code wiki / _hdl_build / nx_cap_capacity_gate_t186.nx
nx_cap_capacity_gate_t186.nx source
↩ module page · 144 lines · 10601 B
1// nx_cap_capacity_gate_t186.nx -- Verifies cryptographic authorization of 36 grants against a published allowlist and token.
2import "nx_mgmt_cap_candidate_t186.nx"
3import "nx_gate_verdict.nx"
4func cap187_actual_scope(c:*i64,out:*u8)->i64{
5 // Exact public grant names read from the default local capability; no secret.
6 let csv:*u8="nx_fs,nx_fs_write,nx_shelltool,nx_debt,nx_job_run,nx_filehash,nx_sov_build_run,nx_health,nx_stage_alias,nx_resmon,nx_absent,nx_catalog,nx_store_put,nx_https_get,nx_behaveprobe,nx_contentdiff,nx_compare_rank,nx_build_admit,nx_capsearch,nx_filecopy,nx_swcompare_evidence,nx_offc_install,nx_gate_bite,nx_organ_ship,nx_page_verify,nx_domain_admit,nx_toolatency,nx_research_fetch,nx_video_h2h,nx_compile_wat,nx_wat_compiler,nx_spendgate,nx_gatefresh,nx_stale_check,nx_restage,nx_site_publish";let cn:i64=486
7 let row:*u8="\t/tmp/fixture.elf\tGREEN\n"
8 let registry:*u8=sys_mmap(cn+36*fi_len(row)+1);var start:i64=0;var r:i64=0
9 while start<cn{var end:i64=start;while end<cn && csv[end]!=44 as u8{end=end+1}
10 r=capt_catb(registry,r,csv+start,end-start);r=ma_cap_cat(registry,r,row);start=end+1
11 }
12 if dp_writefile("tool_allowlist.conf",registry,r)!=0{return 3}
13 let req:*u8=cap186_request(csv,"&days=1&nonce=187&confirm=yes")
14 let n:i64=ma_do_cap_mint_at(req,fi_len(req),out,SD_OUTCAP,"fixture.key","audit.log")
15 let pos:i64=ma_find(out,n,"\"cap\":\"")
16 if pos<0{return 3}
17 let token:*u8=out+pos+7;var tn:i64=0;while pos+7+tn<n && token[tn]!=34 as u8{tn=tn+1}
18 var same:i64=1;var i:i64=0;while i<cn{if token[i]!=csv[i]{same=0};i=i+1}
19 gv_check("actual470-byte35-grant scope preserved with486-byte publisher scope",same==1 && token[cn]==126 as u8,c)
20 let key:*u8="fixture-key-not-a-production-secret-186";let now:i64=sys_now_realtime_sec()
21 var all:i64=1;var count:i64=0;start=0
22 while start<cn{var end:i64=start;while end<cn && csv[end]!=44 as u8{end=end+1}
23 if capt_verify(key,fi_len(key),token,tn,csv+start,end-start,now)!=CAPT_OK{all=0}
24 count=count+1;start=end+1
25 }
26 gv_check("all36 exact grants cryptographically authorized",all==1 && count==36,c)
27 return 0
28}
29func cap186_request(allow:*u8,suffix:*u8)->*u8{
30 let prefix:*u8="POST /api/cap/mint HTTP/1.1\r\nHost: fixture\r\n\r\nallow="
31 let cap:i64=fi_len(prefix)+fi_len(allow)+fi_len(suffix)+1;let out:*u8=sys_mmap(cap)
32 var p:i64=sd_cat(out,0,prefix);p=sd_cat(out,p,allow);p=sd_cat(out,p,suffix);return out
33}
34func cap186_positive(count:i64,c:*i64,out:*u8)->i64{
35 let per:i64=fi_len("tool_")+capt_decimal_bytes(count)+1
36 let capacity:i64=count*per+fi_len("nx_site_publish")+1
37 let allow:*u8=sys_mmap(capacity)
38 let row_overhead:i64=fi_len("\t/tmp/fixture.elf\tGREEN\n")
39 let registry:*u8=sys_mmap(capacity+(count+1)*row_overhead+1)
40 var a:i64=0;var r:i64=0;var i:i64=0;let name:*u8=sys_mmap(per+1)
41 while i<count{
42 var n:i64=sd_cat(name,0,"tool_");n=sd_catn(name,n,i);name[n]=0 as u8
43 a=sd_cat(allow,a,name);a=sd_cat(allow,a,",")
44 r=sd_cat(registry,r,name);r=sd_cat(registry,r,"\t/tmp/fixture.elf\tGREEN\n");i=i+1
45 }
46 a=sd_cat(allow,a,"nx_site_publish")
47 r=sd_cat(registry,r,"nx_site_publish\t/tmp/fixture.elf\tGREEN\n")
48 if dp_writefile("tool_allowlist.conf",registry,r)!=0{return 3}
49 let req:*u8=cap186_request(allow,"&days=1&nonce=186&confirm=yes")
50 let n:i64=ma_do_cap_mint_at(req,fi_len(req),out,SD_OUTCAP,"fixture.key","audit.log")
51 gv_check("complete allow list minted without ceiling",n>0 && dp_contains(out,n,"200 OK")==1 && dp_contains(out,n,"\"MINTED\"")==1,c)
52 let pos:i64=ma_find(out,n,"\"cap\":\"")
53 if pos<0{return 1}
54 let token:*u8=out+pos+7;var tn:i64=0;while token[tn]!=34 as u8 && pos+7+tn<n{tn=tn+1}
55 var equal:i64=1;i=0;while i<a{if token[i]!=allow[i]{equal=0};i=i+1}
56 gv_check("all original allow bytes preserved exactly",equal==1 && token[a]==126 as u8,c)
57 let key:*u8="fixture-key-not-a-production-secret-186"
58 let now:i64=sys_now_realtime_sec()
59 gv_check("actual signature verifies first grant",capt_verify(key,fi_len(key),token,tn,"tool_0",6,now)==CAPT_OK,c)
60 gv_check("actual signature verifies publisher grant",capt_verify(key,fi_len(key),token,tn,"nx_site_publish",15,now)==CAPT_OK,c)
61 gv_check("unlisted tool remains denied",capt_verify(key,fi_len(key),token,tn,"unlisted",8,now)==CAPT_DENY_TOOL,c)
62 gv_check("expired capability remains denied",capt_verify(key,fi_len(key),token,tn,"nx_site_publish",15,now+CM_SECS_PER_DAY*2)==CAPT_DENY_EXP,c)
63 let saved:u8=token[0];token[0]=88 as u8
64 gv_check("tampered capability remains denied",capt_verify(key,fi_len(key),token,tn,"nx_site_publish",15,now)==CAPT_DENY_MAC,c);token[0]=saved
65 let cap:i64=capt_issue_capacity(a,now+CM_SECS_PER_DAY,186);let direct:*u8=sys_mmap(cap)
66 direct[0]=90 as u8
67 gv_check("insufficient caller buffer refused before write",cm_mint(key,fi_len(key),allow,a,now+CM_SECS_PER_DAY,186,direct,cap-1)<0 && direct[0]==90 as u8,c)
68 sys_write(1,"allow_bytes=",12);let num:*u8=sys_mmap(32);let nn:i64=sd_catn(num,0,a);sys_write(1,num,nn);sys_write(1,"\n",1)
69 return 0
70}
71func cap186_negative(body:*u8,reason:*u8,c:*i64,out:*u8)->i64{
72 let req:*u8=cap186_request(body,"")
73 let n:i64=ma_do_cap_mint_at(req,fi_len(req),out,SD_OUTCAP,"fixture.key","audit.log")
74 gv_check(reason,n>0 && dp_contains(out,n,"400 Bad Request")==1 && dp_contains(out,n,"\"token_emitted\":false")==1,c);return 0
75}
76func main()->i64{
77 let c:*i64=gv_ctr();gv_head("Complete capability issuance follows admitted lengths")
78 let root:*u8=sys_mmap(128);var n:i64=sd_cat(root,0,"/tmp/nishi-capacity-t186-");n=sd_catn(root,n,sys_now_ms())
79 if sys_mkdir(root,MODE_0755)!=0 || sys_chdir(root)!=0{return 3}
80 let key:*u8="fixture-key-not-a-production-secret-186"
81 if dp_writefile("fixture.key",key,fi_len(key))!=0{return 3}
82 let out:*u8=sys_mmap(SD_OUTCAP)
83 if cap186_positive(35,c,out)!=0{return 3}
84 if cap186_positive(120,c,out)!=0{return 3}
85 if cap186_positive(600,c,out)!=0{return 3}
86 cap186_negative("*&confirm=yes","API wildcard stays refused",c,out)
87 cap186_negative("tool_0,,nx_site_publish&confirm=yes","malformed CSV refused",c,out)
88 cap186_negative("tool_0,missing&confirm=yes","unregistered grant refused",c,out)
89 cap186_negative("tool_0&nonce=abc186&confirm=yes","nonce junk no longer silently parsed",c,out)
90 cap186_negative("tool_0&nonce=9223372036854775808&confirm=yes","nonce overflow refused",c,out)
91 cap186_negative("tool_0&days=0&confirm=yes","expiry policy preserved",c,out)
92 cap186_negative("tool_0&days=1&exp=9999999999&confirm=yes","conflicting expiry refused",c,out)
93 cap186_negative("tool_0&allow=nx_site_publish&confirm=yes","duplicate allow refused",c,out)
94 cap186_negative("tool_0","confirmation remains required",c,out)
95 gv_check("representable size overflow refused",capt_issue_capacity(CAPT_SIZE_MAX,100,1)<0,c)
96 out[0]=90 as u8
97 let refused_alloc:i64=capt_issue(key,fi_len(key),"a",CAPT_SIZE_MAX-100,100,1,out,CAPT_SIZE_MAX)
98 gv_check("unrepresentable SHA extent refused before touching output",refused_alloc<0 && out[0]==90 as u8,c)
99 let req:*u8=cap186_request("tool_0","&days=1&nonce=186&confirm=yes")
100 let missing_key:i64=ma_do_cap_mint_at(req,fi_len(req),out,SD_OUTCAP,"absent.key","audit.log")
101 gv_check("unavailable signing dependency returns503 no token",missing_key>0 && dp_contains(out,missing_key,"503 Service Unavailable")==1 && dp_contains(out,missing_key,"\"token_emitted\":false")==1,c)
102 let no_audit:i64=ma_do_cap_mint_at(req,fi_len(req),out,SD_OUTCAP,"fixture.key","absent/audit.log")
103 gv_check("unavailable audit withholds token",no_audit>0 && dp_contains(out,no_audit,"503 Service Unavailable")==1 && dp_contains(out,no_audit,"\"token_emitted\":false")==1,c)
104 out[0]=90 as u8
105 let small:i64=ma_do_cap_mint_at(req,fi_len(req),out,1,"fixture.key","audit.log")
106 gv_check("tiny response budget returns no response without write",small==MA_CAP_NO_RESPONSE && out[0]==90 as u8,c)
107 // A genuinely three-byte backing allocation exposes a one-byte destination
108 // between sentinels. Unlike the old large backing buffer, adjacent writes fail.
109 let tiny:*u8=sys_mmap_try(3);if (tiny as i64)<=0{return 3}
110 tiny[0]=71 as u8;tiny[1]=72 as u8;tiny[2]=73 as u8
111 let tiny_result:i64=ma_do_cap_mint_at(req,fi_len(req),tiny+1,1,"fixture.key","audit.log")
112 gv_check("one-byte destination preserves both neighboring bytes",tiny_result==MA_CAP_NO_RESPONSE && tiny[0]==71 as u8 && tiny[1]==72 as u8 && tiny[2]==73 as u8,c)
113 let listener:i64=sys_unix_listen("mint-transport.sock",1);if listener<0{return 3}
114 let client:i64=sys_unix_connect_fd("mint-transport.sock");if client<0{sys_close(listener);return 3}
115 let server:i64=sys_accept(listener);sys_close(listener);if server<0{sys_close(client);return 3}
116 let sent:i64=nx_http_server_send_response_nokeep_close(server,tiny+1,tiny_result)
117 sys_close(server)
118 let received:i64=sys_read(client,out,SD_OUTCAP);sys_close(client)
119 gv_check("actual HTTP sender rejects negative result and sends no success",sent==NXS_BAD_ARG && received==0,c)
120 if sys_munmap_direct(tiny,3)!=0{return 3}
121 let parsed:*NxCapMintInput=sys_mmap(__size_of(NxCapMintInput)) as *NxCapMintInput
122 let limits:*i64=sys_mmap(__size_of(i64)*2) as *i64;limits[0]=0;limits[1]=0
123 let wait:*i64=sys_mmap(__size_of(i64)) as *i64;*wait=0
124 let now:i64=sys_now_realtime_sec();let bodyoff:i64=sd_body_off(req,fi_len(req))
125 if ma_cap_input_read(req+bodyoff,fi_len(req)-bodyoff,now,parsed)!=0{return 3}
126 let pid:i64=sys_fork()
127 if pid==0{
128 if nx_prlimit(0,RLIMIT_AS,limits as *u8,0 as *u8)!=0{sys_exit_group(20)}
129 if (sys_mmap_try(1) as i64)>0{sys_exit_group(21)}
130 let denied:i64=ma_do_cap_mint_at(req,fi_len(req),out,SD_OUTCAP,"fixture.key","audit.log")
131 if denied<=0 || dp_contains(out,denied,"503 Service Unavailable")!=1 || dp_contains(out,denied,"token_emitted")!=1{sys_exit_group(22)}
132 let later:i64=ma_cap_issue_response(parsed,now,"fixture.key","audit.log",out,SD_OUTCAP)
133 if later<=0 || dp_contains(out,later,"503 Service Unavailable")!=1{sys_exit_group(23)}
134 out[0]=90 as u8
135 if ma_do_cap_mint_at(req,fi_len(req),out,1,"fixture.key","audit.log")!=MA_CAP_NO_RESPONSE || out[0]!=90 as u8{sys_exit_group(24)}
136 if cm_mint_file("fixture.key","tool_0",6,now+CM_SECS_PER_DAY,187,out,SD_OUTCAP)!=CAPT_ERR_ALLOC{sys_exit_group(25)}
137 if capt_issue(key,fi_len(key),"tool_0",6,now+CM_SECS_PER_DAY,187,out,SD_OUTCAP)!=CAPT_ERR_ALLOC{sys_exit_group(26)}
138 sys_exit_group(0)
139 }
140 if pid<0{return 3}
141 gv_check("actual handler and later issuance stages survive allocation denial",sys_wait4(pid,wait,0)==pid && wait_status_rc(*wait)==0,c)
142 if cap187_actual_scope(c,out)!=0{return 3}
143 return gv_verdict("capability-capacity",c,"Real native signatures, actual handler, isolated test key and audit; no production credentials minted")
144}