nx_fetch_any_gate.nx source
↩ module page · 61 lines · 5012 B
1// nx_fetch_any_gate.nx -- teeth for the intelligent fetch dispatcher (operator 2026-07-14: researcher/census/
2// adversary/critic must "not get errors and return nothing without informing the user"). ADVERSARY DISCIPLINE:
3// the classifier is LAW only if it discriminates a REAL page from the exact thing that fools a naive fetcher --
4// a Cloudflare 200-OK CHALLENGE page. Gates fa_status / fa_challenge / fa_is_real / fa_body_off / fa_to_body.
5// license_tier: ORIGINAL
6import "nx_syscalls.nx"
7import "nx_fetch_any.nx"
8
9func g_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
10func g_putn(v: i64) -> i64 {
11 let t: *u8 = sys_mmap(28); var m: i64 = v; var k: i64 = 0
12 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m }
13 if m == 0 { t[0] = 48 as u8; k = 1 }
14 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
15 let b: *u8 = sys_mmap(28); var i: i64 = 0
16 while i < k { b[i] = t[k - 1 - i]; i = i + 1 }
17 sys_write(1, b, k); return 0
18}
19func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
20
21func main() -> i64 {
22 var pass: i64 = 0; var tot: i64 = 0
23
24 // fixtures (>256B so the challenge/real verdict is driven by CONTENT, not the size guard)
25 let real: *u8 = "<!doctype html><html><head><title>Jellyfin Media Server</title></head><body><h1>Jellyfin</h1><p>Jellyfin is a free software media system that organizes movies shows music and photos. This page documents trickplay scrub previews chapter markers hardware transcoding HLS delivery keyframe accurate seeking subtitles and multi user watch state.</p></body></html>" as *u8
26 let ch: *u8 = "<!doctype html><html><head><title>Just a moment...</title></head><body><div class=cf-chl-widget id=challenge-platform><h1>Checking your browser before accessing the site.</h1><p>Enable JavaScript and cookies to continue. This process is automatic and your browser will redirect shortly.</p></div></body></html>" as *u8
27
28 // ---- T1: fa_status parses the HTTP code ----
29 tot = tot + 1; if fa_status("HTTP/1.1 200 OK\r\nX: y\r\n\r\nhi" as *u8, g_slen("HTTP/1.1 200 OK\r\nX: y\r\n\r\nhi" as *u8)) == 200 { pass = pass + 1 } else { g_puts("FAIL T1a status-200\n" as *u8) }
30 tot = tot + 1; if fa_status("HTTP/1.1 403 Forbidden\r\n\r\n" as *u8, g_slen("HTTP/1.1 403 Forbidden\r\n\r\n" as *u8)) == 403 { pass = pass + 1 } else { g_puts("FAIL T1b status-403\n" as *u8) }
31 tot = tot + 1; if fa_status("<html>no headers here</html>" as *u8, g_slen("<html>no headers here</html>" as *u8)) == 0 { pass = pass + 1 } else { g_puts("FAIL T1c status-none\n" as *u8) }
32
33 // ---- T2: fa_challenge detects bot-walls, passes real content ----
34 tot = tot + 1; if fa_challenge(ch, g_slen(ch)) == 1 { pass = pass + 1 } else { g_puts("FAIL T2a challenge-detected\n" as *u8) }
35 tot = tot + 1; if fa_challenge(real, g_slen(real)) == 0 { pass = pass + 1 } else { g_puts("FAIL T2b real-not-flagged\n" as *u8) }
36
37 // ---- T3: fa_is_real -- THE anti-silent-bad core ----
38 tot = tot + 1; if fa_is_real(200, real, g_slen(real)) == 1 { pass = pass + 1 } else { g_puts("FAIL T3a real-accepted\n" as *u8) }
39 // the CRITICAL adversary test: a 200-OK Cloudflare CHALLENGE (what fools a naive fetcher) must be REJECTED
40 tot = tot + 1; if fa_is_real(200, ch, g_slen(ch)) == 0 { pass = pass + 1 } else { g_puts("FAIL T3b 200-challenge-REJECTED (silent-bad guard)\n" as *u8) }
41 tot = tot + 1; if fa_is_real(403, ch, g_slen(ch)) == 0 { pass = pass + 1 } else { g_puts("FAIL T3c 403-rejected\n" as *u8) }
42 tot = tot + 1; if fa_is_real(200, "hi" as *u8, 2) == 0 { pass = pass + 1 } else { g_puts("FAIL T3d tiny-rejected\n" as *u8) }
43 tot = tot + 1; if fa_is_real(500, real, g_slen(real)) == 0 { pass = pass + 1 } else { g_puts("FAIL T3e 5xx-rejected\n" as *u8) }
44
45 // ---- T4: fa_body_off / fa_to_body strip HTTP headers so banked content is clean ----
46 let resp: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nServer: nishi\r\n\r\nBODYSTART then real content long enough to matter for extraction padded padded padded." as *u8
47 let rl: i64 = g_slen(resp)
48 let bo: i64 = fa_body_off(resp, rl)
49 tot = tot + 1
50 if bo > 0 { if resp[bo] == (66 as u8) { pass = pass + 1 } else { g_puts("FAIL T4a body-off-not-B\n" as *u8) } } else { g_puts("FAIL T4a no-body-off\n" as *u8) }
51 // shift into a COPY (never write a string literal)
52 let cp: *u8 = sys_mmap(4096); var i: i64 = 0
53 while i < rl { cp[i] = resp[i]; i = i + 1 }
54 let bl: i64 = fa_to_body(cp, rl)
55 tot = tot + 1; if cp[0] == (66 as u8) { pass = pass + 1 } else { g_puts("FAIL T4b shift-front-not-body\n" as *u8) }
56 tot = tot + 1; if bl < rl { pass = pass + 1 } else { g_puts("FAIL T4c body-not-shorter\n" as *u8) }
57
58 g_puts("nx_fetch_any_gate pass=" as *u8); g_putn(pass); g_puts("/" as *u8); g_putn(tot)
59 if pass == tot { g_puts(" GREEN\n" as *u8); sys_exit(0); return 0 }
60 g_puts(" RED\n" as *u8); sys_exit(1); return 1
61}