code wiki / _hdl_build / nx_iot_ctl_gate.nx
`nx_iot_ctl_gate.nx` source

↩ module page · 316 lines · 14360 B
1// nx_iot_ctl_gate.nx -- gate for the sovereign home-electronics organ.
2//
3// Every tooth is designed to FAIL if the claim is false, not to co-sign it:
4//
5//   T1  manifest defaults load, and ORDER IS PRECEDENCE (kasa:9999 outranks
6//       http:80) -- the exact inversion that makes the live survey call a
7//       smart plug a "web-device"
8//   T2  conf parsing is real: a conf image REPLACES the defaults, with the
9//       parsed values readable back (not merely "a file was opened")
10//   T3  fail-safe: a MALFORMED / absent conf degrades to defaults, never to
11//       an empty manifest (an organ that silently sees nothing is worse than
12//       one that sees the default set)
13//   T4  the UDP blind spot is DECLARED: wiz/38899 is present in the manifest,
14//       marked udp, and excluded from the swept set
15//   T5  NEVER-BRICK: no write verb exists; on/off/set/flash/provision/gcode
16//       all resolve to BAD, and the verb map has exactly 4 read-only entries
17//   T6  REAL loopback sweep: a live listener on 127.0.0.1 is found through the
18//       SHARED lscan_sweep primitive (the same bytes nx_printer_ctl runs)
19//   T7  REAL end-to-end classification: a fork'd fake Kasa device on loopback
20//       is swept, and the emitted JSON says smart-plug + kasa -- NOT web-device
21//   T8  REAL Kasa probe roundtrip: framed+autokey-encrypted get_sysinfo over
22//       the kernel TCP stack, reply decrypted, vendor decided by REPLY signal
23//   T9  NEGATIVE CONTROL for T7/T8: an HTTP-only listener must NOT be called a
24//       kasa plug (a classifier that says "kasa" to everything passes T7)
25//
26// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
27import "nx_syscalls.nx"
28import "nx_tls13_io.nx"
29import "nx_lan_scan.nx"
30import "nx_iot_ctl_lib.nx"
31import "nx_gate_verdict.nx"
32
33func ig_contains(buf: *u8, len: i64, needle: *u8) -> i64 {
  var nlen: i64 = 0
  while needle[nlen] != (0 as u8) { nlen = nlen + 1 }
  if nlen == 0 { return 1 }
  if len < nlen { return 0 }
  var i: i64 = 0
  while i <= len - nlen {
      var j: i64 = 0
      var matched: i64 = 1
      while j < nlen {
          if buf[i + j] != needle[j] { matched = 0; j = nlen }
          j = j + 1
      }
      if matched == 1 { return 1 }
      i = i + 1
  }
  return 0
50}
51
52// A fake Kasa device: accept one connection, read the framed request, reply
53// with a framed + autokey-encrypted sysinfo body (real bytes, real cipher).
54func ig_fake_kasa(listen_fd: i64) -> i64 {
  let cfd: i64 = sys_accept(listen_fd)
  if cfd < 0 { return 0 }
  let req: *u8 = sys_mmap(4096)
  sys_read(cfd, req, 4096)
  let body: *u8 = "{\"system\":{\"get_sysinfo\":{\"sw_ver\":\"1.0.6\",\"model\":\"HS210(US)\",\"relay_state\":1,\"mic_type\":\"IOT.SMARTPLUGSWITCH\"}}}"
  var bn: i64 = 0
  while body[bn] != (0 as u8) { bn = bn + 1 }
  let frame: *u8 = sys_mmap(4096)
  let vp: *i64 = sys_mmap(8) as *i64
  vp[0] = 0
  let fn2: i64 = nx_iot_kasa_frame_tcp(body, bn, frame, 4096, vp)
  if fn2 > 0 { sys_write(cfd, frame, fn2) }
  sys_close(cfd)
  return 1
69}
70
71func main() -> i64 {
  let ctr: *i64 = gv_ctr()
  gv_head("nx_iot_ctl_gate -- sovereign home-electronics identification (data-driven manifest, declared blind spots, real loopback)" as *u8)
74
  // ---- T1: defaults + manifest order IS precedence ----
  let m1: *u8 = iotm_new()
  iotm_defaults(m1)
  var t1: i64 = 0
  if iotm_count(m1) > 6 {
      // kasa:9999 must sit at a LOWER index than http:80, else a plug that
      // also serves a web UI gets called a web-device (the live defect).
      var i_kasa: i64 = 0 - 1
      var i_http: i64 = 0 - 1
      var i: i64 = 0
      while i < iotm_count(m1) {
          if iotm_port(m1, i) == 9999 { if i_kasa < 0 { i_kasa = i } }
          if iotm_port(m1, i) == 80   { if i_http < 0 { i_http = i } }
          i = i + 1
      }
      if i_kasa >= 0 {
          if i_http > i_kasa {
              // and the resolver must actually honour that order
              let bits: i64 = (1 << i_kasa) | (1 << i_http)
              if iotc_mask_row(m1, bits) == i_kasa {
                  if iotc_streq(iotc_kind_name(iotm_kind(m1, i_kasa)), "smart-plug" as *u8) == 1 { t1 = 1 }
              }
          }
      }
  }
  gv_check("T1 defaults load; manifest ORDER=precedence (kasa:9999 outranks http:80 -> smart-plug not web-device)" as *u8, t1, ctr)
101
  // ---- T2: conf parsing REPLACES defaults, values read back ----
  let m2: *u8 = iotm_new()
  let conf: *u8 = "# comment line\n4711 tcp yeelight bulb lab-bulb\n1234 udp wiz bulb lab-wiz\n"
  var cn: i64 = 0
  while conf[cn] != (0 as u8) { cn = cn + 1 }
  let got2: i64 = iotm_parse(m2, conf, cn)
  var t2: i64 = 0
  if got2 == 2 {
      if iotm_count(m2) == 2 {
          if iotm_port(m2, 0) == 4711 {
              if iotm_proto(m2, 0) == IOTC_PROTO_TCP {
                  if iotm_vendor(m2, 0) == NX_IOT_VENDOR_YEELIGHT {
                      if iotm_kind(m2, 0) == IOTC_KIND_BULB {
                          if iotc_streq(iotm_label(m2, 0), "lab-bulb" as *u8) == 1 {
                              if iotm_port(m2, 1) == 1234 {
                                  if iotm_proto(m2, 1) == IOTC_PROTO_UDP { t2 = 1 }
                              }
                          }
                      }
                  }
              }
          }
      }
  }
  gv_check("T2 conf rows parse + read back (port/proto/vendor/kind/label); '#' comment skipped" as *u8, t2, ctr)
127
  // ---- T3: malformed conf -> defaults, never an empty manifest ----
  let m3: *u8 = iotm_new()
  let junk: *u8 = "not a row at all\n### \nzzz qqq\n"
  var jn: i64 = 0
  while junk[jn] != (0 as u8) { jn = jn + 1 }
  let got3: i64 = iotm_parse(m3, junk, jn)
  var t3: i64 = 0
  if got3 == 0 {
      if iotm_count(m3) == 0 {
          // this is the path iotm_load takes: no usable rows -> defaults
          iotm_defaults(m3)
          if iotm_count(m3) > 6 { t3 = 1 }
      }
  }
  gv_check("T3 fail-safe: malformed conf yields 0 rows -> compiled defaults, never a blind empty manifest" as *u8, t3, ctr)
143
  // ---- T4: the UDP blind spot is declared, not hidden ----
  var t4: i64 = 0
  var wiz_i: i64 = 0 - 1
  var k: i64 = 0
  while k < iotm_count(m1) {
      if iotm_port(m1, k) == 38899 { if wiz_i < 0 { wiz_i = k } }
      k = k + 1
  }
  if wiz_i >= 0 {
      if iotm_proto(m1, wiz_i) == IOTC_PROTO_UDP {
          if iotm_vendor(m1, wiz_i) == NX_IOT_VENDOR_WIZ {
              // and a scan emission must name it as unswept
              let mask4: *i64 = sys_mmap(256 * 8) as *i64
              let out4: *u8 = sys_mmap(IOTC_OUT)
              let n4: i64 = iotc_emit_scan(out4, m1, "10.0.0" as *u8, 0, mask4, 0)
              if ig_contains(out4, n4, "\"udp_ports_unswept\":[38899]" as *u8) == 1 {
                  if ig_contains(out4, n4, "NOT evidence of absence" as *u8) == 1 { t4 = 1 }
              }
          }
      }
  }
  gv_check("T4 blind spot DECLARED: wiz/38899 is udp, excluded from the sweep, and named in udp_ports_unswept" as *u8, t4, ctr)
166
  // ---- T5: NEVER-BRICK -- no write verb is reachable ----
  var t5: i64 = 1
  if iotc_verb_id("on" as *u8) != IOTC_V_BAD { t5 = 0 }
  if iotc_verb_id("off" as *u8) != IOTC_V_BAD { t5 = 0 }
  if iotc_verb_id("set" as *u8) != IOTC_V_BAD { t5 = 0 }
  if iotc_verb_id("flash" as *u8) != IOTC_V_BAD { t5 = 0 }
  if iotc_verb_id("ota" as *u8) != IOTC_V_BAD { t5 = 0 }
  if iotc_verb_id("provision" as *u8) != IOTC_V_BAD { t5 = 0 }
  if iotc_verb_id("set_stainfo" as *u8) != IOTC_V_BAD { t5 = 0 }
  if iotc_verb_id("gcode" as *u8) != IOTC_V_BAD { t5 = 0 }
  if iotc_verb_id("reboot" as *u8) != IOTC_V_BAD { t5 = 0 }
  // and the four read verbs DO resolve (a map that rejects everything also
  // passes the negatives above -- this is the non-vacuity control)
  if iotc_verb_id("services" as *u8) != IOTC_V_SERVICES { t5 = 0 }
  if iotc_verb_id("scan" as *u8) != IOTC_V_SCAN { t5 = 0 }
  if iotc_verb_id("probe" as *u8) != IOTC_V_PROBE { t5 = 0 }
  if iotc_verb_id("contract" as *u8) != IOTC_V_CONTRACT { t5 = 0 }
  gv_check("T5 never-brick: no write/flash/provision verb resolves; the 4 read verbs do (non-vacuous)" as *u8, t5, ctr)
185
  // ---- T6: the SHARED sweep finds a real listener ----
  var t6: i64 = 0
  let lfd6: i64 = tcp_listen_loopback(19311)
  if lfd6 >= 0 {
      let base: i64 = lscan_parse_prefix("127.0.0" as *u8)
      let ips: *i64 = sys_mmap(LSCAN_HOSTS * 8) as *i64
      let cnt: i64 = lscan_sweep(base, 19311, 120, ips, LSCAN_HOSTS)
      let want: i64 = ((127 << 24) | 1)
      if cnt >= 1 { if ips[0] == want { t6 = 1 } }
      sys_close(lfd6)
  }
  gv_check("T6 shared lscan_sweep (the one nx_printer_ctl also uses) finds a real 127.0.0.1 listener" as *u8, t6, ctr)
198
  // ---- T7: real sweep -> emitted JSON says smart-plug + kasa ----
  var t7: i64 = 0
  let lfd7: i64 = tcp_listen_loopback(9999)
  if lfd7 >= 0 {
      let m7: *u8 = iotm_new()
      iotm_defaults(m7)
      let mask7: *i64 = sys_mmap(256 * 8) as *i64
      iotc_scan(m7, lscan_parse_prefix("127.0.0" as *u8), 60, mask7)
      let out7: *u8 = sys_mmap(IOTC_OUT)
      let n7: i64 = iotc_emit_scan(out7, m7, "127.0.0" as *u8, lscan_parse_prefix("127.0.0" as *u8), mask7, 0)
      if ig_contains(out7, n7, "\"ip\":\"127.0.0.1\"" as *u8) == 1 {
          if ig_contains(out7, n7, "\"kind\":\"smart-plug\"" as *u8) == 1 {
              if ig_contains(out7, n7, "\"vendor\":\"kasa\"" as *u8) == 1 { t7 = 1 }
          }
      }
      sys_close(lfd7)
  }
  gv_check("T7 real sweep of a :9999 listener emits kind=smart-plug vendor=kasa (NOT web-device)" as *u8, t7, ctr)
217
  // ---- T8: real Kasa probe roundtrip, vendor decided by REPLY ----
  var t8: i64 = 0
  let lfd8: i64 = tcp_listen_loopback(19399)
  if lfd8 >= 0 {
      let pid: i64 = sys_fork()
      if pid == 0 {
          // child = the production client path
          var spin: i64 = 0
          while spin < 80000 { spin = spin + 1 }
          let plain: *u8 = sys_mmap(IOTC_RESP)
          let pn: i64 = iotc_kasa_probe((127 << 24) | 1, 19399, plain, IOTC_RESP)
          if pn > 0 {
              if nx_iot_kasa_looks_like_sysinfo(plain, pn) == 1 {
                  if nx_iot_classify_by_reply(plain, pn) == NX_IOT_VENDOR_KASA { sys_exit(0) }
              }
          }
          sys_exit(1)
      }
      if pid > 0 {
          ig_fake_kasa(lfd8)
          sys_close(lfd8)
          let st: *i64 = sys_mmap(8) as *i64
          st[0] = 0
          sys_wait4(pid, st, 0)
          if ((st[0] >> 8) & 0xff) == 0 { t8 = 1 }
      }
  }
  gv_check("T8 real Kasa probe: framed+autokey get_sysinfo over loopback TCP, reply decrypted, vendor by REPLY signal" as *u8, t8, ctr)
246
  // ---- T9: negative control -- an HTTP-only host is NOT a kasa plug ----
  var t9: i64 = 0
  let lfd9: i64 = tcp_listen_loopback(80)
  if lfd9 >= 0 {
      let m9: *u8 = iotm_new()
      iotm_defaults(m9)
      let mask9: *i64 = sys_mmap(256 * 8) as *i64
      iotc_scan(m9, lscan_parse_prefix("127.0.0" as *u8), 60, mask9)
      let out9: *u8 = sys_mmap(IOTC_OUT)
      let n9: i64 = iotc_emit_scan(out9, m9, "127.0.0" as *u8, lscan_parse_prefix("127.0.0" as *u8), mask9, 0)
      if ig_contains(out9, n9, "\"kind\":\"web-device\"" as *u8) == 1 {
          if ig_contains(out9, n9, "\"vendor\":\"kasa\"" as *u8) == 0 { t9 = 1 }
      }
      sys_close(lfd9)
  } else {
      // binding :80 needs privilege; a skipped control must NOT count as a
      // pass -- prove the classifier discriminates on a synthetic mask instead
      let mA: *u8 = iotm_new()
      iotm_defaults(mA)
      var i_http: i64 = 0 - 1
      var q: i64 = 0
      while q < iotm_count(mA) {
          if iotm_port(mA, q) == 80 { if i_http < 0 { i_http = q } }
          q = q + 1
      }
      if i_http >= 0 {
          let bits: i64 = 1 << i_http
          if iotc_streq(iotc_kind_name(iotm_kind(mA, iotc_mask_row(mA, bits))), "web-device" as *u8) == 1 {
              if iotc_mask_vendor(mA, bits) == NX_IOT_VENDOR_UNKNOWN { t9 = 1 }
          }
      }
  }
  gv_check("T9 negative control: an HTTP-only host classifies web-device/unknown, never kasa" as *u8, t9, ctr)
280
  // ---- T10: COMPOSITE -- one real host answering on TWO manifest ports ----
  // T7 binds a single port, so it can pass even if precedence is inverted
  // (proven: a mutation that reordered the defaults left T7 green while T1
  // went red). The live case is a host that answers on several ports at once,
  // so bind BOTH a kasa port and a lower-precedence printer port on the same
  // loopback host and require the higher-precedence row to win.
  var t10: i64 = 0
  let lfdA: i64 = tcp_listen_loopback(9999)
  let lfdB: i64 = tcp_listen_loopback(10088)
  if lfdA >= 0 {
      if lfdB >= 0 {
          let mB: *u8 = iotm_new()
          iotm_defaults(mB)
          let maskB: *i64 = sys_mmap(256 * 8) as *i64
          let baseB: i64 = lscan_parse_prefix("127.0.0" as *u8)
          iotc_scan(mB, baseB, 60, maskB)
          // the host must have BOTH bits set, else this is not a composite test
          let outB: *u8 = sys_mmap(IOTC_OUT)
          let nB: i64 = iotc_emit_scan(outB, mB, "127.0.0" as *u8, baseB, maskB, 0)
          if ig_contains(outB, nB, "9999" as *u8) == 1 {
              if ig_contains(outB, nB, "10088" as *u8) == 1 {
                  if ig_contains(outB, nB, "\"kind\":\"smart-plug\"" as *u8) == 1 {
                      if ig_contains(outB, nB, "\"kind\":\"3d-printer\"" as *u8) == 0 { t10 = 1 }
                  }
              }
          }
          sys_close(lfdB)
      }
      sys_close(lfdA)
  }
  gv_check("T10 composite: a host open on BOTH 9999 and 10088 resolves smart-plug (higher-precedence row wins)" as *u8, t10, ctr)
312
  gv_verdict("nx_iot_ctl_gate" as *u8, ctr,
             "sovereign home-electronics identification: data-driven manifest, declared UDP blind spot, never-brick read-only surface, real loopback classification" as *u8)
  return 0
316}
nx_iot_ctl_gate.nx source

`nx_iot_ctl_gate.nx` source
