#!/bin/sh
# DF-0477 run.sh - loads ipfw3 + submodules, runs the overflow probe.
# NOTE: kldload ipfw3 enables a default-DENY firewall and will cut off ssh.
# Run detached (nohup ... </dev/null >out 2>&1 &) and recover the guest by
# force-kill + reboot (vm.sh down ; vm.sh up) to read the output file.
# Requires root (raw socket + kldload). Root->kernel path (no privesc).
O=/usr/obj/usr/src/sys/X86_64_GENERIC/usr/src/sys/net
[ -f /boot/kernel/ipfw3.ko ] && O=/boot/kernel   # use installed modules if present
kldload $O/ipfw3.ko
kldload $O/../../../net/ipfw3_basic/ipfw3_basic.ko 2>/dev/null || kldload $O/ipfw3_basic.ko
kldload $O/../../../net/ipfw3_layer2/ipfw3_layer2.ko 2>/dev/null || kldload $O/ipfw3_layer2.ko
kldload $O/../../../net/ipfw3_layer4/ipfw3_layer4.ko 2>/dev/null || kldload $O/ipfw3_layer4.ko
kldload $O/../../../net/ipfw3_nat/ipfw3_nat.ko 2>/dev/null || kldload $O/ipfw3_nat.ko
cd "$(dirname "$0")"
./ipfw3_get_modules_overflow 1 256    # see module_str
./ipfw3_get_modules_overflow 50 5     # trigger overflow (unpatched) / bounded (patched)