nx_nettier_gate.nx source

1// nx_nettier_gate.nx -- gate for the access-wall network-tier layer (nx_cidr + nx_nettier). Proves CIDR masks, 2// match (pos + neg), LONGEST-PREFIX wins, peer-IP -> tier classification, the DENY-BY-DEFAULT (unknown -> 3// PUBLIC/least-trust) fail-closed default, nt_meets, and the nx_ipaddr reuse (string parse == integer form). 4// Positive AND negative controls. Appends "ACCESSGATE row=nx_nettier net-tier ... verdict=PASS" to 5// knowledge/status/access_gate.log on all-pass. Exit 0 iff all pass. license_tier: ORIGINAL 6import "nx_nettier.nx" 7import "nx_syscalls.nx" 8 9func ng_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 10func ng_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 11func ng_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o } 12func ng_catnum(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o } 13func ng_row(id: i64, ok: i64, what: *u8) -> i64 { ng_w("NTROW " as *u8); ng_num(id); ng_w(" " as *u8); if ok==1 { ng_w("PASS " as *u8) } else { ng_w("FAIL " as *u8) } ng_w(what); ng_w("\n" as *u8); return ok } 14 15func mkip(a: i64, b: i64, c: i64, d: i64) -> i64 { return (a << 24) | (b << 16) | (c << 8) | d } 16 17func main() -> i64 { 18 var pass: i64 = 0 19 var rows: i64 = 0 20 var ok: i64 = 0 21 22 // R0: masks 23 ok = 0; if cidr_mask(0)==0 { if cidr_mask(32)==0xffffffff { if cidr_mask(24)==0xffffff00 { if cidr_mask(16)==0xffff0000 { if cidr_mask(8)==0xff000000 { ok=1 } } } } } 24 rows=rows+1; pass=pass+ng_row(0, ok, "cidr_mask: /0=0 /8 /16 /24 /32=full" as *u8) 25 26 // R1 (pos): in-range matches 27 ok = 0; if cidr_match(mkip(192,168,1,5), mkip(192,168,0,0), 16)==1 { if cidr_match(mkip(192,168,1,5), mkip(192,168,1,0), 24)==1 { if cidr_match(mkip(192,168,1,5), mkip(192,168,1,5), 32)==1 { ok=1 } } } 28 rows=rows+1; pass=pass+ng_row(1, ok, "cidr_match positive: ip in /16, /24, exact /32" as *u8) 29 30 // R2 (neg): out-of-range rejected 31 ok = 0; if cidr_match(mkip(8,8,8,8), mkip(192,168,0,0), 16)==0 { if cidr_match(mkip(192,168,2,5), mkip(192,168,1,0), 24)==0 { ok=1 } } 32 rows=rows+1; pass=pass+ng_row(2, ok, "cidr_match negative: out-of-range rejected (neg control)" as *u8) 33 34 // R3: /0 matches everything (and an exact /32 does not match a different ip) 35 ok = 0; if cidr_match(mkip(8,8,8,8), 0, 0)==1 { if cidr_match(mkip(1,2,3,4), mkip(1,2,3,5), 32)==0 { ok=1 } } 36 rows=rows+1; pass=pass+ng_row(3, ok, "/0 matches all; /32 is exact (neg)" as *u8) 37 38 // ---- the network-tier rule table (DATA): loopback+RFC1918 = LAN, a VPN CIDR = VPN ---- 39 let nets: *i64 = sys_mmap(8*8) as *i64 40 let pfx: *i64 = sys_mmap(8*8) as *i64 41 let tier: *i64 = sys_mmap(8*8) as *i64 42 nets[0]=mkip(127,0,0,0); pfx[0]=8; tier[0]=NT_LAN 43 nets[1]=mkip(192,168,0,0); pfx[1]=16; tier[1]=NT_LAN 44 nets[2]=mkip(10,0,0,0); pfx[2]=8; tier[2]=NT_LAN 45 nets[3]=mkip(10,8,0,0); pfx[3]=24; tier[3]=NT_VPN 46 nets[4]=mkip(100,64,0,0); pfx[4]=10; tier[4]=NT_VPN 47 let nrules: i64 = 5 48 49 // R4: LONGEST-PREFIX wins -- 10.8.0.5 matches both 10.0.0.0/8(LAN) and 10.8.0.0/24(VPN) -> VPN 50 ok = 0; if nt_classify(mkip(10,8,0,5), nets, pfx, tier, nrules)==NT_VPN { if nt_classify(mkip(10,1,2,3), nets, pfx, tier, nrules)==NT_LAN { ok=1 } } 51 rows=rows+1; pass=pass+ng_row(4, ok, "longest-prefix wins: 10.8.0.5->VPN, 10.1.2.3->LAN" as *u8) 52 53 // R5: classification of representative peers 54 ok = 0; if nt_classify(mkip(127,0,0,1), nets, pfx, tier, nrules)==NT_LAN { if nt_classify(mkip(192,168,1,50), nets, pfx, tier, nrules)==NT_LAN { if nt_classify(mkip(8,8,8,8), nets, pfx, tier, nrules)==NT_PUBLIC { ok=1 } } } 55 rows=rows+1; pass=pass+ng_row(5, ok, "classify: loopback/LAN->LAN, public->PUBLIC" as *u8) 56 57 // R6: DENY-BY-DEFAULT trust -- an unknown public IP is PUBLIC (least trust), fail-closed 58 ok = 0; if nt_classify(mkip(203,0,113,7), nets, pfx, tier, nrules)==NT_PUBLIC { ok=1 } 59 rows=rows+1; pass=pass+ng_row(6, ok, "unknown IP -> PUBLIC (deny-by-default trust, fail-closed)" as *u8) 60 61 // R7: nt_meets threshold 62 ok = 0; if nt_meets(NT_LAN, NT_LAN)==1 { if nt_meets(NT_PUBLIC, NT_LAN)==0 { if nt_meets(NT_VPN, NT_LAN)==1 { ok=1 } } } 63 rows=rows+1; pass=pass+ng_row(7, ok, "nt_meets: LAN>=LAN ok, PUBLIC>=LAN denied, VPN>=LAN ok" as *u8) 64 65 // R8: nx_ipaddr REUSE -- string parse equals the integer form (composes the existing net stack) 66 ok = 0; if cidr_ip("192.168.1.5" as *u8)==mkip(192,168,1,5) { if cidr_ip("8.8.8.8" as *u8)==mkip(8,8,8,8) { ok=1 } } 67 rows=rows+1; pass=pass+ng_row(8, ok, "nx_ipaddr reuse: ipv4_parse(string)==integer form" as *u8) 68 69 ng_w("NX-NETTIER-GATE rows=" as *u8); ng_num(rows); ng_w(" pass=" as *u8); ng_num(pass); ng_w("\n" as *u8) 70 if pass == rows { 71 let line: *u8 = sys_mmap(256) 72 var off: i64 = ng_cat(line, 0, "ACCESSGATE row=nx_nettier net-tier rows=" as *u8) 73 off = ng_catnum(line, off, rows); off = ng_cat(line, off, " pass=" as *u8); off = ng_catnum(line, off, pass) 74 off = ng_cat(line, off, " verdict=PASS\n" as *u8) 75 let gf: i64 = sys_openat_append("knowledge/status/access_gate.log" as *u8, 0x1a4) 76 if gf >= 0 { sys_write(gf, line, off); sys_close(gf) } 77 ng_w("NX-NETTIER-GATE verdict=PASS -- network-tier layer recorded in access_gate.log\n" as *u8) 78 sys_exit(0); return 0 79 } 80 ng_w("NX-NETTIER-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8) 81 sys_exit(1); return 1 82}