nx_dev_api_build_probe.nx source
↩ module page · 156 lines · 8736 B
1// nx_dev_api_build_probe.nx -- SOVEREIGN end-to-end proof that /api/dev/build BUILDS on the hub over the LIVE edge.
2// The true round-trip (operator: "build so verify"): a TLS-1.3 client POSTs /api/dev/build with the operator's
3// X-Nishi-Cap (dev_cap.tok) + organ=nx_bytes_eq to https://nishifamily.com; the edge proxies to the loopback dev
4// daemon; da_do_build forks ./_offc/nx_sov_build_run.elf (the toolchain we shipped) -> compiles on the NAS ->
5// returns {exit, output}. GREEN iff the response carries the daemon's own build output ("SOVEREIGN"). Clones the
6// proven TLS POST path from nx_login_e2e_probe. A CLIENT that runs+exits. license_tier: ORIGINAL expect_exit: 0
7import "nx_syscalls.nx"
8import "nx_x509_trust_store.nx"
9import "nx_trust_store_load_from_certdata.nx"
10import "nx_tls13_client_validate_certificate.nx"
11import "nx_tls13_client_session_run.nx"
12import "nx_https_url_for_fetch.nx"
13import "nx_https_url_connect.nx"
14import "nx_http_response_parse.nx"
15import "nx_tls13.nx"
16import "nx_tls13_record.nx"
17import "nx_tls13_read_record_from_fd.nx"
18import "nx_tls13_client_session.nx"
19import "nx_chacha20_poly1305.nx"
20import "nx_u256.nx"
21const K_MAGIC_16645: i64 = 16645
22const K_MAGIC_4194304: i64 = 4194304
23const K_MAGIC_1024: i64 = 1024
24const K_MAGIC_8192: i64 = 8192
25const K_MAGIC_262144: i64 = 262144
26
27func ep(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
28func epn(v: i64) -> i64 { let b: *u8=sys_mmap(28); var x: i64=v; if x<0 {b[0]=45;sys_write(1,b,1);x=0-x}; if x==0 {b[0]=48;sys_write(1,b,1);return 0} var d: i64=0; var y: i64=x; while y>0 {d=d+1;y=y/10} var i: i64=d-1; y=x; while i>=0 {b[i]=(48+(y%10)) as u8; y=y/10; i=i-1} sys_write(1,b,d); return 0 }
29func ecat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var i: i64=0; while s[i]!=(0 as u8){dst[o]=s[i]; o=o+1; i=i+1} return o }
30func eslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
31func econtains(buf: *u8, n: i64, needle: *u8) -> i64 {
32 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1}
33 if nl==0 { return 0 }
34 var i: i64=0
35 while i+nl<=n { var j: i64=0; var ok: i64=1; while j<nl { if buf[i+j]!=needle[j] { ok=0; j=nl } else { j=j+1 } } if ok==1 { return 1 } i=i+1 }
36 return 0
37}
38func ewrite_n(fd: i64, buf: *u8, n: i64) -> i64 { var off: i64=0; while off<n { let w: i64=sys_write(fd, ((buf as i64)+off) as *u8, n-off); if w<=0 { return 0-1 } off=off+w } return 0 }
39
40func e2e_send(s: *Tls13ClientSession, fd: i64, req: *u8, req_len: i64, out: *u8, out_cap: i64) -> i64 {
41 if s.state != NX_TLS13_CSESSION_STATE_CONNECTED { return 0-1 }
42 let rec_buf: *u8 = sys_mmap(req_len + 64)
43 let header_out: *u8 = rec_buf
44 let ct_out: *u8 = ((rec_buf as i64) + NX_TLS13_RECORD_HEADER_LEN) as *u8
45 let tag_out: *u8 = ((rec_buf as i64) + NX_TLS13_RECORD_HEADER_LEN + req_len + 1) as *u8
46 let enc_v: i64 = nx_tls13_record_encrypt_v2(s.cipher_suite, s.client_app_traffic_key, s.client_app_iv, s.client_app_seq, req, req_len, NX_TLS13_CT_APPLICATION_DATA, 0, header_out, ct_out, tag_out)
47 s.client_app_seq = s.client_app_seq + 1
48 if enc_v != NX_TLS13_REC_VERDICT_OK { return 0-2 }
49 let total: i64 = NX_TLS13_RECORD_HEADER_LEN + req_len + 1 + NX_TLS13_RECORD_TAG_LEN
50 if ewrite_n(fd, rec_buf, total) < 0 { return 0-3 }
51 var acc: i64 = 0
52 let rec_in: *u8 = sys_mmap(K_MAGIC_16645)
53 let plain: *u8 = sys_mmap(K_MAGIC_16645)
54 let ct_p: *i64 = sys_mmap(16) as *i64
55 let len_p: *i64 = sys_mmap(16) as *i64
56 while acc < out_cap {
57 let rin: i64 = nx_tls13_read_record_from_fd(fd, rec_in, K_MAGIC_16645)
58 if rin < 0 { return acc }
59 let ctlen: i64 = rin - NX_TLS13_RECORD_HEADER_LEN - NX_TLS13_RECORD_TAG_LEN
60 let rin_ct: *u8 = ((rec_in as i64) + NX_TLS13_RECORD_HEADER_LEN) as *u8
61 let rin_tag: *u8 = ((rec_in as i64) + rin - NX_TLS13_RECORD_TAG_LEN) as *u8
62 let dv: i64 = nx_tls13_record_decrypt_v2(s.cipher_suite, s.server_app_traffic_key, s.server_app_iv, s.server_app_seq, rec_in, rin_ct, ctlen, rin_tag, plain, ct_p, len_p)
63 s.server_app_seq = s.server_app_seq + 1
64 if dv != NX_TLS13_REC_VERDICT_OK { return acc }
65 if ct_p[0] == NX_TLS13_CT_ALERT { return acc }
66 if ct_p[0] == NX_TLS13_CT_APPLICATION_DATA {
67 let tc: i64 = len_p[0]
68 if acc + tc > out_cap { return acc }
69 var i: i64 = 0
70 while i < tc { out[acc+i] = plain[i]; i=i+1 }
71 acc = acc + tc
72 }
73 }
74 return acc
75}
76
77func e2e_req(store: *TrustStore, req: *u8, req_len: i64, out: *u8, out_cap: i64) -> i64 {
78 let _sm: i64 = nx_scratch_save()
79 let urlbuf: *u8 = sys_mmap(256)
80 let _u: i64 = ecat(urlbuf, 0, "https://nishifamily.com/" as *u8); urlbuf[_u] = 0 as u8
81 let target_raw: *u8 = sys_mmap(64)
82 let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
83 target.url = nx_url_new(); target.port = 0
84 if nx_https_url_for_fetch(urlbuf, target) != NX_HTTPS_URL_OK { return 0-10 }
85 let fd_p: *i64 = sys_mmap(16) as *i64
86 if nx_https_url_connect(target, urlbuf, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK { return 0-11 }
87 let fd: i64 = fd_p[0]
88 let cr: *u8 = sys_mmap(32); let priv: *u8 = sys_mmap(32)
89 var i: i64 = 0; while i < 32 { cr[i]=(0xC0+i) as u8; priv[i]=(0xA0+i) as u8; i=i+1 }
90 let vc_raw: *u8 = sys_mmap(64)
91 let vc: *TlsValidationContext = vc_raw as *TlsValidationContext
92 vc.store = store
93 vc.sni_host = ((urlbuf as i64) + target.url.host_off) as *u8
94 vc.sni_host_len = target.url.host_len
95 vc.now_epoch = sys_now_realtime_sec()
96 let sr: i64 = nx_tls13_client_session_run(fd, ((urlbuf as i64)+target.url.host_off) as *u8, target.url.host_len, cr, priv, vc)
97 if sr <= 0 { sys_close(fd); return 0-12 }
98 let session: *Tls13ClientSession = sr as *Tls13ClientSession
99 let n: i64 = e2e_send(session, fd, req, req_len, out, out_cap)
100 sys_close(fd)
101 nx_scratch_restore(_sm)
102 return n
103}
104
105// read dev_cap.tok (the operator dev_build capability), strip trailing CR/LF, NUL-terminate. Returns length.
106func read_cap(out: *u8, cap: i64) -> i64 {
107 let fd: i64 = sys_openat_rd("dev_cap.tok" as *u8)
108 if fd < 0 { return 0 }
109 let n: i64 = sys_read(fd, out, cap - 1)
110 sys_close(fd)
111 var k: i64 = n
112 while k > 0 { if out[k-1]==(10 as u8) { k=k-1 } else { if out[k-1]==(13 as u8) { k=k-1 } else { break } } }
113 out[k] = 0 as u8
114 return k
115}
116
117// POST <path> with X-Nishi-Cap header + form body. Returns request length.
118func build_post_cap(path: *u8, cap: *u8, body: *u8, out: *u8) -> i64 {
119 let bl: i64 = eslen(body)
120 var o: i64 = 0
121 o = ecat(out, o, "POST " as *u8); o = ecat(out, o, path)
122 o = ecat(out, o, " HTTP/1.1\r\nHost: nishifamily.com\r\nContent-Type: application/x-www-form-urlencoded\r\nX-Nishi-Cap: " as *u8)
123 o = ecat(out, o, cap)
124 o = ecat(out, o, "\r\nContent-Length: " as *u8)
125 if bl==0 { out[o]=48; o=o+1 } else { let t: *u8=sys_mmap(24); var m: i64=bl; var k: i64=0; while m>0 {t[k]=(48+(m%10)) as u8; m=m/10; k=k+1} var q: i64=k-1; while q>=0 {out[o]=t[q]; o=o+1; q=q-1} }
126 o = ecat(out, o, "\r\nConnection: close\r\n\r\n" as *u8)
127 o = ecat(out, o, body)
128 return o
129}
130
131func main() -> i64 {
132 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, K_MAGIC_4194304)
133 if r <= 0 { ep("certdata load failed (run from nxc2 dir)\n" as *u8); sys_exit(1); return 1 }
134 let store: *TrustStore = r as *TrustStore
135 let cap: *u8 = sys_mmap(K_MAGIC_1024)
136 let cn: i64 = read_cap(cap, K_MAGIC_1024)
137 if cn <= 0 { ep("dev_cap.tok not found/empty (run from nxc2 dir)\n" as *u8); sys_exit(1); return 1 }
138 ep("[cap] dev_cap.tok len="); epn(cn); ep("\n" as *u8)
139 let req: *u8 = sys_mmap(K_MAGIC_8192)
140 let out: *u8 = sys_mmap(K_MAGIC_262144)
141
142 ep("========== LIVE /api/dev/build ROUND-TRIP (sovereign TLS-1.3 POST + X-Nishi-Cap, off-LAN) ==========\n" as *u8)
143 let rl: i64 = build_post_cap("/api/dev/build" as *u8, cap, "organ=nx_bytes_eq" as *u8, req)
144 let n: i64 = e2e_req(store, req, rl, out, K_MAGIC_262144)
145 ep("[build] resp bytes="); epn(n); ep("\n" as *u8)
146 var dn: i64=n; if dn>360 {dn=360} if dn>0 { sys_write(1, out, dn) } ep("\n" as *u8)
147
148 var ok: i64 = 0
149 if econtains(out, n, "SOVEREIGN" as *u8) == 1 { ok = 1 }
150 if ok == 1 {
151 ep("VERDICT: GREEN -- POST /api/dev/build over the LIVE edge COMPILED nx_bytes_eq ON THE HUB (nx_cc toolchain on the NAS). Full author->build round-trip PROVEN off-LAN, zero WSL.\n" as *u8)
152 sys_exit(0); return 0
153 }
154 ep("VERDICT: RED -- no build output in the response (see body above: 401/403/302 gated, or backend/toolchain issue).\n" as *u8)
155 sys_exit(1); return 1
156}