nx_aposematism_test.nx source
↩ module page · 75 lines · 3247 B
1// nx_aposematism_test.nx -- smoke for nx_aposematism.
2
3import "nx_syscalls.nx"
4import "nx_aposematism.nx"
5
6func main() -> i64 {
7 // 1: display enum sealed
8 if NX_AP_N_DISPLAYS != 8 { return 1 }
9 if nx_ap_display_is_valid(NX_AP_SIEM_MONITORED) != 1 { return 2 }
10 if nx_ap_display_is_valid(NX_AP_INCIDENT_RESPONSE) != 1 { return 3 }
11 if nx_ap_display_is_valid(-1) != 0 { return 4 }
12 if nx_ap_display_is_valid(8) != 0 { return 5 }
13
14 // 2: backoff probabilities are ordered: compliance > classified
15 // > incident > high_value/honeypot > forensic > siem > none
16 let b_comp: nx_int = nx_ap_display_backoff_q10(NX_AP_COMPLIANCE_AUDITED)
17 let b_class: nx_int = nx_ap_display_backoff_q10(NX_AP_CLASSIFIED_TIER)
18 let b_ir: nx_int = nx_ap_display_backoff_q10(NX_AP_INCIDENT_RESPONSE)
19 let b_hvt: nx_int = nx_ap_display_backoff_q10(NX_AP_HIGH_VALUE_TARGET)
20 let b_hon: nx_int = nx_ap_display_backoff_q10(NX_AP_HONEYPOT_SUSPECT)
21 let b_fl: nx_int = nx_ap_display_backoff_q10(NX_AP_FORENSIC_LOGGED)
22 let b_siem: nx_int = nx_ap_display_backoff_q10(NX_AP_SIEM_MONITORED)
23 let b_none: nx_int = nx_ap_display_backoff_q10(NX_AP_NONE)
24 if b_comp <= b_class { return 6 }
25 if b_class <= b_ir { return 7 }
26 if b_ir <= b_hvt { return 8 }
27 if b_hvt < b_hon { return 9 } // tied
28 if b_hvt <= b_fl { return 10 }
29 if b_fl <= b_siem { return 11 }
30 if b_siem <= b_none { return 12 }
31 if b_none != 0 { return 13 }
32
33 // 3: pattern construction
34 let sig: *u8 = (sys_mmap(16)) as *u8
35 sig[0] = 83 as u8 // 'S'
36 sig[1] = 73 as u8 // 'I'
37 sig[2] = 69 as u8 // 'E'
38 sig[3] = 77 as u8 // 'M'
39 let p1: *NxWarningPattern = nx_ap_pattern_new(NX_AP_SIEM_MONITORED, sig, 4)
40 if p1.display != NX_AP_SIEM_MONITORED { return 14 }
41 if p1.signature_len != 4 { return 15 }
42 if p1.estimated_backoff_q10 != 410 { return 16 }
43
44 let p2: *NxWarningPattern = nx_ap_pattern_new(NX_AP_COMPLIANCE_AUDITED, sig, 4)
45 if p2.estimated_backoff_q10 != 870 { return 17 }
46
47 // 4: combined backoff -- stacking increases backoff
48 let arr2: **NxWarningPattern = (sys_mmap(16)) as **NxWarningPattern
49 let slot0: *i64 = (arr2 as i64) as *i64
50 let slot1: *i64 = (arr2 as i64 + 8) as *i64
51 slot0[0] = p1 as i64
52 slot1[0] = p2 as i64
53 let combined: nx_int = nx_ap_combined_backoff_q10(arr2, 2)
54 // Single SIEM is 410; single COMPLIANCE is 870. Combined:
55 // 1 - (1 - 410/1024)(1 - 870/1024) = 1 - (614/1024)(154/1024)
56 // = 1 - 92316/1048576 = 1 - ~88 in Q10 -> ~936
57 if combined < 900 { return 18 }
58 if combined < b_comp { return 19 } // stacked must exceed each
59
60 // 5: combined of empty list is 0
61 let arr0: **NxWarningPattern = (sys_mmap(8)) as **NxWarningPattern
62 if nx_ap_combined_backoff_q10(arr0, 0) != 0 { return 20 }
63
64 // 6: emit_warning_bytes copies sig into destination
65 let dst: *u8 = (sys_mmap(32)) as *u8
66 let written: nx_size = nx_ap_emit_warning_bytes(p1, dst, 32)
67 if written != 4 { return 21 }
68 if (dst[0] as i64) & 255 != 83 { return 22 }
69 if (dst[3] as i64) & 255 != 77 { return 23 }
70
71 // 7: emit refuses when dst too small
72 if nx_ap_emit_warning_bytes(p1, dst, 2) != 0 { return 24 }
73
74 return 0
75}