nx_decoy_test.nx source
↩ module page · 71 lines · 2667 B
1// nx_decoy_test.nx -- smoke for nx_decoy.
2
3import "nx_syscalls.nx"
4import "nx_decoy.nx"
5
6func main() -> i64 {
7 // 1: kind enum sealed
8 if NX_DK_N_KINDS != 7 { return 1 }
9 if nx_decoy_kind_is_valid(NX_DK_FAKE_CREDENTIALS) != 1 { return 2 }
10 if nx_decoy_kind_is_valid(NX_DK_FAKE_PASSWORD_MGR) != 1 { return 3 }
11 if nx_decoy_kind_is_valid(-1) != 0 { return 4 }
12 if nx_decoy_kind_is_valid(7) != 0 { return 5 }
13
14 // 2: plant fake credentials with tripwire token
15 let payload: *u8 = (sys_mmap(64)) as *u8
16 payload[0] = 65 as u8 // 'A'
17 let d: *NxDecoy = nx_decoy_plant(NX_DK_FAKE_CREDENTIALS,
18 0xbeefcafe, payload, 64)
19 if (d as i64) == 0 { return 6 }
20 if d.kind != NX_DK_FAKE_CREDENTIALS { return 7 }
21 if d.tripwire_token != 0xbeefcafe { return 8 }
22 if d.read_count != 0 { return 9 }
23 if nx_decoy_was_read(d) != 0 { return 10 }
24
25 // 3: bad kind rejected
26 let null_d: *NxDecoy = nx_decoy_plant(99,
27 0xbeefcafe, payload, 64)
28 if (null_d as i64) != 0 { return 11 }
29
30 // 4: zero token rejected (token=0 means "no tripwire" sentinel)
31 let no_tok: *NxDecoy = nx_decoy_plant(NX_DK_FAKE_SSH_KEY,
32 0, payload, 64)
33 if (no_tok as i64) != 0 { return 12 }
34
35 // 5: read fires tripwire
36 // xeno_id=1234, now=1000
37 let v1: nx_int = nx_decoy_on_read(d, 1234, 1000)
38 if v1 != NX_DECOY_TRIPWIRE_FIRED { return 13 }
39 if d.read_count != 1 { return 14 }
40 if d.first_read_us != 1000 { return 15 }
41 if d.last_read_us != 1000 { return 16 }
42 if nx_decoy_reader(d) != 1234 { return 17 }
43 if nx_decoy_was_read(d) != 1 { return 18 }
44
45 // 6: subsequent read updates last_read_us but preserves first_read_us
46 nx_decoy_on_read(d, 1234, 5000)
47 if d.first_read_us != 1000 { return 19 }
48 if d.last_read_us != 5000 { return 20 }
49 if d.read_count != 2 { return 21 }
50 if nx_decoy_read_count(d) != 2 { return 22 }
51
52 // 7: token-match check
53 if nx_decoy_token_matches(d, 0xbeefcafe) != 1 { return 23 }
54 if nx_decoy_token_matches(d, 0xdeadbeef) != 0 { return 24 }
55
56 // 8: multiple decoys with different tokens; only matching one trips
57 let d2: *NxDecoy = nx_decoy_plant(NX_DK_FAKE_WALLET,
58 0xdeadcafe, payload, 64)
59 if nx_decoy_token_matches(d2, 0xbeefcafe) != 0 { return 25 }
60 if nx_decoy_token_matches(d2, 0xdeadcafe) != 1 { return 26 }
61
62 // 9: unknown reader (xeno_id=0) doesn't overwrite known reader
63 nx_decoy_on_read(d, 0, 9000)
64 if nx_decoy_reader(d) != 1234 { return 27 } // preserved
65
66 // 10: new known reader does overwrite
67 nx_decoy_on_read(d, 5678, 10000)
68 if nx_decoy_reader(d) != 5678 { return 28 }
69
70 return 0
71}