#!/bin/sh
# DF-3340 fix validation (run as root, patched pf.ko pre-loaded as "pf").
# Re-runs the EXACT baseline trigger (synproxy PROXY:DST -> expiry purge)
# and additionally captures lo0 to prove the deferred RST is still emitted.
set -x
date
kldstat -n pf

cat > /tmp/df3340.conf <<EOF
set timeout tcp.first 5
pass in quick on lo0 inet proto tcp from 127.0.0.0/8 to 127.0.0.1 port 8080 flags S/SA synproxy state
EOF

pfctl -F all >/dev/null 2>&1 || true
pfctl -f /tmp/df3340.conf || exit 1
pfctl -e 2>/dev/null || true

tcpdump -i lo0 -n -c 12 tcp port 8080 > /tmp/df3340_cap.txt 2>&1 &
TDPID=$!
sleep 1

nc 127.0.0.1 8080 </dev/null &
sleep 2
echo "--- states at t+2s (expect PROXY:DST):"
pfctl -s state
sleep 12
echo "--- SURVIVED t+14s (expected on patched module):"
pfctl -s state
pfctl -s info | grep -E "states|State"
kill $TDPID 2>/dev/null
sleep 1
echo "--- lo0 capture (expect spoofed RST 127.0.0.1.8080 -> client):"
cat /tmp/df3340_cap.txt
echo "--- dmesg tail:"
dmesg | tail -5
date