DF-0735 / build.sh
#!/bin/sh # DF-0735 build script -- builds the trigger, fixed, and ng harness modules # from the in-guest source. Run on the DragonFly guest as root from # findings/poc/DF-0735/ (or the directory you scp'd it to). # # Produces: # df735_trigger.ko -- BUGGY: calls ip_input() directly from sysctl thread # (mirrors sys/netgraph7/ng_ipfw.c:248) # df735_fixed.ko -- FIXED: routes via netisr_queue(NETISR_IP, m) as the # fix.diff does (and as the sibling ng_ip_input.c:125 does) # ng_df735_poc.ko -- faithful netgraph node harness (builds, but may not # load due to netgraph7 ABI version mismatch -- the # sysctl trigger modules fully demonstrate the bug) set -eu WRK=${WRK:-$(pwd)} SYSDIR=${SYSDIR:-/usr/src/sys} build_one() { name=$1; src=$2 cat > "$WRK/Makefile.$name" <<EOF KMOD= $name SRCS= $src SYSDIR?= $SYSDIR .include <bsd.kmod.mk> EOF rm -f "$WRK/$name".*.o "$WRK/$name.ko" "$WRK/$name.ln" 2>/dev/null || true ( cd "$WRK" && make -m /usr/share/mk -f "Makefile.$name" KMODDIR=/boot/kernel ) } build_one df735_trigger df735_trigger.c build_one df735_fixed df735_fixed.c build_one ng_df735_poc ng_df735_poc.c ls -l "$WRK"/df735_trigger.ko "$WRK"/df735_fixed.ko "$WRK"/ng_df735_poc.ko |