#!/bin/sh
# Fix-validation for DF-3326 (association without completed authentication).
# Kernel has BOTH fixes applied (DF-3323 fix.diff + DF-3326 fix.diff).
#   baseline: attack=1 -> attack=4 => ASSOC_RESP (0x10), associd 0xc001,
#             AUTHORIZED=0
#   patched:  attack=1 -> attack=4 => DEAUTH (0xc0), associd 0x0
#   regression: open-authmode vap, attack=6 (open auth) -> attack=4
#             => associd 0xc001 + AUTHORIZED=1 (legit flow unbroken)
set -e
D=dfbsd-qemu
P=/root/fw4

echo "== doubly-patched guest: $( $D/vm.sh run_root 'uname -a' )"

$D/vm.sh run_root "kldload $P/fw4.ko" || true
$D/vm.sh run_root "ifconfig wlan create wlandev fw4_0 wlanmode ap ssid fw4ap mode 11g channel 1 authmode shared wepkey 1:0x0123456789abcdef0123456789 weptxkey 1 wepmode on up"
sleep 3

echo "== attack: one auth REQUEST, then ASSOC_REQ (baseline: associated)"
$D/vm.sh run_root "sysctl kern.fw4_attack=1" || true
$D/vm.sh run_root "sysctl kern.fw4_attack=4" || true
$D/vm.sh run_root "sysctl kern.fw4_state" || true
$D/vm.sh run_root "ifconfig wlan0 list sta 2>/dev/null || true"

echo "== regression: open-authmode vap, legit open auth -> assoc"
$D/vm.sh run_root "ifconfig wlan0 destroy"
$D/vm.sh run_root "ifconfig wlan create wlandev fw4_0 wlanmode ap ssid fw4ap mode 11g channel 1 up"
sleep 3
$D/vm.sh run_root "sysctl kern.fw4_attack=6" || true
$D/vm.sh run_root "sysctl kern.fw4_attack=4" || true
$D/vm.sh run_root "sysctl kern.fw4_state" || true
$D/vm.sh run_root 'dmesg | grep -E "fw4" | tail -10'
$D/vm.sh run_root "ifconfig wlan0 destroy; kldunload fw4; echo FIXCHECK_DONE" || true