`nx_cms_gate.nx` source

↩ module page · 385 lines · 17470 B
1// nx_cms_gate.nx -- THE CMS ARC GATE (re-runnable, evidence-driven): boots the real admin daemon on
2// loopback, then plays the LEGAL-TEAM USER + THE ATTACKER over real HTTP with its own client (no curl,
3// no .sh): unauth surfaces refused, login lockout-guarded, CSRF enforced, stored-XSS sanitized on
4// write, edit->publish live, revision rollback restores the prior publish. These are the spec's
5// acceptance criteria (2026-06-06-sovereign-cms-architecture.md) mechanized. Appends a CMSGATE line
6// to knowledge/status/cms_gate.log. Exit 0 iff permil=1000. license_tier: ORIGINAL
7import "nx_cms_store.nx"
8import "nx_connect.nx"   // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
9import "nx_sha256.nx"
10import "nx_syscalls.nx"
11import "nx_gate_verdict.nx"
12import "_hdl_build/nx_kill_portable.nx"
13
14const CG_PORT: i64 = 8077
15const CG_SITE: *u8 = "/tmp/_cms_gate_site"
16
17func cg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
18func cg_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
19func cg_cat(dst: *u8, off: i64, s: *u8) -> i64 {
  var o: i64 = off
  var k: i64 = 0
  while s[k] != (0 as u8) { dst[o] = s[k]; o = o + 1; k = k + 1 }
  return o
24}
25func cg_catn(dst: *u8, off: i64, s: *u8, n: i64) -> i64 {
  var o: i64 = off
  var k: i64 = 0
  while k < n { dst[o] = s[k]; o = o + 1; k = k + 1 }
  return o
30}
31func cg_index(hay: *u8, n: i64, needle: *u8) -> i64 {
  let nl: i64 = cg_len(needle)
  var i: i64 = 0
  while i + nl <= n {
      var q: i64 = 0
      var ok: i64 = 1
      while q < nl { if (hay[i+q] as i64) != (needle[q] as i64) { ok = 0; q = nl } q = q + 1 }
      if ok == 1 { return i }
      i = i + 1
  }
  return 0 - 1
42}
43func cg_has(hay: *u8, n: i64, needle: *u8) -> i64 { if cg_index(hay, n, needle) >= 0 { return 1 } return 0 }
44
45// own HTTP client: send req, read to EOF (server closes). returns response length, -1 connect-fail.
46func cg_http(req: *u8, rl: i64, resp: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_socket(2, 1, 0)
  if fd < 0 { return 0 - 1 }
  let addr: *u8 = sys_mmap(16)
  addr[0] = 2 as u8; addr[1] = 0 as u8
  addr[2] = ((CG_PORT >> 8) & 0xff) as u8
  addr[3] = (CG_PORT & 0xff) as u8
  addr[4] = 127 as u8; addr[5] = 0 as u8; addr[6] = 0 as u8; addr[7] = 1 as u8
  var zi: i64 = 8
  while zi < 16 { addr[zi] = 0 as u8; zi = zi + 1 }
  if nx_connect_bounded(fd, addr, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); return 0 - 1 }
  var off: i64 = 0
  var go: i64 = 1
  while go == 1 {
      go = 0
      if off < rl {
          let w: i64 = sys_write(fd, (req + off) as *u8, rl - off)
          if w > 0 { off = off + w; go = 1 }
      }
  }
  sys_set_socket_timeout(fd, 10)
  var total: i64 = 0
  go = 1
  while go == 1 {
      go = 0
      if total < cap {
          let r: i64 = sys_read(fd, (resp + total) as *u8, cap - total)
          if r > 0 { total = total + r; go = 1 }
      }
  }
  sys_close(fd)
  return total
78}
79
80// build a POST with urlencoded body
81func cg_post(req: *u8, path: *u8, cookie: *u8, body: *u8) -> i64 {
  var o: i64 = cg_cat(req, 0, "POST " as *u8)
  o = cg_cat(req, o, path)
  o = cg_cat(req, o, " HTTP/1.1\r\nHost: gate\r\nContent-Type: application/x-www-form-urlencoded\r\n" as *u8)
  if (cookie[0] as i64) != 0 {
      o = cg_cat(req, o, "Cookie: nsess=" as *u8)
      o = cg_catn(req, o, cookie, 32)
      o = cg_cat(req, o, "\r\n" as *u8)
  }
  o = cg_cat(req, o, "Content-Length: " as *u8)
  let bl: i64 = cg_len(body)
  // integer print
  let t: *u8 = sys_mmap(24)
  var m: i64 = bl
  var k: i64 = 0
  if m == 0 { t[0] = 48 as u8; k = 1 }
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var i: i64 = 0
  while i < k { req[o] = t[k-1-i]; o = o + 1; i = i + 1 }
  o = cg_cat(req, o, "\r\n\r\n" as *u8)
  o = cg_cat(req, o, body)
  return o
103}
104func cg_get(req: *u8, path: *u8, cookie: *u8) -> i64 {
  var o: i64 = cg_cat(req, 0, "GET " as *u8)
  o = cg_cat(req, o, path)
  o = cg_cat(req, o, " HTTP/1.1\r\nHost: gate\r\n" as *u8)
  if (cookie[0] as i64) != 0 {
      o = cg_cat(req, o, "Cookie: nsess=" as *u8)
      o = cg_catn(req, o, cookie, 32)
      o = cg_cat(req, o, "\r\n" as *u8)
  }
  o = cg_cat(req, o, "\r\n" as *u8)
  return o
115}
116
117func cg_row(id: i64, ok: i64, what: *u8) -> i64 {
  cg_w("CMSROW " as *u8)
  let d: *u8 = sys_mmap(8); d[0] = (48 + id/10) as u8; d[1] = (48 + id%10) as u8; d[2] = 32 as u8; d[3] = 0 as u8
  cg_w(d)
  if ok == 1 { cg_w("PASS " as *u8) }
  if ok == 0 { cg_w("FAIL " as *u8) }
  cg_w(what); cg_w("\n" as *u8)
  return ok
125}
126
127// mkdirat via runtime-computed x86 number (258): sys_mkdir's rv64 34 risked the untranslated-row
128// pause-hang (same class as the nxk_kill landmine; mkdirat row was absent on a 2026-06-10 lane).
129func cg_mkdir(path: *u8, mode: i64) -> i64 {
  let nb: *i64 = sys_mmap(8) as *i64
  nb[0] = 258                      // x86_64 mkdirat, untranslated by design
  return __syscall(nb[0], 0 - 100, path, mode, 0, 0, 0)
133}
134
135func main() -> i64 {
  // ---- setup the gate site dir from the canonical andelinwest content ----
  cg_mkdir(CG_SITE, 0x1ed)
  cst_copy("knowledge/cms/andelinwest/template.html" as *u8, "/tmp/_cms_gate_site/template.html" as *u8)
  cst_copy("knowledge/cms/andelinwest/content.txt" as *u8, "/tmp/_cms_gate_site/content.txt" as *u8)
  // remove stale revision/page state from prior runs: overwrite by fresh copies only (additive law:
  // /tmp gate scratch, not production data). pw hash = sha256("gate-test-pw-1")
  let dig: *u8 = sys_mmap(32)
  sha256_digest("gate-test-pw-1" as *u8, 14, dig)
  let hexs: *u8 = sys_mmap(80)
  let hxc: *u8 = "0123456789abcdef" as *u8
  var i: i64 = 0
  while i < 32 {
      hexs[i*2] = hxc[((dig[i] as i64) >> 4) & 15]
      hexs[i*2+1] = hxc[(dig[i] as i64) & 15]
      i = i + 1
  }
  let pf: i64 = sys_openat_wr("/tmp/_cms_gate_site/admin_pw.sha256" as *u8, 0x1a4)
  sys_write(pf, hexs, 64)
  sys_close(pf)
155
  // ---- REBUILD the admin daemon sovereignly (prove-all doctrine: /tmp is contested; never
  // trust a prebuilt binary). The runner runs it arg-less after build = harmless usage-exit. ----
  let bpid: i64 = sys_fork()
  if bpid == 0 {
      let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
      if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
      let bargv: *i64 = sys_mmap(32) as *i64
      bargv[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64
      bargv[1] = "nx_cms_admin" as *u8 as i64
      bargv[2] = 0
      let benvp: *i64 = sys_mmap(16) as *i64
      benvp[0] = 0
      sys_execve("_offc/nx_sov_build_run.elf" as *u8, bargv, benvp); sys_exit(127)
  }
  let bst: *i64 = sys_mmap(16) as *i64
  sys_wait4(bpid, bst, 0)
  // CALLER-GAP FIX 2026-08-01 (seq1267 class): the runner emits buildroot/_build/<t>.sov.elf under
  // the no-/tmp doctrine while this probed /tmp. Proven by control: _build copy 208962B, /tmp absent.
  var bchk: i64 = sys_openat_rd("buildroot/_build/nx_cms_admin.sov.elf" as *u8)
  var badm: *u8 = "buildroot/_build/nx_cms_admin.sov.elf" as *u8
  if bchk < 0 { bchk = sys_openat_rd("/tmp/nx_cms_admin.sov.elf" as *u8); badm = "/tmp/nx_cms_admin.sov.elf" as *u8 }
  if bchk < 0 { cg_w("CMSGATE ADMIN-BUILD-MISSING (probed buildroot/_build AND /tmp)\n" as *u8); sys_exit(1) }
  sys_close(bchk)
179
  // ---- boot the real admin daemon ----
  let pid: i64 = sys_fork()
  if pid == 0 {
      let lg: i64 = sys_openat_wr("/tmp/_cms_admin_gate.log" as *u8, 0x1a4)
      if lg >= 0 { sys_dup3(lg, 1, 0); sys_dup3(lg, 2, 0) }
      let argvv: *i64 = sys_mmap(8*6) as *i64
      argvv[0] = badm as i64
      argvv[1] = "8077" as *u8 as i64
      argvv[2] = CG_SITE as i64
      argvv[3] = "99" as *u8 as i64
      argvv[4] = 0
      let envp: *i64 = sys_mmap(16) as *i64
      envp[0] = 0
      sys_execve(badm, argvv, envp)
      sys_exit(127)
  }
196
  let req: *u8 = sys_mmap(262144)
  let resp: *u8 = sys_mmap(524288)
  let nocookie: *u8 = sys_mmap(8)
  nocookie[0] = 0 as u8
  let sess: *u8 = sys_mmap(64)
  sess[0] = 0 as u8
  let csrf: *u8 = sys_mmap(64)
  csrf[0] = 0 as u8
205
  // R0: seed page serves (also the boot-poll: retry till the daemon accepts)
  var rn: i64 = 0 - 1
  var tries: i64 = 0
  while tries < 50 {
      let rl: i64 = cg_get(req, "/" as *u8, nocookie)
      rn = cg_http(req, rl, resp, 524287)
      if rn > 0 { tries = 50 }
      if rn <= 0 { sys_sleep_ms(100); tries = tries + 1 }
  }
  var pass: i64 = 0
  var rows: i64 = 0
  var ok: i64 = 0
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "200 OK" as *u8) == 1 { if cg_has(resp, rn, "Andelin West Law" as *u8) == 1 { ok = 1 } } }
  rows = rows + 1; pass = pass + cg_row(0, ok, "seed render serves GET /" as *u8)
221
  // R1: GET /admin unauthed -> login form, NO editor fields leak
  var rl: i64 = cg_get(req, "/admin" as *u8, nocookie)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "Editor Login" as *u8) == 1 { if cg_has(resp, rn, "hero_title" as *u8) == 0 { ok = 1 } } }
  rows = rows + 1; pass = pass + cg_row(1, ok, "unauthed /admin = login only" as *u8)
228
  // R2: unauth POST /admin/save -> 403
  rl = cg_post(req, "/admin/save" as *u8, nocookie, "csrf=00000000000000000000000000000000&hero_title=HACKED" as *u8)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "403" as *u8) == 1 { ok = 1 } }
  rows = rows + 1; pass = pass + cg_row(2, ok, "unauth save refused 403" as *u8)
235
  // R3: wrong password -> 403
  rl = cg_post(req, "/admin/login" as *u8, nocookie, "pw=wrong-password" as *u8)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "403" as *u8) == 1 { ok = 1 } }
  rows = rows + 1; pass = pass + cg_row(3, ok, "wrong password refused 403" as *u8)
242
  // R4: correct password -> 303 + session cookie
  rl = cg_post(req, "/admin/login" as *u8, nocookie, "pw=gate-test-pw-1" as *u8)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "303" as *u8) == 1 {
      let sp: i64 = cg_index(resp, rn, "nsess=" as *u8)
      if sp >= 0 {
          var m2: i64 = 0
          while m2 < 32 { sess[m2] = resp[sp+6+m2]; m2 = m2 + 1 }
          sess[32] = 0 as u8
          ok = 1
      }
  } }
  rows = rows + 1; pass = pass + cg_row(4, ok, "login issues HttpOnly session" as *u8)
257
  // R5: GET /admin with session -> editor with fields + CSRF
  rl = cg_get(req, "/admin" as *u8, sess)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "name=\"hero_title\"" as *u8) == 1 { if cg_has(resp, rn, "Andelin West Law" as *u8) == 1 {
      let cp: i64 = cg_index(resp, rn, "name=\"csrf\" value=\"" as *u8)
      if cp >= 0 {
          var m3: i64 = 0
          while m3 < 32 { csrf[m3] = resp[cp+19+m3]; m3 = m3 + 1 }
          csrf[32] = 0 as u8
          ok = 1
      }
  } } }
  rows = rows + 1; pass = pass + cg_row(5, ok, "editor shows fields + csrf" as *u8)
272
  // R6: save with session but WRONG csrf -> 403
  rl = cg_post(req, "/admin/save" as *u8, sess, "csrf=00000000000000000000000000000000&hero_title=FORGED" as *u8)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "403" as *u8) == 1 { ok = 1 } }
  rows = rows + 1; pass = pass + cg_row(6, ok, "cross-site forged save refused (CSRF)" as *u8)
279
  // R7: REAL EDIT: new headline + note with injected <script> (and legit <b>)
  let body7: *u8 = sys_mmap(4096)
  var b7: i64 = cg_cat(body7, 0, "csrf=" as *u8)
  b7 = cg_catn(body7, b7, csrf, 32)
  b7 = cg_cat(body7, b7, "&hero_title=Andelin+West+Law+-+Newly+Edited&note_html=%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3Cb%3ESpring+hours+posted.%3C%2Fb%3E" as *u8)
  body7[b7] = 0 as u8
  rl = cg_post(req, "/admin/save" as *u8, sess, body7)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "303" as *u8) == 1 { ok = 1 } }
  rows = rows + 1; pass = pass + cg_row(7, ok, "legal-team edit publishes 303" as *u8)
291
  // R8: the live page reflects the edit, keeps <b>, and the script is GONE
  rl = cg_get(req, "/" as *u8, nocookie)
  rn = cg_http(req, rl, resp, 524287)
  // SPLIT 2026-08-07. This was ONE row ANDing three conditions, so a failure said only
  // "edit LIVE + stored-XSS sanitized FAIL" and left the reader to guess which third broke --
  // and the natural guess is the alarming one. A COMPOUND ASSERTION THAT WILL NOT NAME THE
  // FAILING CONJUNCT IS A FALSE-ALARM GENERATOR: read as an XSS hole, it is far more likely to
  // be the edit simply not reaching the page. Three named rows cost nothing and diagnose themselves.
  var ok8a: i64 = 0
  var ok8b: i64 = 0
  var ok8c: i64 = 0
  if rn > 0 {
      if cg_has(resp, rn, "Newly Edited" as *u8) == 1 { ok8a = 1 }
      if cg_has(resp, rn, "<b>Spring hours posted.</b>" as *u8) == 1 { ok8b = 1 }
      if cg_has(resp, rn, "<script" as *u8) == 0 { ok8c = 1 }
  }
  rows = rows + 1; pass = pass + cg_row(8, ok8a, "edit REACHES the live page (title updated)" as *u8)
  rows = rows + 1; pass = pass + cg_row(9, ok8b, "benign markup SURVIVES sanitize (<b> kept)" as *u8)
  rows = rows + 1; pass = pass + cg_row(10, ok8c, "SECURITY stored-XSS stripped (no <script)" as *u8)
311
  // R9: rollback -> 303
  let body9: *u8 = sys_mmap(256)
  var b9: i64 = cg_cat(body9, 0, "csrf=" as *u8)
  b9 = cg_catn(body9, b9, csrf, 32)
  body9[b9] = 0 as u8
  rl = cg_post(req, "/admin/rollback" as *u8, sess, body9)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "303" as *u8) == 1 { ok = 1 } }
  rows = rows + 1; pass = pass + cg_row(11, ok, "rollback accepted" as *u8)
322
  // R10: prior publish restored
  rl = cg_get(req, "/" as *u8, nocookie)
  rn = cg_http(req, rl, resp, 524287)
  ok = 0
  if rn > 0 { if cg_has(resp, rn, "Newly Edited" as *u8) == 0 { if cg_has(resp, rn, "Andelin West Law" as *u8) == 1 { ok = 1 } } }
  rows = rows + 1; pass = pass + cg_row(12, ok, "revision rollback restores prior publish" as *u8)
329
  // ---- teardown our own child (nxk_kill = runtime-computed x86 kill, the syscall-table escape hatch) ----
  nxk_kill(pid, 9)
  let stbuf: *i64 = sys_mmap(16) as *i64
  sys_wait4(pid, stbuf, 0)
334
  let permil: i64 = pass * 1000 / rows
  let line: *u8 = sys_mmap(512)
  var lo: i64 = cg_cat(line, 0, "CMSGATE target=andelinwest rows=" as *u8)
  let t2: *u8 = sys_mmap(24)
  var mm: i64 = rows
  var kk: i64 = 0
  if mm == 0 { t2[0] = 48 as u8; kk = 1 }
  while mm > 0 { t2[kk] = (48 + (mm % 10)) as u8; mm = mm / 10; kk = kk + 1 }
  var ii: i64 = 0
  while ii < kk { line[lo] = t2[kk-1-ii]; lo = lo + 1; ii = ii + 1 }
  lo = cg_cat(line, lo, " pass=" as *u8)
  mm = pass; kk = 0
  if mm == 0 { t2[0] = 48 as u8; kk = 1 }
  while mm > 0 { t2[kk] = (48 + (mm % 10)) as u8; mm = mm / 10; kk = kk + 1 }
  ii = 0
  while ii < kk { line[lo] = t2[kk-1-ii]; lo = lo + 1; ii = ii + 1 }
  lo = cg_cat(line, lo, " permil=" as *u8)
  mm = permil; kk = 0
  if mm == 0 { t2[0] = 48 as u8; kk = 1 }
  while mm > 0 { t2[kk] = (48 + (mm % 10)) as u8; mm = mm / 10; kk = kk + 1 }
  ii = 0
  while ii < kk { line[lo] = t2[kk-1-ii]; lo = lo + 1; ii = ii + 1 }
  lo = cg_cat(line, lo, " epoch=" as *u8)
  mm = sys_now_realtime_sec(); kk = 0
  if mm == 0 { t2[0] = 48 as u8; kk = 1 }
  while mm > 0 { t2[kk] = (48 + (mm % 10)) as u8; mm = mm / 10; kk = kk + 1 }
  ii = 0
  while ii < kk { line[lo] = t2[kk-1-ii]; lo = lo + 1; ii = ii + 1 }
  // Canonical verdict token, appended LAST (nx_gate_rollup's gv_last_line anchors by POSITION).
  // The rollup reads THIS LOG, not the exit code, and a row carrying no verdict= is fail-closed as
  // not-passing -- so this gate was emitting rows=13 pass=13 permil=1000 and being counted RED in the
  // fleet number: a gate that passes every tooth and is scored as a failure. The rich domain fields
  // stay exactly as they were; the fix is in the EMITTER, never by widening the reader's vocabulary.
  if permil == 1000 { lo = cg_cat(line, lo, " verdict=GREEN" as *u8) } else { lo = cg_cat(line, lo, " verdict=RED" as *u8) }
  line[lo] = 10 as u8
  lo = lo + 1
  sys_write(1, line, lo)
  let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4)
  if gf >= 0 { sys_write(gf, line, lo); sys_close(gf) }
  // MIGRATED onto nx_gate_verdict (D001). No helper renames needed -- this gate names its locals cg_*,
  // so there was no collision with the base class. Every check above is untouched, so the PASS/FAIL
  // vector cannot change; only the hand-rolled exit is replaced, so /api/gate_run and the harness
  // frame can READ the outcome. The denominator is `rows`, derived from the teeth actually run, never
  // a literal -- add a tooth and the counter moves by itself instead of printing 14/13.
  let ctr__dry: *i64 = gv_ctr()
  ctr__dry[0] = pass
  ctr__dry[1] = rows
  let rc__dry: i64 = gv_verdict("CMS-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
  sys_exit(rc__dry)
  return rc__dry
385}
nx_cms_gate.nx source

`nx_cms_gate.nx` source
