#!/bin/sh
# DF-2610 canonical run (as root): attempt every userspace-reachable mbuf
# shape for an ND_REDIRECT (type 137) delivered to ::1 and watch for
# panic/corruption; prove traversal via icp6s_inhist[137] + nd6log output.
set -x
cd /root/poc
sysctl net.inet6.icmp6.nd6_debug
sysctl net.inet6.icmp6.rediraccept
echo BEFORE:
./ic6stat
# valid-ish redirect (src linklocal + hlim 255): traverses the whole
# validation block incl. the 2196-2197 reads and rtpurelookup
./redir6 -h 255 -S fe80::1 ::1
# 2. sizes: single mbuf (<= MHLEN+prependspace) and chains (> MHLEN)
./redir6 -s 48 -h 255 -S fe80::1 ::1
./redir6 -s 100 -h 255 -S fe80::1 ::1
./redir6 -s 150 -h 255 -S fe80::1 ::1
./redir6 -s 200 -h 255 -S fe80::1 ::1
./redir6 -s 256 -h 255 -S fe80::1 ::1
./redir6 -s 300 -h 255 -S fe80::1 ::1
./redir6 -s 512 -h 255 -S fe80::1 ::1
./redir6 -s 1000 -h 255 -S fe80::1 ::1
./redir6 -s 2000 -h 255 -S fe80::1 ::1
./redir6 -s 2048 -h 255 -S fe80::1 ::1
./redir6 -s 2100 -h 255 -S fe80::1 ::1
./redir6 -s 3000 -h 255 -S fe80::1 ::1
./redir6 -s 8000 -h 255 -S fe80::1 ::1
# 3. multi-iov chain-shaping attempts
./redir6 -s 100 -v 2 -h 255 -S fe80::1 ::1
./redir6 -s 300 -v 2 -h 255 -S fe80::1 ::1
./redir6 -s 300 -v 8 -h 255 -S fe80::1 ::1
./redir6 -s 2048 -v 2 -h 255 -S fe80::1 ::1
# 4. invalid variants: bad hlim, non-linklocal src
./redir6 -h 64 -S fe80::1 ::1
./redir6 -h 255 ::1
# 5. burst
./redir6 -s 100 -n 50 -p 20000 -h 255 -S fe80::1 ::1
echo ALIVE_AFTER_SENDS
sleep 1
echo AFTER:
./ic6stat
echo DMESG_REDIRECT_LINES:
dmesg | grep -i 'redirect' | tail -8
uptime