#!/usr/bin/perl

# (c)2003 Marc Alexander Lehmann <nbd@plan9.de>
#
# This file is released under the General Public License, version 2 or later.

require v5.8;

use strict 'subs';

use Socket;
use IO::Socket::INET;

$VERSION = 0.1;

#############################################################################

$DEV = "/dev/nd0";

umask 077;

for (0..7) {
   -e "/dev/nd$_" || qx<sh -x -c "mknod /dev/nd$_ b 43 $_">;
}

print <<EOF;

WARNING: This program contains a locally exploitable race condition.
EOF

sub NBD_SET_SOCK         (){ 0x0000ab00 }
sub NBD_SET_BLKSIZE      (){ 0x0000ab01 }
sub NBD_SET_SIZE         (){ 0x0000ab02 }
sub NBD_DO_IT            (){ 0x0000ab03 }
sub NBD_CLEAR_SOCK       (){ 0x0000ab04 }
sub NBD_CLEAR_QUE        (){ 0x0000ab05 }
sub NBD_PRINT_DEBUG      (){ 0x0000ab06 }
sub NBD_SET_SIZE_BLOCKS  (){ 0x0000ab07 }
sub NBD_DISCONNECT       (){ 0x0000ab08 }

open ND, "+<", $DEV or die "$DEV: $!";

ioctl ND, NBD_CLEAR_QUE, my $x or die "NBD_CLEAR_QUE: $!";
ioctl ND, NBD_DISCONNECT, my $x;
ioctl ND, NBD_CLEAR_SOCK, my $x;

#############################################################################

$BIN = shift or die "usage: $0 iso9660.bin";

open BIN, "<", $BIN or die "$BIN: $!";

# create a socketpair... ugh
my $srv = new IO::Socket::INET LocalHost => "127.0.0.1", Listen => 1
   or die "unable to create listen socket: $!";
my $cli = new IO::Socket::INET PeerHost => $srv->sockhost, PeerPort => $srv->sockport
   or die "unable to connect to listen socket: $!";
$srv = $srv->accept
   or die "accept: $!";

# TODO: should exchange secure token, but I don't care for races now

ioctl ND, NBD_SET_SOCK, 0 + fileno $cli or die "NBD_SET_SOCK: $!";

sub REQ_MAGIC () { 0x25609513 }
sub REQ($) { unpack "N N a8 NN N", $_[0] }
sub REQ_SIZE (){ 4+4+4 + 8 + 8 }
sub REP_MAGIC () { 0x67446698 }
sub REP($$$;$) { pack "N N a8 a*", @_ }

if (!($srv_pid = fork)) {
   ioctl ND, NBD_DO_IT, my $x
      or die "unable do _do_ _it_: $!";
   exit;
}

$SIG{INT} =
$SIG{TERM} =
$SIG{QUIT} =
$SIG{HUP} = sub { exit };

sub END {
   if ($srv_pid) {
      print "killing server...\n";
      kill 9, $srv_pid;
   }
   print "bye.\n";
}

#if (fork == 0) {
#   system "isoinfo", "-l", "-i", $DEV;
#   _exit(1);
#}

print <<EOF;

Everything seems to be set up now, try sth. like:

   mount -tiso9660 $DEV /mnt

Press ^C to exit...
EOF

while (REQ_SIZE == sysread $srv, my $req, REQ_SIZE) {
   my ($magic, $type, $handle, undef, $from, $len) = REQ $req;

   $magic == REQ_MAGIC
      or die "protocol error (magic number mismatch)";

   my ($from_l, $from_h) = ($from & 2047, $from >> 11);

   if ($type == 0) {
      printf "READ %08x \@%08x (block $from_h+$from_l)\n", $len, $from;

      syswrite $srv, REP REP_MAGIC, 0, $handle;

      while ($len) {
         sysseek BIN, ($from_h * 2352) + $from_l + 0x18, 0
            or die;

         $from_l = 2048 - $from_l;
         $from_l < $len or $from_l = $len;

         sysread BIN, my $buf, $from_l;

         $from_l == length $buf or $buf = "\x0" x $from_l;

         syswrite $srv, $buf;

         $len -= $from_l;

         $from_l = 0;
         $from_h++;
      }
   } elsif ($type == 1) {
      die "write not supported\n";
   } elsif ($type == 2) {
      print "disconnect requested, exiting...\n";
      last;
   } else {
      die "unsupported operation ($type)\n";
   }
}