code wiki / _hdl_build / nx_media_e2e_gate.nx
nx_media_e2e_gate.nx source
↩ module page · 152 lines · 9234 B
1// nx_media_e2e_gate.nx -- SOVEREIGN end-to-end test of nishifamily.com/media (no shells/curl). Arms a realm +
2// registers a FAMILY member via real Modern Auth, forks the REAL nx_media_server, then drives it over raw
3// sockets: family login works; the SFW library path passes the allowlist; the OWNER-ONLY recordings/NSFW
4// (/mnt/nas_logging) are DENIED (403) even WITH a valid family token; and no token -> 401 (the wall).
5// PRE: ./_offc/nx_sov_build_run.elf nx_media_server --build-only (produces /tmp/nx_media_server.sov.elf)
6// Sovereign: nx_http_client + nx_modern_auth_flow + nx_syscalls. license_tier: ORIGINAL
7import "nx_http_client.nx"
8import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
9import "hub/nx_modern_auth_flow.nx"
10import "nx_syscalls.nx"
11
12const ME_PORT: i64 = 8795
13const ME_DAEMON: *u8 = "/tmp/nx_media_server.sov.elf" as *u8
14
15func me_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
16func me_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
17func me_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){d[o+i]=s[i];i=i+1} return o+i }
18func me_catn(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64=0; while i<n{d[o+i]=s[i];i=i+1} return o+n }
19func me_has(buf: *u8, n: i64, s: *u8) -> i64 {
20 var nl: i64=0; while s[nl]!=(0 as u8){nl=nl+1}
21 if nl==0 { return 1 } if nl>n { return 0 }
22 let last: i64=n-nl; var i: i64=0
23 while i<=last { var j: i64=0; var hit: i64=1; while j<nl { if (buf[i+j] as i64)!=(s[j] as i64){hit=0;j=nl} if hit==1{j=j+1} } if hit==1 { return 1 } i=i+1 }
24 return 0
25}
26func me_row(name: *u8, ok: i64) -> i64 { if ok==1 { me_w(" PASS " as *u8) } else { me_w(" FAIL " as *u8) } me_w(name); me_w("\n" as *u8); return ok }
27func me_trunc(p: *u8) -> i64 { let fd: i64=sys_openat_wr(p, 0x180); if fd>=0 { sys_close(fd) } return 0 }
28func me_extract_token(resp: *u8, n: i64, out: *u8) -> i64 {
29 let key: *u8 = "{\"token\":\"" as *u8
30 let kn: i64 = 10
31 var start: i64 = 0-1; var i: i64 = 0
32 while i+kn <= n { var m: i64=1; var j: i64=0; while j<kn { if (resp[i+j] as i64)!=(key[j] as i64){m=0;j=kn} else {j=j+1} } if m==1 { start=i+kn; i=n } i=i+1 }
33 if start<0 { return 0 }
34 var w: i64=0; var k: i64=start; var done: i64=0
35 while done==0 { if k>=n { done=1 } if done==0 { if (resp[k] as i64)==34 { done=1 } } if done==0 { out[w]=resp[k]; w=w+1; k=k+1 } }
36 return w
37}
38func me_send(reqbuf: *u8, reqlen: i64, resp: *u8, cap: i64) -> i64 {
39 let addr: *u8 = sys_mmap(16)
40 nx_http_client_sockaddr_ipv4(addr, 127, 0, 0, 1, ME_PORT)
41 let fd: i64 = sys_socket(2, 1, 0)
42 if fd < 0 { return 0-1 }
43 if nx_connect_bounded(fd, addr, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); return 0-1 }
44 sys_write(fd, reqbuf, reqlen)
45 var off: i64=0; var keep: i64=1
46 while keep==1 { if off>=cap { keep=0 } else { let r: i64=sys_read(fd, (resp+off) as *u8, cap-off); if r<=0 { keep=0 } else { off=off+r } } }
47 sys_close(fd); return off
48}
49// GET /file?p=<path> with (optional) X-Nishi-Session token
50func me_getfile(req: *u8, path: *u8, tok: *u8, toklen: i64) -> i64 {
51 var o: i64 = me_cat(req, 0, "GET /file?p=" as *u8)
52 o = me_cat(req, o, path)
53 o = me_cat(req, o, " HTTP/1.1\r\nHost: x\r\n" as *u8)
54 if toklen > 0 { o = me_cat(req, o, "X-Nishi-Session: " as *u8); o = me_catn(req, o, tok, toklen); o = me_cat(req, o, "\r\n" as *u8) }
55 o = me_cat(req, o, "Connection: close\r\n\r\n" as *u8)
56 return o
57}
58
59func main() -> i64 {
60 me_w("media e2e gate: family login + SFW allowed + owner-only (nas_logging) DENIED, over real HTTP\n" as *u8)
61 me_trunc("/tmp/nx_me_keys.log" as *u8)
62 me_trunc("/tmp/nx_me_store.log" as *u8)
63
64 // arm + register a FAMILY member (so /api/login works), into the store the daemon will load
65 let oprf: *u8=sys_mmap(32); let akp: *u8=sys_mmap(32); let akb: *u8=sys_mmap(33); let edp: *u8=sys_mmap(32); let edb: *u8=sys_mmap(32)
66 if nx_uas_server_keys_load_or_init("/tmp/nx_me_keys.log" as *u8, oprf, akp, akb, edp, edb) != NX_UAS_OK { me_w("KEYS FAIL\n" as *u8); sys_exit(1) }
67 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
68 let realm_p: *u8 = "nishifamily" as *u8
69 let store_p: *u8 = "/tmp/nx_me_store.log" as *u8
70 if nx_auth_context_init(ctx, realm_p, 11, realm_p, 11, store_p as i64, oprf, edp, edb, 900, 8192, 1, 1, 5, 1) != NX_MAUTH_OK { me_w("CTX FAIL\n" as *u8); sys_exit(1) }
71 let mn: *u8=sys_mmap(512); let mnn: *i64=sys_mmap(8) as *i64
72 if nx_modern_auth_register(ctx, "kid" as *u8, 3, "kid-family-passphrase" as *u8, 21, mn, 512, mnn) != NX_MAUTH_OK { me_w("REGISTER FAIL\n" as *u8); sys_exit(1) }
73
74 // fork + exec the REAL media server (keysfile storefile realm port)
75 let pid: i64 = sys_fork()
76 if pid == 0 {
77 let argv: *i64 = sys_mmap(64) as *i64
78 argv[0]=ME_DAEMON as i64; argv[1]="/tmp/nx_me_keys.log" as *u8 as i64; argv[2]="/tmp/nx_me_store.log" as *u8 as i64; argv[3]="nishifamily" as *u8 as i64; argv[4]="8795" as *u8 as i64; argv[5]=0
79 let envp: *i64 = sys_mmap(16) as *i64; envp[0]=0
80 sys_execve(ME_DAEMON, argv, envp)
81 sys_exit(127)
82 }
83 let resp: *u8 = sys_mmap(262144)
84 let req: *u8 = sys_mmap(16384)
85 let nul: *u8 = sys_mmap(8)
86
87 // wait for bind
88 var tries: i64 = 0
89 while tries < 400 {
90 var ro: i64 = me_cat(req, 0, "GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n" as *u8)
91 let g: i64 = me_send(req, ro, resp, 262143)
92 if g > 0 { tries = 400 } else { tries = tries + 1 }
93 }
94
95 var pass: i64 = 0
96
97 // T1: family login -> 200 + token
98 var r1: i64 = me_cat(req, 0, "POST /api/login HTTP/1.1\r\nHost: x\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 42\r\nConnection: close\r\n\r\nhandle=kid&passphrase=kid-family-passphrase" as *u8)
99 let n1: i64 = me_send(req, r1, resp, 262143)
100 let tok: *u8 = sys_mmap(256)
101 var tokn: i64 = 0
102 var t1: i64 = 0
103 if me_has(resp, n1, "HTTP/1.1 200" as *u8) == 1 { tokn = me_extract_token(resp, n1, tok); if tokn > 0 { t1 = 1 } }
104 pass = pass + me_row("T1 family /api/login -> 200 + token\x00" as *u8, t1)
105
106 // T2: OWNER-ONLY recording (/mnt/nas_logging) WITH a family token -> 403 (denied even authenticated)
107 let n2: i64 = me_send(req, me_getfile(req, "/mnt/nas_logging/beanco_/x.ts" as *u8, tok, tokn), resp, 262143)
108 var t2: i64 = 0
109 if me_has(resp, n2, "403" as *u8) == 1 { t2 = 1 }
110 pass = pass + me_row("T2 /file nas_logging recording WITH family token -> 403 (owner-only)\x00" as *u8, t2)
111
112 // T3: SFW library (/mnt/nas_movies) WITH token -> NOT 403 (allowlist passes; 404 since no NAS file here)
113 let n3: i64 = me_send(req, me_getfile(req, "/mnt/nas_movies/Zatoichi.mkv" as *u8, tok, tokn), resp, 262143)
114 var t3: i64 = 0
115 if me_has(resp, n3, "403" as *u8) == 0 { if me_has(resp, n3, "404" as *u8) == 1 { t3 = 1 } }
116 pass = pass + me_row("T3 /file nas_movies (SFW) WITH token -> allowlist PASSES (404 no-file, not 403)\x00" as *u8, t3)
117
118 // T4: owner-only path WITHOUT a token -> 401 (the wall fires before the allowlist)
119 let n4: i64 = me_send(req, me_getfile(req, "/mnt/nas_logging/beanco_/x.ts" as *u8, nul, 0), resp, 262143)
120 var t4: i64 = 0
121 if me_has(resp, n4, "401" as *u8) == 1 { t4 = 1 }
122 pass = pass + me_row("T4 /file no token -> 401 (the login wall)\x00" as *u8, t4)
123
124 // T5: OWNER-ONLY NSFW (/Redgifs/) WITH a family token -> 403
125 let n5: i64 = me_send(req, me_getfile(req, "/mnt/nas_logging/Redgifs/y.mp4" as *u8, tok, tokn), resp, 262143)
126 var t5: i64 = 0
127 if me_has(resp, n5, "403" as *u8) == 1 { t5 = 1 }
128 pass = pass + me_row("T5 /file nas_logging NSFW WITH family token -> 403 (owner-only)\x00" as *u8, t5)
129
130 // T6: the /media PREFIX route -- reader strips /media -> /file -> allowlist denies the owner-only recording
131 var r6: i64 = me_cat(req, 0, "GET /media/file?p=/mnt/nas_logging/beanco_/x.ts HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
132 r6 = me_catn(req, r6, tok, tokn)
133 r6 = me_cat(req, r6, "\r\nConnection: close\r\n\r\n" as *u8)
134 let n6: i64 = me_send(req, r6, resp, 262143)
135 var t6: i64 = 0
136 if me_has(resp, n6, "403" as *u8) == 1 { t6 = 1 }
137 pass = pass + me_row("T6 GET /media/file (prefix-aware) nas_logging WITH token -> 403 (owner-only)\x00" as *u8, t6)
138
139 __syscall(129, pid, 9, 0, 0, 0, 0) // rv64 kill=129; raw x86 62 is an RV64 KEY translated to lseek(8) -- the kill never happened (debt idx 2277)
140
141 me_w("NX-MEDIA-E2E-GATE rows=6 pass=" as *u8); let pb: *u8=sys_mmap(8); pb[0]=(48+pass) as u8; sys_write(1,pb,1); me_w("\n" as *u8)
142 if pass == 6 {
143 let line: *u8 = "CMSGATE row=nx_media_e2e media-family-login+sfw-allow+owner-deny+media-prefix-http rows=6 pass=6 verdict=PASS\n" as *u8
144 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4)
145 if gf >= 0 { sys_write(gf, line, me_len(line)); sys_close(gf) }
146 me_w("NX-MEDIA-E2E-GATE GREEN 6/6 (/media: family login + SFW served + owner-only DENIED + /media-prefix, over real HTTP)\n" as *u8)
147 sys_exit(0)
148 }
149 me_w("NX-MEDIA-E2E-GATE RED\n" as *u8)
150 sys_exit(1)
151 return 1
152}