#!/bin/sh
# DF-0747 setup: load ipfw3 modules with default-accept (so SSH survives),
# then install the established/deny rule pair that exercises check_established.
# MUST be run as root.
set -e

echo "[setup] ensuring default-to-accept BEFORE loading ipfw3..."
sysctl net.filters_default_to_accept=1

echo "[setup] loading ipfw3 + ipfw3_basic + ipfw3_layer4..."
kldload ipfw3.ko
kldload ipfw3_basic.ko
kldload ipfw3_layer4.ko

echo "[setup] verifying ipfw3 enabled..."
sysctl net.inet.ip.fw3.enable

echo "[setup] installing rules..."
# Rule 50:  explicitly allow SSH so the management session survives
# Rule 100: allow tcp "established" → invokes check_established (the bug path)
# Rule 200: deny all other tcp (exercises the misclassification on fragments)
# Rule 65534: allow everything else (keeps the box usable)
ipfw3 flush 2>/dev/null || true
ipfw3 add 50 allow tcp from any to me 22
ipfw3 add 50 allow tcp from me 22 to any
ipfw3 add 100 allow tcp from any to any established
ipfw3 add 200 deny tcp from any to any
ipfw3 add 65534 allow ip from any to any

echo "[setup] rules installed:"
ipfw3 list
echo "[setup] zero counters for clean baseline:"
ipfw3 zero
echo "[setup] done."