nx_external_reach_probe_test.nx source

1// nx_external_reach_probe_test.nx -- smoke test for the graduated 2// nx_reach_probe_now wire-up against a real public endpoint. 3// 4// Mirrors nx_https_get_live_demo_test pattern: drives a real HTTPS GET 5// against a public server with an EMPTY trust store, asserts the verdict 6// is FAIL_TLS_HANDSHAKE (chain validation rejects without anchors). 7// That proves the reach-probe wire-up successfully completes DNS + TCP + 8// initial TLS bytes -- which IS the reachability signal we want to 9// surface continuously against nishifamily.com from peer hosts. 10// 11// Once trust_store_alloc + Mozilla CA bundle compose into a populated 12// trust store, the same call should return NX_REACH_OK against 13// example.com / nishifamily.com / any reachable HTTPS endpoint. 14// 15// expect_exit: 0 16// license_tier: PUBLIC_NISHI_SUBSTRATE 17// 18// Composes: 19// nx_external_reach_probe (the primitive under test) 20// nx_https_get (substrate-side network stack) 21// nx_clock_monotonic_ns (timing) 22// nx_x509_trust_store (empty store for handshake-fail probe) 23 24import "nx_syscalls.nx" 25import "nx_external_reach_probe.nx" 26 27func main() -> i64 { 28 // Build URL: "https://example.com/" 29 let url: *u8 = sys_mmap(64) 30 url[0]=0x68; url[1]=0x74; url[2]=0x74; url[3]=0x70; url[4]=0x73 // "https" 31 url[5]=0x3A; url[6]=0x2F; url[7]=0x2F // "://" 32 url[8]=0x65; url[9]=0x78; url[10]=0x61; url[11]=0x6D 33 url[12]=0x70; url[13]=0x6C; url[14]=0x65; url[15]=0x2E 34 url[16]=0x63; url[17]=0x6F; url[18]=0x6D // "example.com" 35 url[19]=0x2F // "/" 36 url[20]=0 37 38 // Allocate result struct. 39 let result: *NxReachProbeResult = sys_mmap(128) as *NxReachProbeResult 40 41 let v: i64 = nx_reach_probe_now(url, 20, 42 10000, // tcp_timeout_ms 43 10000, // tls_timeout_ms 44 30000, // http_timeout_ms 45 result) 46 47 // Assertion: with empty trust store + reachable example.com :443, 48 // verdict should be FAIL_TLS_HANDSHAKE (Certificate chain rejected). 49 // If we see FAIL_TCP_TIMEOUT or FAIL_DNS, that means substrate 50 // network stack regressed. If we see NX_REACH_OK that means 51 // empty-store cert validation got bypassed somehow. 52 if v == NX_REACH_FAIL_TLS_HANDSHAKE { 53 // Verify timing was captured (total_us should be positive). 54 if result.total_end_to_end_us > 0 { 55 return 0 // SUCCESS 56 } 57 return 11 // verdict OK but no timing captured (regression) 58 } 59 60 // Honest verdict per feedback-honest-perf-verdict-no-aspirational-claims: 61 // any other outcome is a substrate regression or network issue. Return 62 // distinct exit codes to surface which. 63 if v == NX_REACH_OK { return 20 } // unexpected pass 64 if v == NX_REACH_FAIL_DNS { return 21 } 65 if v == NX_REACH_FAIL_TCP_TIMEOUT { return 22 } 66 if v == NX_REACH_FAIL_HTTP_ERROR { return 23 } 67 if v == NX_REACH_FAIL_PAYLOAD_INCOMPLETE { return 24 } 68 if v == NX_REACH_FAIL_DEPENDENCY_MISSING { return 25 } 69 if v == NX_REACH_DEGRADED_SLOW { return 26 } 70 return 99 // unknown verdict code 71}