#!/bin/sh
# Fix-validation driver (host side): backs up the guest's pristine udf
# sources, applies the three pass-2 fixes (DF-3102/3103/3104), rebuilds the
# udf module in the guest, swaps udf.ko in, remounts the SAME image and
# re-runs the exact PoCs.  Expected on the patched kernel:
#   DF-3102: leak1 tail == 0xAA (no OOB bytes)
#   DF-3103: open(/mnt/EMB) fails (invalid l_ea/l_ad rejected at vget)
#   DF-3104: months>=13 clamp to epoch 0 (no OOB mon_lens terms)
set -u
cd "$(dirname "$0")"
CFG=../../../dfbsd-qemu/config
SCP="scp -F $CFG -o ConnectTimeout=8 -o BatchMode=yes"
SSH="ssh -F $CFG -o ConnectTimeout=8 -o BatchMode=yes"

# combined patch = union of the three per-finding fix.diffs (already
# hand-merged; generated against sys/vfs/udf/{udf_vnops.c,udf_vfsops.c})
cp "$(dirname "$0")"/df31xx_combined_fix.diff /tmp/df31xx_fix.diff

cat > /tmp/df31xx_fixrun.sh <<'RUNEOF'
#!/bin/sh
set -e
cd /usr/src/sys/vfs/udf
cp -n udf_vnops.c /root/udf_vnops.c.orig
cp -n udf_vfsops.c /root/udf_vfsops.c.orig
cd /
patch -p1 --dry-run < /tmp/df31xx_fix.diff
patch -p1 < /tmp/df31xx_fix.diff
cd /usr/src/sys/vfs/udf
make > /tmp/fix_build.log 2>&1 || { tail -30 /tmp/fix_build.log; exit 1; }
cp -n /boot/kernel/udf.ko /root/udf.ko.orig
umount /mnt 2>/dev/null || true
kldunload udf || { echo KLDUNLOAD_FAILED; kldstat; exit 1; }
cp udf.ko /boot/kernel/udf.ko
kldload udf || { echo KLDLOAD_FAILED; exit 1; }
vnconfig -u vn0 2>/dev/null || true
vnconfig -c vn0 /tmp/df3102.udf
mount_udf -o ro /dev/vn0 /mnt
chmod 755 /mnt || true
echo PATCHED_MODULE_READY
RUNEOF

$SCP /tmp/df31xx_fix.diff dfbsd:/tmp/df31xx_fix.diff
$SCP /tmp/df31xx_fixrun.sh dfbsd:/tmp/df31xx_fixrun.sh
$SSH dfbsd "sh /tmp/df31xx_fixrun.sh" || { echo "FIX BUILD FAILED"; exit 1; }
echo "--- DF-3102 on patched kernel (expect tail == 0xAA, NOT_CONFIRMED) ---"
$SSH dfbsd "sh -c 'su maxx -c \"/tmp/df3102_poc leak1 /mnt/F1\"'"
echo "EXIT=$?"
echo "--- DF-3103 on patched kernel (expect open EMB to fail) ---"
$SSH dfbsd "sh -c 'su maxx -c \"/tmp/df3102_poc emb /mnt/EMB 96\"'"
echo "EXIT=$?"
echo "--- DF-3103 EMB2 on patched kernel (expect open to fail) ---"
$SSH dfbsd "sh -c 'su maxx -c \"/tmp/df3102_poc emb /mnt/EMB2 96\"'"
echo "EXIT=$?"
echo "--- DF-3104 on patched kernel (expect months>=13 clamped to 0) ---"
$SSH dfbsd "sh -c 'su maxx -c \"/tmp/df3102_poc ts /mnt\"'"
echo "EXIT=$?"
echo "--- sanity: normal reads still work ---"
$SSH dfbsd "sh -c 'su maxx -c \"/tmp/df3102_poc leak1 /mnt/F1; head -c 64 /mnt/F1 | od -c | head -3\"'"