#!/bin/sh
# DF-0472 run: load ipfw3, disable packet filtering, run the leak PoC.
# MUST run as root (raw socket + ipfw3 ctl path). Demonstrates the heap
# over-read + info leak. See panic.sh for the OOB-call panic variant.
cd "$(dirname "$0")"
# ensure the firewall does not evaluate the garbage rule on live traffic
sysctl net.filters_default_to_accept=1 >/dev/null 2>&1 || true
kldload ipfw3 2>/dev/null || true
sysctl net.inet.ip.fw3.enable=0 >/dev/null 2>&1
echo "=== DF-0472 info-leak reproduction (expect rc=0 + non-zero leaked bytes) ==="
./leak
echo "leak_rc=$?"
echo
echo "=== To reproduce the OOB-call PANIC instead, run:  ./panic  ==="
echo "=== (it enables the firewall + sends a packet -> kernel panic) ==="