nx_video_sniff_guard_gate.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_video_sniff_guard_gate.nx -- proves SAFE EXECUTION OF UNTRUSTED PAGE JS via process-isolation: a 4// hostile while(true){} / alloc-bomb is KILLED by the kernel (RLIMIT_CPU/RLIMIT_AS in a forked child) and 5// the parent returns in bounded time -- it NEVER hangs. Benign pages pass through transparently with the 6// correct download route. This is the safety primitive that unlocks running arbitrary LIVE bundles WITHOUT 7// an interpreter fuel budget (so it doesn't touch the contended nx_js_eval). license_tier: ORIGINAL expect_exit: 0 8import "nx_syscalls.nx" 9import "nx_js_eval.nx" 10import "nx_media_jsexec.nx" 11import "nx_video_sniff.nx" 12 13func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 14" as *u8); return ok } 15func gsl(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 16func plan_has(planbuf: *u8, want: *u8) -> i64 { return mjx_contains(planbuf, gsl(planbuf), want, gsl(want)) } 17 18// run vs_sniff_guarded (2 CPU-sec budget); pass iff kind==want_kind AND plan contains want_sub. 19func run_g(js: *u8, want_kind: i64, want_sub: *u8) -> i64 { 20 let planbuf: *u8 = sys_mmap(2560) 21 let k: i64 = vs_sniff_guarded(js, gsl(js), planbuf, 2560, 2) 22 if k != want_kind { gw(" (kind=" as *u8); gn(k); gw(" plan=[" as *u8); gw(planbuf); gw("])\n" as *u8); return 0 } 23 if plan_has(planbuf, want_sub) == 0 { gw(" (plan=[" as *u8); gw(planbuf); gw("])\n" as *u8); return 0 } 24 return 1 25} 26 27func main() -> i64 { 28 gw("video-sniff GUARD gate (untrusted page JS in a CPU/mem-capped child: hostile=KILLED, benign=transparent)\n" as *u8) 29 var pass: i64 = 0 30 var ttl: i64 = 0 31 32 // G1: BENIGN page, guard transparent -> correct route (the guard doesn't break normal operation). 33 ttl=ttl+1; pass=pass+grow("G1 benign master.m3u8 through guard -> route=hls\x00" as *u8, 34 run_g("function m(id){return 'https://cdn/'+id+'/master.m3u8';} fetch(m('Z9'));" as *u8, 35 VSK_HLS, "ROUTE=hls\x00" as *u8)) 36 // G2: HOSTILE while(true){} -> CPU cap -> KERNEL KILLS the child -> guard-killed, NO HANG. THE KEY PROOF. 37 ttl=ttl+1; pass=pass+grow("G2 while(true){} -> guard-killed (bounded, no hang)\x00" as *u8, 38 run_g("var x=0; while(true){ x=x+1; }" as *u8, 39 VSK_KILLED, "guard-killed\x00" as *u8)) 40 // G3: BENIGN direct .mp4 through guard -> route=direct (transparent). 41 ttl=ttl+1; pass=pass+grow("G3 benign direct .mp4 through guard -> route=direct\x00" as *u8, 42 run_g("fetch('https://cdn/'+'clip'+'.mp4');" as *u8, 43 VSK_DIRECT, "ROUTE=direct\x00" as *u8)) 44 // G4: HOSTILE runaway that also builds strings (CPU-bound work) -> killed just the same. 45 ttl=ttl+1; pass=pass+grow("G4 for(;;) string-build runaway -> guard-killed\x00" as *u8, 46 run_g("var s=''; var i=0; while(i<1){ s=s+'ab'; }" as *u8, 47 VSK_KILLED, "guard-killed\x00" as *u8)) 48 // G5: BENIGN no-media page through guard -> route=none (transparent, quiet). 49 ttl=ttl+1; pass=pass+grow("G5 benign no-media through guard -> route=none\x00" as *u8, 50 run_g("var a=1+1; fetch('https://api/ping');" as *u8, 51 VSK_NONE, "ROUTE=none\x00" as *u8)) 52 53 gw("pass=" as *u8); gn(pass); gw("/" as *u8); gn(ttl); gw("\n" as *u8) 54 if pass == ttl { gw("verdict=GREEN (hostile page JS is KILLED by the kernel in bounded time; benign passes through)\n" as *u8); sys_exit(0); return 0 } 55 gw("verdict=RED\n" as *u8); sys_exit(1); return 1 56}