nx_recovery_guard.nx source
↩ module page · 56 lines · 2690 B
1// nx_recovery_guard.nx -- the ENFORCEMENT bridge: before recovered media is accepted, fingerprint it and refuse it if
2// it matches an APPROVED do-not-recover entry. Crucially it loads ONLY status=approved rows from the seg_store
3// blocklist -- pending entries (awaiting operator review) do NOT block. One organ across what looked like two syscall
4// stacks: syscalls.nx is an alias that path-dedups to nx_syscalls.nx, so nx_phash (image) + nx_seg_store (storage)
5// share one surface. Composes nx_gif_decode + nx_phash + nx_media_exclusion + nx_blocklist_store. license_tier: ORIGINAL
6import "nx_gif_decode.nx"
7import "nx_phash.nx"
8import "nx_media_exclusion.nx"
9import "nx_blocklist_store.nx"
10import "nx_tabrec.nx"
11const K_MAGIC_1048576: i64 = 1048576
12
13// load ONLY approved blocklist rows under `prefix` into bl_dhash[]/bl_thresh[]; returns count. Pending/retracted skipped.
14func guard_load_approved(prefix: *u8, bl_dhash: *i64, bl_thresh: *i64, cap: i64) -> i64 {
15 let idxbuf: *u8=sys_mmap(K_MAGIC_1048576)
16 let il: i64=bl_index_pfx(prefix, idxbuf)
17 let po: *i64=sys_mmap(16) as *i64
18 let lo: *i64=sys_mmap(16) as *i64
19 let f2: *i64=sys_mmap(16) as *i64
20 let idz: *u8=sys_mmap(512)
21 var c: i64=0; var ls: i64=0; var i: i64=0
22 while i<=il {
23 var eol: i64=0
24 if i==il { eol=1 } else { if idxbuf[i]==10 as u8 { eol=1 } }
25 if eol==1 { if i>ls {
26 var k: i64=0; while k<i-ls { idz[k]=idxbuf[ls+k]; k=k+1 } idz[i-ls]=0 as u8
27 if bl_get_pfx(prefix, idz, po, lo)==1 {
28 let rec: *u8=po[0] as *u8
29 let rlen: i64=lo[0]
30 if tr_field_eq(rec, rlen, 6, "approved" as *u8, f2)==1 { if c<cap {
31 tr_field(rec,0,rlen,0,f2); bl_dhash[c]=excl_hex16(((rec as i64)+f2[0]) as *u8)
32 tr_field(rec,0,rlen,1,f2); bl_thresh[c]=tr_atoi(rec, f2[0], f2[1])
33 c=c+1
34 } }
35 }
36 } ls=i+1 }
37 i=i+1
38 }
39 return c
40}
41
42// decode a GIF, fingerprint it, check against the APPROVED blocklist. Returns the matched row index (>=0 BLOCKED),
43// 0-1 ALLOWED, or 0-2 if the image could not be decoded.
44func guard_check_gif(path: *u8, prefix: *u8) -> i64 {
45 let wh: *i64=sys_mmap(16) as *i64
46 let box: *i64=sys_mmap(16) as *i64
47 let raw: *u8=sys_read_file(path, box)
48 if raw==(0 as *u8) { return 0 - 2 }
49 let g: *u8=gif_decode(raw, box[0], wh)
50 if g==(0 as *u8) { return 0 - 2 }
51 let dh: i64=nx_phash_dhash(g, wh[0], wh[1])
52 let bd: *i64=sys_mmap(8*256) as *i64
53 let bt: *i64=sys_mmap(8*256) as *i64
54 let n: i64=guard_load_approved(prefix, bd, bt, 256)
55 return excl_blocked(dh, bd, bt, n)
56}