_dlr_probe.nx source
↩ module page · 74 lines · 3015 B
1// _dlr_probe.nx -- localize the validated-HTTPS read-hang (SREACH R1 blocker).
2// Replicates nx_https_get's four stages with a FLUSHED stderr marker after each;
3// the last marker before the hang names the stage that blocks. Target is
4// example.com (reproduces the hang fast). Run under `timeout -s KILL`.
5import "nx_str.nx"
6import "nx_syscalls.nx"
7import "nx_csprng.nx"
8import "nx_url.nx"
9import "nx_x509_trust_store.nx"
10import "nx_pem_loader.nx"
11import "nx_tls13_client_validate_certificate.nx"
12import "nx_tls13_client_session.nx"
13import "nx_tls13_client_session_run.nx"
14import "nx_https_url_for_fetch.nx"
15import "nx_https_url_connect.nx"
16import "nx_https_get_complete.nx"
17
18func P(s: *u8) -> i64 { sys_write(2, s, nx_str_len(s)); return 0 }
19func Pi(n: i64) -> i64 {
20 if n == 0 { sys_write(2, "0" as *u8, 1); return 0 }
21 var v: i64 = n; if v < 0 { sys_write(2, "-" as *u8, 1); v = 0 - v }
22 let t: *u8 = sys_mmap(32); var k: i64 = 0
23 while v > 0 { t[k] = 0x30 + (v - (v/10)*10); v = v/10; k = k+1 }
24 while k > 0 { k = k-1; sys_write(2, (((t as i64)+k) as *u8), 1) }
25 return 0
26}
27
28func main() -> i64 {
29 P("M0 start\n")
30 let store: *TrustStore = trust_store_alloc(400)
31 let nroots: i64 = nx_pem_trust_load_file("/etc/ssl/certs/ca-certificates.crt\x00", store)
32 P("M1 roots="); Pi(nroots); P("\n")
33 if nroots <= 0 { P("STOP no-roots\n"); return 1 }
34
35 let cr: *u8 = sys_mmap(32); nx_csprng_fill(cr, 32)
36 let pk: *u8 = sys_mmap(32); nx_csprng_fill(pk, 32)
37 let now: i64 = sys_now_realtime_sec()
38 let url: *u8 = "https://example.com/"
39
40 let url_p: *NxUrl = nx_url_new()
41 let target_raw: *u8 = sys_mmap(32)
42 let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
43 target.url = url_p
44 target.port = 0
45 let uv: i64 = nx_https_url_for_fetch(url, target)
46 P("M2 url_for_fetch="); Pi(uv); P("\n")
47 if uv != NX_HTTPS_URL_OK { P("STOP bad-url\n"); return 2 }
48
49 let fd_p: *i64 = sys_mmap(16) as *i64
50 let cv: i64 = nx_https_url_connect(target, url, now, fd_p)
51 P("M3 connect-verdict="); Pi(cv); P("\n")
52 if cv != NX_HTTPS_CONNECT_OK { P("STOP connect\n"); return 3 }
53 let fd: i64 = fd_p[0]
54
55 let val_ctx_raw: *u8 = sys_mmap(64)
56 let val_ctx: *TlsValidationContext = val_ctx_raw as *TlsValidationContext
57 val_ctx.store = store
58 val_ctx.sni_host = url + target.url.host_off
59 val_ctx.sni_host_len = target.url.host_len
60 val_ctx.now_epoch = now
61 P("M4 pre-handshake\n")
62 let sr: i64 = nx_tls13_client_session_run(fd, url + target.url.host_off, target.url.host_len, cr, pk, val_ctx)
63 P("M5 handshake-r="); Pi(sr); P("\n")
64 if sr < 0 { P("STOP handshake\n"); return 4 }
65 let session: *Tls13ClientSession = sr as *Tls13ClientSession
66
67 P("M6 pre-get (read loop)\n")
68 let out: *u8 = sys_mmap(262144)
69 let n: i64 = nx_https_get_complete(session, fd, "/" as *u8, 1, url + target.url.host_off, target.url.host_len, out, 262144)
70 P("M7 get-n="); Pi(n); P("\n")
71 sys_close(fd)
72 P("DONE\n")
73 return 0
74}