nx_ipfilter_gate.nx source
↩ module page · 43 lines · 3445 B
1// nx_ipfilter_gate.nx -- proves the ip-filter: (1) ipf_load reads the binary + ipf_blocked correctly matches
2// in-range / passes out-of-range; (2) if_parse_cidr expands "a.b.c.d/n" and bare IPs to the right start-end.
3// license_tier: ORIGINAL depends: nx_ipfilter_fetch (if_parse_cidr) + nx_ipfilter (ipf_* transitively)
4import "nx_ipfilter_fetch.nx"
5import "nx_gate_verdict.nx"
6
7func g_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
8func g_n(v: i64) -> i64 { if v==0 { sys_write(1,"0" as *u8,1); return 0 } var m: i64=v; if m<0 { sys_write(1,"-" as *u8,1); m=0-m } let t: *u8=sys_mmap(28); var k: i64=0; while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } while k>0 { k=k-1; sys_write(1,(((t as i64)+k) as *u8),1) } return 0 }
9
10func main() -> i64 {
11 g_p("IPFILTER-GATE authored=organ\n" as *u8)
12 // (1) write a known binary: [10.0.0.0 .. 10.0.0.255] and [192.168.5.0 .. 192.168.5.10]
13 let ob: *u8 = sys_mmap(64); var o: i64=0
14 o=ipf_put_u32le(ob,o, ipf_ip(10,0,0,0)); o=ipf_put_u32le(ob,o, ipf_ip(10,0,0,255))
15 o=ipf_put_u32le(ob,o, ipf_ip(192,168,5,0)); o=ipf_put_u32le(ob,o, ipf_ip(192,168,5,10))
16 let wf: i64=sys_openat_wr("/tmp/ipf_test.bin" as *u8, 0x1a4); sys_write(wf, ob, o); sys_close(wf)
17 // (2) load + check
18 let arr: *i64 = sys_mmap(4096) as *i64
19 let c: i64 = ipf_load("/tmp/ipf_test.bin" as *u8, arr, 256)
20 let b1: i64 = ipf_blocked(arr, c, ipf_ip(10,0,0,5)) // in -> 1
21 let b2: i64 = ipf_blocked(arr, c, ipf_ip(192,168,5,5)) // in -> 1
22 let b3: i64 = ipf_blocked(arr, c, ipf_ip(8,8,8,8)) // out -> 0
23 let b4: i64 = ipf_blocked(arr, c, ipf_ip(192,168,5,20)) // out (past end) -> 0
24 g_p(" count="); g_n(c); g_p(" b1="); g_n(b1); g_p(" b2="); g_n(b2); g_p(" b3="); g_n(b3); g_p(" b4="); g_n(b4); g_p("\n" as *u8)
25 // (3) CIDR parse
26 let oct: *i64 = sys_mmap(64) as *i64; let rng: *i64 = sys_mmap(16) as *i64
27 let s1: *u8 = "10.0.0.0/24" as *u8; var l1: i64=0; while s1[l1]!=(0 as u8){l1=l1+1}
28 let ok1: i64 = if_parse_cidr(s1, 0, l1, oct, rng); let cs1: i64=rng[0]&0xFFFFFFFF; let ce1: i64=rng[1]&0xFFFFFFFF
29 let s2: *u8 = "1.2.3.4" as *u8; var l2: i64=0; while s2[l2]!=(0 as u8){l2=l2+1}
30 let ok2: i64 = if_parse_cidr(s2, 0, l2, oct, rng); let cs2: i64=rng[0]&0xFFFFFFFF; let ce2: i64=rng[1]&0xFFFFFFFF
31 g_p(" cidr /24 ok="); g_n(ok1); g_p(" start=="); if cs1==(ipf_ip(10,0,0,0)&0xFFFFFFFF) { g_n(1) } else { g_n(0) } g_p(" end=="); if ce1==(ipf_ip(10,0,0,255)&0xFFFFFFFF) { g_n(1) } else { g_n(0) }
32 g_p(" bareIP ok="); g_n(ok2); g_p(" eq="); if cs2==(ipf_ip(1,2,3,4)&0xFFFFFFFF) { if ce2==cs2 { g_n(1) } else { g_n(0) } } else { g_n(0) } g_p("\n" as *u8)
33 var cidr_ok: i64=0; if ok1==1 { if cs1==(ipf_ip(10,0,0,0)&0xFFFFFFFF) { if ce1==(ipf_ip(10,0,0,255)&0xFFFFFFFF) { if ok2==1 { if cs2==(ipf_ip(1,2,3,4)&0xFFFFFFFF) { if ce2==cs2 { cidr_ok=1 } } } } } }
34 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
35 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
36 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
37 let ctr__dry: *i64 = gv_ctr()
38 ctr__dry[0] = c
39 ctr__dry[1] = 2
40 let rc__dry: i64 = gv_verdict("IPFILTER-GATE" as *u8, ctr__dry, "load+match correct; CIDR /24 + bare-IP expand correct)" as *u8)
41 sys_exit(rc__dry)
42 return rc__dry
43}