nx_realm_multi_gate.nx source

1// nx_realm_multi_gate.nx -- proves the DATA-DRIVEN realm (one daemon serves many properties) isolates correctly: 2// the SAME ls_signup_allowed, given a different realm + that realm's HR store, makes realm-correct decisions and 3// NEVER leaks across realms. nishifamily (brad invited) vs andelinwest (robert invited) -- a handle invited in one 4// realm is denied in the other, because cred_id = SHA-256(realm|||handle) namespaces identities. This is the 5// andelinwest.com enablement: run nx_lan_signup_daemon with [6]=andelinwest_admin + andelinwest_hr.log. GREEN iff 6// every row matches. Durable -> knowledge/status/realm_multi_gate.log. 7import "nx_lan_signup.nx" // ls_signup_allowed 8import "nx_g_puts_lib.nx" 9import "nx_hr_admin.nx" // hra_invite + HRA_LVL_* 10import "nx_hr.nx" // hr_cred_id 11import "nx_syscalls.nx" 12 13func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 14func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 15func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 16func gtrunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd>=0 { sys_close(fd) } return 0 } 17func g_mkpfx(base: *u8, ms: i64, out: *u8) -> i64 { var o: i64=0; while base[o]!=(0 as u8){out[o]=base[o];o=o+1} let t: *u8=sys_mmap(28); var m: i64=ms; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var z: i64=k-1; while z>=0{out[o]=t[z];o=o+1;z=z-1} out[o]=0 as u8; return o } 18func g_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while 1==1 { let ca: i64=a[i] as i64; let cb: i64=b[i] as i64; if ca!=cb { return 0 } if ca==0 { return 1 } i=i+1 } return 1 } 19func g_ip4(out: *u8, a: i64, b: i64, c: i64, d: i64) -> i64 { out[0]=a as u8; out[1]=b as u8; out[2]=c as u8; out[3]=d as u8; return 0 } 20func chk(got: i64, want: i64, label: *u8) -> i64 { 21 g_puts(" "); g_puts(label); g_puts(" got="); g_num(got); g_puts(" want="); g_num(want) 22 if got == want { g_puts(" PASS\n"); return 1 } 23 g_puts(" FAIL\n"); return 0 24} 25 26func main() -> i64 { 27 g_puts("=== NISHI REALM-MULTI GATE (one daemon, many properties; cross-realm isolation) ===\n" as *u8) 28 var pass: i64=0; var rows: i64=0 29 let ms: i64 = sys_now_ms() 30 let nishi: *u8 = sys_mmap(96); g_mkpfx("/tmp/nx_rm_n_" as *u8, ms, nishi) // seg_store prefix (cutover) 31 let andel: *u8 = sys_mmap(96); g_mkpfx("/tmp/nx_rm_a_" as *u8, ms, andel) 32 let NR: *u8 = "nishi_site_admin" as *u8; let NRN: i64 = 16 33 let AR: *u8 = "andelinwest_admin" as *u8; let ARN: i64 = 17 34 let fam: *u8 = "andelin" as *u8 35 let cid: *u8 = sys_mmap(96) 36 hra_invite(nishi, NR, NRN, "brad" as *u8, 4, HRA_LVL_MEMBER, fam, 1000, "elderwesto" as *u8, cid) 37 hra_invite(andel, AR, ARN, "robert" as *u8, 6, HRA_LVL_OWNER, fam, 1000, "elderwesto" as *u8, cid) 38 39 let lan: *u8 = sys_mmap(8); g_ip4(lan,192,168,8,20) 40 let wan: *u8 = sys_mmap(8); g_ip4(wan,203,0,113,9) 41 42 // the SAME function + LAN peer, switched only by realm + that realm's store: 43 rows=rows+1; pass=pass+chk(ls_signup_allowed(lan, nishi, NR, NRN, "brad" as *u8, 4), 1, "nishifamily realm: brad(invited) -> ALLOW" as *u8) 44 rows=rows+1; pass=pass+chk(ls_signup_allowed(lan, nishi, NR, NRN, "robert" as *u8, 6), 0, "nishifamily realm: robert(not here) -> DENY (isolation)" as *u8) 45 rows=rows+1; pass=pass+chk(ls_signup_allowed(lan, andel, AR, ARN, "robert" as *u8, 6), 1, "andelinwest realm: robert(invited) -> ALLOW" as *u8) 46 rows=rows+1; pass=pass+chk(ls_signup_allowed(lan, andel, AR, ARN, "brad" as *u8, 4), 0, "andelinwest realm: brad(not here) -> DENY (isolation)" as *u8) 47 rows=rows+1; pass=pass+chk(ls_signup_allowed(wan, andel, AR, ARN, "robert" as *u8, 6), 0, "andelinwest realm: robert from WAN -> DENY (LAN gate per realm)" as *u8) 48 49 // the ROOT CAUSE: same handle, different realm => different cred_id (so a store can never confuse realms) 50 let cN: *u8 = sys_mmap(96); let cA: *u8 = sys_mmap(96) 51 hrs_cred_id(NR, NRN, "robert" as *u8, 6, cN) 52 hrs_cred_id(AR, ARN, "robert" as *u8, 6, cA) 53 rows=rows+1; pass=pass+chk(g_streq(cN, cA), 0, "same handle 'robert' -> DIFFERENT cred_id per realm (namespacing)" as *u8) 54 55 g_puts("----\nNISHI-REALM-MULTI-GATE rows=" as *u8); g_num(rows); g_puts(" pass=" as *u8); g_num(pass) 56 if pass==rows { g_puts(" verdict=GREEN\n" as *u8) } else { g_puts(" verdict=RED\n" as *u8) } 57 let lg: i64=sys_openat_append("knowledge/status/realm_multi_gate.log" as *u8, 0x1a4) 58 if lg>=0 { 59 g_w(lg, "NISHI-REALM-MULTI-GATE rows=" as *u8); g_wn(lg, rows); g_w(lg, " pass=" as *u8); g_wn(lg, pass) 60 if pass==rows { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } 61 sys_close(lg) 62 } 63 if pass==rows { sys_exit(0); return 0 } 64 sys_exit(1); return 1 65}