#!/bin/sh
# Fix-validation for DF-3323 (shared-key auth cleartext-response bypass).
# Boots the patched kernel (fix.diff applied to /usr/src in the guest,
# make -j6 nativekernel) and re-runs the EXACT baseline attack:
#   baseline:  fw4.attack=2 -> AUTHORIZED=1  <<<< BYPASSED  (+ assoc works)
#   patched:   fw4.attack=2 -> AUTHORIZED=0, AP sends NO seq-4 success;
#              fw4.attack=1 still issues the challenge (legit cleartext
#              request path unbroken); assoc then fails (not authenticated).
set -e
D=dfbsd-qemu
P=/root/fw4

echo "== patched guest: $( $D/vm.sh run_root 'uname -a' )"

$D/vm.sh run_root "kldload $P/fw4.ko" || true
$D/vm.sh run_root "ifconfig wlan create wlandev fw4_0 wlanmode ap ssid fw4ap mode 11g channel 1 authmode shared wepkey 1:0x0123456789abcdef0123456789 weptxkey 1 wepmode on up"
sleep 3
$D/vm.sh run_root "ifconfig wlan0 | grep -E 'wlan0:|status' || true"

echo "== step 1 (regression): auth request seq1 -> AP must still answer seq2 challenge"
$D/vm.sh run_root "sysctl kern.fw4_attack=1" || true
echo "== attack: cleartext seq3 with captured challenge -> must NOT authorize"
$D/vm.sh run_root "sysctl kern.fw4_attack=2" || true
$D/vm.sh run_root "sysctl kern.fw4_state" || true
echo "== follow-on assoc (baseline: associd 0xc001) -> must be refused now"
$D/vm.sh run_root "sysctl kern.fw4_attack=4" || true
$D/vm.sh run_root "sysctl kern.fw4_state" || true
$D/vm.sh run_root "ifconfig wlan0 list sta 2>/dev/null || true"
$D/vm.sh run_root 'dmesg | grep -E "fw4" | tail -14'

$D/vm.sh run_root "ifconfig wlan0 destroy; kldunload fw4; echo FIXCHECK_DONE" || true