nx_lysis_test.nx source
↩ module page · 89 lines · 3928 B
1// nx_lysis_test.nx -- smoke for nx_lysis.
2
3import "nx_syscalls.nx"
4import "nx_attention_class.nx"
5import "nx_evict_journal.nx"
6import "nx_lysis.nx"
7
8func main() -> i64 {
9 // 1: mechanism enum sealed
10 if NX_LYSIS_N_MECHANISMS != 10 { return 1 }
11 if nx_lysis_mechanism_is_valid(NX_LYSIS_CAPABILITY_REVOKE) != 1 { return 2 }
12 if nx_lysis_mechanism_is_valid(NX_LYSIS_DECOY_PROMOTE) != 1 { return 3 }
13 if nx_lysis_mechanism_is_valid(-1) != 0 { return 4 }
14 if nx_lysis_mechanism_is_valid(10) != 0 { return 5 }
15
16 // 2: severity enum sealed
17 if NX_LYSIS_N_SEVS != 3 { return 6 }
18 if nx_lysis_severity_is_valid(NX_LYSIS_SEV_LOW) != 1 { return 7 }
19 if nx_lysis_severity_is_valid(NX_LYSIS_SEV_HIGH) != 1 { return 8 }
20 if nx_lysis_severity_is_valid(3) != 0 { return 9 }
21
22 // 3: reversibility predicates
23 if nx_lysis_is_reversible(NX_LYSIS_CAPABILITY_REVOKE) != 1 { return 10 }
24 if nx_lysis_is_reversible(NX_LYSIS_PROCESS_PAUSE) != 1 { return 11 }
25 if nx_lysis_is_reversible(NX_LYSIS_PROCESS_TERMINATE) != 0 { return 12 }
26 if nx_lysis_is_reversible(NX_LYSIS_MEMORY_ZERO) != 0 { return 13 }
27
28 // 4: host-tolerance predicates
29 if nx_lysis_is_host_tolerant(NX_LYSIS_CAPABILITY_REVOKE) != 1 { return 14 }
30 if nx_lysis_is_host_tolerant(NX_LYSIS_NETWORK_BLACKHOLE) != 1 { return 15 }
31 if nx_lysis_is_host_tolerant(NX_LYSIS_CRYPTO_REKEY) != 0 { return 16 }
32
33 // 5: operator-gating
34 if nx_lysis_requires_operator(NX_LYSIS_PROCESS_TERMINATE) != 1 { return 17 }
35 if nx_lysis_requires_operator(NX_LYSIS_CRYPTO_REKEY) != 1 { return 18 }
36 if nx_lysis_requires_operator(NX_LYSIS_QUARANTINE) != 0 { return 19 }
37 if nx_lysis_requires_operator(NX_LYSIS_CAPABILITY_REVOKE) != 0 { return 20 }
38
39 // 6: selector -- LOW severity always QUARANTINE
40 let m_low: nx_int = nx_lysis_select(NX_LYSIS_SEV_LOW, 0, 0, 0, 0)
41 if m_low != NX_LYSIS_QUARANTINE { return 21 }
42
43 // 7: MED + network-active -> NETWORK_BLACKHOLE
44 let m_med_net: nx_int = nx_lysis_select(NX_LYSIS_SEV_MED, 1, 0, 0, 0)
45 if m_med_net != NX_LYSIS_NETWORK_BLACKHOLE { return 22 }
46
47 // 8: MED + no network -> CAPABILITY_REVOKE
48 let m_med: nx_int = nx_lysis_select(NX_LYSIS_SEV_MED, 0, 0, 0, 0)
49 if m_med != NX_LYSIS_CAPABILITY_REVOKE { return 23 }
50
51 // 9: HIGH + persistent -> PROCESS_TERMINATE (if not reversible_only)
52 let m_high_term: nx_int = nx_lysis_select(NX_LYSIS_SEV_HIGH, 0, 1, 0, 0)
53 if m_high_term != NX_LYSIS_PROCESS_TERMINATE { return 24 }
54
55 // 10: HIGH + persistent + reversible_only -> PROCESS_PAUSE
56 let m_high_pause: nx_int = nx_lysis_select(NX_LYSIS_SEV_HIGH, 0, 1, 0, 1)
57 if m_high_pause != NX_LYSIS_PROCESS_PAUSE { return 25 }
58
59 // 11: HIGH + key_leak -> CRYPTO_REKEY (without reversible-only)
60 let m_high_key: nx_int = nx_lysis_select(NX_LYSIS_SEV_HIGH, 0, 0, 1, 0)
61 if m_high_key != NX_LYSIS_CRYPTO_REKEY { return 26 }
62
63 // 12: HIGH + key_leak + reversible-only -> CAPABILITY_REVOKE
64 let m_high_key_rev: nx_int = nx_lysis_select(NX_LYSIS_SEV_HIGH, 0, 0, 1, 1)
65 if m_high_key_rev != NX_LYSIS_CAPABILITY_REVOKE { return 27 }
66
67 // 13: bad severity -> NONE
68 if nx_lysis_select(99, 0, 0, 0, 0) != NX_LYSIS_NONE { return 28 }
69
70 // 14: emit action
71 let a: *NxLysisAction = nx_lysis_emit(1234,
72 NX_LYSIS_CAPABILITY_REVOKE, NX_LYSIS_SEV_MED, 5000, 0)
73 if (a as i64) == 0 { return 29 }
74 if a.target_id != 1234 { return 30 }
75 if a.reversible != 1 { return 31 }
76 if a.operator_gated != 0 { return 32 }
77
78 // 15: emit with require_host_tolerant=1 refuses CRYPTO_REKEY
79 let a_bad: *NxLysisAction = nx_lysis_emit(1234,
80 NX_LYSIS_CRYPTO_REKEY, NX_LYSIS_SEV_HIGH, 5000, 1)
81 if (a_bad as i64) != 0 { return 33 }
82
83 // 16: log to journal
84 let j: *NxEvictJournal = nx_evict_journal_new(8)
85 if nx_lysis_log(a, j, NX_AC_DEV, 9999) != NX_LYSIS_OK { return 34 }
86 if j.count != 1 { return 35 }
87
88 return 0
89}