nx_capability_route_gate.nx source

1// nx_capability_route_gate.nx -- MEASURED unit gate for the global functionality split (nx_capability_route). 2// Pure/offline (crafted host strings, no socket): proves capabilities route to subdomains and visitor content to 3// the bare/www host, GLOBALLY (same rule every domain), with the leading-label dot required (no false matches). 4// T1 admin.<d> -> CR_ADMIN T2 mail.<d> -> CR_MAIL 5// T3 <d> -> CR_CONTENT T4 www.<d> -> CR_CONTENT 6// T5 GLOBAL: admin.<otherdomain> -> CR_ADMIN AND mail.<thirddomain> -> CR_MAIL (not per-domain) 7// T6 backend ports: ADMIN=8456 MAIL=8457 CONTENT=0 8// T7 neg-control: "administrative.com" -> CR_CONTENT (dot required) AND case-insensitive ADMIN.X -> CR_ADMIN 9// GREEN iff 7/7. Appends knowledge/status/capability_route_gate.log. license_tier: ORIGINAL 10import "nx_capability_route.nx" 11import "nx_g_puts_lib.nx" 12import "nx_syscalls.nx" 13 14func g_num(v: i64) -> i64 { 15 let bb: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m; sys_write(1, "-" as *u8, 1) } 16 let t: *u8 = sys_mmap(28); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } 17 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 18 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(1, bb, k); return 0 19} 20func g_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 21func g_wn(fd: i64, v: i64) -> i64 { 22 let bb: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m } 23 let t: *u8 = sys_mmap(28); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } 24 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 25 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(fd, bb, k); return 0 26} 27func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 28func cap_of(h: *u8) -> i64 { return cr_capability(h, g_slen(h)) } 29 30func main() -> i64 { 31 g_puts("=== CAPABILITY ROUTE GATE (global functionality split: mail./admin. subdomains vs <d>/paths content) ===\n" as *u8) 32 var pass: i64 = 0 33 34 var t1: i64 = 0; if cap_of("admin.andelinwest.com" as *u8) == CR_ADMIN { t1 = 1 } pass = pass + t1 35 g_puts(" T1 admin.<d> -> ADMIN: "); if t1 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 36 37 var t2: i64 = 0; if cap_of("mail.andelinwest.com" as *u8) == CR_MAIL { t2 = 1 } pass = pass + t2 38 g_puts(" T2 mail.<d> -> MAIL: "); if t2 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 39 40 var t3: i64 = 0; if cap_of("andelinwest.com" as *u8) == CR_CONTENT { t3 = 1 } pass = pass + t3 41 g_puts(" T3 <d> -> CONTENT: "); if t3 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 42 43 var t4: i64 = 0; if cap_of("www.andelinwest.com" as *u8) == CR_CONTENT { t4 = 1 } pass = pass + t4 44 g_puts(" T4 www.<d> -> CONTENT: "); if t4 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 45 46 var t5: i64 = 0 47 if cap_of("admin.nishifamily.com" as *u8) == CR_ADMIN { if cap_of("mail.jasonewest.com" as *u8) == CR_MAIL { t5 = 1 } } 48 pass = pass + t5 49 g_puts(" T5 GLOBAL (same rule every domain): "); if t5 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 50 51 var t6: i64 = 0 52 if cr_backend_port(CR_ADMIN) == 8456 { if cr_backend_port(CR_MAIL) == 8457 { if cr_backend_port(CR_CONTENT) == 0 { t6 = 1 } } } 53 pass = pass + t6 54 g_puts(" T6 backend ports (admin=8456 mail=8457 content=0): "); if t6 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 55 56 var t7: i64 = 0 57 if cap_of("administrative.com" as *u8) == CR_CONTENT { if cap_of("ADMIN.X.COM" as *u8) == CR_ADMIN { t7 = 1 } } 58 pass = pass + t7 59 g_puts(" T7 neg-control (dot-required + case-insensitive): "); if t7 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 60 61 g_puts("----\nCAPABILITY-ROUTE rows=7 pass="); g_num(pass); g_puts("\n" as *u8) 62 let lg: i64 = sys_openat_append("knowledge/status/capability_route_gate.log" as *u8, 0x1a4) 63 if lg >= 0 { 64 g_w(lg, "CAPABILITY-ROUTE admin_sub="); g_wn(lg, t1); g_w(lg, " mail_sub="); g_wn(lg, t2); g_w(lg, " content_bare="); g_wn(lg, t3) 65 g_w(lg, " content_www="); g_wn(lg, t4); g_w(lg, " global="); g_wn(lg, t5); g_w(lg, " ports="); g_wn(lg, t6); g_w(lg, " negctrl="); g_wn(lg, t7) 66 g_w(lg, " rows=7 pass="); g_wn(lg, pass) 67 if pass == 7 { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } 68 sys_close(lg) 69 } 70 if pass == 7 { g_puts("CAPABILITY-ROUTE GREEN (mail./admin. capability subdomains vs <d>/path content, global -- measured)\n" as *u8); sys_exit(0); return 0 } 71 g_puts("CAPABILITY-ROUTE RED\n" as *u8); sys_exit(1); return 1 72}