#!/bin/sh
# DF-3399: per-flow kernel netmsg leak in ipfw3_nat nat_state_add_dispatch.
# Each NEW outbound NAT flow whose return-traffic hash CPU differs from the
# sending CPU kmalloc()s a netmsg_nat_state_add (M_LWKTMSG) that the handler
# never replies/forwards -> leaked. Watch the lwkt_message malloc-type
# in-use count climb with plain UDP traffic from an unprivileged user.
{
echo "=== rules"; ipfw3 show | head -6
ipfw3 add 98 nat 1 udp from any to any out via vtnet0 >/dev/null
echo "=== baseline malloc types (lwkt)"; vmstat -m | grep -i lwkt
echo "=== 3000 UDP flows from unprivileged user (maxx)"
su - maxx -c '/root/udp_spray 3000'
echo "=== after"; vmstat -m | grep -i lwkt
echo "=== 3000 more"
su - maxx -c '/root/udp_spray 3000'
echo "=== after2"; vmstat -m | grep -i lwkt
echo "=== NAT states now (ipfw3 nat show state 1 | wc)"; ipfw3 nat 1 show state 2>/dev/null | wc -l
} > /root/leak_out.txt 2>&1
echo LEAK_DONE