nx_regress_bank.nx source
↩ module page · 54 lines · 3815 B
1// nx_regress_bank.nx -- the ADVERSARIAL REGRESSION BANK (census gap #1). Every bug the team's adversarial work FINDS
2// is banked here as a PERMANENT assertion of the INVARIANT the bug violated, so it can NEVER be silently re-introduced.
3// Append-only; run in continuous-CI (nx_adversarial_ci) before every deploy. A RED here = a previously-killed bug is
4// back -> STOP. license_tier: ORIGINAL
5import "nx_cap_token.nx" // capt_issue/capt_verify/CAPT_OK/CAPT_DENY_MAC + (transitive) ct_memcmp
6import "nx_gate.nx"
7const K_MAGIC_1782000000: i64 = 1782000000
8const K_MAGIC_1024: i64 = 1024
9const K_MAGIC_9999999999: i64 = 9999999999
10
11func rb_mark(cond: i64, pass: *i64, tot: *i64, label: *u8) -> i64 {
12 tot[0] = tot[0] + 1
13 if cond == 1 { pass[0] = pass[0] + 1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
14 gw(label); gw("\n" as *u8)
15 return 0
16}
17
18func main() -> i64 {
19 gw("=== nx_regress_bank: permanent regression gate for every adversarially-found bug (never re-introduce) ===\n" as *u8)
20 let pbox: *i64 = sys_mmap(16) as *i64; pbox[0] = 0
21 let tbox: *i64 = sys_mmap(16) as *i64; tbox[0] = 0
22
23 // ---- REG-001 signed_cookie MAC-inversion (found 2026-07-02) ----------------------------------------------
24 // ROOT CAUSE: nx_signed_cookie.nx:116 did `if ct_memcmp(...) != 0 { reject }`, but nx_ct's ct_memcmp returns
25 // 1-if-EQUAL -> it ACCEPTED forgeries and REJECTED valid MACs. INVARIANT that must never regress: our capability
26 // verifier (capt_verify -> capt_mac_ok, which OWNS the compare) ACCEPTS a valid token and REJECTS a forged one.
27 let key: *u8 = "regress-bank-secret-key-001-abcdef" as *u8
28 let klen: i64 = capt_slen(key)
29 let now: i64 = K_MAGIC_1782000000
30 let tok: *u8 = sys_mmap(K_MAGIC_1024)
31 let tn: i64 = capt_issue(key, klen, "nx_tool" as *u8, 7, K_MAGIC_9999999999, 1, tok, K_MAGIC_1024)
32 var r1a: i64 = 0; if capt_verify(key, klen, tok, tn, "nx_tool" as *u8, 7, now) == CAPT_OK { r1a = 1 }
33 rb_mark(r1a, pbox, tbox, "REG-001a valid capability ACCEPTED (correctness)" as *u8)
34 let fk: *u8 = "WRONG-forger-key-9999999999999999xy" as *u8
35 let ftok: *u8 = sys_mmap(K_MAGIC_1024)
36 let fn: i64 = capt_issue(fk, capt_slen(fk), "nx_tool" as *u8, 7, K_MAGIC_9999999999, 1, ftok, K_MAGIC_1024)
37 var r1b: i64 = 0; if capt_verify(key, klen, ftok, fn, "nx_tool" as *u8, 7, now) == CAPT_DENY_MAC { r1b = 1 }
38 rb_mark(r1b, pbox, tbox, "REG-001b FORGED capability (wrong key) REJECTED -- the MAC-inversion class stays dead" as *u8)
39
40 // ---- REG-002 ct_memcmp convention lock ------------------------------------------------------------------
41 // The confusion that CAUSED REG-001: ct_memcmp returns 1-if-EQUAL (an equality predicate), NOT C-memcmp's
42 // 0-if-equal. Pin the convention so any refactor of nx_ct -- or any caller reasoning about it -- is checked.
43 let ba: *u8 = sys_mmap(8); let bb: *u8 = sys_mmap(8)
44 var i: i64 = 0; while i < 8 { ba[i] = (65 + i) as u8; bb[i] = (65 + i) as u8; i = i + 1 }
45 var r2a: i64 = 0; if ct_memcmp(ba, bb, 8) == 1 { r2a = 1 }
46 rb_mark(r2a, pbox, tbox, "REG-002a ct_memcmp(equal) == 1 (convention: 1-if-EQUAL; a caller using `!= 0` to reject INVERTS the check)" as *u8)
47 bb[3] = (bb[3] ^ 1) as u8
48 var r2b: i64 = 0; if ct_memcmp(ba, bb, 8) == 0 { r2b = 1 }
49 rb_mark(r2b, pbox, tbox, "REG-002b ct_memcmp(differ) == 0" as *u8)
50
51 gw("\n=== nx_regress_bank " as *u8); gn(pbox[0]); gw("/" as *u8); gn(tbox[0]); gw(" (banked: REG-001 signed_cookie MAC-inversion, REG-002 ct_memcmp-convention) ===\n" as *u8)
52 if pbox[0] == tbox[0] { gw("REGRESS-BANK GREEN -- every banked bug stays fixed.\n" as *u8); sys_exit(0); return 0 }
53 gw("REGRESS-BANK RED -- a previously-killed bug has REGRESSED. STOP (do not deploy).\n" as *u8); sys_exit(1); return 1
54}