`_wt_probe_one.nx` source

1// _wt_probe_one.nx -- single-host WALL PROBE unit for nx_wall_triage. Runs the
2// full sovereign HTTPS fetch and exits with the STAGE that refused us, so the
3// parent can NAME the wall instead of a flat rc=2:
4//   exit 0  = HTTP reached (status line + header head written to argv[2] --
5//             an HTTP-level wall like 403 is visible there)
6//   exit 12 = bad url        exit 13 = DNS/TCP connect refused
7//   exit 14 = TLS handshake refused (ClientHello-fingerprint suspect)
8//   exit 15 = TLS up, HTTP fetch failed (send/read)
9//   exit 3  = bad args
10// Child of nx_guarded_run (a hang is reaped as 124). usage: _wt_probe_one <url> <out>
11import "nx_str.nx"
12import "nx_syscalls.nx"
13import "nx_csprng.nx"
14import "nx_x509_trust_store.nx"
15import "nx_pem_loader.nx"
16import "nx_https_get.nx"
17
18func main(argc: i64, argv: *i64) -> i64 {
19    if argc < 3 { return 3 }
20    let url: *u8 = argv[1] as *u8
21    let outp: *u8 = argv[2] as *u8
22    let store: *TrustStore = trust_store_alloc(400)
23    if nx_pem_trust_load_file("/etc/ssl/certs/ca-certificates.crt\x00", store) <= 0 { return 15 }
24    let cr: *u8 = sys_mmap(32); nx_csprng_fill(cr, 32)
25    let pk: *u8 = sys_mmap(32); nx_csprng_fill(pk, 32)
26    let out: *u8 = sys_mmap(524288)
27    let r: i64 = nx_https_get(url, cr, pk, store, sys_now_realtime_sec(), out, 524288)
28    if r > 0 {
29        var n: i64 = r
30        if n > 300 { n = 300 }                      // status line + header head = the evidence
31        let fd: i64 = sys_openat_wr(outp, 0x1a4)
32        if fd >= 0 { sys_write(fd, out, n); sys_close(fd) }
33        return 0
34    }
35    let v: i64 = 0 - r                              // NX_HTTPS_GET_* verdict
36    if v == 2 { return 12 }
37    if v == 3 { return 13 }
38    if v == 4 { return 14 }
39    return 15
40}
_wt_probe_one.nx source

`_wt_probe_one.nx` source
