#!/bin/sh
# DF-0477 driver - PATCHED kernel/module. Output -> /root/df0477_fixed.out
# Loads the (patched) ipfw3 + submodules, runs the overflow PoC.
# With the fix, bcopy is bounded by sopt_valsize -> returned_len <= payload.
exec >/root/df0477_fixed.out 2>&1
set -x
date
echo "kern.version: $(sysctl -n kern.version | head -1)"
kldload /boot/kernel/ipfw3.ko       ; echo "core rc=$?"
kldload /boot/kernel/ipfw3_basic.ko ; echo "basic rc=$?"
kldload /boot/kernel/ipfw3_layer2.ko; echo "layer2 rc=$?"
kldload /boot/kernel/ipfw3_layer4.ko; echo "layer4 rc=$?"
kldload /boot/kernel/ipfw3_nat.ko   ; echo "nat rc=$?"
kldstat | grep -i ipfw
cd /root/poc/DF-0477
echo "=== probe large buffer (see module_str) ==="
./ipfw3_get_modules_overflow 1 256
echo "=== overflow attempt: bufsize=5 (expect returned_len<=1 => NO overflow) ==="
./ipfw3_get_modules_overflow 50 5
echo "POC_DONE rc=$?"
date
sync