#!/bin/sh
# DF-0736 run.sh — trigger the panic.
#
# Preconditions (performed by setup.sh):
#   - netgraph.ko + ng_socket.ko + ng_ipfw.ko loaded
#   - the "ipfw" netgraph node is live
#
# This script just kldloads the attack module; the module's MOD_LOAD
# handler builds the forged mbuf and synchronously invokes
# ng_ipfw_rcvdata via node->nd_type->rcvdata(NULL, item).
#
# On the unfixed kernel the load itself panics the kernel:
#     panic: ng_ipfw_rcvdata: bad dir 2
#     ng_ipfw_rcvdata() at ng_ipfw_rcvdata+0xc2
#     df736_modevent() at df736_modevent+0x125
#     ... kldload plumbing ...
#
# On the fixed kernel the load returns 0 and dmesg shows:
#     ng_ipfw_rcvdata: bad dir 2, dropping mbuf
#
# Requires root (kldload).  Use:
#   ssh dfbsd '/bin/sh /root/run.sh'
set -e
kldload "$(dirname "$0")/df736attack.ko"
echo "load_exit=$?"
dmesg | tail -5