nx_cms_migrate_exceed_gate.nx source

1// nx_cms_migrate_exceed_gate.nx -- W-RE-004 head-to-head EXCEED (import-export-migrate, INTEGRITY axis). 2// Runs BOTH importers on the SAME corpus of bundles (pristine + byte-tampered): 3// OURS = cms_migrate_import (sha256-verifies the body before accepting) 4// INCUMBENT = a no-integrity importer (strip header, copy body, never verify) -- the CWE-494 failure 5// mode of migration tools that import without an integrity check (silent corruption). 6// Ground truth: a pristine bundle SHOULD import; a tampered bundle SHOULD be refused. Verdict COMPUTED by 7// nx_cms_exceed. Writes CMSEXCEED feature=import-export-migrate axis=integrity to cms_exceed.log on a 8// measured AHEAD + referee-clean + anti-false-green self-tests. license_tier: ORIGINAL 9import "nx_cms_exceed.nx" 10import "nx_cms_migrate.nx" 11import "nx_syscalls.nx" 12 13func em_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 14func em_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 15func em_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o } 16func em_catnum(dst: *u8, off: i64, v: i64) -> i64 { 17 var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0 18 if m==0 {t[0]=48 as u8;k=1}; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1} 19 var i: i64=0; while i<k {dst[o]=t[k-1-i]; o=o+1; i=i+1} return o 20} 21func em_cpy(dst: *u8, src: *u8) -> i64 { var k: i64=0; while src[k]!=(0 as u8){dst[k]=src[k];k=k+1} return k } 22func em_row(id: i64, ok: i64, what: *u8) -> i64 { 23 em_w("EMROW " as *u8); em_num(id); em_w(" " as *u8) 24 if ok==1 { em_w("PASS " as *u8) } else { em_w("FAIL " as *u8) } 25 em_w(what); em_w("\n" as *u8) 26 return ok 27} 28 29// incumbent: import WITHOUT integrity verification -- accept any well-formed-looking bundle (1), else 0. 30func em_incumbent_import(bundle: *u8, bn: i64) -> i64 { 31 var he: i64 = 0 - 1 32 var i: i64 = 0 33 while i < bn { if (bundle[i] as i64) == 10 { he = i; i = bn } else { i = i + 1 } } 34 if he < 0 { return 0 } 35 if bn - (he + 1) <= 0 { return 0 } 36 return 1 37} 38 39func main() -> i64 { 40 var pass: i64 = 0 41 var rows: i64 = 0 42 43 let src: *u8 = sys_mmap(4096) 44 let srclen: i64 = em_cpy(src, "@title\nAutumn Sale\n@status\nscheduled\n@body\nBig autumn news.\n" as *u8) 45 let bundle: *u8 = sys_mmap(4096) 46 let blen: i64 = cms_migrate_export(src, srclen, bundle, 4096) 47 let out: *u8 = sys_mmap(4096) 48 49 // header end (first newline) -> body region begins at he+1 50 var he: i64 = 0 - 1 51 var hi: i64 = 0 52 while hi < blen { if (bundle[hi] as i64) == 10 { he = hi; hi = blen } else { hi = hi + 1 } } 53 let body0: i64 = he + 1 54 55 // corpus: parallel arrays of (bundle ptr, len, truth=should-accept) 56 let bp: *i64 = sys_mmap(8 * 16) as *i64 57 let bl: *i64 = sys_mmap(8 * 16) as *i64 58 let tr: *i64 = sys_mmap(8 * 16) as *i64 59 var nc: i64 = 0 60 61 // 2 pristine (truth=accept) 62 bp[nc]=bundle as i64; bl[nc]=blen; tr[nc]=1; nc=nc+1 63 let pris2: *u8 = sys_mmap(4096) 64 var c2: i64=0; while c2<blen { pris2[c2]=bundle[c2]; c2=c2+1 } 65 bp[nc]=pris2 as i64; bl[nc]=blen; tr[nc]=1; nc=nc+1 66 67 // 3 tampered copies (flip a BODY byte; header sha unchanged -> should be REJECTED) 68 let t0: *u8 = sys_mmap(4096); var x0: i64=0; while x0<blen { t0[x0]=bundle[x0]; x0=x0+1 } 69 t0[body0 + 1] = (t0[body0 + 1] as i64 + 1) as u8 70 bp[nc]=t0 as i64; bl[nc]=blen; tr[nc]=0; nc=nc+1 71 let t1: *u8 = sys_mmap(4096); var x1: i64=0; while x1<blen { t1[x1]=bundle[x1]; x1=x1+1 } 72 t1[body0 + 4] = 88 as u8 73 bp[nc]=t1 as i64; bl[nc]=blen; tr[nc]=0; nc=nc+1 74 let t2: *u8 = sys_mmap(4096); var x2: i64=0; while x2<blen { t2[x2]=bundle[x2]; x2=x2+1 } 75 t2[blen - 1] = (t2[blen - 1] as i64 + 1) as u8 76 bp[nc]=t2 as i64; bl[nc]=blen; tr[nc]=0; nc=nc+1 77 78 // run BOTH sides; measure 79 var our_correct: i64 = 0 80 var inc_correct: i64 = 0 81 var n_tamp: i64 = 0 82 var tamp_our: i64 = 0 83 var tamp_inc: i64 = 0 84 var i: i64 = 0 85 while i < nc { 86 let b: *u8 = (bp[i]) as *u8 87 let ln: i64 = bl[i] 88 let truth: i64 = tr[i] 89 var our_v: i64 = 0; if cms_migrate_import(b, ln, out, 4096) >= 0 { our_v = 1 } 90 let inc_v: i64 = em_incumbent_import(b, ln) 91 if our_v == truth { our_correct = our_correct + 1 } 92 if inc_v == truth { inc_correct = inc_correct + 1 } 93 if truth == 0 { 94 n_tamp = n_tamp + 1 95 if our_v == 0 { tamp_our = tamp_our + 1 } 96 if inc_v == 0 { tamp_inc = tamp_inc + 1 } 97 } 98 i = i + 1 99 } 100 101 let verdict: i64 = xcd_verdict(our_correct, inc_correct) 102 em_w("HEAD-TO-HEAD import-export-migrate integrity: ours=" as *u8); em_num(our_correct); em_w("/" as *u8); em_num(nc) 103 em_w(" incumbent=" as *u8); em_num(inc_correct); em_w("/" as *u8); em_num(nc) 104 em_w(" tamper-caught ours=" as *u8); em_num(tamp_our); em_w("/" as *u8); em_num(n_tamp) 105 em_w(" incumbent=" as *u8); em_num(tamp_inc); em_w("/" as *u8); em_num(n_tamp) 106 em_w(" verdict=" as *u8); em_w(xcd_vname(verdict)); em_w("\n" as *u8) 107 108 var ok: i64 = 0; if our_correct == nc { ok = 1 } 109 rows=rows+1; pass=pass+em_row(0, ok, "ours fully correct (imports pristine, refuses every tamper)" as *u8) 110 ok = 0; if inc_correct < nc { ok = 1 } 111 rows=rows+1; pass=pass+em_row(1, ok, "incumbent no-verify fails (imports tampered = CWE-494)" as *u8) 112 ok = 0; if verdict == XCD_AHEAD { ok = 1 } 113 rows=rows+1; pass=pass+em_row(2, ok, "measured verdict = AHEAD" as *u8) 114 ok = 0; if tamp_our == n_tamp { if tamp_inc == 0 { if n_tamp > 0 { ok = 1 } } } 115 rows=rows+1; pass=pass+em_row(3, ok, "integrity axis: ours catches all tampers, incumbent catches 0" as *u8) 116 ok = 0; if xcd_referee_ok(XCD_AHEAD, our_correct, nc) == 1 { ok = 1 } 117 rows=rows+1; pass=pass+em_row(4, ok, "referee accepts honest AHEAD claim" as *u8) 118 ok = 0; if xcd_referee_ok(XCD_AHEAD, nc - 1, nc) == 0 { ok = 1 } 119 rows=rows+1; pass=pass+em_row(5, ok, "referee rejects overclaim (anti-false-green)" as *u8) 120 121 em_w("CMS-MIGRATE-EXCEED-GATE rows=" as *u8); em_num(rows); em_w(" pass=" as *u8); em_num(pass); em_w("\n" as *u8) 122 123 if pass == rows { 124 if verdict == XCD_AHEAD { 125 if xcd_referee_ok(XCD_AHEAD, our_correct, nc) == 1 { 126 let line: *u8 = sys_mmap(256) 127 var lo: i64 = em_cat(line, 0, "CMSEXCEED feature=import-export-migrate axis=integrity cwe=CWE-494 ours=" as *u8) 128 lo = em_catnum(line, lo, our_correct); lo = em_cat(line, lo, "/" as *u8); lo = em_catnum(line, lo, nc) 129 lo = em_cat(line, lo, " incumbent=" as *u8); lo = em_catnum(line, lo, inc_correct); lo = em_cat(line, lo, "/" as *u8); lo = em_catnum(line, lo, nc) 130 lo = em_cat(line, lo, " tamper-caught=" as *u8); lo = em_catnum(line, lo, tamp_our); lo = em_cat(line, lo, "/" as *u8); lo = em_catnum(line, lo, n_tamp) 131 lo = em_cat(line, lo, " verdict=AHEAD\n" as *u8) 132 let gf: i64 = sys_openat_append("knowledge/status/cms_exceed.log" as *u8, 0x1a4) 133 if gf >= 0 { sys_write(gf, line, lo); sys_close(gf) } 134 em_w("CMS-MIGRATE-EXCEED-GATE verdict=AHEAD -- measured EXCEED recorded\n" as *u8) 135 sys_exit(0); return 0 136 } 137 } 138 } 139 em_w("CMS-MIGRATE-EXCEED-GATE verdict=NOT-RECORDED (no fake-green)\n" as *u8) 140 sys_exit(1); return 1 141}