⬢ DragonFlyBSD Kernel Audit
DF-3204 / run_fixed.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#!/bin/sh
# Fixed-kernel A/B suite (all three fixes in one kernel, line-disjoint
# hunks).  Baseline numbers in brackets came from the same tests on the
# baseline harness kernel (#1); see the per-pack run logs.
set -e
D=/root/dfrig13
cd $D
ifconfig lo0 127.0.0.2 netmask 255.0.0.0 alias 2>/dev/null || true

echo "===== FIXED T5: xid determinism (baseline: 0xffffff00+n ascending) ====="
usched :1 ./attacker dump -p 7771 -n 6 > fx_dump.log 2>&1 &
sleep 1
sysctl -w kern.dfrig13_arg=6 >/dev/null
usched :1 sysctl -w kern.dfrig13=5 >/dev/null
sysctl -n kern.dfrig13_status
wait
cat fx_dump.log

echo
echo "===== FIXED T1: wrong-origin spoof (baseline: ATTACKER payload) ====="
usched :1 ./attacker spoofsrc -p 7771 -n 1 > fx_spoof.log 2>&1 &
sleep 1
usched :1 sysctl -w kern.dfrig13=1 >/dev/null
sysctl -n kern.dfrig13_status
wait
cat fx_spoof.log

echo
echo "===== FIXED T4 blind pmap (baseline: port ca fe from blind xid) ====="
usched :1 ./attacker pmap -b -n 1 > fx_pmap.log 2>&1 &
sleep 1
usched :1 sysctl -w kern.dfrig13=4 >/dev/null
sysctl -n kern.dfrig13_status
wait
cat fx_pmap.log

echo
echo "===== FIXED T2/T22 short reply (baseline: rpc denied, status=<stale>) ====="
DM0=$(dmesg | grep -c "rpc denied, status=" || true)
usched :1 ./attacker short -p 7771 -n 6 > fx_short.log 2>&1 &
sleep 1
sysctl -w kern.dfrig13_arg=0xc3 >/dev/null
usched :1 sysctl -w kern.dfrig13=2 >/dev/null
sysctl -w kern.dfrig13_arg=0x5a >/dev/null
usched :1 sysctl -w kern.dfrig13=22 >/dev/null
sysctl -n kern.dfrig13_status
wait
DM1=$(dmesg | grep -c "rpc denied, status=" || true)
echo "rpc-denied lines before=$DM0 after=$DM1 (baseline grew by >=1 per attempt)"

echo
echo "===== FIXED primer attribution (baseline: value tracks pattern 18/18) ====="
DM2=$(dmesg | grep -c "rpc denied, status=" || true)
usched :1 ./attacker short_p -p 7771 -n 3 -x 0x5a5a5a5a > fx_primer.log 2>&1 &
sleep 1
sysctl -w kern.dfrig13_arg=0xc3 >/dev/null
usched :1 sysctl -w kern.dfrig13=2 >/dev/null
wait
DM3=$(dmesg | grep -c "rpc denied, status=" || true)
echo "rpc-denied lines before=$DM2 after=$DM3 (must NOT grow)"

echo
echo "===== FIXED T3 pmis leak (baseline: +50 mbufs) ====="
MB0=$(netstat -m | head -1)
usched :1 ./attacker pmis -p 7771 -n 50 > fx_pmis.log 2>&1 &
sleep 1
sysctl -w kern.dfrig13_arg=50 >/dev/null
usched :1 sysctl -w kern.dfrig13=3 >/dev/null
sysctl -n kern.dfrig13_status
wait
sleep 2
MB1=$(netstat -m | head -1)
echo "mbufs before: $MB0"
echo "mbufs after:  $MB1"

echo
echo "===== FIXED T33 honest control (must stay flat) ====="
MB2=$(netstat -m | head -1)
usched :1 ./attacker good -p 7771 -n 50 > fx_good.log 2>&1 &
sleep 1
sysctl -w kern.dfrig13_arg=50 >/dev/null
usched :1 sysctl -w kern.dfrig13=33 >/dev/null
sysctl -n kern.dfrig13_status
wait
sleep 2
MB3=$(netstat -m | head -1)
echo "mbufs before control: $MB2"
echo "mbufs after control:  $MB3"

echo
echo "FIXED-KERNEL SUITE DONE"