#!/bin/sh
# DF-0430 run — injects a PFSYNC_ACT_CLR(ifname="",creatorid=0xdeadbeef) mass-delete trigger.
# Requires root on the guest (raw socket). Build first: ./build.sh
#
# The demonstration is a NEGATIVE result: because pfsync_input is dead code
# (not registered as proto-240 handler), the packet deletes no pf state,
# increments no pfsyncstats, produces no observable pfsync activity.
set -e
cd "$(dirname "$0")"
echo "--- handler registration check ---"
nm /boot/kernel/kernel.debug 2>/dev/null | grep -w pfsync_input || echo "pfsync_input: ABSENT from static kernel (dead code)"
echo "--- BEFORE ---"
netstat -sp ip 2>/dev/null | grep -iE "unknown|unsupported" | head
pfctl -s states 2>/dev/null | wc -l
echo "--- INJECT CLR ---"
./inject_clr 10.0.2.99 224.0.0.240 0xdeadbeef
sleep 2
echo "--- AFTER ---"
netstat -sp ip 2>/dev/null | grep -iE "unknown|unsupported" | head
netstat -sp pfsync 2>/dev/null | grep -iE "received|input" | head || echo "(no pfsync protocol registered)"
pfctl -s states 2>/dev/null | wc -l
echo "RESULT: no state deletion, no pfsyncstats => pfsync_input unreachable (DF-0430 dead code)"