nx_library_gate_test.nx source

1// nx_library_gate_test.nx -- prove the /library login-gate: a request WITH a valid OPAQUE session 2// header serves the library (200); WITHOUT (or forged) -> 302 /wiki/login. The security property the 3// operator required ("behind a login") proven before any live deploy. license_tier: ORIGINAL 4import "nx_library_gate_handle.nx" 5import "nx_ed25519_signature.nx" 6import "hub/nx_no_cookie_session.nx" 7import "nx_syscalls.nx" 8 9func gt_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 10func gt_hex(dst: *u8, off: i64, tok: *u8, n: i64) -> i64 { 11 let hx: *u8 = "0123456789abcdef" as *u8 12 var i: i64=0 13 while i<n { dst[off+i*2]=hx[((tok[i] as i64)>>4)&15]; dst[off+i*2+1]=hx[(tok[i] as i64)&15]; i=i+1 } 14 return off+n*2 15} 16func gt_app(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){dst[off+i]=s[i];i=i+1} var n: i64=0; while s[n]!=(0 as u8){n=n+1} return off+n } 17 18const GT_NOW: i64 = 1000000 19 20func main() -> i64 { 21 let priv: *u8 = sys_mmap(32); var i: i64=0; while i<32 { priv[i]=(i+1) as u8; i=i+1 } 22 let pub: *u8 = sys_mmap(32); ed25519_pub_from_priv(priv, pub) 23 let uid: *u8 = sys_mmap(32); i=0; while i<32 { uid[i]=17 as u8; i=i+1 } 24 let realm: *u8 = sys_mmap(32); i=0; while i<32 { realm[i]=34 as u8; i=i+1 } 25 let tok: *u8 = sys_mmap(152) 26 let mrc: i64 = nx_ncs_mint_token(priv, uid, realm, GT_NOW, 3600, tok) 27 28 // request WITH valid session header 29 let req1: *u8 = sys_mmap(4096) 30 var o: i64 = 0 31 o = gt_app(req1, o, "GET /library HTTP/1.1\r\nHost: nishifamily.com\r\nX-Nishi-Session: " as *u8) 32 o = gt_hex(req1, o, tok, 152) 33 o = gt_app(req1, o, "\r\n\r\n" as *u8) 34 let out1: *u8 = sys_mmap(262144); let n1: *i64 = sys_mmap(8) as *i64 35 let r1: i64 = nx_library_gate_handle(req1, o, pub, GT_NOW, "knowledge/library.html" as *u8, out1, 262144, n1) 36 var served_ok: i64=0 37 if r1==LG_SERVED { if n1[0]>500 { served_ok=1 } } 38 39 // request WITHOUT session -> 302 40 let req2: *u8 = sys_mmap(4096) 41 let o2: i64 = gt_app(req2, 0, "GET /library HTTP/1.1\r\nHost: nishifamily.com\r\n\r\n" as *u8) 42 let out2: *u8 = sys_mmap(8192); let n2: *i64 = sys_mmap(8) as *i64 43 let r2: i64 = nx_library_gate_handle(req2, o2, pub, GT_NOW, "knowledge/library.html" as *u8, out2, 8192, n2) 44 var redir_ok: i64=0 45 if r2==LG_REDIRECT { redir_ok=1 } 46 47 // request with FORGED token -> 302 48 let req3: *u8 = sys_mmap(4096) 49 var o3: i64 = gt_app(req3, 0, "GET /library HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8) 50 let bad: *u8 = sys_mmap(152); i=0; while i<152 { bad[i]=tok[i]; i=i+1 } bad[88]=((bad[88] as i64)^1) as u8 51 o3 = gt_hex(req3, o3, bad, 152) 52 o3 = gt_app(req3, o3, "\r\n\r\n" as *u8) 53 let out3: *u8 = sys_mmap(8192); let n3: *i64 = sys_mmap(8) as *i64 54 let r3: i64 = nx_library_gate_handle(req3, o3, pub, GT_NOW, "knowledge/library.html" as *u8, out3, 8192, n3) 55 var forged_ok: i64=0 56 if r3==LG_REDIRECT { forged_ok=1 } 57 58 gt_w("LIBGATE-HANDLE mint_ok=" as *u8); if mrc==0 { gt_w("1" as *u8) } else { gt_w("0" as *u8) } 59 gt_w(" authed_serves_library=" as *u8); if served_ok==1 { gt_w("1" as *u8) } else { gt_w("0" as *u8) } 60 gt_w(" no_session_302=" as *u8); if redir_ok==1 { gt_w("1" as *u8) } else { gt_w("0" as *u8) } 61 gt_w(" forged_302=" as *u8); if forged_ok==1 { gt_w("1" as *u8) } else { gt_w("0" as *u8) } 62 if mrc==0 { if served_ok==1 { if redir_ok==1 { if forged_ok==1 { 63 gt_w(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 } } } } 64 gt_w(" verdict=RED\n" as *u8); sys_exit(1); return 1 65}