code wiki / _hdl_build / nx_uiq_wire_gate.nx
nx_uiq_wire_gate.nx source
↩ module page · 52 lines · 3020 B
1// nx_uiq_wire_gate.nx -- D001 gate for the first-byte-up response-header auditor (gv-verdict anchored).
2// Proves the wire-layer audit DISCRIMINATES on hermetic response fixtures: a bare response (only
3// Content-Type) scores 0/5 = EXPOSED; a fully-hardened response scores 5/5 = HARDENED; a CSP with
4// frame-ancestors counts as the frame guard; header matching is case-insensitive; status parsed from byte 0.
5// license_tier: ORIGINAL expect_exit: 0
6import "nx_uiq_wire_lib.nx"
7import "nx_gate_verdict.nx"
8
9func main() -> i64 {
10 let ctr: *i64 = gv_ctr()
11 gv_head("nx_uiq_wire_gate -- first-byte-up response security-header audit: discriminating, liar-killed" as *u8)
12 let bare: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nCache-Control: no-cache\r\n\r\n<html></html>" as *u8
13 uw_write_kat("uwgbare.txt" as *u8, bare)
14 let b1: *u8 = sys_mmap(8192)
15 let n1: i64 = uw_slurp("uwgbare.txt" as *u8, b1, 8191)
16 let o1: *i64 = sys_mmap(64) as *i64
17 uw_audit(b1, n1, o1)
18 var t1: i64=0
19 if o1[0]==200 { if o1[1]==1 { t1=1 } }
20 gv_check("T1 status parsed from byte 0 (200) + Content-Type present" as *u8, t1, ctr)
21 var t2: i64=0
22 if o1[7]==0 { t2=1 }
23 gv_check("T2 bare response = 0/5 security headers = EXPOSED (the measured live posture)" as *u8, t2, ctr)
24 let hard: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nX-Content-Type-Options: nosniff\r\nContent-Security-Policy: default-src 'self'; frame-ancestors 'self'\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=63072000\r\n\r\nbody" as *u8
25 uw_write_kat("uwghard.txt" as *u8, hard)
26 let b2: *u8 = sys_mmap(8192)
27 let n2: i64 = uw_slurp("uwghard.txt" as *u8, b2, 8191)
28 let o2: *i64 = sys_mmap(64) as *i64
29 uw_audit(b2, n2, o2)
30 var t3: i64=0
31 if o2[7]==5 { t3=1 }
32 gv_check("T3 fully-hardened response = 5/5 = HARDENED" as *u8, t3, ctr)
33 var t4: i64=0
34 if o2[3]==1 { if o2[4]==1 { t4=1 } }
35 gv_check("T4 CSP frame-ancestors counts as the clickjacking frame guard" as *u8, t4, ctr)
36 let xfo: *u8 = "HTTP/1.1 204 No Content\r\nX-FRAME-OPTIONS: SAMEORIGIN\r\nreferrer-policy: no-referrer\r\n\r\n" as *u8
37 uw_write_kat("uwgxfo.txt" as *u8, xfo)
38 let b3: *u8 = sys_mmap(4096)
39 let n3: i64 = uw_slurp("uwgxfo.txt" as *u8, b3, 4095)
40 let o3: *i64 = sys_mmap(64) as *i64
41 uw_audit(b3, n3, o3)
42 var t5: i64=0
43 if o3[3]==1 { if o3[5]==1 { if o3[0]==204 { t5=1 } } }
44 gv_check("T5 case-insensitive: UPPER X-FRAME-OPTIONS + lower referrer-policy both matched, status 204" as *u8, t5, ctr)
45 let sf: i64 = uw_selftest()
46 var t6: i64=0
47 if sf==0 { t6=1 }
48 gv_check("T6 embedded selftest (the CLI --kat contract) 0 fails" as *u8, t6, ctr)
49 let rc: i64 = gv_verdict("UIQ-WIRE-GATE" as *u8, ctr, "first-byte-up response header audit: EXPOSED vs HARDENED discriminated, frame-ancestors|X-Frame-Options, case-insensitive, status from byte 0" as *u8)
50 sys_exit(rc)
51 return rc
52}