aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/lib.rs184
-rw-r--r--src/main.rs144
2 files changed, 328 insertions, 0 deletions
diff --git a/src/lib.rs b/src/lib.rs
new file mode 100644
index 0000000..18c1b74
--- /dev/null
+++ b/src/lib.rs
@@ -0,0 +1,184 @@
+//! Collection of some abstractions and the error definition used by this PoC.
+
+/// Errors that can occur in this PoC.
+#[derive(Debug)]
+pub enum Error {
+ /// Failed to open and read the `/proc/self/maps` file.
+ FailedToReadMaps,
+ /// Failed to a parse line from the `/proc/self/maps` file.
+ /// Captures line that failed to parse.
+ ParseMapEntryError(String),
+ /// No `[vdso]` segment found in `/proc/self/maps`.
+ VdsoSegmentNotFound,
+ /// Failed to parse bytes as ELF file.
+ FailedToParseAsElf,
+ /// No `PT_LOAD` program header found in the ELF file.
+ LoadPhdrNotFound,
+ /// Requested symbol not found in the ELF file.
+ /// Captures the name of the requested symbol.
+ SymbolNotFound(String),
+}
+
+/// Representation of an 64-bit virtual address.
+#[derive(Debug, Copy, Clone)]
+pub struct VirtAddr(pub u64);
+
+/// Represents an entry from the `/proc/self/maps` file with the information needed by this PoC.
+/// ```text
+/// man 5 proc
+/// address perms offset dev inode pathname
+/// 00400000-00452000 r-xp 00000000 08:02 173521 /usr/bin/dbus-daemon
+/// ```
+#[derive(Debug)]
+pub struct MapEntry {
+ /// Start address of the memory segment.
+ pub addr: u64,
+ /// Length of the memory segment.
+ pub len: u64,
+ /// Optional name of the memory segment.
+ pub name: Option<String>,
+}
+
+impl MapEntry {
+ /// Try to parse a [`MapEntry`] from the `line` passed as argument.
+ pub fn from_line<'a>(line: &'a str) -> Result<MapEntry, Error> {
+ let expect = |tok: Option<&'a str>| tok.ok_or(Error::ParseMapEntryError(line.into()));
+
+ // Tokenize the line.
+ let mut toks = line.split_whitespace();
+ let addr = expect(toks.next())?;
+ let _perms = expect(toks.next())?;
+ let _offset = expect(toks.next())?;
+ let _dev = expect(toks.next())?;
+ let _inode = expect(toks.next())?;
+ let name = toks.next().map(|name| String::from(name));
+
+ // Parse the address token.
+ let (addr, len) = {
+ let tou64 = |s: &'a str| {
+ u64::from_str_radix(s, 16)
+ .map_err(|e| Error::ParseMapEntryError(format!("{}\n{}", line, e)))
+ };
+
+ let mut toks = addr.split('-');
+ let start = tou64(expect(toks.next())?)?;
+ let end = tou64(expect(toks.next())?)?;
+
+ (start, end - start)
+ };
+
+ Ok(MapEntry { addr, len, name })
+ }
+}
+
+/// Owned [`libc::mmap`] allocation.
+pub struct Mmap {
+ ptr: *mut libc::c_void,
+ len: usize,
+ map: MapEntry,
+}
+
+impl Mmap {
+ /// Create a new allocation with `read | write | execute` permissions big enough to hold a copy
+ /// of `bytes` and initialize it with the `bytes` passed as argument.
+ pub fn new_rwx_from(bytes: &[u8]) -> Option<Mmap> {
+ use libc::{
+ memcpy, mmap, sysconf, MAP_ANONYMOUS, MAP_FAILED, MAP_PRIVATE, PROT_EXEC, PROT_READ,
+ PROT_WRITE, _SC_PAGESIZE,
+ };
+
+ // Get the page size.
+ let page_size = unsafe { sysconf(_SC_PAGESIZE) } as usize;
+
+ // Compute required size for the new allocation by rounding up to the next page size.
+ let len = ((bytes.len() + page_size - 1) / page_size) * page_size;
+
+ // Allocate new `rwx` memory segment.
+ let ptr = unsafe {
+ mmap(
+ std::ptr::null_mut(),
+ len,
+ PROT_READ | PROT_WRITE | PROT_EXEC,
+ MAP_PRIVATE | MAP_ANONYMOUS,
+ -1, /* fd */
+ 0, /* offset */
+ )
+ };
+
+ if ptr == MAP_FAILED {
+ return None;
+ }
+
+ unsafe {
+ // Initialize new allocation with `bytes` passed as argument.
+ memcpy(ptr, bytes.as_ptr().cast(), bytes.len());
+ }
+
+ Some(Mmap {
+ ptr,
+ len,
+ map: MapEntry {
+ addr: ptr as u64,
+ len: len as u64,
+ name: Some("mmap_rwx".into()),
+ },
+ })
+ }
+}
+
+impl Drop for Mmap {
+ fn drop(&mut self) {
+ unsafe { libc::munmap(self.ptr, self.len) };
+ }
+}
+
+impl AsRef<MapEntry> for Mmap {
+ fn as_ref(&self) -> &'_ MapEntry {
+ &self.map
+ }
+}
+
+impl AsMut<[u8]> for Mmap {
+ fn as_mut(&mut self) -> &mut [u8] {
+ unsafe { std::slice::from_raw_parts_mut(self.ptr.cast(), self.len) }
+ }
+}
+
+/// An `x86_64` jump pad (trampoline) that that can be installed at a [`VirtAddr`].
+///
+/// The jump pad is implemented as:
+/// ```asm
+/// mov rax, imm64 ; target
+/// jmp rax
+/// ```
+#[allow(dead_code)]
+#[cfg(target_arch = "x86_64")]
+#[repr(packed)]
+pub struct JmpPad {
+ movabs: u16,
+ target: u64,
+ jmp_rax: u16,
+}
+
+#[cfg(target_arch = "x86_64")]
+impl JmpPad {
+ /// Initialize a new jump pad to the destination virtual address `target`.
+ /// This does not install the jump pad.
+ pub fn to(target: VirtAddr) -> JmpPad {
+ JmpPad {
+ movabs: 0xb848, // REX.W + mov rax, imm64
+ target: target.0,
+ jmp_rax: 0xe0ff, // jmp rax
+ }
+ }
+
+ /// Install the jump pad at the virtual address `addr`.
+ ///
+ /// # Safety
+ /// The caller must guarantee the following constraints:
+ /// - `addr` must be a valid virtual address referring to writeable memory.
+ /// - There must be enough space to store [`size_of::<JmpPad>()`](core::mem::size_of) bytes.
+ pub unsafe fn install_at(self, addr: VirtAddr) {
+ std::ptr::write(addr.0 as *mut JmpPad, self);
+ }
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 0000000..400b2d7
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,144 @@
+use goblin::elf::{Elf, program_header::PT_LOAD};
+use std::convert::TryFrom;
+use vdso_proxy_poc::{Error, JmpPad, MapEntry, Mmap, VirtAddr};
+
+#[cfg(not(target_os = "linux"))]
+compile_error!("This only makes sense on Linux, as we are poking the vdso.");
+
+/// Find the `[vdso]` entry in `/proc/self/maps`.
+fn get_vdso() -> Result<MapEntry, Error> {
+ for line in std::fs::read_to_string("/proc/self/maps")
+ .map_err(|_| Error::FailedToReadMaps)?
+ .lines()
+ {
+ let map = MapEntry::from_line(line)?;
+ match &map.name {
+ Some(n) if n == "[vdso]" => return Ok(map),
+ _ => {}
+ }
+ }
+ Err(Error::VdsoSegmentNotFound)
+}
+
+/// Create a copy of the `vdso` memory segment. Effectively allocates memory and copies the virtual
+/// address range described by `vdso`.
+///
+/// # Safety:
+/// The caller must guarantee that the `vdso` argument describes a valid virtual address range by
+/// its `address` and `length` fields.
+#[allow(unused_unsafe)]
+unsafe fn copy_vdso(vdso: &MapEntry) -> Option<Mmap> {
+ let bytes = {
+ let ptr = vdso.addr as *const u8;
+ let len = usize::try_from(vdso.len)
+ .expect("It's required that the segment length fits into a usize!");
+ // SAFETY: Validity of ptr & len must be ensured by the caller.
+ unsafe { std::slice::from_raw_parts(ptr, len) }
+ };
+
+ Mmap::new_rwx_from(&bytes)
+}
+
+/// Find the `symbol_name` in the vdso described by the [`MapEntry`] memory segment.
+///
+/// # Safety:
+/// The caller must guarantee that the `vdso` argument describes a valid virtual address range by
+/// its `address` and `length` fields.
+///
+/// # Note:
+/// Currently the version of the symbol is not checked, technically this is an error which can be
+/// fatal in case of a binary incompatibility, but that's accepted for this PoC.
+#[allow(unused_unsafe)]
+unsafe fn get_vdso_sym(vdso: &MapEntry, symbol_name: &str) -> Result<VirtAddr, Error> {
+ // Turn `vdso` maps entry into slice of bytes.
+ let bytes = {
+ let ptr = vdso.addr as *const u8;
+ let len = usize::try_from(vdso.len)
+ .expect("It's required that the segment length fits into a usize!");
+ // SAFETY: Validity of ptr & len must be ensured by the caller.
+ unsafe { std::slice::from_raw_parts(ptr, len) }
+ };
+
+ // Parse vdso bytes as ELF.
+ let elf = Elf::parse(bytes).map_err(|_| Error::FailedToParseAsElf)?;
+
+ // Compute the dynamic shared object (dso) base address. Symbol offsets are relative to this
+ // dso base address.
+ let dso_base = {
+ let phdr_load = elf
+ .program_headers
+ .iter()
+ .find(|p| p.p_type == PT_LOAD)
+ .ok_or(Error::LoadPhdrNotFound)?;
+ vdso.addr - phdr_load.p_offset - phdr_load.p_vaddr
+ };
+ assert_ne!(dso_base, 0, "If the dso base address is 0 that means the symbols contain absolute addresses, we don't want to support that!");
+
+ // Try to find the requested symbol.
+ let sym = elf
+ .dynsyms
+ .iter()
+ .filter(|sym| sym.is_function())
+ .find(|sym| matches!(elf.dynstrtab.get_at(sym.st_name), Some(sym) if sym == symbol_name))
+ .ok_or(Error::SymbolNotFound(symbol_name.into()))?;
+
+ // Compute the absolute virtual address of the requested symbol.
+ Ok(VirtAddr(dso_base + sym.st_value))
+}
+
+/// Represent the `struct timeval` C structure (see `man 2 gettimeofday`).
+#[repr(C)]
+struct Timeval {
+ tv_sec: i64,
+ tv_usec: i64,
+}
+
+fn main() -> Result<(), Error> {
+ // This represents the _new_ vdso pages that the kernel mapped into the restoring process.
+ let orig_vdso = get_vdso()?;
+
+ // This represents the _old_ vdso pages that were captured in the memory dump of the process
+ // checkpoint.
+ //
+ // SAFETY: orig_vdso describes a valid memory region as we got it from /proc/self/maps.
+ let copy_vdso = unsafe { copy_vdso(&orig_vdso).expect("Copy of vdso must succeed!") };
+
+ let (orig_sym_addr, copy_sym_addr) = unsafe {
+ // SAFETY: orig_vdso describes a valid memory region as we got it from /proc/self/maps.
+ let orig = get_vdso_sym(&orig_vdso, "__vdso_gettimeofday")?;
+ // SAFETY: copy_vdso describes a valid and owned memory allocation.
+ let copy = get_vdso_sym(&copy_vdso.as_ref(), "__vdso_gettimeofday")?;
+
+ (orig, copy)
+ };
+
+ // As an example, install a trampoline for the `__vdso_gettimeofday` symbol. The trampoline is
+ // installed in the _old_ vdso pages, where the user code from the checkpoint image links to,
+ // and forwards the calls into the _new_ vdso pages.
+ let pad = JmpPad::to(orig_sym_addr);
+ // SAFETY: copy_sym_addr is a valid virtual address as we got it from the symbol lookup.
+ unsafe { pad.install_at(copy_sym_addr) };
+
+ let mut tv: Timeval = Timeval {
+ tv_sec: 0,
+ tv_usec: 0,
+ };
+
+ unsafe {
+ // Mimic a call to `__vdso_gettimeofday` from user code which is still linked to the _old_
+ // vdso.
+
+ // SAFETY: copy_sym_addr is a valid virtual address pointing to the `__vdso_gettimeofday`
+ // function.
+ let gettimeofday: extern "C" fn(*mut Timeval, *mut libc::c_void) -> i32 =
+ std::mem::transmute(copy_sym_addr.0 as *const ());
+
+ // Invoke the `__vdso_gettimeofday` function in the copied memory region (_old_ vdso). This
+ // should forward to the function in the original memory region.
+ gettimeofday(&mut tv as *mut Timeval, std::ptr::null_mut());
+ }
+
+ println!("Timeval tv_sec : {} tv_usec : {}", tv.tv_sec, tv.tv_usec);
+
+ Ok(())
+}