⬢ DragonFlyBSD Kernel Audit
DF-5534 / matrix.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
#!/bin/sh
# Negative-validation matrix for sys/platform/vkernel64/x86_64/autoconf.c (pass 2)
# Four boots, hostile operator-supplied boot args; criterion = autoconf/pxe parsing
# survives with no memory-safety signature (no Fatal trap / unexpected panic).
VK=/usr/obj/usr/src/sys/VKERNEL64/kernel.debug
KDIR=/usr/obj/usr/src/sys/VKERNEL64

run_vk() {
    name=$1; secs=$2; mem=$3; shift 3
    rm -f /tmp/vkin.$name /tmp/vkc.$name
    mkfifo /tmp/vkin.$name
    (sleep $((secs + 90)) > /tmp/vkin.$name) &
    H=$!
    ( exec 3> /tmp/vkin.$name
      i=0
      while [ $i -lt $secs ]; do
        grep -q "mountroot>" /tmp/vkc.$name 2>/dev/null && break
        sleep 1; i=$((i+1))
      done
      echo "ufs:vkd0" >&3
    ) &
    P=$!
    ( cd $KDIR && exec ./kernel.debug -m $mem -r /vkroot.img -n 1 \
        -e init_path=/bin/vkinit "$@" -s < /tmp/vkin.$name > /tmp/vkc.$name 2>&1 ) &
    V=$!
    echo "[$name] vkernel pid=$V"
    i=0
    while [ $i -lt $secs ]; do
      kill -0 $V 2>/dev/null || break
      grep -q "vkinit\|# \|\$ " /tmp/vkc.$name 2>/dev/null && break
      sleep 1; i=$((i+1))
    done
    sleep 3
    if kill -0 $V 2>/dev/null; then ALIVE=YES; else ALIVE=NO; fi
    echo "[$name] alive=$ALIVE after ${i}s"
    kill $P $H 2>/dev/null
    pkill -9 -f "kernel.debug.*$name" 2>/dev/null
    kill -9 $V 2>/dev/null
    i=0
    while pgrep -f kernel.debug >/dev/null 2>&1 && [ $i -lt 45 ]; do sleep 1; i=$((i+1)); done
    sleep 2
    echo "[$name] === console ==="
    cat /tmp/vkc.$name
    echo "[$name] === end ==="
}

echo "########## RUN B: layered garbage (int overflow fields, unbounded hex) ##########"
run_vk garbage 90 512m \
  -e boot.netif.ip=-2147483648.2147483647.0.0 \
  -e boot.netif.netmask=4294967295.99999999999999999999.1.1 \
  -e boot.netif.hwaddr=ffffffffffffffffffffffffffffffff

echo "########## RUN C: valid hwaddr -> interface match walk ##########"
run_vk matchwalk 90 512m \
  -e boot.netif.ip=10.0.0.1 \
  -e boot.netif.netmask=255.0.0.0 \
  -e 'boot.netif.hwaddr="aa:bb:cc:dd:ee:ff"'

echo "########## RUN A: deep path (name=lo0, server=127.0.0.1, handle, path, iosize) ##########"
run_vk deep 120 512m \
  -e boot.netif.ip=10.1.2.3 \
  -e boot.netif.netmask=255.255.255.0 \
  -e boot.netif.name=lo0 \
  -e boot.netif.gateway=10.1.2.1 \
  -e boot.nfsroot.server=127.0.0.1 \
  -e boot.nfsroot.nfshandle=Xdeadbeefcafebabe0123456789abcdefaabbccdd \
  -e boot.nfsroot.path=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
  -e nfsroot.iosize=99999999999999999999 \
  -e nfsroot.rahead=-7

echo "########## RUN D: kern.nbuf extreme (cpu_startup clamp) ##########"
run_vk nbuf 90 2g \
  -e kern.nbuf=99999999999

echo "MATRIX DONE"