_name, const char* dev_name, | |
const char* netdev_prefix) | |
{ | |
struct genlmsghdr genlhdr; | |
int len, total_len, id, err, offset; | |
uint16_t netdev_index; | |
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); | |
if (sock == -1) | |
exit(1); | |
int rtsock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); | |
if (rtsock == -1) | |
exit(1); | |
id = netlink_query_family_id(&nlmsg, sock, DEVLINK_FAMILY_NAME, true); | |
if (id == -1) | |
goto error; | |
memset(&genlhdr, 0, sizeof(genlhdr)); | |
genlhdr.cmd = DEVLINK_CMD_PORT_GET; | |
netlink_init(&nlmsg, id, NLM_F_DUMP, &genlhdr, sizeof(genlhdr)); | |
netlink_attr(&nlmsg, DEVLINK_ATTR_BUS_NAME, bus_name, strlen(bus_name) + 1); | |
netlink_attr(&nlmsg, DEVLINK_ATTR_DEV_NAME, dev_name, strlen(dev_name) + 1); | |
err = netlink_send_ext(&nlmsg, sock, id, &total_len, true); | |
if (err < 0) { | |
goto error; | |
} | |
offset = 0; | |
netdev_index = 0; | |
while ((len = netlink_next_msg(&nlmsg, offset, total_len)) != -1) { | |
struct nlattr* attr = (struct nlattr*)(nlmsg.buf + offset + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); | |
for (; (char*)attr < nlmsg.buf + offset + len; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { | |
if (attr->nla_type == DEVLINK_ATTR_NETDEV_NAME) { | |
char* port_name; | |
char netdev_name[IFNAMSIZ]; | |
port_name = (char*)(attr + 1); | |
snprintf(netdev_name, sizeof(netdev_name), "%s%d", netdev_prefix, netdev_index); | |
netlink_device_change(&nlmsg2, rtsock, port_name, true, 0, 0, 0, netdev_name); | |
break; | |
} | |
} | |
offset += len; | |
netdev_index++; | |
} | |
error: | |
close(rtsock); | |
close(sock); | |
} | |
#define DEV_IPV4 "172.20.20.%d" | |
#define DEV_IPV6 "fe80::%02x" | |
#define DEV_MAC 0x00aaaaaaaaaa | |
static void netdevsim_add(unsigned int addr, unsigned int port_count) | |
{ | |
write_file("/sys/bus/netdevsim/del_device", "%u", addr); | |
if (write_file("/sys/bus/netdevsim/new_device", "%u %u", addr, port_count)) { | |
char buf[32]; | |
snprintf(buf, sizeof(buf), "netdevsim%d", addr); | |
initialize_devlink_ports("netdevsim", buf, "netdevsim"); | |
} | |
} | |
#define WG_GENL_NAME "wireguard" | |
enum wg_cmd { | |
WG_CMD_GET_DEVICE, | |
WG_CMD_SET_DEVICE, | |
}; | |
enum wgdevice_attribute { | |
WGDEVICE_A_UNSPEC, | |
WGDEVICE_A_IFINDEX, | |
WGDEVICE_A_IFNAME, | |
WGDEVICE_A_PRIVATE_KEY, | |
WGDEVICE_A_PUBLIC_KEY, | |
WGDEVICE_A_FLAGS, | |
WGDEVICE_A_LISTEN_PORT, | |
WGDEVICE_A_FWMARK, | |
WGDEVICE_A_PEERS, | |
}; | |
enum wgpeer_attribute { | |
WGPEER_A_UNSPEC, | |
WGPEER_A_PUBLIC_KEY, | |
WGPEER_A_PRESHARED_KEY, | |
WGPEER_A_FLAGS, | |
WGPEER_A_ENDPOINT, | |
WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, | |
WGPEER_A_LAST_HANDSHAKE_TIME, | |
WGPEER_A_RX_BYTES, | |
WGPEER_A_TX_BYTES, | |
WGPEER_A_ALLOWEDIPS, | |
WGPEER_A_PROTOCOL_VERSION, | |
}; | |
enum wgallowedip_attribute { | |
WGALLOWEDIP_A_UNSPEC, | |
WGALLOWEDIP_A_FAMILY, | |
WGALLOWEDIP_A_IPADDR, | |
WGALLOWEDIP_A_CIDR_MASK, | |
}; | |
static void netlink_wireguard_setup(void) | |
{ | |
const char ifname_a[] = "wg0"; | |
const char ifname_b[] = "wg1"; | |
const char ifname_c[] = "wg2"; | |
const char private_a[] = "\xa0\x5c\xa8\x4f\x6c\x9c\x8e\x38\x53\xe2\xfd\x7a\x70\xae\x0f\xb2\x0f\xa1\x52\x60\x0c\xb0\x08\x45\x17\x4f\x08\x07\x6f\x8d\x78\x43"; | |
const char private_b[] = "\xb0\x80\x73\xe8\xd4\x4e\x91\xe3\xda\x92\x2c\x22\x43\x82\x44\xbb\x88\x5c\x69\xe2\x69\xc8\xe9\xd8\x35\xb1\x14\x29\x3a\x4d\xdc\x6e"; | |
const char private_c[] = "\xa0\xcb\x87\x9a\x47\xf5\xbc\x64\x4c\x0e\x69\x3f\xa6\xd0\x31\xc7\x4a\x15\x53\xb6\xe9\x01\xb9\xff\x2f\x51\x8c\x78\x04\x2f\xb5\x42"; | |
const char public_a[] = "\x97\x5c\x9d\x81\xc9\x83\xc8\x20\x9e\xe7\x81\x25\x4b\x89\x9f\x8e\xd9\x25\xae\x9f\x09\x23\xc2\x3c\x62\xf5\x3c\x57\xcd\xbf\x69\x1c"; | |
const char public_b[] = "\xd1\x73\x28\x99\xf6\x11\xcd\x89\x94\x03\x4d\x7f\x41\x3d\xc9\x57\x63\x0e\x54\x93\xc2\x85\xac\xa4\x00\x65\xcb\x63\x11\xbe\x69\x6b"; | |
const char public_c[] = "\xf4\x4d\xa3\x67\xa8\x8e\xe6\x56\x4f\x02\x02\x11\x45\x67\x27\x08\x2f\x5c\xeb\xee\x8b\x1b\xf5\xeb\x73\x37\x34\x1b\x45\x9b\x39\x22"; | |
const uint16_t listen_a = 20001; | |
const uint16_t listen_b = 20002; | |
const uint16_t listen_c = 20003; | |
const uint16_t af_inet = AF_INET; | |
const uint16_t af_inet6 = AF_INET6; | |
const struct sockaddr_in endpoint_b_v4 = { | |
.sin_family = AF_INET, | |
.sin_port = htons(listen_b), | |
.sin_addr = {htonl(INADDR_LOOPBACK)}}; | |
const struct sockaddr_in endpoint_c_v4 = { | |
.sin_family = AF_INET, | |
.sin_port = htons(listen_c), | |
.sin_addr = {htonl(INADDR_LOOPBACK)}}; | |
struct sockaddr_in6 endpoint_a_v6 = { | |
.sin6_family = AF_INET6, | |
.sin6_port = htons(listen_a)}; | |
endpoint_a_v6.sin6_addr = in6addr_loopback; | |
struct sockaddr_in6 endpoint_c_v6 = { | |
.sin6_family = AF_INET6, | |
.sin6_port = htons(listen_c)}; | |
endpoint_c_v6.sin6_addr = in6addr_loopback; | |
const struct in_addr first_half_v4 = {0}; | |
const struct in_addr second_half_v4 = {(uint32_t)htonl(128 << 24)}; | |
const struct in6_addr first_half_v6 = {{{0}}}; | |
const struct in6_addr second_half_v6 = {{{0x80}}}; | |
const uint8_t half_cidr = 1; | |
const uint16_t persistent_keepalives[] = {1, 3, 7, 9, 14, 19}; | |
struct genlmsghdr genlhdr = { | |
.cmd = WG_CMD_SET_DEVICE, | |
.version = 1}; | |
int sock; | |
int id, err; | |
sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); | |
if (sock == -1) { | |
return; | |
} | |
id = netlink_query_family_id(&nlmsg, sock, WG_GENL_NAME, true); | |
if (id == -1) | |
goto error; | |
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); | |
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_a, strlen(ifname_a) + 1); | |
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_a, 32); | |
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_a, 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); | |
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4)); | |
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[0], 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); | |
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v6, sizeof(endpoint_c_v6)); | |
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[1], 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
err = netlink_send(&nlmsg, sock); | |
if (err < 0) { | |
} | |
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); | |
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_b, strlen(ifname_b) + 1); | |
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_b, 32); | |
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_b, 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); | |
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6)); | |
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[2], 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_c, 32); | |
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_c_v4, sizeof(endpoint_c_v4)); | |
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[3], 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
err = netlink_send(&nlmsg, sock); | |
if (err < 0) { | |
} | |
netlink_init(&nlmsg, id, 0, &genlhdr, sizeof(genlhdr)); | |
netlink_attr(&nlmsg, WGDEVICE_A_IFNAME, ifname_c, strlen(ifname_c) + 1); | |
netlink_attr(&nlmsg, WGDEVICE_A_PRIVATE_KEY, private_c, 32); | |
netlink_attr(&nlmsg, WGDEVICE_A_LISTEN_PORT, &listen_c, 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGDEVICE_A_PEERS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_a, 32); | |
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_a_v6, sizeof(endpoint_a_v6)); | |
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[4], 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v4, sizeof(first_half_v4)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &first_half_v6, sizeof(first_half_v6)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGPEER_A_PUBLIC_KEY, public_b, 32); | |
netlink_attr(&nlmsg, WGPEER_A_ENDPOINT, &endpoint_b_v4, sizeof(endpoint_b_v4)); | |
netlink_attr(&nlmsg, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, &persistent_keepalives[5], 2); | |
netlink_nest(&nlmsg, NLA_F_NESTED | WGPEER_A_ALLOWEDIPS); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v4, sizeof(second_half_v4)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_nest(&nlmsg, NLA_F_NESTED | 0); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_FAMILY, &af_inet6, 2); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_IPADDR, &second_half_v6, sizeof(second_half_v6)); | |
netlink_attr(&nlmsg, WGALLOWEDIP_A_CIDR_MASK, &half_cidr, 1); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
netlink_done(&nlmsg); | |
err = netlink_send(&nlmsg, sock); | |
if (err < 0) { | |
} | |
error: | |
close(sock); | |
} | |
static void initialize_netdevices(void) | |
{ | |
char netdevsim[16]; | |
sprintf(netdevsim, "netdevsim%d", (int)procid); | |
struct { | |
const char* type; | |
const char* dev; | |
} devtypes[] = { | |
{"ip6gretap", "ip6gretap0"}, | |
{"bridge", "bridge0"}, | |
{"vcan", "vcan0"}, | |
{"bond", "bond0"}, | |
{"team", "team0"}, | |
{"dummy", "dummy0"}, | |
{"nlmon", "nlmon0"}, | |
{"caif", "caif0"}, | |
{"batadv", "batadv0"}, | |
{"vxcan", "vxcan1"}, | |
{"veth", 0}, | |
{"wireguard", "wg0"}, | |
{"wireguard", "wg1"}, | |
{"wireguard", "wg2"}, | |
}; | |
const char* devmasters[] = {"bridge", "bond", "team", "batadv"}; | |
struct { | |
const char* name; | |
int macsize; | |
bool noipv6; | |
} devices[] = { | |
{"lo", ETH_ALEN}, | |
{"sit0", 0}, | |
{"bridge0", ETH_ALEN}, | |
{"vcan0", 0, true}, | |
{"tunl0", 0}, | |
{"gre0", 0}, | |
{"gretap0", ETH_ALEN}, | |
{"ip_vti0", 0}, | |
{"ip6_vti0", 0}, | |
{"ip6tnl0", 0}, | |
{"ip6gre0", 0}, | |
{"ip6gretap0", ETH_ALEN}, | |
{"erspan0", ETH_ALEN}, | |
{"bond0", ETH_ALEN}, | |
{"veth0", ETH_ALEN}, | |
{"veth1", ETH_ALEN}, | |
{"team0", ETH_ALEN}, | |
{"veth0_to_bridge", ETH_ALEN}, | |
{"veth1_to_bridge", ETH_ALEN}, | |
{"veth0_to_bond", ETH_ALEN}, | |
{"veth1_to_bond", ETH_ALEN}, | |
{"veth0_to_team", ETH_ALEN}, | |
{"veth1_to_team", ETH_ALEN}, | |
{"veth0_to_hsr", ETH_ALEN}, | |
{"veth1_to_hsr", ETH_ALEN}, | |
{"hsr0", 0}, | |
{"dummy0", ETH_ALEN}, | |
{"nlmon0", 0}, | |
{"vxcan0", 0, true}, | |
{"vxcan1", 0, true}, | |
{"caif0", ETH_ALEN}, | |
{"batadv0", ETH_ALEN}, | |
{netdevsim, ETH_ALEN}, | |
{"xfrm0", ETH_ALEN}, | |
{"veth0_virt_wifi", ETH_ALEN}, | |
{"veth1_virt_wifi", ETH_ALEN}, | |
{"virt_wifi0", ETH_ALEN}, | |
{"veth0_vlan", ETH_ALEN}, | |
{"veth1_vlan", ETH_ALEN}, | |
{"vlan0", ETH_ALEN}, | |
{"vlan1", ETH_ALEN}, | |
{"macvlan0", ETH_ALEN}, | |
{"macvlan1", ETH_ALEN}, | |
{"ipvlan0", ETH_ALEN}, | |
{"ipvlan1", ETH_ALEN}, | |
{"veth0_macvtap", ETH_ALEN}, | |
{"veth1_macvtap", ETH_ALEN}, | |
{"macvtap0", ETH_ALEN}, | |
{"macsec0", ETH_ALEN}, | |
{"veth0_to_batadv", ETH_ALEN}, | |
{"veth1_to_batadv", ETH_ALEN}, | |
{"batadv_slave_0", ETH_ALEN}, | |
{"batadv_slave_1", ETH_ALEN}, | |
{"geneve0", ETH_ALEN}, | |
{"geneve1", ETH_ALEN}, | |
{"wg0", 0}, | |
{"wg1", 0}, | |
{"wg2", 0}, | |
}; | |
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); | |
if (sock == -1) | |
exit(1); | |
unsigned i; | |
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) | |
netlink_add_device(&nlmsg, sock, devtypes[i].type, devtypes[i].dev); | |
for (i = 0; i < sizeof(devmasters) / (sizeof(devmasters[0])); i++) { | |
char master[32], slave0[32], veth0[32], slave1[32], veth1[32]; | |
sprintf(slave0, "%s_slave_0", devmasters[i]); | |
sprintf(veth0, "veth0_to_%s", devmasters[i]); | |
netlink_add_veth(&nlmsg, sock, slave0, veth0); | |
sprintf(slave1, "%s_slave_1", devmasters[i]); | |
sprintf(veth1, "veth1_to_%s", devmasters[i]); | |
netlink_add_veth(&nlmsg, sock, slave1, veth1); | |
sprintf(master, "%s0", devmasters[i]); | |
netlink_device_change(&nlmsg, sock, slave0, false, master, 0, 0, NULL); | |
netlink_device_change(&nlmsg, sock, slave1, false, master, 0, 0, NULL); | |
} | |
netlink_add_xfrm(&nlmsg, sock, "xfrm0"); | |
netlink_device_change(&nlmsg, sock, "bridge_slave_0", true, 0, 0, 0, NULL); | |
netlink_device_change(&nlmsg, sock, "bridge_slave_1", true, 0, 0, 0, NULL); | |
netlink_add_veth(&nlmsg, sock, "hsr_slave_0", "veth0_to_hsr"); | |
netlink_add_veth(&nlmsg, sock, "hsr_slave_1", "veth1_to_hsr"); | |
netlink_add_hsr(&nlmsg, sock, "hsr0", "hsr_slave_0", "hsr_slave_1"); | |
netlink_device_change(&nlmsg, sock, "hsr_slave_0", true, 0, 0, 0, NULL); | |
netlink_device_change(&nlmsg, sock, "hsr_slave_1", true, 0, 0, 0, NULL); | |
netlink_add_veth(&nlmsg, sock, "veth0_virt_wifi", "veth1_virt_wifi"); | |
netlink_add_linked(&nlmsg, sock, "virt_wifi", "virt_wifi0", "veth1_virt_wifi"); | |
netlink_add_veth(&nlmsg, sock, "veth0_vlan", "veth1_vlan"); | |
netlink_add_vlan(&nlmsg, sock, "vlan0", "veth0_vlan", 0, htons(ETH_P_8021Q)); | |
netlink_add_vlan(&nlmsg, sock, "vlan1", "veth0_vlan", 1, htons(ETH_P_8021AD)); | |
netlink_add_macvlan(&nlmsg, sock, "macvlan0", "veth1_vlan"); | |
netlink_add_macvlan(&nlmsg, sock, "macvlan1", "veth1_vlan"); | |
netlink_add_ipvlan(&nlmsg, sock, "ipvlan0", "veth0_vlan", IPVLAN_MODE_L2, 0); | |
netlink_add_ipvlan(&nlmsg, sock, "ipvlan1", "veth0_vlan", IPVLAN_MODE_L3S, IPVLAN_F_VEPA); | |
netlink_add_veth(&nlmsg, sock, "veth0_macvtap", "veth1_macvtap"); | |
netlink_add_linked(&nlmsg, sock, "macvtap", "macvtap0", "veth0_macvtap"); | |
netlink_add_linked(&nlmsg, sock, "macsec", "macsec0", "veth1_macvtap"); | |
char addr[32]; | |
sprintf(addr, DEV_IPV4, 14 + 10); | |
struct in_addr geneve_addr4; | |
if (inet_pton(AF_INET, addr, &geneve_addr4) <= 0) | |
exit(1); | |
struct in6_addr geneve_addr6; | |
if (inet_pton(AF_INET6, "fc00::01", &geneve_addr6) <= 0) | |
exit(1); | |
netlink_add_geneve(&nlmsg, sock, "geneve0", 0, &geneve_addr4, 0); | |
netlink_add_geneve(&nlmsg, sock, "geneve1", 1, 0, &geneve_addr6); | |
netdevsim_add((int)procid, 4); | |
netlink_wireguard_setup(); | |
for (i = 0; i < sizeof(devices) / (sizeof(devices[0])); i++) { | |
char addr[32]; | |
sprintf(addr, DEV_IPV4, i + 10); | |
netlink_add_addr4(&nlmsg, sock, devices[i].name, addr); | |
if (!devices[i].noipv6) { | |
sprintf(addr, DEV_IPV6, i + 10); | |
netlink_add_addr6(&nlmsg, sock, devices[i].name, addr); | |
} | |
uint64_t macaddr = DEV_MAC + ((i + 10ull) << 40); | |
netlink_device_change(&nlmsg, sock, devices[i].name, true, 0, &macaddr, devices[i].macsize, NULL); | |
} | |
close(sock); | |
} | |
static void initialize_netdevices_init(void) | |
{ | |
int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); | |
if (sock == -1) | |
exit(1); | |
struct { | |
const char* type; | |
int macsize; | |
bool noipv6; | |
bool noup; | |
} devtypes[] = { | |
{"nr", 7, true}, | |
{"rose", 5, true, true}, | |
}; | |
unsigned i; | |
for (i = 0; i < sizeof(devtypes) / sizeof(devtypes[0]); i++) { | |
char dev[32], addr[32]; | |
sprintf(dev, "%s%d", devtypes[i].type, (int)procid); | |
sprintf(addr, "172.30.%d.%d", i, (int)procid + 1); | |
netlink_add_addr4(&nlmsg, sock, dev, addr); | |
if (!devtypes[i].noipv6) { | |
sprintf(addr, "fe88::%02x:%02x", i, (int)procid + 1); | |
netlink_add_addr6(&nlmsg, sock, dev, addr); | |
} | |
int macsize = devtypes[i].macsize; | |
uint64_t macaddr = 0xbbbbbb + ((unsigned long long)i << (8 * (macsize - 2))) + | |
(procid << (8 * (macsize - 1))); | |
netlink_device_change(&nlmsg, sock, dev, !devtypes[i].noup, 0, &macaddr, macsize, NULL); | |
} | |
close(sock); | |
} | |
static int read_tun(char* data, int size) | |
{ | |
if (tunfd < 0) | |
return -1; | |
int rv = read(tunfd, data, size); | |
if (rv < 0) { | |
if (errno == EAGAIN || errno == EBADFD) | |
return -1; | |
exit(1); | |
} | |
return rv; | |
} | |
static long syz_emit_ethernet(volatile long a0, volatile long a1, volatile long a2) | |
{ | |
if (tunfd < 0) | |
return (uintptr_t)-1; | |
uint32_t length = a0; | |
char* data = (char*)a1; | |
return write(tunfd, data, length); | |
} | |
static void flush_tun() | |
{ | |
char data[1000]; | |
while (read_tun(&data[0], sizeof(data)) != -1) { | |
} | |
} | |
#define MAX_FDS 30 | |
//% This code is derived from puff.{c,h}, found in the zlib development. The | |
//% original files come with the following copyright notice: | |
//% Copyright (C) 2002-2013 Mark Adler, all rights reserved | |
//% version 2.3, 21 Jan 2013 | |
//% This software is provided 'as-is', without any express or implied | |
//% warranty. In no event will the author be held liable for any damages | |
//% arising from the use of this software. | |
//% Permission is granted to anyone to use this software for any purpose, | |
//% including commercial applications, and to alter it and redistribute it | |
//% freely, subject to the following restrictions: | |
//% 1. The origin of this software must not be misrepresented; you must not | |
//% claim that you wrote the original software. If you use this software | |
//% in a product, an acknowledgment in the product documentation would be | |
//% appreciated but is not required. | |
//% 2. Altered source versions must be plainly marked as such, and must not be | |
//% misrepresented as being the original software. | |
//% 3. This notice may not be removed or altered from any source distribution. | |
//% Mark Adler madler@alumni.caltech.edu | |
//% BEGIN CODE DERIVED FROM puff.{c,h} | |
#define MAXBITS 15 | |
#define MAXLCODES 286 | |
#define MAXDCODES 30 | |
#define MAXCODES (MAXLCODES + MAXDCODES) | |
#define FIXLCODES 288 | |
struct puff_state { | |
unsigned char* out; | |
unsigned long outlen; | |
unsigned long outcnt; | |
const unsigned char* in; | |
unsigned long inlen; | |
unsigned long incnt; | |
int bitbuf; | |
int bitcnt; | |
jmp_buf env; | |
}; | |
static int puff_bits(struct puff_state* s, int need) | |
{ | |
long val = s->bitbuf; | |
while (s->bitcnt < need) { | |
if (s->incnt == s->inlen) | |
longjmp(s->env, 1); | |
val |= (long)(s->in[s->incnt++]) << s->bitcnt; | |
s->bitcnt += 8; | |
} | |
s->bitbuf = (int)(val >> need); | |
s->bitcnt -= need; | |
return (int)(val & ((1L << need) - 1)); | |
} | |
static int puff_stored(struct puff_state* s) | |
{ | |
s->bitbuf = 0; | |
s->bitcnt = 0; | |
if (s->incnt + 4 > s->inlen) | |
return 2; | |
unsigned len = s->in[s->incnt++]; | |
len |= s->in[s->incnt++] << 8; | |
if (s->in[s->incnt++] != (~len & 0xff) || | |
s->in[s->incnt++] != ((~len >> 8) & 0xff)) | |
return -2; | |
if (s->incnt + len > s->inlen) | |
return 2; | |
if (s->outcnt + len > s->outlen) | |
return 1; | |
for (; len--; s->outcnt++, s->incnt++) { | |
if (s->in[s->incnt]) | |
s->out[s->outcnt] = s->in[s->incnt]; | |
} | |
return 0; | |
} | |
struct puff_huffman { | |
short* count; | |
short* symbol; | |
}; | |
static int puff_decode(struct puff_state* s, const struct puff_huffman* h) | |
{ | |
int first = 0; | |
int index = 0; | |
int bitbuf = s->bitbuf; | |
int left = s->bitcnt; | |
int code = first = index = 0; | |
int len = 1; | |
short* next = h->count + 1; | |
while (1) { | |
while (left--) { | |
code |= bitbuf & 1; | |
bitbuf >>= 1; | |
int count = *next++; | |
if (code - count < first) { | |
s->bitbuf = bitbuf; | |
s->bitcnt = (s->bitcnt - len) & 7; | |
return h->symbol[index + (code - first)]; | |
} | |
index += count; | |
first += count; | |
first <<= 1; | |
code <<= 1; | |
len++; | |
} | |
left = (MAXBITS + 1) - len; | |
if (left == 0) | |
break; | |
if (s->incnt == s->inlen) | |
longjmp(s->env, 1); | |
bitbuf = s->in[s->incnt++]; | |
if (left > 8) | |
left = 8; | |
} | |
return -10; | |
} | |
static int puff_construct(struct puff_huffman* h, const short* length, int n) | |
{ | |
int len; | |
for (len = 0; len <= MAXBITS; len++) | |
h->count[len] = 0; | |
int symbol; | |
for (symbol = 0; symbol < n; symbol++) | |
(h->count[length[symbol]])++; | |
if (h->count[0] == n) | |
return 0; | |
int left = 1; | |
for (len = 1; len <= MAXBITS; len++) { | |
left <<= 1; | |
left -= h->count[len]; | |
if (left < 0) | |
return left; | |
} | |
short offs[MAXBITS + 1]; | |
offs[1] = 0; | |
for (len = 1; len < MAXBITS; len++) | |
offs[len + 1] = offs[len] + h->count[len]; | |
for (symbol = 0; symbol < n; symbol++) | |
if (length[symbol] != 0) | |
h->symbol[offs[length[symbol]]++] = symbol; | |
return left; | |
} | |
static int puff_codes(struct puff_state* s, | |
const struct puff_huffman* lencode, | |
const struct puff_huffman* distcode) | |
{ | |
static const short lens[29] = { | |
3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31, | |
35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258}; | |
static const short lext[29] = { | |
0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, | |
3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0}; | |
static const short dists[30] = { | |
1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193, | |
257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, | |
8193, 12289, 16385, 24577}; | |
static const short dext[30] = { | |
0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, | |
7, 7, 8, 8, 9, 9, 10, 10, 11, 11, | |
12, 12, 13, 13}; | |
int symbol; | |
do { | |
symbol = puff_decode(s, lencode); | |
if (symbol < 0) | |
return symbol; | |
if (symbol < 256) { | |
if (s->outcnt == s->outlen) | |
return 1; | |
if (symbol) | |
s->out[s->outcnt] = symbol; | |
s->outcnt++; | |
} else if (symbol > 256) { | |
symbol -= 257; | |
if (symbol >= 29) | |
return -10; | |
int len = lens[symbol] + puff_bits(s, lext[symbol]); | |
symbol = puff_decode(s, distcode); | |
if (symbol < 0) | |
return symbol; | |
unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]); | |
if (dist > s->outcnt) | |
return -11; | |
if (s->outcnt + len > s->outlen) | |
return 1; | |
while (len--) { | |
if (dist <= s->outcnt && s->out[s->outcnt - dist]) | |
s->out[s->outcnt] = s->out[s->outcnt - dist]; | |
s->outcnt++; | |
} | |
} | |
} while (symbol != 256); | |
return 0; | |
} | |
static int puff_fixed(struct puff_state* s) | |
{ | |
static int virgin = 1; | |
static short lencnt[MAXBITS + 1], lensym[FIXLCODES]; | |
static short distcnt[MAXBITS + 1], distsym[MAXDCODES]; | |
static struct puff_huffman lencode, distcode; | |
if (virgin) { | |
lencode.count = lencnt; | |
lencode.symbol = lensym; | |
distcode.count = distcnt; | |
distcode.symbol = distsym; | |
short lengths[FIXLCODES]; | |
int symbol; | |
for (symbol = 0; symbol < 144; symbol++) | |
lengths[symbol] = 8; | |
for (; symbol < 256; symbol++) | |
lengths[symbol] = 9; | |
for (; symbol < 280; symbol++) | |
lengths[symbol] = 7; | |
for (; symbol < FIXLCODES; symbol++) | |
lengths[symbol] = 8; | |
puff_construct(&lencode, lengths, FIXLCODES); | |
for (symbol = 0; symbol < MAXDCODES; symbol++) | |
lengths[symbol] = 5; | |
puff_construct(&distcode, lengths, MAXDCODES); | |
virgin = 0; | |
} | |
return puff_codes(s, &lencode, &distcode); | |
} | |
static int puff_dynamic(struct puff_state* s) | |
{ | |
static const short order[19] = | |
{16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; | |
int nlen = puff_bits(s, 5) + 257; | |
int ndist = puff_bits(s, 5) + 1; | |
int ncode = puff_bits(s, 4) + 4; | |
if (nlen > MAXLCODES || ndist > MAXDCODES) | |
return -3; | |
short lengths[MAXCODES]; | |
int index; | |
for (index = 0; index < ncode; index++) | |
lengths[order[index]] = puff_bits(s, 3); | |
for (; index < 19; index++) | |
lengths[order[index]] = 0; | |
short lencnt[MAXBITS + 1], lensym[MAXLCODES]; | |
struct puff_huffman lencode = {lencnt, lensym}; | |
int err = puff_construct(&lencode, lengths, 19); | |
if (err != 0) | |
return -4; | |
index = 0; | |
while (index < nlen + ndist) { | |
int symbol; | |
int len; | |
symbol = puff_decode(s, &lencode); | |
if (symbol < 0) | |
return symbol; | |
if (symbol < 16) | |
lengths[index++] = symbol; | |
else { | |
len = 0; | |
if (symbol == 16) { | |
if (index == 0) | |
return -5; | |
len = lengths[index - 1]; | |
symbol = 3 + puff_bits(s, 2); | |
} else if (symbol == 17) | |
symbol = 3 + puff_bits(s, 3); | |
else | |
symbol = 11 + puff_bits(s, 7); | |
if (index + symbol > nlen + ndist) | |
return -6; | |
while (symbol--) | |
lengths[index++] = len; | |
} | |
} | |
if (lengths[256] == 0) | |
return -9; | |
err = puff_construct(&lencode, lengths, nlen); | |
if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1])) | |
return -7; | |
short distcnt[MAXBITS + 1], distsym[MAXDCODES]; | |
struct puff_huffman distcode = {distcnt, distsym}; | |
err = puff_construct(&distcode, lengths + nlen, ndist); | |
if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1])) | |
return -8; | |
return puff_codes(s, &lencode, &distcode); | |
} | |
static int puff( | |
unsigned char* dest, | |
unsigned long* destlen, | |
const unsigned char* source, | |
unsigned long sourcelen) | |
{ | |
struct puff_state s = { | |
.out = dest, | |
.outlen = *destlen, | |
.outcnt = 0, | |
.in = source, | |
.inlen = sourcelen, | |
.incnt = 0, | |
.bitbuf = 0, | |
.bitcnt = 0, | |
}; | |
int err; | |
if (setjmp(s.env) != 0) | |
err = 2; | |
else { | |
int last; | |
do { | |
last = puff_bits(&s, 1); | |
int type = puff_bits(&s, 2); | |
err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1)); | |
if (err != 0) | |
break; | |
} while (!last); | |
} | |
*destlen = s.outcnt; | |
return err; | |
} | |
//% END CODE DERIVED FROM puff.{c,h} | |
#define ZLIB_HEADER_WIDTH 2 | |
static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd) | |
{ | |
if (sourcelen < ZLIB_HEADER_WIDTH) | |
return 0; | |
source += ZLIB_HEADER_WIDTH; | |
sourcelen -= ZLIB_HEADER_WIDTH; | |
const unsigned long max_destlen = 132 << 20; | |
void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0); | |
if (ret == MAP_FAILED) | |
return -1; | |
unsigned char* dest = (unsigned char*)ret; | |
unsigned long destlen = max_destlen; | |
int err = puff(dest, &destlen, source, sourcelen); | |
if (err) { | |
munmap(dest, max_destlen); | |
errno = -err; | |
return -1; | |
} | |
if (write(dest_fd, dest, destlen) != (ssize_t)destlen) { | |
munmap(dest, max_destlen); | |
return -1; | |
} | |
return munmap(dest, max_destlen); | |
} | |
static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p) | |
{ | |
int err = 0, loopfd = -1; | |
int memfd = syscall(__NR_memfd_create, "syzkaller", 0); | |
if (memfd == -1) { | |
err = errno; | |
goto error; | |
} | |
if (puff_zlib_to_file(data, size, memfd)) { | |
err = errno; | |
goto error_close_memfd; | |
} | |
loopfd = open(loopname, O_RDWR); | |
if (loopfd == -1) { | |
err = errno; | |
goto error_close_memfd; | |
} | |
if (ioctl(loopfd, LOOP_SET_FD, memfd)) { | |
if (errno != EBUSY) { | |
err = errno; | |
goto error_close_loop; | |
} | |
ioctl(loopfd, LOOP_CLR_FD, 0); | |
usleep(1000); | |
if (ioctl(loopfd, LOOP_SET_FD, memfd)) { | |
err = errno; | |
goto error_close_loop; | |
} | |
} | |
close(memfd); | |
*loopfd_p = loopfd; | |
return 0; | |
error_close_loop: | |
close(loopfd); | |
error_close_memfd: | |
close(memfd); | |
error: | |
errno = err; | |
return -1; | |
} | |
static long syz_mount_image( | |
volatile long fsarg, | |
volatile long dir, | |
volatile long flags, | |
volatile long optsarg, | |
volatile long change_dir, | |
volatile unsigned long size, | |
volatile long image) | |
{ | |
unsigned char* data = (unsigned char*)image; | |
int res = -1, err = 0, loopfd = -1, need_loop_device = !!size; | |
char* mount_opts = (char*)optsarg; | |
char* target = (char*)dir; | |
char* fs = (char*)fsarg; | |
char* source = NULL; | |
char loopname[64]; | |
if (need_loop_device) { | |
memset(loopname, 0, sizeof(loopname)); | |
snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid); | |
if (setup_loop_device(data, size, loopname, &loopfd) == -1) | |
return -1; | |
source = loopname; | |
} | |
mkdir(target, 0777); | |
char opts[256]; | |
memset(opts, 0, sizeof(opts)); | |
if (strlen(mount_opts) > (sizeof(opts) - 32)) { | |
} | |
strncpy(opts, mount_opts, sizeof(opts) - 32); | |
if (strcmp(fs, "iso9660") == 0) { | |
flags |= MS_RDONLY; | |
} else if (strncmp(fs, "ext", 3) == 0) { | |
bool has_remount_ro = false; | |
char* remount_ro_start = strstr(opts, "errors=remount-ro"); | |
if (remount_ro_start != NULL) { | |
char after = *(remount_ro_start + strlen("errors=remount-ro")); | |
char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1); | |
has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ',')); | |
} | |
if (strstr(opts, "errors=panic") || !has_remount_ro) | |
strcat(opts, ",errors=continue"); | |
} else if (strcmp(fs, "xfs") == 0) { | |
strcat(opts, ",nouuid"); | |
} | |
res = mount(source, target, fs, flags, opts); | |
if (res == -1) { | |
err = errno; | |
goto error_clear_loop; | |
} | |
res = open(target, O_RDONLY | O_DIRECTORY); | |
if (res == -1) { | |
err = errno; | |
goto error_clear_loop; | |
} | |
if (change_dir) { | |
res = chdir(target); | |
if (res == -1) { | |
err = errno; | |
} | |
} | |
error_clear_loop: | |
if (need_loop_device) { | |
ioctl(loopfd, LOOP_CLR_FD, 0); | |
close(loopfd); | |
} | |
errno = err; | |
return res; | |
} | |
static void setup_common() | |
{ | |
if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { | |
} | |
} | |
static void setup_binderfs() | |
{ | |
if (mkdir("/dev/binderfs", 0777)) { | |
} | |
if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { | |
} | |
} | |
static void loop(); | |
static void sandbox_common() | |
{ | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setsid(); | |
struct rlimit rlim; | |
rlim.rlim_cur = rlim.rlim_max = (200 << 20); | |
setrlimit(RLIMIT_AS, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 32 << 20; | |
setrlimit(RLIMIT_MEMLOCK, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 136 << 20; | |
setrlimit(RLIMIT_FSIZE, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 1 << 20; | |
setrlimit(RLIMIT_STACK, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 128 << 20; | |
setrlimit(RLIMIT_CORE, &rlim); | |
rlim.rlim_cur = rlim.rlim_max = 256; | |
setrlimit(RLIMIT_NOFILE, &rlim); | |
if (unshare(CLONE_NEWNS)) { | |
} | |
if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { | |
} | |
if (unshare(CLONE_NEWIPC)) { | |
} | |
if (unshare(0x02000000)) { | |
} | |
if (unshare(CLONE_NEWUTS)) { | |
} | |
if (unshare(CLONE_SYSVSEM)) { | |
} | |
typedef struct { | |
const char* name; | |
const char* value; | |
} sysctl_t; | |
static const sysctl_t sysctls[] = { | |
{"/proc/sys/kernel/shmmax", "16777216"}, | |
{"/proc/sys/kernel/shmall", "536870912"}, | |
{"/proc/sys/kernel/shmmni", "1024"}, | |
{"/proc/sys/kernel/msgmax", "8192"}, | |
{"/proc/sys/kernel/msgmni", "1024"}, | |
{"/proc/sys/kernel/msgmnb", "1024"}, | |
{"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, | |
}; | |
unsigned i; | |
for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) | |
write_file(sysctls[i].name, sysctls[i].value); | |
} | |
static int wait_for_loop(int pid) | |
{ | |
if (pid < 0) | |
exit(1); | |
int status = 0; | |
while (waitpid(-1, &status, __WALL) != pid) { | |
} | |
return WEXITSTATUS(status); | |
} | |
static void drop_caps(void) | |
{ | |
struct __user_cap_header_struct cap_hdr = {}; | |
struct __user_cap_data_struct cap_data[2] = {}; | |
cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; | |
cap_hdr.pid = getpid(); | |
if (syscall(SYS_capget, &cap_hdr, &cap_data)) | |
exit(1); | |
const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); | |
cap_data[0].effective &= ~drop; | |
cap_data[0].permitted &= ~drop; | |
cap_data[0].inheritable &= ~drop; | |
if (syscall(SYS_capset, &cap_hdr, &cap_data)) | |
exit(1); | |
} | |
static int do_sandbox_none(void) | |
{ | |
if (unshare(CLONE_NEWPID)) { | |
} | |
int pid = fork(); | |
if (pid != 0) | |
return wait_for_loop(pid); | |
setup_common(); | |
sandbox_common(); | |
drop_caps(); | |
initialize_netdevices_init(); | |
if (unshare(CLONE_NEWNET)) { | |
} | |
write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); | |
initialize_tun(); | |
initialize_netdevices(); | |
setup_binderfs(); | |
loop(); | |
exit(1); | |
} | |
#define FS_IOC_SETFLAGS _IOW('f', 2, long) | |
static void remove_dir(const char* dir) | |
{ | |
int iter = 0; | |
DIR* dp = 0; | |
retry: | |
while (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) { | |
} | |
dp = opendir(dir); | |
if (dp == NULL) { | |
if (errno == EMFILE) { | |
exit(1); | |
} | |
exit(1); | |
} | |
struct dirent* ep = 0; | |
while ((ep = readdir(dp))) { | |
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) | |
continue; | |
char filename[FILENAME_MAX]; | |
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); | |
while (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW) == 0) { | |
} | |
struct stat st; | |
if (lstat(filename, &st)) | |
exit(1); | |
if (S_ISDIR(st.st_mode)) { | |
remove_dir(filename); | |
continue; | |
} | |
int i; | |
for (i = 0;; i++) { | |
if (unlink(filename) == 0) | |
break; | |
if (errno == EPERM) { | |
int fd = open(filename, O_RDONLY); | |
if (fd != -1) { | |
long flags = 0; | |
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) { | |
} | |
close(fd); | |
continue; | |
} | |
} | |
if (errno == EROFS) { | |
break; | |
} | |
if (errno != EBUSY || i > 100) | |
exit(1); | |
if (umount2(filename, MNT_DETACH | UMOUNT_NOFOLLOW)) | |
exit(1); | |
} | |
} | |
closedir(dp); | |
for (int i = 0;; i++) { | |
if (rmdir(dir) == 0) | |
break; | |
if (i < 100) { | |
if (errno == EPERM) { | |
int fd = open(dir, O_RDONLY); | |
if (fd != -1) { | |
long flags = 0; | |
if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) { | |
} | |
close(fd); | |
continue; | |
} | |
} | |
if (errno == EROFS) { | |
break; | |
} | |
if (errno == EBUSY) { | |
if (umount2(dir, MNT_DETACH | UMOUNT_NOFOLLOW)) | |
exit(1); | |
continue; | |
} | |
if (errno == ENOTEMPTY) { | |
if (iter < 100) { | |
iter++; | |
goto retry; | |
} | |
} | |
} | |
exit(1); | |
} | |
} | |
static void kill_and_wait(int pid, int* status) | |
{ | |
kill(-pid, SIGKILL); | |
kill(pid, SIGKILL); | |
for (int i = 0; i < 100; i++) { | |
if (waitpid(-1, status, WNOHANG | __WALL) == pid) | |
return; | |
usleep(1000); | |
} | |
DIR* dir = opendir("/sys/fs/fuse/connections"); | |
if (dir) { | |
for (;;) { | |
struct dirent* ent = readdir(dir); | |
if (!ent) | |
break; | |
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) | |
continue; | |
char abort[300]; | |
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); | |
int fd = open(abort, O_WRONLY); | |
if (fd == -1) { | |
continue; | |
} | |
if (write(fd, abort, 1) < 0) { | |
} | |
close(fd); | |
} | |
closedir(dir); | |
} else { | |
} | |
while (waitpid(-1, status, __WALL) != pid) { | |
} | |
} | |
static void reset_loop() | |
{ | |
char buf[64]; | |
snprintf(buf, sizeof(buf), "/dev/loop%llu", procid); | |
int loopfd = open(buf, O_RDWR); | |
if (loopfd != -1) { | |
ioctl(loopfd, LOOP_CLR_FD, 0); | |
close(loopfd); | |
} | |
} | |
static void setup_test() | |
{ | |
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | |
setpgrp(); | |
write_file("/proc/self/oom_score_adj", "1000"); | |
flush_tun(); | |
if (symlink("/dev/binderfs", "./binderfs")) { | |
} | |
} | |
static void close_fds() | |
{ | |
for (int fd = 3; fd < MAX_FDS; fd++) | |
close(fd); | |
} | |
static void execute_one(void); | |
#define WAIT_FLAGS __WALL | |
static void loop(void) | |
{ | |
int iter = 0; | |
for (;; iter++) { | |
char cwdbuf[32]; | |
sprintf(cwdbuf, "./%d", iter); | |
if (mkdir(cwdbuf, 0777)) | |
exit(1); | |
reset_loop(); | |
int pid = fork(); | |
if (pid < 0) | |
exit(1); | |
if (pid == 0) { | |
if (chdir(cwdbuf)) | |
exit(1); | |
setup_test(); | |
execute_one(); | |
close_fds(); | |
exit(0); | |
} | |
int status = 0; | |
uint64_t start = current_time_ms(); | |
for (;;) { | |
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) | |
break; | |
sleep_ms(1); | |
if (current_time_ms() - start < 5000) | |
continue; | |
kill_and_wait(pid, &status); | |
break; | |
} | |
remove_dir(cwdbuf); | |
} | |
} | |
void execute_one(void) | |
{ | |
NONFAILING(memset((void*)0x20000000, 170, 5)); | |
NONFAILING(*(uint8_t*)0x20000005 = 0xaa); | |
NONFAILING(memset((void*)0x20000006, 0, 6)); | |
NONFAILING(*(uint16_t*)0x2000000c = htobe16(0x86dd)); | |
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000000e, 0, 0, 4)); | |
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x2000000e, 6, 4, 4)); | |
NONFAILING(memcpy((void*)0x2000000f, "\x0d\x02\x00", 3)); | |
NONFAILING(*(uint16_t*)0x20000012 = htobe16(0x14)); | |
NONFAILING(*(uint8_t*)0x20000014 = 6); | |
NONFAILING(*(uint8_t*)0x20000015 = 0); | |
NONFAILING(memset((void*)0x20000016, 0, 16)); | |
NONFAILING(*(uint8_t*)0x20000026 = 0xfe); | |
NONFAILING(*(uint8_t*)0x20000027 = 0x80); | |
NONFAILING(memset((void*)0x20000028, 0, 13)); | |
NONFAILING(*(uint8_t*)0x20000035 = 0xaa); | |
NONFAILING(*(uint16_t*)0x20000036 = htobe16(0)); | |
NONFAILING(*(uint16_t*)0x20000038 = htobe16(0x4001)); | |
NONFAILING(*(uint32_t*)0x2000003a = 0x41424344); | |
NONFAILING(*(uint32_t*)0x2000003e = 0x41424344); | |
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000042, 0, 0, 1)); | |
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000042, 0, 1, 3)); | |
NONFAILING(STORE_BY_BITMASK(uint8_t, , 0x20000042, 5, 4, 4)); | |
NONFAILING(*(uint8_t*)0x20000043 = 2); | |
NONFAILING(*(uint16_t*)0x20000044 = htobe16(0)); | |
NONFAILING(*(uint16_t*)0x20000046 = htobe16(0)); | |
NONFAILING(*(uint16_t*)0x20000048 = htobe16(0)); | |
struct csum_inet csum_1; | |
csum_inet_init(&csum_1); | |
NONFAILING(csum_inet_update(&csum_1, (const uint8_t*)0x20000016, 16)); | |
NONFAILING(csum_inet_update(&csum_1, (const uint8_t*)0x20000026, 16)); | |
uint32_t csum_1_chunk_2 = 0x14000000; | |
csum_inet_update(&csum_1, (const uint8_t*)&csum_1_chunk_2, 4); | |
uint32_t csum_1_chunk_3 = 0x6000000; | |
csum_inet_update(&csum_1, (const uint8_t*)&csum_1_chunk_3, 4); | |
NONFAILING(csum_inet_update(&csum_1, (const uint8_t*)0x20000036, 20)); | |
NONFAILING(*(uint16_t*)0x20000046 = csum_inet_digest(&csum_1)); | |
NONFAILING(syz_emit_ethernet(/*len=*/0x4a, /*packet=*/0x20000000, /*frags=*/0)); | |
NONFAILING(memcpy((void*)0x20000080, "./file0\000", 8)); | |
NONFAILING(syz_mount_image(/*fs=*/0, /*dir=*/0x20000080, /*flags=*/0, /*opts=*/0, /*chdir=*/0, /*size=*/0, /*img=*/0)); | |
NONFAILING(memcpy((void*)0x20000000, "./file0\000", 8)); | |
NONFAILING(memcpy((void*)0x20000040, "./file0\000", 8)); | |
syscall(__NR_mount, /*src=*/0x20000000ul, /*dst=*/0x20000040ul, /*type=*/0ul, /*flags=*/0x1010ul, /*data=*/0ul); | |
NONFAILING(memcpy((void*)0x200000c0, "./file0\000", 8)); | |
NONFAILING(memcpy((void*)0x20000100, "./file0\000", 8)); | |
syscall(__NR_pivot_root, /*new_root=*/0x200000c0ul, /*put_old=*/0x20000100ul); | |
} | |
int main(void) | |
{ | |
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); | |
install_segv_handler(); | |
for (procid = 0; procid < 4; procid++) { | |
if (fork() == 0) { | |
use_temporary_dir(); | |
do_sandbox_none(); | |
} | |
} | |
sleep(1000000); | |
return 0; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# ./syz-execprog -repeat 0 ./repro.txt | |
syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0d0200", 0x14, 0x6, 0x0, @empty, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) | |
syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) | |
mount$bind(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1010, 0x0) | |
pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment