code wiki / _hdl_build / nx_cms_fuzz_gate.nx

nx_cms_fuzz_gate.nx

buildroot/runtime/_hdl_build/nx_cms_fuzz_gate.nx

11887 B276 linesdepth 5pulls 6 transitivereach 0 importersview sourcekind gate/prooftopic cms

docs dependencies structs consts functions

about

nx_cms_fuzz_gate.nx -- C6b SECURITY GATE (the Engineer/Auditor's adversarial instrument). The CMS editor is the ONLY untrusted-input surface (spec rule 12); this gate ATTACKS the real running daemon with hostile HTTP and proves it degrades gracefully (rule 14): never crashes, never reflects an injected response header, never serves a route that should not exist, and is STILL ALIVE after the barrage (a clean GET / succeeds at the end). Boots its OWN nx_cms_admin via nx_sov_build_run (prove- all: /tmp is contested), plays the attacks with the team's own HTTP client, appends a row=nx_cms_fuzz verdict=PASS|FAIL line to knowledge/status/cms_gate.log so the arc board routes on it. Exit 0 iff all attacks contained. license_tier: ORIGINAL

dependencies 3 imports · 0 importers

imports: nx_syscalls.nxnx_connect.nxnx_kill_portable.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

13	const CF_PORT: i64 = 8078
14	const CF_SITE: *u8 = "/tmp/_cms_fuzz_site"

functions

16	func cf_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 2: cf_row main calls 1: sys_write
17	func cf_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 1: cf_index
18	func cf_cat(dst: u8, off: i64, s: u8) -> i64 called by 2: cf_alive main
24	func cf_index(hay: u8, n: i64, needle: u8) -> i64 called by 1: cf_has calls 1: cf_len
36	func cf_has(hay: u8, n: i64, needle: u8) -> i64 { if cf_index(hay, n, needle) >= 0 { return 1 } return 0 } called by 3: cf_alive cf_no_5xx main calls 1: cf_index
38	func cf_mkdir(path: *u8, mode: i64) -> i64 called by 1: main calls 1: sys_mmap
43	func cf_copy(src: u8, dst: u8) -> i64 called by 1: main calls 6: sys_openat_rd sys_openat_wr sys_close sys_mmap sys_read sys_write
60	func cf_send(raw: u8, rl: i64, resp: u8, cap: i64) -> i64 called by 2: cf_alive main calls 7: sys_socket sys_mmap nx_connect_bounded sys_close sys_write sys_set_socket_timeout+1
95	func cf_alive(resp: *u8, cap: i64) -> i64 called by 1: main calls 4: sys_mmap cf_cat cf_send cf_has
107	func cf_no_5xx(resp: *u8, rn: i64) -> i64 called by 1: main calls 1: cf_has
115	func cf_row(id: i64, ok: i64, what: *u8) -> i64 called by 1: main calls 2: cf_w sys_mmap
125	func main() -> i64 calls 22: cf_mkdir cf_copy sys_openat_wr sys_write sys_close sys_fork+16