#!/bin/sh
# Run script for DF-0650 PoC.
# Must be run as root (raw socket requires SYSCAP_NONET_RAW).
# Captures emitted packets on vtnet0 and shows the leaked ip_dst values.
set -e
cd "$(dirname "$0")"

if [ "$(id -u)" != "0" ]; then
    echo "DF-0650: must be run as root (raw socket required)" >&2
    exit 1
fi

# Configure ipfw to log all emitted packets by destination bucket.
ipfw -q flush 2>/dev/null || true
ipfw -q add 1000 allow ip from any to any
ipfw -q add 100 count log ip from 10.0.2.0/24 to 10.0.2.0/24      # sa_len=7: 10.0.2.255
ipfw -q add 200 count log ip from 10.0.2.0/24 to 10.0.255.255/16  # sa_len=6: 10.0.255.255
ipfw -q add 300 count log ip from 10.0.2.0/24 to 10.255.255.255/8 # sa_len=5: 10.255.255.255
ipfw -q add 400 count log ip from 10.0.2.0/24 to 255.255.255.255/32 # sa_len=2..4: 255.255.255.255
ipfw -q add 500 count log ip from 10.0.2.0/24 to any

mkdir -p /tmp/df0650
tcpdump -i vtnet0 -nn -w /tmp/df0650/vt.pcap 'ip and not port 22' 2>/tmp/df0650/td.err &
TD=$!
sleep 1
./df0650_poc 8 2>&1
sleep 3
kill $TD 2>/dev/null
wait $TD 2>/dev/null

echo "=== ipfw counts (each shows leaked-dst packets matched) ==="
ipfw -a list
echo "=== tcpdump on vtnet0 (sorted) ==="
tcpdump -nn -r /tmp/df0650/vt.pcap 2>/dev/null | sort | uniq -c | sort -rn | head -20
echo "RUN_EXIT=$?"