#!/bin/sh
# DF-0220 fresh-boot probe (guest, run as root right after vm.sh reset).
# Builds and runs, in one shot:
#   1. ref_keystream (degenerate + zero-key reference)
#   2. rand_probe    (64 B from /dev/urandom, /dev/random, getrandom, kern.random) as USER
#   3. zero_scan     (15 s unprivileged window scan on all 3 interfaces) as USER
#   4. csprng_force_zero info (per-CPU state introspection at earliest ssh)
# Output is fully untrimmed for the evidence pack.
set -e
cd /tmp/rng220

echo "### uname"; uname -a
echo "### uptime_at_start"; uptime

echo; echo "### build"
cc -O2 -o rand_probe rand_probe.c
cc -O2 -o ref_keystream ref_keystream.c
cc -O2 -o zero_scan zero_scan.c
cc -O2 -o csprng_force_zero csprng_force_zero.c
echo "BUILD_OK"

echo; echo "### ref degenerate keystream (all-zero ctx)"
./ref_keystream 32
echo; echo "### ref zero-key chacha20 (post-first-rekey state)"
./ref_keystream 32 zerokey

echo; echo "### rand_probe AS UNPRIVILEGED USER (maxx)"
su -m maxx -c /tmp/rng220/rand_probe

echo; echo "### zero_scan AS UNPRIVILEGED USER (maxx)"
su -m maxx -c '/tmp/rng220/zero_scan 15'

echo; echo "### csprng per-CPU state at earliest-ssh moment (root, kmem)"
SYM=$(nm /boot/kernel/kernel | awk '/ csprng_pcpu$/ {print $1}')
./csprng_force_zero 0x$SYM info

echo; echo "### sysctl"
sysctl kern.rand_mode
echo "PROBE_DONE"