nx_lan_signup_gate.nx source

1// nx_lan_signup_gate.nx -- referee for the BY-CONSTRUCTION signup gate (nx_lan_signup). PROVES: 2// * ls_ip_is_lan classifies RFC1918 + loopback as LAN and every near-miss (11.x, 172.15/172.32, 192.169, 3// TEST-NET 203.0.113.x, 8.8.8.8) as WAN ; 4// * ls_signup_allowed = ALLOW only when LAN AND invited, with the decisive leak-checks: 5// - an INVITED handle from a WAN address is DENIED (the "only on LAN" guarantee -- a flag can't open it) ; 6// - a LAN stranger (un-invited handle) is DENIED (the "only the family" guarantee) ; 7// - a handle already CLAIMED (active) is DENIED from the LAN (re-registration blocked) ; 8// - loopback (the publisher's own proxy) is allowed for an invited handle. 9// GREEN iff every row matches. Durable -> knowledge/status/lan_signup_gate.log. 10import "nx_lan_signup.nx" 11import "nx_g_puts_lib.nx" 12import "nx_hr_admin.nx" 13import "nx_syscalls.nx" 14 15func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 16func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 17func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 18func gtrunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd>=0 { sys_close(fd) } return 0 } 19func g_mkpfx(base: *u8, ms: i64, out: *u8) -> i64 { var o: i64=0; while base[o]!=(0 as u8){out[o]=base[o];o=o+1} let t: *u8=sys_mmap(28); var m: i64=ms; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var z: i64=k-1; while z>=0{out[o]=t[z];o=o+1;z=z-1} out[o]=0 as u8; return o } 20func g_ip4(out: *u8, a: i64, b: i64, c: i64, d: i64) -> i64 { out[0]=a as u8; out[1]=b as u8; out[2]=c as u8; out[3]=d as u8; return 0 } 21func chk(got: i64, want: i64, label: *u8) -> i64 { 22 g_puts(" "); g_puts(label); g_puts(" got="); g_num(got); g_puts(" want="); g_num(want) 23 if got == want { g_puts(" PASS\n"); return 1 } 24 g_puts(" FAIL\n"); return 0 25} 26 27func main() -> i64 { 28 g_puts("=== NISHI LAN-SIGNUP GATE (only on LAN + only invited, by construction) ===\n" as *u8) 29 var pass: i64=0; var rows: i64=0 30 let ip: *u8 = sys_mmap(8) 31 32 // ---- ls_ip_is_lan classification ---- 33 g_ip4(ip,10,0,0,5); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 1, "10.0.0.5 -> LAN" as *u8) 34 g_ip4(ip,192,168,8,227); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 1, "192.168.8.227 (the NAS) -> LAN" as *u8) 35 g_ip4(ip,172,16,0,1); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 1, "172.16.0.1 -> LAN" as *u8) 36 g_ip4(ip,172,31,255,254); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 1, "172.31.255.254 -> LAN" as *u8) 37 g_ip4(ip,127,0,0,1); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 1, "127.0.0.1 loopback -> LAN" as *u8) 38 g_ip4(ip,8,8,8,8); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 0, "8.8.8.8 -> WAN" as *u8) 39 g_ip4(ip,11,0,0,1); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 0, "11.0.0.1 (NOT 10/8) -> WAN" as *u8) 40 g_ip4(ip,172,15,0,1); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 0, "172.15.0.1 (below /12) -> WAN" as *u8) 41 g_ip4(ip,172,32,0,1); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 0, "172.32.0.1 (above /12) -> WAN" as *u8) 42 g_ip4(ip,192,169,0,1); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 0, "192.169.0.1 (NOT 192.168) -> WAN" as *u8) 43 g_ip4(ip,203,0,113,5); rows=rows+1; pass=pass+chk(ls_ip_is_lan(ip), 0, "203.0.113.5 (TEST-NET/public) -> WAN" as *u8) 44 45 // ---- ls_signup_allowed: HR roster = brad invited, jensen invited+claimed(active), kelli NOT provisioned ---- 46 let hr: *u8 = sys_mmap(96); g_mkpfx("/tmp/nx_ls_hr_" as *u8, sys_now_ms(), hr) // seg_store prefix (cutover) 47 let NR: *u8 = "nishi_site_admin" as *u8; let NRN: i64 = 16 48 let fam: *u8 = "andelin" as *u8 49 let cid: *u8 = sys_mmap(96) 50 hra_invite(hr, NR, NRN, "brad" as *u8, 4, HRA_LVL_MEMBER, fam, 1000, "elderwesto" as *u8, cid) 51 hra_invite(hr, NR, NRN, "jensen" as *u8, 6, HRA_LVL_MEMBER, fam, 1000, "elderwesto" as *u8, cid) 52 hra_claim(hr, NR, NRN, "jensen" as *u8, 6, fam, 2000, "self" as *u8) // jensen now ACTIVE (already signed up) 53 54 let lan: *u8 = sys_mmap(8); g_ip4(lan,192,168,8,10) 55 let lop: *u8 = sys_mmap(8); g_ip4(lop,127,0,0,1) 56 let wan: *u8 = sys_mmap(8); g_ip4(wan,203,0,113,5) 57 let wan2: *u8 = sys_mmap(8); g_ip4(wan2,8,8,8,8) 58 59 rows=rows+1; pass=pass+chk(ls_signup_allowed(lan, hr, NR, NRN, "brad" as *u8, 4), 1, "LAN + brad(invited) -> ALLOW" as *u8) 60 rows=rows+1; pass=pass+chk(ls_signup_allowed(wan, hr, NR, NRN, "brad" as *u8, 4), 0, "WAN + brad(invited) -> DENY (only-on-LAN, flag can't open it)" as *u8) 61 rows=rows+1; pass=pass+chk(ls_signup_allowed(lan, hr, NR, NRN, "kelli" as *u8, 5), 0, "LAN + kelli(NOT invited) -> DENY (only-the-family)" as *u8) 62 rows=rows+1; pass=pass+chk(ls_signup_allowed(lan, hr, NR, NRN, "jensen" as *u8, 6), 0, "LAN + jensen(already active) -> DENY (re-registration blocked)" as *u8) 63 rows=rows+1; pass=pass+chk(ls_signup_allowed(lop, hr, NR, NRN, "brad" as *u8, 4), 1, "loopback + brad(invited) -> ALLOW (publisher proxy)" as *u8) 64 rows=rows+1; pass=pass+chk(ls_signup_allowed(wan2, hr, NR, NRN, "kelli" as *u8, 5), 0, "WAN + kelli(not invited) -> DENY (both fail)" as *u8) 65 66 g_puts("----\nNISHI-LAN-SIGNUP-GATE rows=" as *u8); g_num(rows); g_puts(" pass=" as *u8); g_num(pass) 67 if pass==rows { g_puts(" verdict=GREEN\n" as *u8) } else { g_puts(" verdict=RED\n" as *u8) } 68 let lg: i64=sys_openat_append("knowledge/status/lan_signup_gate.log" as *u8, 0x1a4) 69 if lg>=0 { 70 g_w(lg, "NISHI-LAN-SIGNUP-GATE rows=" as *u8); g_wn(lg, rows); g_w(lg, " pass=" as *u8); g_wn(lg, pass) 71 if pass==rows { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } 72 sys_close(lg) 73 } 74 if pass==rows { sys_exit(0); return 0 } 75 sys_exit(1); return 1 76}