#!/bin/sh
# run.sh — demonstrate the negative result.
#
# Prereq (run as root on the guest, ONCE):
#     kldload pf.ko ; pfctl -e ; ifconfig pfsync0 create
#
# This script injects a crafted IPPROTO_PFSYNC(240) CLR packet from a
# spoofed on-link source. On the current master DEV kernel the packet
# hits the RAW wildcard handler (rip_input) and is dropped — pfsync_input
# is never invoked. We print evidence of that: no kernel message, no
# pfsync protocol in netstat -s, no pf-state change.
#
# Run as root (raw socket). Usage: ./run.sh
set -e
cd "$(dirname "$0")"

echo "=== before injection: netstat -s protocols (note: NO pfsync) ==="
netstat -s 2>&1 | grep -iE "^(icmp|igmp|tcp|udp|ip|pfsync|carp|ip6|icmp6)" | head

echo
echo "=== dmesg line count (to detect new kernel messages) ==="
DMESG_BEFORE=$(dmesg | wc -l)
echo "before = $DMESG_BEFORE"

echo
echo "=== inject proto-240 CLR packet from spoofed 10.0.2.99 -> 224.0.0.240 ==="
./inject_pfsync 10.0.2.99 224.0.0.240 0xdeadbeef

sleep 2

echo
echo "=== dmesg after injection (should be UNCHANGED) ==="
DMESG_AFTER=$(dmesg | wc -l)
echo "after = $DMESG_AFTER"
dmesg | tail -3

echo
echo "=== netstat -s protocols after (still NO pfsync => handler not registered) ==="
netstat -s 2>&1 | grep -iE "^(icmp|igmp|tcp|udp|ip|pfsync|carp|ip6|icmp6)" | head

echo
echo "=== verdict ==="
echo "If no new dmesg line and no pfsync protocol appears above, pfsync_input"
echo "was never reached -> DF-0428's claimed injection surface does not exist."