nx_web_filter_gate.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_web_filter_gate.nx -- proves CLEAN WATCHING: given the barrage of requests a hostile pirate/adult page 4// fires (video + ad networks + crypto-miner + trackers + scam landing + popunder), the filter BLOCKS every 5// malicious/junk request and PASSES the actual video -- even when the video sits on a sketchy host. That is 6// "watch the content without the viruses" as a verdict, no DOM fingerprint for anti-adblock to detect. ORIGINAL expect_exit: 0 7import "nx_syscalls.nx" 8import "nx_media_signal.nx" 9import "nx_web_filter.nx" 10import "nx_gate_verdict.nx" 11 12func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 13" as *u8); return ok } 14func gsl(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 15 16func main() -> i64 { 17 gw("web-filter SOVEREIGN gate (hostile page barrage -> block ads/miners/trackers/scam/popunder, pass the video)\n" as *u8) 18 var pass: i64 = 0 19 var ttl: i64 = 0 20 let t: *i64 = wf_new(); wf_seed(t) 21 let cat: *i64 = sys_mmap(8) as *i64 22 23 // the video the user came to watch -> ALLOWED (content), even on a sketchy .top host 24 ttl=ttl+1; pass=pass+grow("W1 video master.m3u8 -> ALLOW (content)\x00" as *u8, (wf_should_block(t, "https://cdn.stream.example/hls/master.m3u8" as *u8, gsl("https://cdn.stream.example/hls/master.m3u8" as *u8), cat) == 0) as i64 * ((cat[0]==WF_CONTENT) as i64)) 25 ttl=ttl+1; pass=pass+grow("W2 video .mp4 on a SKETCHY .top host -> still ALLOW (content-first, no collateral)\x00" as *u8, (wf_should_block(t, "https://vault.sketchy.top/v/abc/1080.mp4" as *u8, gsl("https://vault.sketchy.top/v/abc/1080.mp4" as *u8), cat) == 0) as i64 * ((cat[0]==WF_CONTENT) as i64)) 26 27 // the malicious barrage -> all BLOCKED, correctly categorized 28 ttl=ttl+1; pass=pass+grow("W3 exoclick popunder.js -> BLOCK (ad)\x00" as *u8, (wf_should_block(t, "https://s.exoclick.com/popunder.js" as *u8, gsl("https://s.exoclick.com/popunder.js" as *u8), cat) == 1) as i64 * ((cat[0]==WF_AD) as i64)) 29 ttl=ttl+1; pass=pass+grow("W4 coinhive miner -> BLOCK (crypto-miner)\x00" as *u8, (wf_should_block(t, "https://cdn.coinhive.com/lib/coinhive.min.js" as *u8, gsl("https://cdn.coinhive.com/lib/coinhive.min.js" as *u8), cat) == 1) as i64 * ((cat[0]==WF_MINER) as i64)) 30 ttl=ttl+1; pass=pass+grow("W5 google-analytics collect -> BLOCK (tracker)\x00" as *u8, (wf_should_block(t, "https://www.google-analytics.com/collect?v=1" as *u8, gsl("https://www.google-analytics.com/collect?v=1" as *u8), cat) == 1) as i64 * ((cat[0]==WF_TRACK) as i64)) 31 ttl=ttl+1; pass=pass+grow("W6 you-have-won scam landing -> BLOCK (malware/scam)\x00" as *u8, (wf_should_block(t, "https://landing.bad.top/you-have-won-iphone" as *u8, gsl("https://landing.bad.top/you-have-won-iphone" as *u8), cat) == 1) as i64 * ((cat[0]==WF_MAL) as i64)) 32 ttl=ttl+1; pass=pass+grow("W7 /pop.js popunder -> BLOCK (popunder)\x00" as *u8, (wf_should_block(t, "https://ads.thirdparty.io/pop.js" as *u8, gsl("https://ads.thirdparty.io/pop.js" as *u8), cat) == 1) as i64 * ((cat[0]==WF_POPUP) as i64)) 33 34 // a benign first-party request -> ALLOWED (default-permit, don't break the site) 35 ttl=ttl+1; pass=pass+grow("W8 first-party /api/v8/video -> ALLOW (default-permit)\x00" as *u8, (wf_should_block(t, "https://site.example/api/v8/video?id=1" as *u8, gsl("https://site.example/api/v8/video?id=1" as *u8), cat) == 0) as i64) 36 37 // the concrete story: block-count over a realistic hostile page 38 var blocked: i64 = 0; var allowed: i64 = 0 39 let urls: *i64 = sys_mmap(8*8) as *i64 40 urls[0] = "https://cdn.stream.example/hls/master.m3u8" as *u8 as i64 41 urls[1] = "https://s.exoclick.com/popunder.js" as *u8 as i64 42 urls[2] = "https://cdn.coinhive.com/lib/coinhive.min.js" as *u8 as i64 43 urls[3] = "https://www.google-analytics.com/collect?v=1" as *u8 as i64 44 urls[4] = "https://landing.bad.top/you-have-won-iphone" as *u8 as i64 45 urls[5] = "https://ads.thirdparty.io/pop.js" as *u8 as i64 46 urls[6] = "https://juicyads.com/adframe.js" as *u8 as i64 47 urls[7] = "https://vault.sketchy.top/v/abc/1080.mp4" as *u8 as i64 48 var i: i64 = 0 49 while i < 8 { let u: *u8 = (urls[i]) as *u8; if wf_should_block(t, u, gsl(u), cat) == 1 { blocked = blocked + 1 } else { allowed = allowed + 1 } i = i + 1 } 50 ttl=ttl+1; pass=pass+grow("W9 hostile page: 6 junk BLOCKED, 2 (video+video) ALLOWED\x00" as *u8, ((blocked == 6)) as i64 * ((allowed == 2) as i64)) 51 52 gw("pass=" as *u8); gn(pass); gw("/" as *u8); gn(ttl); gw(" (blocked " as *u8); gn(blocked); gw(" junk, passed " as *u8); gn(allowed); gw(" video)\n" as *u8) 53 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 54 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 55 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 56 let ctr__dry: *i64 = gv_ctr() 57 ctr__dry[0] = pass 58 ctr__dry[1] = ttl 59 let rc__dry: i64 = gv_verdict("WEB-FILTER-GATE" as *u8, ctr__dry, "clean watching: the malvertising/miners/trackers/popunders are blocked, the video passes -- site-agnostic user protection)" as *u8) 60 sys_exit(rc__dry) 61 return rc__dry 62}