⬢ DragonFlyBSD Kernel Audit
DF-3452 / df3452_dead.c
← back to finding ↓ download raw
/*
 * df3452_dead.c -- on-guest check for DF-3452: prove the ipfw3 sync
 * sockopts are dead code (ip_fw3_ctl_sync_ptr is never assigned), so
 * ip_fw3_sync_send_state() is unreachable (twice over: the function
 * pointer ipfw_sync_send_state_prt is never called either).
 *
 * Sends IP_FW_X (49) with opcode IP_FW_SYNC_SHOW_STATUS (83) /
 * IP_FW_SYNC_CENTRE_TEST (92) through setsockopt on a raw socket.
 * Expected on stock tree: setsockopt returns 0 (silent no-op -- the
 * switch case finds ip_fw3_ctl_sync_ptr == NULL and does nothing),
 * and dmesg shows no "ipfw3 sync" output.  A live implementation
 * would have to return data / print kprintf output.
 */
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

struct xhdr { unsigned short opcode; unsigned short pad; };

int
main(void)
{
	struct xhdr x;
	int s, rc, val;
	socklen_t len;

	s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
	if (s < 0) { perror("socket"); return 1; }

	/* SOPT_SET: IP_FW_SYNC_SHOW_STATUS via IP_FW_X */
	x.opcode = 83; x.pad = 0;
	rc = setsockopt(s, IPPROTO_IP, 49, &x, sizeof(x));
	printf("SET  IP_FW_X/SYNC_SHOW_STATUS: rc=%d errno=%d\n", rc, errno);

	/* SOPT_SET: IP_FW_SYNC_CENTRE_TEST with an int arg */
	{
		char buf[sizeof(struct xhdr) + sizeof(int)];
		int one = 1;
		memcpy(buf, &x, sizeof(x));
		memcpy(buf + sizeof(x), &one, sizeof(int));
		rc = setsockopt(s, IPPROTO_IP, 49, buf, sizeof(buf));
		printf("SET  IP_FW_X/SYNC_CENTRE_TEST: rc=%d errno=%d\n", rc, errno);
	}

	/* SOPT_GET: sync show status -- should be a no-op returning 0 bytes */
	val = -1; len = sizeof(val);
	rc = getsockopt(s, IPPROTO_IP, 49, &val, &len);
	printf("GET  IP_FW_X: rc=%d errno=%d val=0x%x len=%d\n",
	    rc, errno, val, (int)len);
	return 0;
}