nx_https_get_hdr.nx source
↩ module page · 75 lines · 3483 B
1// nx_https_get_hdr.nx -- generic sovereign HTTPS GET with a CALLER-SUPPLIED request header, over the FULL
2// best-effort ladder (minimal TLS-1.3 hello -> Chrome-JA3 -> TLS-1.2), redirect-following + cookie jar. The
3// header-capable twin of nx_https_get and the adoption vehicle for the 2026-08-12 header fold
4// (nx_https_fetch_follow_hdr_best). Reaches an authed/Cloudflare API in ONE call:
5// nx_https_get_hdr <url> "Authorization: Bearer <token>" (redgifs / reddit-OAuth)
6// nx_https_get_hdr <url> "Cookie: over18=1" (pre-seeded age cookie)
7// argv[1]=url (required), argv[2]=one header line (optional, sent verbatim + CRLF). NO curl/libc/fetch-shim.
8// Structured refusal (reason+fix) on failure per feedback-refusals-carry-reason-and-fix. license_tier: ORIGINAL
9import "nx_syscalls.nx"
10import "nx_x509_trust_store.nx"
11import "nx_trust_store_load_from_certdata.nx"
12import "nx_https_fetch_follow.nx"
13const HGH_MAGIC_8192: i64 = 8192
14const HGH_MAGIC_8189: i64 = 8189
15
16const HGH_OUTCAP: i64 = 4194304
17const HGH_CERTDATA: *u8 = "data/mozilla_certdata.txt" as *u8
18
19func hgh_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
20func hgh_put(fd: i64, s: *u8) -> i64 { sys_write(fd, s, hgh_slen(s)); return 0 }
21func hgh_putn(fd: i64, v: i64) -> i64 {
22 let b: *u8 = sys_mmap(24)
23 var m: i64 = v
24 if m == 0 { b[0] = 48 as u8; sys_write(fd, b, 1); return 0 }
25 if m < 0 { sys_write(fd, "-" as *u8, 1); m = 0 - m }
26 var nd: i64 = 0
27 var t: i64 = m
28 while t > 0 { nd = nd + 1; t = t / 10 }
29 var i: i64 = nd - 1
30 while i >= 0 { b[i] = (48 + (m % 10)) as u8; m = m / 10; i = i - 1 }
31 sys_write(fd, b, nd)
32 return 0
33}
34
35func main(argc: i64, argv: *i64) -> i64 {
36 if argc < 2 {
37 hgh_put(2, "usage: nx_https_get_hdr <url> [\"Header: value\"]\n" as *u8)
38 return 3
39 }
40 let url: *u8 = argv[1] as *u8
41 // Build the extra-header blob: the caller's header line + CRLF (the builder wants each line CRLF-terminated,
42 // NO trailing blank line). Absent header -> xlen 0 -> byte-identical to the plain follow fetch.
43 let xhdr: *u8 = sys_mmap(HGH_MAGIC_8192)
44 var xlen: i64 = 0
45 if argc >= 3 {
46 let h: *u8 = argv[2] as *u8
47 var i: i64 = 0
48 while h[i] != (0 as u8) { if xlen < HGH_MAGIC_8189 { xhdr[xlen] = h[i]; xlen = xlen + 1 } i = i + 1 }
49 xhdr[xlen] = 13 as u8; xlen = xlen + 1
50 xhdr[xlen] = 10 as u8; xlen = xlen + 1
51 }
52 let r: i64 = nx_trust_store_load_from_certdata(HGH_CERTDATA, 512, HGH_OUTCAP)
53 if r <= 0 {
54 hgh_put(2, "HGH REFUSED verdict=RED reason=certdata-load-failed(data/mozilla_certdata.txt) fix=verify the Mozilla CA bundle is present at that path\n" as *u8)
55 return 1
56 }
57 let store: *TrustStore = r as *TrustStore
58 let out: *u8 = sys_mmap(HGH_OUTCAP)
59 let status: *i64 = sys_mmap(8) as *i64
60 status[0] = 0
61 let n: i64 = nx_https_fetch_follow_hdr_best(url, store, out, HGH_OUTCAP, 6, status, xhdr, xlen)
62 if n < 0 {
63 hgh_put(2, "HGH REFUSED verdict=RED reason=fetch-failed(code=" as *u8)
64 hgh_putn(2, 0 - n)
65 hgh_put(2, ") fix=verify NAS outbound 443 + header/token validity (2=bad-url 3=trust/connect 4=tls-handshake 5..7=get/parse)\n" as *u8)
66 return 2
67 }
68 hgh_put(2, "HGH OK status=" as *u8)
69 hgh_putn(2, status[0])
70 hgh_put(2, " body_bytes=" as *u8)
71 hgh_putn(2, n)
72 hgh_put(2, "\n" as *u8)
73 sys_write(1, out, n)
74 return 0
75}