DF-3044 — BOOTP/DHCP reply acceptance: zero origin validation + deterministic XID

Verified in VERIFY mode (audit skipped) on the single-tenant QEMU guest, with the verbatim-interposition kernel-compiled harness (dfrig12_bootp.c, this directory) that #includes the unmodified production sys/vfs/nfs/bootp_subr.c (sha256-gated: build.sh refuses to build unless the guest source is byte-identical to the audited tree).

What was reproduced (baseline kernel)

• Blind predicted-XID spoof, arbitrary origin, full client compromise of the netboot identity: a reply whose XID is computed purely from source constants — seed 0xFFFF0000 (bootp_subr.c:1538 gctx->xid = ~0xFFFF), +0x100 per interface (:435), +1 on the first compose of an unresolved ifctx (:1194-1195) — sent from 6.6.6.6:9999 (a port no DHCP server uses) is accepted by the verbatim bootpc_call matcher (:838-848) and the verbatim bootpc_decode_reply adopts the attacker's entire config: hostname, root NFS server+path, swap NFS server+path, default route. soreceive(so, NULL, ...) at :807 means the origin is never even requested (harness counter: 0 times).
• DoS manifestation: the same predicted-XID ACK carrying TAG_SUBNETMASK with len 3 reaches bootpc_decode_reply and trips the verbatim panic("bootpc: subnet mask len is 3") (:1390) → panic.txt.

Files

• dfrig12_bootp.c — the harness (interposition seams: sockets, ifioctl, rtrequest, tsleep, setfs/nfs_mountopts/md_mount/md_lookup_swap, bcmp).
• build.sh — verbatim sha256 gate + make nativekernel + installkernel.
• run.sh — test selector (2 = blind spoof, 20 = wrong-xid control, 21/22 = fixed-kernel sniff variants, 4 = panic path, dedicated boot).
• run.log — baseline test-2 console trace (verbatim Received DHCP Offer/Ack ... (accepted) lines + adopted-config decode line) + test-20 control status.
• run.fixed.log — fixed-kernel runs (2/21/22 + test 4 without panic).
• panic.txt — baseline test-4 panic + backtrace.
• fix_validation.log — A/B table.
• fix.diff — the validated fix (random XID seed + require source port 67).
• build.log / build_fixed.log — full untrimmed kernel build logs.
• env.txt — guest, compiler, rig, gate hashes.

Reproduce (on the DragonFly guest)

sh build.sh                      # gate + build + install (reboot after)
sysctl -w kern.dfrig12=2         # blind spoof   -> full adoption (baseline)
sysctl -w kern.dfrig12=20        # wrong-xid     -> ignored
sysctl -n kern.dfrig12_status    # verdict markers
# dedicated boot:
sysctl -w kern.dfrig12=4         # -> panic: bootpc: subnet mask len is 3

Expected (baseline)

dfrig12: client broadcasts query #1 xid_raw=0100ffff ...
dfrig12: ATTACKER injects OFFER xid_raw=0100ffff origin=6.6.6.6:9999 ...
Received DHCP Offer packet on vtnet0 from 6.6.6.6 (accepted) (no root path)
...
Received DHCP Ack packet on vtnet0 from 6.6.6.6 (accepted) (got root path)
vtnet0 at 66.6.6.6 server 6.6.6.6
subnet mask 255.255.0.0 router 1.6.6.6 rootfs 6.6.6.6:/pwn3d swapfs 6.6.6.6:/swpwn swapsize 65536 KB hostname pwn3d
dfrig12: DF3044: hostname ADOPTED 'pwn3d' ...
dfrig12: DF3044: root NFS mount ADOPTED from attacker 6.6.6.6 path=6.6.6.6:/pwn3d
dfrig12: DF3044: default route ADOPTED via attacker 6.6.6.1 flags=0x803

(with attacker constants stored big-endian; on-wire they appear as 66.6.6.6 / 6.6.6.6 / 1.6.6.6 — all attacker-chosen either way.)

DF-3044 — VERDICT

Status: reproduced (mechanically, at every decision point of the verbatim production code), impact on this guest: panic (DoS manifestation), with the primary real-world impact — total identity/config compromise of a netboot client by an unauthenticated same-L2 (or XID-predicting off-path) attacker — demonstrated end-to-end through the verbatim path but not convertible to uid=0 on this guest because the guest boots from disk and its stock kernel does not compile this file (options BOOTP is LINT64-only; sys/conf/files:1894 gates bootp_subr.c on it).

What the run proved, line-accurately

1. Deterministic XID — bootp_subr.c:1538 seeds gctx->xid = ~0xFFFF (0xFFFF0000), :429/:435 copies-and-increments per interface (+0x100), :1194-1196 adds +1 on the first compose of an unresolved ifctx and byte-swaps into call.xid. Guest observation: the DISCOVER and the subsequent DHCP REQUEST both used xid bytes 01 00 ff ff (0xFFFF0001); the xid only advances (+1) when a failed exchange resets the state to unresolved. The harness "attacker" computed this value from the source constants alone, never from an observed packet, and the client's first query matched the prediction exactly (client 1st xid_raw=0100ffff vs predicted 0100ffff: MATCH).
2. Zero origin validation — :807-808 soreceive(so, NULL, &auio, ...) discards the source address/port; the entire acceptance test is op == BOOTP_REPLY (:831), xid == call.xid (:838), hlen == (:842), bcmp(chaddr) (:846-848). Replies from 6.6.6.6:9999 were accepted throughout the baseline runs; the harness counted 0 origin requests.
3. Full compromise of the netboot identity — after acceptance, verbatim bootpc_decode_reply (:1341-1515) adopts attacker yiaddr/ siaddr/giaddr, TAG_HOSTNAME (strcpy(hostname, ...) :1487), TAG_ROOT/TAG_SWAP paths fed to setfs → md_mount (:1644-1666), TAG_ROUTERS → default route via rtrequest_global (:1142-1148). All adoption markers captured (run.log), including the verbatim decode console line vtnet0 at 66.6.6.6 server 6.6.6.6 ... hostname pwn3d. On a real diskless client the attacker-chosen root NFS server hands the machine its entire root filesystem — i.e. root-level control of the client by design of netboot, pre-authentication. (On the audit guest the mount is intercepted at the md_mount seam — no real RPC leaves the box.)
4. Panic manifestation — a predicted-XID ACK with TAG_SUBNETMASK len 3 trips the verbatim panic("bootpc: subnet mask len is 3") (:1389-1391): panic.txt, backtrace bootpc_init <- sysctl_df_test <- sysctl_root <- userland_sysctl <- sys___sysctl. Same-L2 attacker → repeatable boot-time crash of the netboot client (worse-case DoS at the worst possible time).

Honest reachability

• Attacker = malicious DHCP/BOOTP server on the client boot network (AV:A at boot; the deterministic XID also removes the need to observe any packet — a blind spoofer who knows only the client MAC, which every on-link host hears in each broadcast DISCOVER, succeeds).
• Requires the non-default options BOOTP diskless configuration (LINT64-only in this tree) — the stock X86_64_GENERIC guest kernel does not contain this code; that is exactly why the rig compiles the file verbatim into the harness kernel instead.
• Unprivileged-local reach on a normal system: none (code runs at boot, before userland).
• Privesc on THIS guest: not reachable (see above) — the escalation ceiling is on real netboot deployments, where it is total (attacker serves the root filesystem).

Fix validation (fix.diff, A/B on the same harness)

• gctx->xid = karc4random() at :1550 → blind prediction dead (3c53bacd vs predicted 0100ffff: differ).
• soreceive(so, &fromp, ...) + sin_port == htons(67) requirement → sniffed-XID spoof from :9999 rejected with the verbatim message bootpc: reply not from server port 67, ignored (run.fixed.log); test-4 panic gone (timeout, clean return).
• Documented residual: a same-L2 sniffer spoofing source port 67 still controls the client (test 22) — inherent to unauthenticated BOOTP/DHCP (RFC 2131 sec 7; no RFC 3118); the fix removes the deterministic XID and the any-origin acceptance, not the on-link attacker.

Rig artifacts worth noting

• Harness-only knob #define BOOTP_TIMEOUT 12 bounds the retry loop for negative tests (the shipped default retries forever; unrelated to the cited lines).
• The production while (time_uptime < atimo) liveness relies on the real blocking soreceive (time_uptime is not volatile, sys/time.h:163); the stub models this with lwkt_yield() (env.txt).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.