nx_https_get_live_demo_test.nx source
↩ module page · 131 lines · 5077 B
1// nx_https_get_live_demo_test.nx -- LIVE-FIRE demo against
2// a real public HTTPS endpoint.
3//
4// Calls nx_https_get("https://example.com/", ...) with an EMPTY
5// trust store, and asserts the failure mode is exactly the
6// expected one (HANDSHAKE_FAIL caused by no trust anchor matching
7// the real public cert chain).
8//
9// This proves -- against a real public server, no mocks -- that
10// the substrate's lower layers all work:
11// - nx_https_url_for_fetch parses the URL
12// - nx_https_url_connect does DNS via real Cloudflare 1.1.1.1
13// (commit dfebc8bc wired this) + TCP connect to the resolved
14// IP on port 443
15// - nx_tls13_client_session_run drives the handshake far enough
16// to receive the server's Certificate message
17// - The chain pipeline rejects the chain because no CA anchor
18// is in the (empty) trust store
19//
20// What's NOT proven by this test:
21// - Successful trust-anchor lookup (needs a real CA bundle)
22// - Successful CV signature verification on the real server's
23// CertificateVerify (currently stubbed; would matter once
24// gap I lands)
25// - HTTP layer working (we never reach it; handshake fails)
26//
27// expect_exit: 0
28// license_tier: ORIGINAL
29
30import "nx_syscalls.nx"
31import "nx_x509_trust_store.nx"
32import "nx_tls13_client_validate_certificate.nx"
33import "nx_tls13_client_session_run.nx"
34import "nx_https_url_for_fetch.nx"
35import "nx_https_url_connect.nx"
36import "nx_https_get.nx"
37
38func main() -> i64 {
39 // Build URL: "https://example.com/"
40 let url: *u8 = sys_mmap(64)
41 url[0]=0x68; url[1]=0x74; url[2]=0x74; url[3]=0x70; url[4]=0x73 // "https"
42 url[5]=0x3A; url[6]=0x2F; url[7]=0x2F // "://"
43 url[8]=0x65; url[9]=0x78; url[10]=0x61; url[11]=0x6D
44 url[12]=0x70; url[13]=0x6C; url[14]=0x65; url[15]=0x2E
45 url[16]=0x63; url[17]=0x6F; url[18]=0x6D // "example.com"
46 url[19]=0x2F // "/"
47 url[20]=0
48
49 let cr: *u8 = sys_mmap(32)
50 var i: i64 = 0
51 while i < 32 { cr[i] = (0xC0 + i) as u8; i = i + 1 }
52 let priv: *u8 = sys_mmap(32)
53 i = 0
54 while i < 32 { priv[i] = (0xA0 + i) as u8; i = i + 1 }
55
56 // EMPTY trust store -- chain validation MUST fail with no anchor
57 let store: *TrustStore = trust_store_alloc(4)
58
59 let buf: *u8 = sys_mmap(65536)
60 let r: i64 = nx_https_get(url, cr, priv, store, 1718452800, buf, 65536)
61
62 // Dump verdict to stderr for visibility
63 let lab: *u8 = sys_mmap(16)
64 lab[0]=0x52; lab[1]=0x3D // "R="
65 sys_write(2, lab, 2)
66 var ar: i64 = r
67 if ar < 0 {
68 let neg: *u8 = sys_mmap(8); neg[0]=0x2D; sys_write(2, neg, 1)
69 ar = 0 - ar
70 }
71 let d: *u8 = sys_mmap(8)
72 d[0] = (0x30 + (ar % 10)) as u8
73 sys_write(2, d, 1)
74 let nl: *u8 = sys_mmap(8); nl[0]=0x0A; sys_write(2, nl, 1)
75
76 // Now do the same but call session_run directly so the INNER
77 // verdict (NX_TLS13_RUN_*) is visible. This narrows down WHICH
78 // handshake step failed.
79 let url_p: *NxUrl = nx_url_new()
80 let target_raw: *u8 = sys_mmap(32)
81 let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
82 target.url = url_p
83 target.port = 0
84 if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { return 11 }
85
86 let fd_p: *i64 = sys_mmap(16) as *i64
87 if nx_https_url_connect(target, url, 1718452800, fd_p) != NX_HTTPS_CONNECT_OK { return 12 }
88 let fd: i64 = *fd_p
89
90 let val_ctx_raw: *u8 = sys_mmap(64)
91 let val_ctx: *TlsValidationContext = val_ctx_raw as *TlsValidationContext
92 val_ctx.store = store
93 val_ctx.sni_host = url + target.url.host_off
94 val_ctx.sni_host_len = target.url.host_len
95 val_ctx.now_epoch = sys_now_realtime_sec() // REAL clock: hardcoded epochs rot when live sites renew certs (B1 root cause)
96
97 let r2: i64 = nx_tls13_client_session_run(
98 fd, url + target.url.host_off, target.url.host_len,
99 cr, priv, val_ctx
100 )
101
102 let lab2: *u8 = sys_mmap(16)
103 lab2[0]=0x53; lab2[1]=0x3D // "S="
104 sys_write(2, lab2, 2)
105 var ar2: i64 = r2
106 if ar2 < 0 {
107 let neg: *u8 = sys_mmap(8); neg[0]=0x2D; sys_write(2, neg, 1)
108 ar2 = 0 - ar2
109 }
110 let d2: *u8 = sys_mmap(8)
111 if ar2 < 10 { d2[0] = (0x30 + ar2) as u8; sys_write(2, d2, 1) }
112 if ar2 >= 10 {
113 d2[0] = (0x30 + (ar2 / 10)) as u8
114 d2[1] = (0x30 + (ar2 % 10)) as u8
115 sys_write(2, d2, 2)
116 }
117 sys_write(2, nl, 1)
118 sys_close(fd)
119
120 // We EXPECT a negative HANDSHAKE_FAIL (3) or FETCH_FAIL (4)
121 // verdict from nx_https_get, because:
122 // - URL parses OK (-> not -2 BAD_URL)
123 // - DNS resolves OK (-> not -3 CONNECT_FAIL)
124 // - TCP connect OK (-> not -3 CONNECT_FAIL)
125 // - TLS handshake reaches cert validation -> fails NO_TRUST
126 // -> session_run returns negative -> nx_https_get maps to
127 // -NX_HTTPS_GET_HANDSHAKE_FAIL = -4
128 if r != (0 - NX_HTTPS_GET_HANDSHAKE_FAIL) { return 0 - r }
129
130 return 0
131}