nx_mgmt_organ_capacity_gate_t180.nx source
↩ module page · 87 lines · 7511 B
1// Actual management handler gate. Fixture registry is isolated in a unique temporary directory;
2// its only executable is the already-vetted, side-effect-free argecho organ.
3import "_hdl_build/nx_mgmt_api.nx"
4import "nx_gate_verdict.nx"
5func oa_contains(b:*u8,n:i64,s:*u8)->i64{let z:i64=sd_len(s);var p:i64=0;while p+z<=n{var k:i64=0;while k<z{if b[p+k]!=s[k]{break};k=k+1};if k==z{return 1};p=p+1};return 0}
6func oa_call(form:*u8,out:*u8)->i64 {
7 let req:*u8=sys_mmap(sd_len(form)+512);var n:i64=sd_cat(req,0,"POST /api/organ_run HTTP/1.1\r\nHost: localhost\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: ")
8 n=sd_catn(req,n,sd_len(form));n=sd_cat(req,n,"\r\n\r\n");n=sd_cat(req,n,form)
9 return ma_do_organ_run(req,n,out)
10}
11func oa_refuse(c:*i64,label:*u8,form:*u8,out:*u8)->i64 {
12 let n:i64=oa_call(form,out)
13 gv_check(label,oa_contains(out,n,"HTTP/1.1 400")==1&&oa_contains(out,n,"NX_TOOL_ARGECHO_OK")==0,c);return 0
14}
15func oa_yes(form:*u8)->i64{return ma_form_yes(form,sd_len(form),"allow_capability_loss",21)}
16func oa_confirm(form:*u8)->i64{
17 let bytes:i64=sd_len(form)+sd_len("POST /unused HTTP/1.1\r\n\r\n")+1
18 let req:*u8=sys_mmap_try(bytes);if (req as i64)==0{return -1}
19 var n:i64=sd_cat(req,0,"POST /unused HTTP/1.1\r\n\r\n");n=sd_cat(req,n,form)
20 let yes:i64=ma_confirmed(req,n);sys_munmap_direct(req,bytes);return yes
21}
22func main()->i64 {
23 let c:*i64=gv_ctr();gv_head("MGMT-ORGAN-ACTUAL-HANDLER-CAPACITY")
24 gv_check("approval missing refuses",oa_yes("")==0,c)
25 gv_check("approval empty refuses",oa_yes("allow_capability_loss=")==0,c)
26 gv_check("approval no refuses",oa_yes("allow_capability_loss=no")==0,c)
27 gv_check("approval false refuses",oa_yes("allow_capability_loss=false")==0,c)
28 gv_check("approval zero refuses",oa_yes("allow_capability_loss=0")==0,c)
29 gv_check("approval yes-prefix refuses",oa_yes("allow_capability_loss=yesplease")==0,c)
30 gv_check("approval exact yes accepts",oa_yes("allow_capability_loss=yes")==1,c)
31 gv_check("approval case differs refuses",oa_yes("allow_capability_loss=YES")==0,c)
32 gv_check("approval percent encoded not silently decoded",oa_yes("allow_capability_loss=%79es")==0,c)
33 gv_check("approval trailing space refuses",oa_yes("allow_capability_loss=yes ")==0,c)
34 gv_check("approval unrelated key refuses",oa_yes("xallow_capability_loss=yes")==0,c)
35 gv_check("confirmation exact yes preserved",oa_confirm("confirm=yes")==1,c)
36 gv_check("confirmation false refuses",oa_confirm("confirm=false")==0,c)
37 gv_check("confirmation yes-prefix refuses",oa_confirm("confirm=yesplease")==0,c)
38 gv_check("confirmation missing refuses",oa_confirm("other=yes")==0,c)
39 gv_check("conflicting duplicate approval refuses in both orders",oa_yes("allow_capability_loss=yes&allow_capability_loss=no")==0&&oa_yes("allow_capability_loss=no&allow_capability_loss=yes")==0,c)
40 gv_check("repeated affirmative approval refuses",oa_yes("allow_capability_loss=yes&allow_capability_loss=yes")==0,c)
41 gv_check("separated duplicate approval refuses",oa_yes("allow_capability_loss=yes&other=1&allow_capability_loss=no")==0,c)
42 gv_check("duplicate confirmation refuses",oa_confirm("confirm=yes&confirm=no")==0,c)
43 gv_check("unique approval amid other fields accepts",oa_yes("other=1&allow_capability_loss=yes&tail=2")==1,c)
44
45 let dir:*u8=sys_mmap(256);var dn:i64=sd_cat(dir,0,"/tmp/nishi-organ-args-gate-");dn=sd_catn(dir,dn,sys_now_ms());dir[dn]=0 as u8
46 if sys_mkdir(dir,448)!=0{return 2};if sys_chdir(dir)!=0{return 2}
47 let reg:*u8="argecho\t/volume1/homes/elderwesto/nishihost/nx_tool_argecho.elf\tGREEN\npinned_echo\t/volume1/homes/elderwesto/nishihost/nx_tool_argecho.elf\tGREEN\tPINNED first second third fourth fifth sixth seventh eighth ninth tenth eleventh twelfth thirteenth\n"
48 let fd:i64=sys_openat_exclusive("tool_allowlist.conf",384);if fd<0{return 2}
49 if sys_write(fd,reg,sd_len(reg))!=sd_len(reg){sys_close(fd);return 2};sys_close(fd)
50 let out:*u8=sys_mmap(SD_OUTCAP);let form:*u8=sys_mmap(16384)
51 var z:i64=sd_cat(form,0,"target=argecho&confirm=yes&args_encoding=percent-v1&args=");var i:i64=1
52 while i<=20{if i>1{z=sd_cat(form,z,"+")};z=sd_cat(form,z,"argument");z=sd_catn(form,z,i);i=i+1};form[z]=0 as u8
53 var n:i64=oa_call(form,out)
54 gv_check("twenty arguments execute",oa_contains(out,n,"HTTP/1.1 200")==1&&oa_contains(out,n,"\"argc\":20")==1&&oa_contains(out,n,"\"exit_code\":0")==1&&oa_contains(out,n,"argument20")==1,c)
55 n=oa_call(form,out)
56 gv_check("same safe request repeatable",oa_contains(out,n,"\"argc\":20")==1&&oa_contains(out,n,"argument20")==1,c)
57 z=sd_cat(form,0,"target=argecho&confirm=yes&args_encoding=percent-v1&args=")
58 i=0;while i<5001{form[z]=65 as u8;z=z+1;i=i+1};form[z]=0 as u8
59 n=oa_call(form,out);var count:i64=0;i=0;while i<n{if out[i]==65 as u8{count=count+1};i=i+1}
60 gv_check("5001-byte argument not truncated",oa_contains(out,n,"HTTP/1.1 200")==1&&oa_contains(out,n,"\"argc\":1")==1&&oa_contains(out,n,"\"exit_code\":0")==1&&count>=5001,c)
61 n=oa_call("target=argecho&confirm=yes&args_encoding=percent-v1&args=plus%2Bpercent%25+space%20inside+amp%26equals%3D+quote%22",out)
62 gv_check("encoded delimiters preserve four tokens",oa_contains(out,n,"\"argc\":4")==1&&oa_contains(out,n,"plus+percent%")==1&&oa_contains(out,n,"space inside")==1&&oa_contains(out,n,"amp&equals=")==1&&oa_contains(out,n,"quote\\\"")==1,c)
63 n=oa_call("target=pinned_echo&confirm=yes&args_encoding=percent-v1&args=CALLER_MUST_NOT_APPEAR%00",out)
64 gv_check("pinned fourteen args override caller",oa_contains(out,n,"\"argc\":14")==1&&oa_contains(out,n,"thirteenth")==1&&oa_contains(out,n,"CALLER_MUST_NOT_APPEAR")==0&&oa_contains(out,n,"\"exit_code\":0")==1,c)
65 n=oa_call("target=argecho&confirm=yes",out)
66 gv_check("zero args remain valid",oa_contains(out,n,"\"argc\":0")==1&&oa_contains(out,n,"\"exit_code\":0")==1,c)
67 oa_refuse(c,"malformed percent refuses","target=argecho&confirm=yes&args_encoding=percent-v1&args=%gg",out)
68 oa_refuse(c,"NUL refuses","target=argecho&confirm=yes&args_encoding=percent-v1&args=%00",out)
69 oa_refuse(c,"newline refuses","target=argecho&confirm=yes&args_encoding=percent-v1&args=%0a",out)
70 oa_refuse(c,"unknown encoding refuses","target=argecho&confirm=yes&args_encoding=other&args=x",out)
71 oa_refuse(c,"legacy unsafe byte refuses","target=argecho&confirm=yes&args=a;b",out)
72 oa_refuse(c,"confirmation required","target=argecho&args_encoding=percent-v1&args=x",out)
73 oa_refuse(c,"unlisted executable refuses","target=not_registered&confirm=yes&args=x",out)
74 gv_check("optional allocation rejects zero", (sys_mmap_try(0) as i64)==0,c)
75 gv_check("optional allocation rejects negative", (sys_mmap_try(-1) as i64)==0,c)
76 gv_check("kernel-impossible mapping refuses without process death", (sys_mmap_try(NX_RA_SIZE_MAX) as i64)==0,c)
77 let mapping:*u8=sys_mmap_try(4096)
78 gv_check("optional allocation succeeds zeroed", (mapping as i64)>0&&mapping[0]==0 as u8,c)
79 if (mapping as i64)>0{mapping[0]=77 as u8;sys_munmap(mapping,4096)}
80 n=ma_do_organ_run(0 as *u8,0,out)
81 gv_check("null request refuses before dereference",oa_contains(out,n,"ORGAN_REQUEST_BOUNDS")==1,c)
82 n=ma_do_organ_run("x",NX_RA_SIZE_MAX,out)
83 gv_check("overflow-sized request refuses before reading",oa_contains(out,n,"ORGAN_REQUEST_BOUNDS")==1,c)
84 n=ma_do_organ_run("x",-1,out)
85 gv_check("negative request length refuses",oa_contains(out,n,"ORGAN_REQUEST_BOUNDS")==1,c)
86 return gv_verdict("MGMT-ORGAN-ACTUAL-HANDLER-CAPACITY",c,"Actual canonical ma_do_organ_run, safe child argv witness, isolated registry, complete admitted arguments or refusal.")
87}