nx_torrent_area_gate.nx source
↩ module page · 87 lines · 6278 B
1// nx_torrent_area_gate.nx -- referee for the torrent daemon's R2 two-area routing + isolation.
2// Imports nx_torrent_daemon (import strips main) so it tests the REAL daemon fns: d_parse_area (the
3// "area=media|gallery" flag), nx_taccess_allow (deny-by-default), and d_resolve_dir (the access-gated
4// dir lookup that /stream + the control verbs use). The load-bearing rows: a FAMILY viewer can flag/see
5// only SFW, and CANNOT even RESOLVE an NSFW torrent's dir by id (so they can't stream/control it) =
6// isolation by construction. Prints verdict=GREEN to STDOUT *and* returns the exit code (0=pass).
7// Durable verdict -> knowledge/status/torrent_area_gate.log. license_tier: ORIGINAL
8import "nx_torrent_daemon.nx"
9import "nx_torrent_access.nx"
10
11func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
13func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
14func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 }
15
16// compare two NUL-terminated strings; 1 if equal.
17func g_streq(a: *u8, b: *u8) -> i64 {
18 var i: i64 = 0
19 while 1 == 1 {
20 let ca: i64 = a[i] as i64; let cb: i64 = b[i] as i64
21 if ca != cb { return 0 }
22 if ca == 0 { return 1 }
23 i = i + 1
24 }
25 return 1
26}
27func g_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
28
29// one row: print label + got/want, return 1 if match else 0.
30func chk(got: i64, want: i64, label: *u8) -> i64 {
31 g_puts(" "); g_puts(label); g_puts(" got="); g_num(got); g_puts(" want="); g_num(want)
32 if got == want { g_puts(" PASS\n"); return 1 }
33 g_puts(" FAIL\n"); return 0
34}
35
36func main() -> i64 {
37 g_puts("=== TORRENT AREA GATE (R2: two-area routing + access-gated dir resolution = isolation) ===\n" as *u8)
38 var pass: i64=0
39 var rows: i64=0
40
41 // --- d_parse_area: the destination flag (default = SFW, the lower-privilege area) ---
42 rows=rows+1; pass=pass+chk(d_parse_area("POST /a body area=gallery x" as *u8, 27), NX_TAREA_NSFW, "parse area=gallery -> NSFW" as *u8)
43 rows=rows+1; pass=pass+chk(d_parse_area("POST /a body area=media x" as *u8, 25), NX_TAREA_SFW, "parse area=media -> SFW" as *u8)
44 rows=rows+1; pass=pass+chk(d_parse_area("POST /a body area=nsfw x" as *u8, 24), NX_TAREA_NSFW, "parse area=nsfw -> NSFW" as *u8)
45 rows=rows+1; pass=pass+chk(d_parse_area("POST /a body no-flag here" as *u8, 25), NX_TAREA_SFW, "parse (no flag) -> SFW default" as *u8)
46
47 // --- enforcement sanity (full matrix is nx_torrent_access_gate): the leak-check ---
48 rows=rows+1; pass=pass+chk(nx_taccess_allow(NX_TACCESS_OWNER, NX_TAREA_NSFW), NX_TACCESS_ALLOW, "owner -> NSFW add allow" as *u8)
49 rows=rows+1; pass=pass+chk(nx_taccess_allow(NX_TACCESS_FAMILY, NX_TAREA_NSFW), NX_TACCESS_DENY, "family -> NSFW add DENY (leak)" as *u8)
50 rows=rows+1; pass=pass+chk(nx_taccess_allow(NX_TACCESS_FAMILY, NX_TAREA_SFW), NX_TACCESS_ALLOW, "family -> SFW add allow" as *u8)
51
52 // --- d_resolve_dir: the access-gated lookup /stream + control use. Set up two area registries. ---
53 d_write_file("/tmp/nx_tar_sfw.idx" as *u8, "alpha\n" as *u8, 6)
54 d_write_file("/tmp/nx_tar_nsfw.idx" as *u8, "beta\n" as *u8, 5)
55 let dir: *u8 = sys_mmap(640); let ar: *i64 = sys_mmap(16) as *i64
56
57 // family resolves an SFW torrent (they own the media area)
58 let r1: i64 = d_resolve_dir("alpha" as *u8, NX_TACCESS_FAMILY, "/tmp/nx_tar_sfw" as *u8, "/tmp/nx_tar_sfw.idx" as *u8, "/tmp/nx_tar_nsfw" as *u8, "/tmp/nx_tar_nsfw.idx" as *u8, dir, ar)
59 rows=rows+1; pass=pass+chk(r1, 1, "family resolve SFW 'alpha' = found" as *u8)
60 rows=rows+1; pass=pass+chk(g_streq(dir, "/tmp/nx_tar_sfw/alpha" as *u8), 1, " -> dir == sfw_root/alpha" as *u8)
61 rows=rows+1; pass=pass+chk(ar[0], NX_TAREA_SFW, " -> area == SFW" as *u8)
62
63 // THE ISOLATION LEAK-CHECK: a family viewer CANNOT resolve an NSFW torrent's dir (so /stream + control can't reach it)
64 let r2: i64 = d_resolve_dir("beta" as *u8, NX_TACCESS_FAMILY, "/tmp/nx_tar_sfw" as *u8, "/tmp/nx_tar_sfw.idx" as *u8, "/tmp/nx_tar_nsfw" as *u8, "/tmp/nx_tar_nsfw.idx" as *u8, dir, ar)
65 rows=rows+1; pass=pass+chk(r2, 0, "family resolve NSFW 'beta' = DENY (ISOLATION leak-check)" as *u8)
66
67 // owner resolves the NSFW torrent
68 let r3: i64 = d_resolve_dir("beta" as *u8, NX_TACCESS_OWNER, "/tmp/nx_tar_sfw" as *u8, "/tmp/nx_tar_sfw.idx" as *u8, "/tmp/nx_tar_nsfw" as *u8, "/tmp/nx_tar_nsfw.idx" as *u8, dir, ar)
69 rows=rows+1; pass=pass+chk(r3, 1, "owner resolve NSFW 'beta' = found" as *u8)
70 rows=rows+1; pass=pass+chk(g_streq(dir, "/tmp/nx_tar_nsfw/beta" as *u8), 1, " -> dir == nsfw_root/beta" as *u8)
71 rows=rows+1; pass=pass+chk(ar[0], NX_TAREA_NSFW, " -> area == NSFW" as *u8)
72
73 // a nonexistent id resolves to nothing (honest, no phantom dir)
74 let r4: i64 = d_resolve_dir("ghost" as *u8, NX_TACCESS_OWNER, "/tmp/nx_tar_sfw" as *u8, "/tmp/nx_tar_sfw.idx" as *u8, "/tmp/nx_tar_nsfw" as *u8, "/tmp/nx_tar_nsfw.idx" as *u8, dir, ar)
75 rows=rows+1; pass=pass+chk(r4, 0, "owner resolve 'ghost' = not found" as *u8)
76
77 g_puts("----\nTORRENT-AREA-GATE rows=" as *u8); g_num(rows); g_puts(" pass=" as *u8); g_num(pass)
78 if pass==rows { g_puts(" verdict=GREEN\n" as *u8) } else { g_puts(" verdict=RED\n" as *u8) }
79 let lg: i64=sys_openat_append("knowledge/status/torrent_area_gate.log" as *u8, 0x1a4)
80 if lg>=0 {
81 g_w(lg, "TORRENT-AREA-GATE rows=" as *u8); g_wn(lg, rows); g_w(lg, " pass=" as *u8); g_wn(lg, pass)
82 if pass==rows { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) }
83 sys_close(lg)
84 }
85 if pass==rows { sys_exit(0); return 0 }
86 sys_exit(1); return 1
87}