nx_ipfilter_seed_gate.nx source
↩ module page · 36 lines · 2816 B
1// nx_ipfilter_seed_gate.nx -- EXECUTION-level proof the seeder actually rejects a blocked peer (not just that
2// ipf_blocked() returns 1). Opens a real loopback TCP connection, accepts it, resolves the peer IP via the
3// same getpeername path the seeder uses (ts_peer_ip), then asserts ts_ipf_reject = 1 when 127.0.0.1 is
4// blocked and 0 when the blocklist is empty. license_tier: ORIGINAL depends: nx_torrent_seed (ts_peer_ip/ts_ipf_reject/ts_sockaddr)
5import "nx_torrent_seed.nx"
6
7import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
8func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
9func gn(v: i64) -> i64 { if v==0 { sys_write(1,"0" as *u8,1); return 0 } var m: i64=v; if m<0 { sys_write(1,"-" as *u8,1); m=0-m } let t: *u8=sys_mmap(28); var k: i64=0; while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } while k>0 { k=k-1; sys_write(1,(((t as i64)+k) as *u8),1) } return 0 }
10
11func main() -> i64 {
12 gp("IPFILTER-SEED-GATE authored=organ\n" as *u8)
13 let port: i64 = 51888
14 let lfd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
15 let one: *u8 = sys_mmap(4); one[0]=1 as u8; sys_setsockopt(lfd, SOL_SOCKET, 2, one, 4)
16 let sa: *u8 = sys_mmap(16); ts_sockaddr(sa, port, 127, 0, 0, 1)
17 if sys_bind(lfd, sa, 16) < 0 { gp("bind fail\n" as *u8); sys_exit(1); return 1 }
18 sys_listen(lfd, 8)
19 let cfd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
20 let ca: *u8 = sys_mmap(16); ts_sockaddr(ca, port, 127, 0, 0, 1)
21 nx_connect_bounded(cfd, ca, 16, NX_CONN_DEFAULT_MS) // loopback: queues into backlog immediately
22 let afd: i64 = sys_accept(lfd)
23 if afd < 0 { gp("accept fail\n" as *u8); sys_exit(1); return 1 }
24 let ip: i64 = ts_peer_ip(afd)
25 gp(" getpeername ip=127.0.0.1? " as *u8); if ip==(ipf_ip(127,0,0,1)) { gn(1) } else { gn(0) } gp(" (got " as *u8); gn((ip>>24)&0xff); gp("." as *u8); gn((ip>>16)&0xff); gp("." as *u8); gn((ip>>8)&0xff); gp("." as *u8); gn(ip&0xff); gp(")\n" as *u8)
26 // blocklist that blocks 127.0.0.1
27 let arr: *i64 = sys_mmap(64) as *i64; arr[0]=ipf_ip(127,0,0,1); arr[1]=ipf_ip(127,0,0,1)
28 let rej_blocked: i64 = ts_ipf_reject(afd, arr, 1) // expect 1 (reject)
29 let rej_empty: i64 = ts_ipf_reject(afd, arr, 0) // cnt=0 -> expect 0 (serve)
30 gp(" reject_when_blocked=" as *u8); gn(rej_blocked); gp(" reject_when_empty=" as *u8); gn(rej_empty); gp("\n" as *u8)
31 sys_close(afd); sys_close(cfd); sys_close(lfd)
32 if ip==(ipf_ip(127,0,0,1)) { if rej_blocked==1 { if rej_empty==0 {
33 gp("IPFILTER-SEED-GATE verdict=GREEN (real accepted peer resolved + blocked-peer rejected, empty-list serves)\n" as *u8); sys_exit(0); return 0
34 } } }
35 gp("IPFILTER-SEED-GATE verdict=RED\n" as *u8); sys_exit(1); return 1
36}