code wiki / _hdl_build / nx_media_e2e_gate.nx

nx_media_e2e_gate.nx source

↩ module page · 152 lines · 9234 B

1// nx_media_e2e_gate.nx -- SOVEREIGN end-to-end test of nishifamily.com/media (no shells/curl). Arms a realm + 2// registers a FAMILY member via real Modern Auth, forks the REAL nx_media_server, then drives it over raw 3// sockets: family login works; the SFW library path passes the allowlist; the OWNER-ONLY recordings/NSFW 4// (/mnt/nas_logging) are DENIED (403) even WITH a valid family token; and no token -> 401 (the wall). 5// PRE: ./_offc/nx_sov_build_run.elf nx_media_server --build-only (produces /tmp/nx_media_server.sov.elf) 6// Sovereign: nx_http_client + nx_modern_auth_flow + nx_syscalls. license_tier: ORIGINAL 7import "nx_http_client.nx" 8import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host 9import "hub/nx_modern_auth_flow.nx" 10import "nx_syscalls.nx" 11 12const ME_PORT: i64 = 8795 13const ME_DAEMON: *u8 = "/tmp/nx_media_server.sov.elf" as *u8 14 15func me_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 16func me_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 17func me_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){d[o+i]=s[i];i=i+1} return o+i } 18func me_catn(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64=0; while i<n{d[o+i]=s[i];i=i+1} return o+n } 19func me_has(buf: *u8, n: i64, s: *u8) -> i64 { 20 var nl: i64=0; while s[nl]!=(0 as u8){nl=nl+1} 21 if nl==0 { return 1 } if nl>n { return 0 } 22 let last: i64=n-nl; var i: i64=0 23 while i<=last { var j: i64=0; var hit: i64=1; while j<nl { if (buf[i+j] as i64)!=(s[j] as i64){hit=0;j=nl} if hit==1{j=j+1} } if hit==1 { return 1 } i=i+1 } 24 return 0 25} 26func me_row(name: *u8, ok: i64) -> i64 { if ok==1 { me_w(" PASS " as *u8) } else { me_w(" FAIL " as *u8) } me_w(name); me_w("\n" as *u8); return ok } 27func me_trunc(p: *u8) -> i64 { let fd: i64=sys_openat_wr(p, 0x180); if fd>=0 { sys_close(fd) } return 0 } 28func me_extract_token(resp: *u8, n: i64, out: *u8) -> i64 { 29 let key: *u8 = "{\"token\":\"" as *u8 30 let kn: i64 = 10 31 var start: i64 = 0-1; var i: i64 = 0 32 while i+kn <= n { var m: i64=1; var j: i64=0; while j<kn { if (resp[i+j] as i64)!=(key[j] as i64){m=0;j=kn} else {j=j+1} } if m==1 { start=i+kn; i=n } i=i+1 } 33 if start<0 { return 0 } 34 var w: i64=0; var k: i64=start; var done: i64=0 35 while done==0 { if k>=n { done=1 } if done==0 { if (resp[k] as i64)==34 { done=1 } } if done==0 { out[w]=resp[k]; w=w+1; k=k+1 } } 36 return w 37} 38func me_send(reqbuf: *u8, reqlen: i64, resp: *u8, cap: i64) -> i64 { 39 let addr: *u8 = sys_mmap(16) 40 nx_http_client_sockaddr_ipv4(addr, 127, 0, 0, 1, ME_PORT) 41 let fd: i64 = sys_socket(2, 1, 0) 42 if fd < 0 { return 0-1 } 43 if nx_connect_bounded(fd, addr, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); return 0-1 } 44 sys_write(fd, reqbuf, reqlen) 45 var off: i64=0; var keep: i64=1 46 while keep==1 { if off>=cap { keep=0 } else { let r: i64=sys_read(fd, (resp+off) as *u8, cap-off); if r<=0 { keep=0 } else { off=off+r } } } 47 sys_close(fd); return off 48} 49// GET /file?p=<path> with (optional) X-Nishi-Session token 50func me_getfile(req: *u8, path: *u8, tok: *u8, toklen: i64) -> i64 { 51 var o: i64 = me_cat(req, 0, "GET /file?p=" as *u8) 52 o = me_cat(req, o, path) 53 o = me_cat(req, o, " HTTP/1.1\r\nHost: x\r\n" as *u8) 54 if toklen > 0 { o = me_cat(req, o, "X-Nishi-Session: " as *u8); o = me_catn(req, o, tok, toklen); o = me_cat(req, o, "\r\n" as *u8) } 55 o = me_cat(req, o, "Connection: close\r\n\r\n" as *u8) 56 return o 57} 58 59func main() -> i64 { 60 me_w("media e2e gate: family login + SFW allowed + owner-only (nas_logging) DENIED, over real HTTP\n" as *u8) 61 me_trunc("/tmp/nx_me_keys.log" as *u8) 62 me_trunc("/tmp/nx_me_store.log" as *u8) 63 64 // arm + register a FAMILY member (so /api/login works), into the store the daemon will load 65 let oprf: *u8=sys_mmap(32); let akp: *u8=sys_mmap(32); let akb: *u8=sys_mmap(33); let edp: *u8=sys_mmap(32); let edb: *u8=sys_mmap(32) 66 if nx_uas_server_keys_load_or_init("/tmp/nx_me_keys.log" as *u8, oprf, akp, akb, edp, edb) != NX_UAS_OK { me_w("KEYS FAIL\n" as *u8); sys_exit(1) } 67 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext 68 let realm_p: *u8 = "nishifamily" as *u8 69 let store_p: *u8 = "/tmp/nx_me_store.log" as *u8 70 if nx_auth_context_init(ctx, realm_p, 11, realm_p, 11, store_p as i64, oprf, edp, edb, 900, 8192, 1, 1, 5, 1) != NX_MAUTH_OK { me_w("CTX FAIL\n" as *u8); sys_exit(1) } 71 let mn: *u8=sys_mmap(512); let mnn: *i64=sys_mmap(8) as *i64 72 if nx_modern_auth_register(ctx, "kid" as *u8, 3, "kid-family-passphrase" as *u8, 21, mn, 512, mnn) != NX_MAUTH_OK { me_w("REGISTER FAIL\n" as *u8); sys_exit(1) } 73 74 // fork + exec the REAL media server (keysfile storefile realm port) 75 let pid: i64 = sys_fork() 76 if pid == 0 { 77 let argv: *i64 = sys_mmap(64) as *i64 78 argv[0]=ME_DAEMON as i64; argv[1]="/tmp/nx_me_keys.log" as *u8 as i64; argv[2]="/tmp/nx_me_store.log" as *u8 as i64; argv[3]="nishifamily" as *u8 as i64; argv[4]="8795" as *u8 as i64; argv[5]=0 79 let envp: *i64 = sys_mmap(16) as *i64; envp[0]=0 80 sys_execve(ME_DAEMON, argv, envp) 81 sys_exit(127) 82 } 83 let resp: *u8 = sys_mmap(262144) 84 let req: *u8 = sys_mmap(16384) 85 let nul: *u8 = sys_mmap(8) 86 87 // wait for bind 88 var tries: i64 = 0 89 while tries < 400 { 90 var ro: i64 = me_cat(req, 0, "GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n" as *u8) 91 let g: i64 = me_send(req, ro, resp, 262143) 92 if g > 0 { tries = 400 } else { tries = tries + 1 } 93 } 94 95 var pass: i64 = 0 96 97 // T1: family login -> 200 + token 98 var r1: i64 = me_cat(req, 0, "POST /api/login HTTP/1.1\r\nHost: x\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 42\r\nConnection: close\r\n\r\nhandle=kid&passphrase=kid-family-passphrase" as *u8) 99 let n1: i64 = me_send(req, r1, resp, 262143) 100 let tok: *u8 = sys_mmap(256) 101 var tokn: i64 = 0 102 var t1: i64 = 0 103 if me_has(resp, n1, "HTTP/1.1 200" as *u8) == 1 { tokn = me_extract_token(resp, n1, tok); if tokn > 0 { t1 = 1 } } 104 pass = pass + me_row("T1 family /api/login -> 200 + token\x00" as *u8, t1) 105 106 // T2: OWNER-ONLY recording (/mnt/nas_logging) WITH a family token -> 403 (denied even authenticated) 107 let n2: i64 = me_send(req, me_getfile(req, "/mnt/nas_logging/beanco_/x.ts" as *u8, tok, tokn), resp, 262143) 108 var t2: i64 = 0 109 if me_has(resp, n2, "403" as *u8) == 1 { t2 = 1 } 110 pass = pass + me_row("T2 /file nas_logging recording WITH family token -> 403 (owner-only)\x00" as *u8, t2) 111 112 // T3: SFW library (/mnt/nas_movies) WITH token -> NOT 403 (allowlist passes; 404 since no NAS file here) 113 let n3: i64 = me_send(req, me_getfile(req, "/mnt/nas_movies/Zatoichi.mkv" as *u8, tok, tokn), resp, 262143) 114 var t3: i64 = 0 115 if me_has(resp, n3, "403" as *u8) == 0 { if me_has(resp, n3, "404" as *u8) == 1 { t3 = 1 } } 116 pass = pass + me_row("T3 /file nas_movies (SFW) WITH token -> allowlist PASSES (404 no-file, not 403)\x00" as *u8, t3) 117 118 // T4: owner-only path WITHOUT a token -> 401 (the wall fires before the allowlist) 119 let n4: i64 = me_send(req, me_getfile(req, "/mnt/nas_logging/beanco_/x.ts" as *u8, nul, 0), resp, 262143) 120 var t4: i64 = 0 121 if me_has(resp, n4, "401" as *u8) == 1 { t4 = 1 } 122 pass = pass + me_row("T4 /file no token -> 401 (the login wall)\x00" as *u8, t4) 123 124 // T5: OWNER-ONLY NSFW (/Redgifs/) WITH a family token -> 403 125 let n5: i64 = me_send(req, me_getfile(req, "/mnt/nas_logging/Redgifs/y.mp4" as *u8, tok, tokn), resp, 262143) 126 var t5: i64 = 0 127 if me_has(resp, n5, "403" as *u8) == 1 { t5 = 1 } 128 pass = pass + me_row("T5 /file nas_logging NSFW WITH family token -> 403 (owner-only)\x00" as *u8, t5) 129 130 // T6: the /media PREFIX route -- reader strips /media -> /file -> allowlist denies the owner-only recording 131 var r6: i64 = me_cat(req, 0, "GET /media/file?p=/mnt/nas_logging/beanco_/x.ts HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8) 132 r6 = me_catn(req, r6, tok, tokn) 133 r6 = me_cat(req, r6, "\r\nConnection: close\r\n\r\n" as *u8) 134 let n6: i64 = me_send(req, r6, resp, 262143) 135 var t6: i64 = 0 136 if me_has(resp, n6, "403" as *u8) == 1 { t6 = 1 } 137 pass = pass + me_row("T6 GET /media/file (prefix-aware) nas_logging WITH token -> 403 (owner-only)\x00" as *u8, t6) 138 139 __syscall(129, pid, 9, 0, 0, 0, 0) // rv64 kill=129; raw x86 62 is an RV64 KEY translated to lseek(8) -- the kill never happened (debt idx 2277) 140 141 me_w("NX-MEDIA-E2E-GATE rows=6 pass=" as *u8); let pb: *u8=sys_mmap(8); pb[0]=(48+pass) as u8; sys_write(1,pb,1); me_w("\n" as *u8) 142 if pass == 6 { 143 let line: *u8 = "CMSGATE row=nx_media_e2e media-family-login+sfw-allow+owner-deny+media-prefix-http rows=6 pass=6 verdict=PASS\n" as *u8 144 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4) 145 if gf >= 0 { sys_write(gf, line, me_len(line)); sys_close(gf) } 146 me_w("NX-MEDIA-E2E-GATE GREEN 6/6 (/media: family login + SFW served + owner-only DENIED + /media-prefix, over real HTTP)\n" as *u8) 147 sys_exit(0) 148 } 149 me_w("NX-MEDIA-E2E-GATE RED\n" as *u8) 150 sys_exit(1) 151 return 1 152}