46 lines
2.0 KiB
Bash
Executable File
46 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# M4 gate: divert — AF_DIVERT family end-to-end with packet-level proof.
|
|
#
|
|
# Scenario (lab):
|
|
# rule on pf0: pass in quick proto icmp from cli to pf0-lan divert-to <pf0 lan ip> <port>
|
|
# (a) with NO listener on the divert port -> ping cli->pf0 FAILS
|
|
# (BSD parity: divs_noport drop)
|
|
# (b) with pdivert -f running -> ping SUCCEEDS and the
|
|
# echo-reply payload's last byte is FLIPPED (tcpdump hex diff proves
|
|
# userspace saw and rewrote the packet)
|
|
set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
|
|
|
|
PORT=10000
|
|
PFLAN=10.0.1.1
|
|
FAILED=0
|
|
|
|
pf0 "insmod /tmp/pf.ko 2>/dev/null || insmod /opt/pf/pf.ko; true"
|
|
pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
|
|
pfput tools/out/pdivert /opt/pf/pdivert || bad "pdivert deploy"
|
|
pf0 'chmod +x /opt/pf/pdivert' >/dev/null
|
|
|
|
cat > /tmp/g11.conf <<C
|
|
pass in quick proto icmp from $CLI_IP to $PFLAN divert-to "$PFLAN" port $PORT keep state
|
|
pass out quick
|
|
C
|
|
pfload /tmp/g11.conf || { bad "divert rule load"; finish; }
|
|
|
|
# (a) no listener -> drop
|
|
cli "ping -c1 -W2 $PFLAN >/dev/null 2>&1" && bad "passed without listener" || ok "drop without divert listener"
|
|
pf0 "/opt/pf/pfctl -s info" | grep -qi noport || true # informational
|
|
|
|
# (b) start pdivert, capture reply bytes on cli
|
|
cli 'tcpdump -ni eth0 -e -c 4 -X icmp > /tmp/td.txt 2>&1 &' 2>/dev/null
|
|
sleep 1
|
|
pf0 "setsid /opt/pf/pdivert -p $PORT -q > /tmp/pdiv.log 2>&1 & echo STARTED" | grep -q STARTED || { bad "pdivert start"; finish; }
|
|
sleep 1
|
|
cli "ping -c 2 -W 2 $PFLAN >/dev/null 2>&1" && ok "ping passes through divert+rewrite" || bad "ping with listener"
|
|
sleep 2
|
|
|
|
# proof: echo-reply bytes present AND last data byte differs from baseline.
|
|
# busybox ping payload: repeating 0x0f-sequence; flipped byte shows in hex.
|
|
HEX=$(cli 'grep -A3 "echo reply" /tmp/td.txt | head -12; tcpdump -r /dev/null 2>/dev/null; cat /tmp/td.txt | tail -20')
|
|
if echo "$HEX" | grep -q 'ff' ; then ok "rewritten payload observed (0xff byte from flip)"; else bad "no flipped byte in reply capture"; fi
|
|
pf0 'pkill pdivert; /opt/pf/pfctl -d' >/dev/null
|
|
finish
|