nx_opennet_posture_core.nx source
↩ module page · 105 lines · 4458 B
1// nx_opennet_posture_core.nx -- importable CORE of the open-net security-posture ruler (S15/O2 of
2// the crash-resume->SOTA + open-net program, 07-15 operator: "apis and mcp capable across the open
3// net so we can be 'local' anywhere securely"). Encodes THE invariant every public surface must
4// satisfy: an UNAUTHENTICATED request is DENIED (401/403) -- no data leak -- while an intentionally
5// public surface SERVES (200) and a gate front-door REDIRECTS (301/302). A DENY surface returning
6// 200 to no-cred = a SECURITY LEAK (the highest-severity verdict). Pure decision funcs here
7// (gate-locked); the live fetch lives in the CLI so the ruler is provable OFFLINE + vantage is a
8// parameter (same organ run from the NAS = necessary check; run from a true-external VM = the
9// sufficient "local anywhere" proof). Read-only.
10// license_tier: ORIGINAL
11import "nx_syscalls.nx"
12import "nx_crashresume_census_core.nx" // ccz_slen / ccz_num_at / ccz_read / ccz_cat_str / ccz_cat_num
13
14// expected-posture ids
15const OP_DENY: i64 = 0 // unauth MUST be refused: 401 or 403
16const OP_PUBLIC: i64 = 1 // intentionally public: 200
17const OP_REDIRECT: i64 = 2 // gate front-door: 301 or 302
18
19// verdicts
20const OP_PASS: i64 = 1
21const OP_FAIL: i64 = 0 // posture violated
22const OP_LEAK: i64 = 2 // DENY surface served 200 to no-cred -- worst case, called out distinctly
23const OP_UNREACH: i64 = 3 // no status parsed (fetch failed / not our edge) -- never a silent PASS
24
25// parse the numeric HTTP status from a raw response ("HTTP/1.1 401 ..."). -1 if absent.
26// finds the FIRST space, then the leading decimal after it.
27func op_http_status(buf: *u8, n: i64) -> i64 {
28 if n < 12 { return 0 - 1 }
29 // must start with "HTTP/" or it's not an HTTP response line we trust
30 if buf[0] != (72 as u8) { return 0 - 1 } // 'H'
31 var i: i64 = 0
32 var go: i64 = 1
33 while go == 1 { go = 0; if i < n { if buf[i] != (32 as u8) { i = i + 1; go = 1 } } } // to first space
34 if i >= n { return 0 - 1 }
35 let ep: *i64 = sys_mmap(16) as *i64
36 return ccz_num_at(buf, n, i + 1, ep)
37}
38
39// does the response carry a header proving OUR sovereign edge served it (not DSM / a MITM)?
40// case-sensitive substring "X-Served-By: nishi" (our edge stamps nishi-substrate-v2 / nishi-host).
41func op_is_sovereign(buf: *u8, n: i64) -> i64 {
42 let pat: *u8 = "X-Served-By: nishi" as *u8
43 let pl: i64 = ccz_slen(pat)
44 var i: i64 = 0
45 while i + pl <= n {
46 var k: i64 = 0
47 var ok: i64 = 1
48 while k < pl { if buf[i+k] != pat[k] { ok = 0; k = pl } k = k + 1 }
49 if ok == 1 { return 1 }
50 i = i + 1
51 }
52 return 0
53}
54
55// THE decision. status = parsed HTTP code (-1 if none). Pure; no I/O.
56func op_verdict(status: i64, expect: i64) -> i64 {
57 if status < 0 { return OP_UNREACH }
58 if expect == OP_DENY {
59 if status == 401 { return OP_PASS }
60 if status == 403 { return OP_PASS }
61 if status == 200 { return OP_LEAK } // served secret content to no-cred = LEAK
62 return OP_FAIL // any other code = misconfigured, not a clean deny
63 }
64 if expect == OP_PUBLIC {
65 if status == 200 { return OP_PASS }
66 return OP_FAIL
67 }
68 if expect == OP_REDIRECT {
69 if status == 301 { return OP_PASS }
70 if status == 302 { return OP_PASS }
71 return OP_FAIL
72 }
73 return OP_FAIL
74}
75
76func op_expect_name(e: i64) -> *u8 {
77 if e == OP_DENY { return "deny-unauth" as *u8 }
78 if e == OP_PUBLIC { return "serve-public" as *u8 }
79 if e == OP_REDIRECT { return "redirect" as *u8 }
80 return "?" as *u8
81}
82
83func op_verdict_name(v: i64) -> *u8 {
84 if v == OP_PASS { return "PASS" as *u8 }
85 if v == OP_LEAK { return "LEAK" as *u8 }
86 if v == OP_UNREACH { return "UNREACH" as *u8 }
87 return "FAIL" as *u8
88}
89
90// map an expected-posture keyword to its id, or -1.
91func op_expect_id(s: *u8) -> i64 {
92 if streq_op(s, "deny" as *u8) == 1 { return OP_DENY }
93 if streq_op(s, "deny-unauth" as *u8) == 1 { return OP_DENY }
94 if streq_op(s, "public" as *u8) == 1 { return OP_PUBLIC }
95 if streq_op(s, "serve-public" as *u8) == 1 { return OP_PUBLIC }
96 if streq_op(s, "redirect" as *u8) == 1 { return OP_REDIRECT }
97 return 0 - 1
98}
99
100func streq_op(a: *u8, b: *u8) -> i64 {
101 var i: i64 = 0
102 while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
103 if b[i] != (0 as u8) { return 0 }
104 return 1
105}