nx_opennet_posture_gate.nx source
↩ module page · 76 lines · 3980 B
1// nx_opennet_posture_gate.nx -- liar-killed GATE for the open-net posture ruler (S15/O2).
2// Proves the security invariant DISCRIMINATES: unauth-deny surfaces PASS only on 401/403, a DENY
3// surface that serves 200 is caught as a LEAK (not a silent pass -- the load-bearing negative
4// control), public surfaces PASS only on 200, redirects on 301/302, an unreachable/parse-fail is
5// UNREACH (never a fabricated PASS), the HTTP-status parser handles real response lines + rejects
6// non-HTTP, and the sovereign-edge header check detects our stamp + rejects its absence. Exit 0
7// only on all-PASS.
8// license_tier: ORIGINAL expect_exit: 0
9import "nx_syscalls.nx"
10import "nx_opennet_posture_core.nx"
11import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc); explicit, not leaned on transitively
12
13func p_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
14
15// MIGRATED to the shared emitter 2026-08-06 (debt 1785516350). The old body mmapped a 32-byte
16// scratch and never freed it -- 4096B leaked per call at page granularity. nxi_out runs the SAME
17// ccz_cat_num digits through a shim that always frees, so emitted bytes are identical.
18func p_putn(v: i64) -> i64 { nxi_out(v); return 0 }
19
20func p_check(name: *u8, got: i64, want: i64, passp: *i64) -> i64 {
21 p_puts("T " as *u8)
22 p_puts(name)
23 p_puts(" got=" as *u8)
24 p_putn(got)
25 p_puts(" want=" as *u8)
26 p_putn(want)
27 if got == want { p_puts(" PASS\n" as *u8); passp[0] = passp[0] + 1 } else { p_puts(" FAIL\n" as *u8) }
28 return 0
29}
30
31func main(argc: i64, argv: *i64) -> i64 {
32 let pass: *i64 = sys_mmap(16) as *i64
33 pass[0] = 0
34
35 // --- decision matrix ---
36 p_check("deny-401-PASS" as *u8, op_verdict(401, OP_DENY), OP_PASS, pass)
37 p_check("deny-403-PASS" as *u8, op_verdict(403, OP_DENY), OP_PASS, pass)
38 // THE load-bearing negative control: a deny surface serving 200 to no-cred = LEAK, caught
39 p_check("deny-200-LEAK" as *u8, op_verdict(200, OP_DENY), OP_LEAK, pass)
40 p_check("deny-500-FAIL" as *u8, op_verdict(500, OP_DENY), OP_FAIL, pass)
41 p_check("public-200-PASS" as *u8, op_verdict(200, OP_PUBLIC), OP_PASS, pass)
42 // a public surface that 401s = availability regression, not a pass
43 p_check("public-401-FAIL" as *u8, op_verdict(401, OP_PUBLIC), OP_FAIL, pass)
44 p_check("redirect-301-PASS" as *u8, op_verdict(301, OP_REDIRECT), OP_PASS, pass)
45 p_check("redirect-302-PASS" as *u8, op_verdict(302, OP_REDIRECT), OP_PASS, pass)
46 // unreachable / unparseable -> UNREACH, NEVER a silent PASS
47 p_check("unreach-UNREACH" as *u8, op_verdict(0 - 1, OP_DENY), OP_UNREACH, pass)
48
49 // --- status parser ---
50 let r401: *u8 = "HTTP/1.1 401 Unauthorized\r\nContent-Type: application/json\r\n\r\n{}" as *u8
51 p_check("parse-401" as *u8, op_http_status(r401, 60), 401, pass)
52 let r200: *u8 = "HTTP/1.1 200 OK\r\nX-Served-By: nishi-substrate-v2\r\n\r\nhi" as *u8
53 p_check("parse-200" as *u8, op_http_status(r200, 55), 200, pass)
54 // non-HTTP garbage -> -1 (never a fabricated status)
55 let rjunk: *u8 = "<html>synology login</html>" as *u8
56 p_check("parse-nonhttp-neg" as *u8, op_http_status(rjunk, 27), 0 - 1, pass)
57
58 // --- sovereign-edge header check ---
59 p_check("sovereign-present" as *u8, op_is_sovereign(r200, 55), 1, pass)
60 p_check("sovereign-absent" as *u8, op_is_sovereign(r401, 60), 0, pass)
61
62 // --- expect-keyword mapping ---
63 var okmap: i64 = 1
64 if op_expect_id("deny" as *u8) != OP_DENY { okmap = 0 }
65 if op_expect_id("serve-public" as *u8) != OP_PUBLIC { okmap = 0 }
66 if op_expect_id("redirect" as *u8) != OP_REDIRECT { okmap = 0 }
67 if op_expect_id("bogus" as *u8) != 0 - 1 { okmap = 0 }
68 p_check("expect-keyword-map" as *u8, okmap, 1, pass)
69
70 p_puts("OPP-GATE pass=" as *u8)
71 p_putn(pass[0])
72 p_puts("/15 verdict=" as *u8)
73 if pass[0] == 15 { p_puts("GREEN\n" as *u8); return 0 }
74 p_puts("RED\n" as *u8)
75 return 1
76}