nx_web_filter_gate.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_web_filter_gate.nx -- proves CLEAN WATCHING: given the barrage of requests a hostile pirate/adult page 4// fires (video + ad networks + crypto-miner + trackers + scam landing + popunder), the filter BLOCKS every 5// malicious/junk request and PASSES the actual video -- even when the video sits on a sketchy host. That is 6// "watch the content without the viruses" as a verdict, no DOM fingerprint for anti-adblock to detect. ORIGINAL expect_exit: 0 7import "nx_syscalls.nx" 8import "nx_media_signal.nx" 9import "nx_web_filter.nx" 10 11func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 12" as *u8); return ok } 13func gsl(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 14 15func main() -> i64 { 16 gw("web-filter SOVEREIGN gate (hostile page barrage -> block ads/miners/trackers/scam/popunder, pass the video)\n" as *u8) 17 var pass: i64 = 0 18 var ttl: i64 = 0 19 let t: *i64 = wf_new(); wf_seed(t) 20 let cat: *i64 = sys_mmap(8) as *i64 21 22 // the video the user came to watch -> ALLOWED (content), even on a sketchy .top host 23 ttl=ttl+1; pass=pass+grow("W1 video master.m3u8 -> ALLOW (content)\x00" as *u8, (wf_should_block(t, "https://cdn.stream.example/hls/master.m3u8" as *u8, gsl("https://cdn.stream.example/hls/master.m3u8" as *u8), cat) == 0) as i64 * ((cat[0]==WF_CONTENT) as i64)) 24 ttl=ttl+1; pass=pass+grow("W2 video .mp4 on a SKETCHY .top host -> still ALLOW (content-first, no collateral)\x00" as *u8, (wf_should_block(t, "https://vault.sketchy.top/v/abc/1080.mp4" as *u8, gsl("https://vault.sketchy.top/v/abc/1080.mp4" as *u8), cat) == 0) as i64 * ((cat[0]==WF_CONTENT) as i64)) 25 26 // the malicious barrage -> all BLOCKED, correctly categorized 27 ttl=ttl+1; pass=pass+grow("W3 exoclick popunder.js -> BLOCK (ad)\x00" as *u8, (wf_should_block(t, "https://s.exoclick.com/popunder.js" as *u8, gsl("https://s.exoclick.com/popunder.js" as *u8), cat) == 1) as i64 * ((cat[0]==WF_AD) as i64)) 28 ttl=ttl+1; pass=pass+grow("W4 coinhive miner -> BLOCK (crypto-miner)\x00" as *u8, (wf_should_block(t, "https://cdn.coinhive.com/lib/coinhive.min.js" as *u8, gsl("https://cdn.coinhive.com/lib/coinhive.min.js" as *u8), cat) == 1) as i64 * ((cat[0]==WF_MINER) as i64)) 29 ttl=ttl+1; pass=pass+grow("W5 google-analytics collect -> BLOCK (tracker)\x00" as *u8, (wf_should_block(t, "https://www.google-analytics.com/collect?v=1" as *u8, gsl("https://www.google-analytics.com/collect?v=1" as *u8), cat) == 1) as i64 * ((cat[0]==WF_TRACK) as i64)) 30 ttl=ttl+1; pass=pass+grow("W6 you-have-won scam landing -> BLOCK (malware/scam)\x00" as *u8, (wf_should_block(t, "https://landing.bad.top/you-have-won-iphone" as *u8, gsl("https://landing.bad.top/you-have-won-iphone" as *u8), cat) == 1) as i64 * ((cat[0]==WF_MAL) as i64)) 31 ttl=ttl+1; pass=pass+grow("W7 /pop.js popunder -> BLOCK (popunder)\x00" as *u8, (wf_should_block(t, "https://ads.thirdparty.io/pop.js" as *u8, gsl("https://ads.thirdparty.io/pop.js" as *u8), cat) == 1) as i64 * ((cat[0]==WF_POPUP) as i64)) 32 33 // a benign first-party request -> ALLOWED (default-permit, don't break the site) 34 ttl=ttl+1; pass=pass+grow("W8 first-party /api/v8/video -> ALLOW (default-permit)\x00" as *u8, (wf_should_block(t, "https://site.example/api/v8/video?id=1" as *u8, gsl("https://site.example/api/v8/video?id=1" as *u8), cat) == 0) as i64) 35 36 // the concrete story: block-count over a realistic hostile page 37 var blocked: i64 = 0; var allowed: i64 = 0 38 let urls: *i64 = sys_mmap(8*8) as *i64 39 urls[0] = "https://cdn.stream.example/hls/master.m3u8" as *u8 as i64 40 urls[1] = "https://s.exoclick.com/popunder.js" as *u8 as i64 41 urls[2] = "https://cdn.coinhive.com/lib/coinhive.min.js" as *u8 as i64 42 urls[3] = "https://www.google-analytics.com/collect?v=1" as *u8 as i64 43 urls[4] = "https://landing.bad.top/you-have-won-iphone" as *u8 as i64 44 urls[5] = "https://ads.thirdparty.io/pop.js" as *u8 as i64 45 urls[6] = "https://juicyads.com/adframe.js" as *u8 as i64 46 urls[7] = "https://vault.sketchy.top/v/abc/1080.mp4" as *u8 as i64 47 var i: i64 = 0 48 while i < 8 { let u: *u8 = (urls[i]) as *u8; if wf_should_block(t, u, gsl(u), cat) == 1 { blocked = blocked + 1 } else { allowed = allowed + 1 } i = i + 1 } 49 ttl=ttl+1; pass=pass+grow("W9 hostile page: 6 junk BLOCKED, 2 (video+video) ALLOWED\x00" as *u8, ((blocked == 6)) as i64 * ((allowed == 2) as i64)) 50 51 gw("pass=" as *u8); gn(pass); gw("/" as *u8); gn(ttl); gw(" (blocked " as *u8); gn(blocked); gw(" junk, passed " as *u8); gn(allowed); gw(" video)\n" as *u8) 52 if pass == ttl { gw("verdict=GREEN (clean watching: the malvertising/miners/trackers/popunders are blocked, the video passes -- site-agnostic user protection)\n" as *u8); sys_exit(0); return 0 } 53 gw("verdict=RED\n" as *u8); sys_exit(1); return 1 54}