nx_cert_carrier_gate.nx source

1import "nx_gate_base.nx" 2// nx_cert_carrier_gate.nx -- gate the BACKEND trust side of the no-JS cert carrier: trust the identity only with 3// the shared secret; a forged X-Nishi-Cert-Identity without the secret is REJECTED. license_tier: ORIGINAL expect_exit: 0 4import "nx_syscalls.nx" 5import "nx_gate_emit_lib.nx" 6import "_hdl_build/nx_cert_carrier.nx" 7 8func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 9" as *u8); return ok } 10func g_puti(v: i64) -> i64 { let b: *u8=sys_mmap(24); var x: i64=v; if x<0 {b[0]=45;sys_write(1,b,1);x=0-x}; if x==0 {b[0]=48;sys_write(1,b,1);return 0} var d: i64=0; var y: i64=x; while y>0 {d=d+1;y=y/10} var i: i64=d-1; y=x; while i>=0 {b[i]=(48+(y%10)) as u8; y=y/10; i=i-1} sys_write(1,b,d); return 0 } 11func g_contains(buf: *u8, n: i64, needle: *u8) -> i64 { 12 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1} 13 if nl==0 { return 0 } 14 var i: i64=0 15 while i+nl<=n { var j: i64=0; var ok: i64=1; while j<nl { if buf[i+j]!=needle[j] { ok=0; j=nl } else { j=j+1 } } if ok==1 { return 1 } i=i+1 } 16 return 0 17} 18 19func main() -> i64 { 20 g_puts("=== nx_cert_carrier gate (backend trust: identity only WITH the shared secret) ===\n" as *u8) 21 let secret: *u8 = "PROXY-SECRET-7f3a" as *u8 22 let sn: i64 = g_slen(secret) 23 let out: *u8 = sys_mmap(256) 24 var fails: i64 = 0 25 26 // T1: trusted (correct secret) -> the uid (X-Nishi-Cert-Identity) is extracted exactly 27 let r1: *u8 = "GET /wiki/x HTTP/1.1\r\nX-Nishi-Proxy-Auth: PROXY-SECRET-7f3a\r\nX-Nishi-Cert-Identity: deadbeefcafe\r\nHost: x\r\n\r\n" as *u8 28 let u1: i64 = cc_accept_uid(r1, g_slen(r1), secret, sn, out, 256) 29 var t1: i64=0; if u1==12 { if cc_eq(out, u1, "deadbeefcafe" as *u8, 12)==1 { t1=1 } } 30 fails = fails + g_check("T1 secret matches -> uid 'deadbeefcafe' extracted (trusted)" as *u8, t1) 31 32 // T2: THE ANTI-SPOOF -- forged X-Nishi-Cert-Identity but NO X-Nishi-Proxy-Auth -> rejected 33 let r2: *u8 = "GET /wiki/x HTTP/1.1\r\nX-Nishi-Cert-Identity: deadbeefcafe\r\nHost: x\r\n\r\n" as *u8 34 var t2: i64=0; if cc_accept_uid(r2, g_slen(r2), secret, sn, out, 256)==0 { t2=1 } 35 fails = fails + g_check("T2 forged identity, NO secret -> REJECTED (0) [the LAN-spoof block]" as *u8, t2) 36 37 // T3: wrong secret -> rejected 38 let r3: *u8 = "GET /wiki/x HTTP/1.1\r\nX-Nishi-Proxy-Auth: WRONG\r\nX-Nishi-Cert-Identity: deadbeefcafe\r\nHost: x\r\n\r\n" as *u8 39 var t3: i64=0; if cc_accept_uid(r3, g_slen(r3), secret, sn, out, 256)==0 { t3=1 } 40 fails = fails + g_check("T3 wrong secret -> REJECTED (0)" as *u8, t3) 41 42 // T4: correct secret but no identity present -> 0 43 let r4: *u8 = "GET /wiki/x HTTP/1.1\r\nX-Nishi-Proxy-Auth: PROXY-SECRET-7f3a\r\nHost: x\r\n\r\n" as *u8 44 var t4: i64=0; if cc_accept_uid(r4, g_slen(r4), secret, sn, out, 256)==0 { t4=1 } 45 fails = fails + g_check("T4 secret ok but no identity header -> 0" as *u8, t4) 46 47 // T5: empty secret configured -> never trust (fail closed) 48 var t5: i64=0; if cc_accept_uid(r1, g_slen(r1), secret, 0, out, 256)==0 { t5=1 } 49 fails = fails + g_check("T5 empty secret configured -> 0 (fail closed)" as *u8, t5) 50 51 // ---- frontend secret injection round-trip (cc_inject_secret) ---- 52 let inj: *u8 = sys_mmap(2048) 53 // T6: a request carrying ONLY the identity -> inject the secret -> the backend now trusts it (full round-trip) 54 let r6: *u8 = "GET /wiki/x HTTP/1.1\r\nX-Nishi-Cert-Identity: feedface99\r\nHost: x\r\n\r\n" as *u8 55 let in6: i64 = cc_inject_secret(r6, g_slen(r6), secret, sn, inj, 2048) 56 let u6: i64 = cc_accept_uid(inj, in6, secret, sn, out, 256) 57 var t6: i64=0; if u6==10 { if cc_eq(out, u6, "feedface99" as *u8, 10)==1 { t6=1 } } 58 fails = fails + g_check("T6 inject-secret -> backend trusts (round-trip): uid 'feedface99'" as *u8, t6) 59 // T7: a CLIENT-supplied X-Nishi-Proxy-Auth is STRIPPED + the real secret injected (defense-in-depth) 60 let r7: *u8 = "GET /wiki/x HTTP/1.1\r\nX-Nishi-Proxy-Auth: CLIENT-GUESS\r\nX-Nishi-Cert-Identity: feedface99\r\nHost: x\r\n\r\n" as *u8 61 let in7: i64 = cc_inject_secret(r7, g_slen(r7), secret, sn, inj, 2048) 62 var t7: i64=0 63 if g_contains(inj, in7, "CLIENT-GUESS" as *u8)==0 { if cc_accept_uid(inj, in7, secret, sn, out, 256)==10 { t7=1 } } 64 fails = fails + g_check("T7 client proxy-auth STRIPPED + real injected (spoof gone, round-trip ok)" as *u8, t7) 65 66 if fails==0 { g_puts("ALL GREEN (7/7)\n" as *u8); sys_exit(0); return 0 } 67 g_puts("HAD FAILURES\n" as *u8); sys_exit(1); return 1 68}