nx_email_dns_gate.nx source

1// nx_email_dns_gate.nx -- generate the jasonewest.com mail DNS artifacts. 2// 3// Generates a REAL ed25519 DKIM keypair (sovereign csprng + ed25519), 4// emits the DNS zone (nx_dns_zone), VERIFIES the key actually signs+ 5// verifies (so the published pubkey will validate this signer), checks 6// the zone structure, and writes two artifacts: 7// knowledge/status/jasonewest_dns_zone.txt <- publish these records 8// knowledge/status/jasonewest_dkim_priv.key <- SECRET: keep to sign outbound 9// 10// Evidence -> knowledge/status/email_dns.log (DNSGATE ... verdict=GREEN) 11// license_tier: ORIGINAL 12import "nx_email_dns.nx" 13import "nx_email_auth.nx" 14import "nx_csprng.nx" 15import "nx_base64.nx" 16import "nx_syscalls.nx" 17 18const DNS_LOG: *u8 = "knowledge/status/email_dns.log" 19 20func ew(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 21func epf(fd: i64, label: *u8, pass: i64) -> i64 { ew(fd, label); if pass == 1 { ew(fd, "PASS" as *u8) } else { ew(fd, "FAIL" as *u8) } return 0 } 22func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 23func contains(hay: *u8, hlen: i64, needle: *u8) -> i64 { 24 let nl: i64 = slen(needle); var i: i64 = 0 25 while i + nl <= hlen { 26 var k: i64 = 0; var hit: i64 = 1 27 while k < nl { if (hay[i + k] & 0xff) != (needle[k] & 0xff) { hit = 0; k = nl } else { k = k + 1 } } 28 if hit == 1 { return 1 } 29 i = i + 1 30 } 31 return 0 32} 33func writefile(path: *u8, buf: *u8, n: i64) -> i64 { 34 let fd: i64 = sys_openat_wr(path, 420) 35 if fd < 0 { return 0 - 1 } 36 var w: i64 = 0 37 while w < n { let k: i64 = sys_write(fd, (buf as i64 + w) as *u8, n - w); if k <= 0 { w = n } else { w = w + k } } 38 sys_close(fd) 39 return 0 40} 41func hexbyte(out: *u8, oi: i64, b: i64) -> i64 { 42 let hi: i64 = (b >> 4) & 0xf; let lo: i64 = b & 0xf 43 if hi < 10 { out[oi] = (48 + hi) as u8 } else { out[oi] = (97 + hi - 10) as u8 } 44 if lo < 10 { out[oi + 1] = (48 + lo) as u8 } else { out[oi + 1] = (97 + lo - 10) as u8 } 45 return oi + 2 46} 47 48func main() -> i64 { 49 var ok: i64 = 1 50 51 // 1. real ed25519 DKIM keypair 52 let priv: *u8 = sys_mmap(32) 53 nx_csprng_fill(priv, 32) 54 let pub: *u8 = sys_mmap(32) 55 ed25519_pub_from_priv(priv, pub) 56 let pub_b64: *u8 = sys_mmap(128) 57 let bl: i64 = b64_encode(pub, 32, pub_b64) 58 pub_b64[bl] = 0 as u8 59 60 // 2. emit zone 61 let zone: *u8 = sys_mmap(4096) 62 let zlen: i64 = nx_dns_zone("jasonewest.com" as *u8, "mail.jasonewest.com" as *u8, "203.0.113.10" as *u8, "nishi1" as *u8, pub_b64, zone, 4096) 63 zone[zlen] = 0 as u8 64 65 // 3. verify the DKIM key round-trips (the published pubkey validates this signer) 66 let sig: *u8 = sys_mmap(64) 67 ed25519_sign_full(priv, "dkim-test" as *u8, 9, sig) 68 var dkim_rt: i64 = 0 69 if ed25519_verify_full(pub, "dkim-test" as *u8, 9, sig) == 1 { dkim_rt = 1 } else { ok = 0 } 70 71 // 4. zone structure checks 72 var z_mx: i64 = contains(zone, zlen, "MX\t10 mail.jasonewest.com" as *u8) 73 var z_dkim: i64 = contains(zone, zlen, "v=DKIM1; k=ed25519; p=" as *u8) 74 var z_spf: i64 = contains(zone, zlen, "v=spf1 a:mail.jasonewest.com -all" as *u8) 75 var z_dmarc: i64 = contains(zone, zlen, "v=DMARC1; p=quarantine" as *u8) 76 var z_sel: i64 = contains(zone, zlen, "nishi1._domainkey.jasonewest.com" as *u8) 77 if z_mx != 1 || z_dkim != 1 || z_spf != 1 || z_dmarc != 1 || z_sel != 1 { ok = 0 } 78 79 // 5. write artifacts 80 writefile("knowledge/status/jasonewest_dns_zone.txt" as *u8, zone, zlen) 81 let keyf: *u8 = sys_mmap(256) 82 var ko: i64 = 0 83 ko = 0 84 let hdr: *u8 = "# SECRET ed25519 DKIM private key for nishi1._domainkey.jasonewest.com -- keep offline.\n# hex(32):\n" as *u8 85 var hk: i64 = 0 86 while hdr[hk] != (0 as u8) { keyf[ko] = hdr[hk]; ko = ko + 1; hk = hk + 1 } 87 var bi: i64 = 0 88 while bi < 32 { ko = hexbyte(keyf, ko, priv[bi] & 0xff); bi = bi + 1 } 89 keyf[ko] = 10 as u8; ko = ko + 1 90 writefile("knowledge/status/jasonewest_dkim_priv.key" as *u8, keyf, ko) 91 var artifacts: i64 = 1 92 93 // 6. emit marker + the zone for the operator 94 var fd: i64 = 1 95 while fd >= 1 { 96 ew(fd, "DNSGATE authored=organ domain=jasonewest.com dkim=ed25519 selector=nishi1 " as *u8) 97 epf(fd, "dkim_roundtrip=" as *u8, dkim_rt) 98 epf(fd, " zone_mx=" as *u8, z_mx) 99 epf(fd, " zone_dkim=" as *u8, z_dkim) 100 epf(fd, " zone_spf=" as *u8, z_spf) 101 epf(fd, " zone_dmarc=" as *u8, z_dmarc) 102 epf(fd, " zone_selector=" as *u8, z_sel) 103 epf(fd, " artifacts_written=" as *u8, artifacts) 104 if ok == 1 { ew(fd, " verdict=GREEN\n" as *u8) } else { ew(fd, " verdict=RED\n" as *u8) } 105 if fd == 1 { 106 let lf: i64 = sys_openat_append(DNS_LOG, 420) 107 if lf >= 1 { fd = lf } else { fd = 0 } 108 } else { sys_close(fd); fd = 0 } 109 } 110 ew(1, "\n----- DNS records (knowledge/status/jasonewest_dns_zone.txt) -----\n" as *u8) 111 ew(1, zone) 112 113 if ok == 1 { return 0 } 114 return 1 115}