nx_video_sniff_guard_gate.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_video_sniff_guard_gate.nx -- proves SAFE EXECUTION OF UNTRUSTED PAGE JS via process-isolation: a 4// hostile while(true){} / alloc-bomb is KILLED by the kernel (RLIMIT_CPU/RLIMIT_AS in a forked child) and 5// the parent returns in bounded time -- it NEVER hangs. Benign pages pass through transparently with the 6// correct download route. This is the safety primitive that unlocks running arbitrary LIVE bundles WITHOUT 7// an interpreter fuel budget (so it doesn't touch the contended nx_js_eval). license_tier: ORIGINAL expect_exit: 0 8import "nx_syscalls.nx" 9import "nx_js_eval.nx" 10import "nx_media_jsexec.nx" 11import "nx_video_sniff.nx" 12import "nx_gate_verdict.nx" 13 14func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 15" as *u8); return ok } 16func gsl(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 17func plan_has(planbuf: *u8, want: *u8) -> i64 { return mjx_contains(planbuf, gsl(planbuf), want, gsl(want)) } 18 19// run vs_sniff_guarded (2 CPU-sec budget); pass iff kind==want_kind AND plan contains want_sub. 20func run_g(js: *u8, want_kind: i64, want_sub: *u8) -> i64 { 21 let planbuf: *u8 = sys_mmap(2560) 22 let k: i64 = vs_sniff_guarded(js, gsl(js), planbuf, 2560, 2) 23 if k != want_kind { gw(" (kind=" as *u8); gn(k); gw(" plan=[" as *u8); gw(planbuf); gw("])\n" as *u8); return 0 } 24 if plan_has(planbuf, want_sub) == 0 { gw(" (plan=[" as *u8); gw(planbuf); gw("])\n" as *u8); return 0 } 25 return 1 26} 27 28func main() -> i64 { 29 gw("video-sniff GUARD gate (untrusted page JS in a CPU/mem-capped child: hostile=KILLED, benign=transparent)\n" as *u8) 30 var pass: i64 = 0 31 var ttl: i64 = 0 32 33 // G1: BENIGN page, guard transparent -> correct route (the guard doesn't break normal operation). 34 ttl=ttl+1; pass=pass+grow("G1 benign master.m3u8 through guard -> route=hls\x00" as *u8, 35 run_g("function m(id){return 'https://cdn/'+id+'/master.m3u8';} fetch(m('Z9'));" as *u8, 36 VSK_HLS, "ROUTE=hls\x00" as *u8)) 37 // G2: HOSTILE while(true){} -> CPU cap -> KERNEL KILLS the child -> guard-killed, NO HANG. THE KEY PROOF. 38 ttl=ttl+1; pass=pass+grow("G2 while(true){} -> guard-killed (bounded, no hang)\x00" as *u8, 39 run_g("var x=0; while(true){ x=x+1; }" as *u8, 40 VSK_KILLED, "guard-killed\x00" as *u8)) 41 // G3: BENIGN direct .mp4 through guard -> route=direct (transparent). 42 ttl=ttl+1; pass=pass+grow("G3 benign direct .mp4 through guard -> route=direct\x00" as *u8, 43 run_g("fetch('https://cdn/'+'clip'+'.mp4');" as *u8, 44 VSK_DIRECT, "ROUTE=direct\x00" as *u8)) 45 // G4: HOSTILE runaway that also builds strings (CPU-bound work) -> killed just the same. 46 ttl=ttl+1; pass=pass+grow("G4 for(;;) string-build runaway -> guard-killed\x00" as *u8, 47 run_g("var s=''; var i=0; while(i<1){ s=s+'ab'; }" as *u8, 48 VSK_KILLED, "guard-killed\x00" as *u8)) 49 // G5: BENIGN no-media page through guard -> route=none (transparent, quiet). 50 ttl=ttl+1; pass=pass+grow("G5 benign no-media through guard -> route=none\x00" as *u8, 51 run_g("var a=1+1; fetch('https://api/ping');" as *u8, 52 VSK_NONE, "ROUTE=none\x00" as *u8)) 53 54 gw("pass=" as *u8); gn(pass); gw("/" as *u8); gn(ttl); gw("\n" as *u8) 55 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 56 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 57 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 58 let ctr__dry: *i64 = gv_ctr() 59 ctr__dry[0] = pass 60 ctr__dry[1] = ttl 61 let rc__dry: i64 = gv_verdict("VIDEO-SNIFF-GUARD-GATE" as *u8, ctr__dry, "hostile page JS is KILLED by the kernel in bounded time; benign passes through)" as *u8) 62 sys_exit(rc__dry) 63 return rc__dry 64}