#!/usr/bin/env bash
# AFFINE.EARTH PLANETARY CIVIC SHIELD — KERNEL L3 BLACKHOLE, SOCKET SEVER & NFTABLES/PF ENFORCER
# Seal: 782423a14eb5 | Drops verified botnet & abliterated AI-agent C2 subnets in < 1 microsecond.
set -euo pipefail

if [ "$(uname -s)" = "Linux" ]; then
  echo "[Affine Civic Shield] Engaging Linux Kernel L3 blackholes & severing active TCP sockets..."
  ip route replace blackhole 3.236.142.19/32 && ss -K dst 3.236.142.19/32 2>/dev/null || true # BA-IT6-01 AS16509 (US)
  ip route replace blackhole 91.92.240.0/24 && ss -K dst 91.92.240.0/24 2>/dev/null || true # BA-IT6-03 AS209588 (BG)
  ip route replace blackhole 45.61.136.0/24 && ss -K dst 45.61.136.0/24 2>/dev/null || true # BA-IT6-04 AS398962 (PA)
  ip route replace blackhole 103.136.42.0/24 && ss -K dst 103.136.42.0/24 2>/dev/null || true # BA-IT6-05 AS138915 (SG)
  ip route replace blackhole 193.142.146.0/24 && ss -K dst 193.142.146.0/24 2>/dev/null || true # BA-IT6-06 AS211252 (MD)
  ip route replace blackhole 103.152.220.0/24 && ss -K dst 103.152.220.0/24 2>/dev/null || true # BA-IT6-07 AS140627 (HK)
  ip route replace blackhole 177.54.144.0/24 && ss -K dst 177.54.144.0/24 2>/dev/null || true # BA-IT6-08 AS262589 (BR)
  ip route replace blackhole 109.160.32.0/24 && ss -K dst 109.160.32.0/24 2>/dev/null || true # BA-IT1-01 AS43624 (RO)
  ip route replace blackhole 195.178.110.0/24 && ss -K dst 195.178.110.0/24 2>/dev/null || true # BA-IT1-02 AS212238 (LV)
  ip route replace blackhole 2.57.121.0/23 && ss -K dst 2.57.121.0/23 2>/dev/null || true # BA-IT1-03 AS210558 (CY)
  ip route replace blackhole 45.148.10.0/24 && ss -K dst 45.148.10.0/24 2>/dev/null || true # BA-IT1-04 AS212047 (NL)
  ip route replace blackhole 77.239.124.0/24 && ss -K dst 77.239.124.0/24 2>/dev/null || true # BA-IT1-05 AS49870 (CZ)
  ip route replace blackhole 179.43.153.0/24 && ss -K dst 179.43.153.0/24 2>/dev/null || true # BA-IT3-01 AS51396 (CH)

  if command -v nft >/dev/null 2>&1; then
    nft add table inet affine_civic_shield 2>/dev/null || true
    nft flush table inet affine_civic_shield
    nft add set inet affine_civic_shield bad_actor_subnets '{ type ipv4_addr; flags interval; }'
    nft add element inet affine_civic_shield bad_actor_subnets "{ 3.236.142.19/32, 91.92.240.0/24, 45.61.136.0/24, 103.136.42.0/24, 193.142.146.0/24, 103.152.220.0/24, 177.54.144.0/24, 109.160.32.0/24, 195.178.110.0/24, 2.57.121.0/23, 45.148.10.0/24, 77.239.124.0/24, 179.43.153.0/24 }"
    nft add chain inet affine_civic_shield prerouting '{ type filter hook prerouting priority raw; policy accept; }'
    nft add rule inet affine_civic_shield prerouting ip saddr @bad_actor_subnets counter drop
    echo "[Affine Civic Shield] Sealed nftables table inet affine_civic_shield (13 verified entries)."
  fi
elif [ "$(uname -s)" = "Darwin" ]; then
  PF_TABLE="/etc/pf.anchors/earth.affine.civic_shield"
  echo "[Affine Civic Shield] Writing macOS pf table anchor to $PF_TABLE..."
  printf '%s\n' "3.236.142.19/32" "91.92.240.0/24" "45.61.136.0/24" "103.136.42.0/24" "193.142.146.0/24" "103.152.220.0/24" "177.54.144.0/24" "109.160.32.0/24" "195.178.110.0/24" "2.57.121.0/23" "45.148.10.0/24" "77.239.124.0/24" "179.43.153.0/24" > "$PF_TABLE"
  pfctl -a earth.affine.civic_shield -T replace -f "$PF_TABLE" 2>/dev/null || true
  echo "[Affine Civic Shield] Loaded 13 entries into macOS pf anchor earth.affine.civic_shield."
fi