code wiki / _hdl_build / nx_adnet_dash_gate.nx
nx_adnet_dash_gate.nx source
↩ module page · 141 lines · 6381 B
1// nx_adnet_dash_gate.nx -- GATE for the adnet advertiser dashboard (nx_adnet_dash). Proves per-ad
2// aggregate rows (served/clicks/CTR-permil) computed EXACTLY from planted counter logs, totals, the
3// zero-division guard, XSS-escape of advertiser text, the dashboard self-optout marker (a dashboard
4// never carries an injected ad), the honest SERVED-not-viewable label, zero visitor identity, and the
5// ads.txt DIRECT emission. Detector anti-false-green: the scanner FIRES on a planted <script.
6// expect_exit: 0 license_tier: ORIGINAL
7import "nx_syscalls.nx"
8import "_hdl_build/nx_adnet_dash.nx"
9
10func dg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
11func dg_putn(v: i64) -> i64 { var m: i64 = v; if m < 0 { dg_puts("-" as *u8); m = 0 - m } let t: *u8 = sys_mmap(24); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } let o: *u8 = sys_mmap(24); var i: i64 = 0; while i < k { o[i] = t[k - 1 - i]; i = i + 1 } sys_write(1, o, k); return 0 }
12func dg_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64 = off; var i: i64 = 0; while s[i] != (0 as u8) { dst[o] = s[i]; o = o + 1; i = i + 1 } return o }
13func dg_tab(dst: *u8, off: i64) -> i64 { dst[off] = 9 as u8; return off + 1 }
14func dg_nl(dst: *u8, off: i64) -> i64 { dst[off] = 10 as u8; return off + 1 }
15
16func dg_has(hay: *u8, n: i64, needle: *u8) -> i64 {
17 var nl: i64 = 0
18 while needle[nl] != (0 as u8) { nl = nl + 1 }
19 if nl == 0 { return 0 }
20 var i: i64 = 0
21 while i + nl <= n {
22 var j: i64 = 0
23 var eq: i64 = 1
24 while j < nl { if hay[i + j] != needle[j] { eq = 0; break } j = j + 1 }
25 if eq == 1 { return 1 }
26 i = i + 1
27 }
28 return 0
29}
30
31func dg_row6(dst: *u8, off: i64, f0: *u8, f1: *u8, f2: *u8, f3: *u8, f4: *u8, f5: *u8) -> i64 {
32 var o: i64 = off
33 o = dg_cat(dst, o, f0)
34 o = dg_tab(dst, o)
35 o = dg_cat(dst, o, f1)
36 o = dg_tab(dst, o)
37 o = dg_cat(dst, o, f2)
38 o = dg_tab(dst, o)
39 o = dg_cat(dst, o, f3)
40 o = dg_tab(dst, o)
41 o = dg_cat(dst, o, f4)
42 o = dg_tab(dst, o)
43 o = dg_cat(dst, o, f5)
44 o = dg_nl(dst, o)
45 return o
46}
47
48func main() -> i64 {
49 dg_puts("=== nx_adnet_dash_gate ===\n" as *u8)
50 var pass: i64 = 0
51 var fail: i64 = 0
52
53 let inv: *u8 = sys_mmap(4096)
54 var n: i64 = 0
55 n = dg_cat(inv, n, "@host" as *u8)
56 n = dg_tab(inv, n)
57 n = dg_cat(inv, n, "nishifamily.com" as *u8)
58 n = dg_nl(inv, n)
59 n = dg_row6(inv, n, "h1" as *u8, "HomeCo" as *u8, "/adnet/h1.png" as *u8, "https://example.com/h1" as *u8, "home" as *u8, "1" as *u8)
60 n = dg_row6(inv, n, "h2" as *u8, "Evil<script>Co" as *u8, "/adnet/h2.png" as *u8, "/torrent" as *u8, "video" as *u8, "1" as *u8)
61
62 let implog: *u8 = sys_mmap(256)
63 var iln: i64 = 0
64 iln = dg_cat(implog, iln, "h1" as *u8)
65 iln = dg_nl(implog, iln)
66 iln = dg_cat(implog, iln, "h1" as *u8)
67 iln = dg_nl(implog, iln)
68 iln = dg_cat(implog, iln, "h1" as *u8)
69 iln = dg_nl(implog, iln)
70 iln = dg_cat(implog, iln, "h2" as *u8)
71 iln = dg_nl(implog, iln)
72 let clklog: *u8 = sys_mmap(256)
73 var cln: i64 = 0
74 cln = dg_cat(clklog, cln, "h1" as *u8)
75 cln = dg_nl(clklog, cln)
76
77 let page: *u8 = sys_mmap(65536)
78 let w: i64 = and_page(inv, n, implog, iln, clklog, cln, page, 65536)
79
80 // T1 page renders
81 if w > 0 { pass = pass + 1 } else { fail = fail + 1; dg_puts("T1 FAIL render\n" as *u8) }
82
83 // T2 exact per-ad aggregate rows (h1: 3 served, 1 click, ctr 333; h2: 1, 0, 0 -- div0 guarded)
84 var t2: i64 = 1
85 if dg_has(page, w, "<td>h1</td><td>HomeCo</td><td>home</td><td>3</td><td>1</td><td>333</td>" as *u8) == 0 { t2 = 0 }
86 if dg_has(page, w, "<td>1</td><td>0</td><td>0</td>" as *u8) == 0 { t2 = 0 }
87 if t2 == 1 { pass = pass + 1 } else { fail = fail + 1; dg_puts("T2 FAIL aggregate rows\n" as *u8) }
88
89 // T3 totals
90 var t3: i64 = 1
91 if dg_has(page, w, "<th>TOTAL</th><th></th><th></th><th>4</th><th>1</th>" as *u8) == 0 { t3 = 0 }
92 if t3 == 1 { pass = pass + 1 } else { fail = fail + 1; dg_puts("T3 FAIL totals\n" as *u8) }
93
94 // T4 XSS-escape: advertiser <script> escaped, raw tag ABSENT
95 var t4: i64 = 1
96 if dg_has(page, w, "Evil<script>Co" as *u8) == 0 { t4 = 0 }
97 if dg_has(page, w, "<script" as *u8) == 1 { t4 = 0 }
98 if t4 == 1 { pass = pass + 1 } else { fail = fail + 1; dg_puts("T4 FAIL escape\n" as *u8) }
99
100 // T5 self-optout + honest labels + zero visitor identity
101 var t5: i64 = 1
102 if dg_has(page, w, "nx-ad-optout" as *u8) == 0 { t5 = 0 }
103 if dg_has(page, w, "SERVED first-party impressions" as *u8) == 0 { t5 = 0 }
104 if dg_has(page, w, "No visitor identity" as *u8) == 0 { t5 = 0 }
105 if dg_has(page, w, "Set-Cookie" as *u8) == 1 { t5 = 0 }
106 if t5 == 1 { pass = pass + 1 } else { fail = fail + 1; dg_puts("T5 FAIL labels/identity\n" as *u8) }
107
108 // T6 ads.txt DIRECT emission
109 let adst: *u8 = sys_mmap(512)
110 let aw: i64 = and_adstxt("nishifamily.com" as *u8, adst, 512)
111 var t6: i64 = 1
112 if aw <= 0 { t6 = 0 }
113 if dg_has(adst, aw, "nishifamily.com, nishi-adnet, DIRECT" as *u8) == 0 { t6 = 0 }
114 if dg_has(adst, aw, "RESELLER" as *u8) == 1 { t6 = 0 }
115 if t6 == 1 { pass = pass + 1 } else { fail = fail + 1; dg_puts("T6 FAIL ads.txt\n" as *u8) }
116
117 // T7 detector anti-false-green: the scanner FIRES on a planted raw <script
118 let planted: *u8 = "xx <script src=evil> yy" as *u8
119 var t7: i64 = 1
120 if dg_has(planted, 23, "<script" as *u8) == 0 { t7 = 0 }
121 if t7 == 1 { pass = pass + 1 } else { fail = fail + 1; dg_puts("T7 FAIL detector\n" as *u8) }
122
123 dg_puts("pass=" as *u8)
124 dg_putn(pass)
125 dg_puts(" fail=" as *u8)
126 dg_putn(fail)
127 dg_puts("\n" as *u8)
128
129 let log2: *u8 = sys_mmap(256)
130 var lo: i64 = 0
131 if fail == 0 { lo = dg_cat(log2, lo, "ADNETDASH authored=organ verdict=GREEN" as *u8) } else { lo = dg_cat(log2, lo, "ADNETDASH authored=organ verdict=RED" as *u8) }
132 log2[lo] = 10 as u8
133 lo = lo + 1
134 let fd: i64 = sys_openat_wr("knowledge/status/adnet_dash.log" as *u8, 0x1A4)
135 if fd >= 0 { sys_write(fd, log2, lo); sys_close(fd) }
136
137 if fail == 0 { dg_puts("=== ADNET-DASH-GATE verdict=GREEN ===\n" as *u8); sys_exit(0); return 0 }
138 dg_puts("=== ADNET-DASH-GATE verdict=RED ===\n" as *u8)
139 sys_exit(1)
140 return 1
141}