nx_ice_check_gate.nx source
↩ module page · 147 lines · 8095 B
1// nx_ice_check_gate.nx -- proves the ICE connectivity-CHECK EXCHANGE end to end:
2// PART A (pure): a check request built with an ICE password verifies its MESSAGE-INTEGRITY under that
3// password and FAILS under a wrong one (the auth is real, not decorative); FINGERPRINT self-consistent;
4// USE-CANDIDATE detected; a success response built with the password verifies too.
5// PART B (LIVE, real UDP): two sovereign endpoints run a full check -- controlling A sends a check request,
6// controlled B validates it under the shared password and answers with a success response carrying A's
7// reflexive address, and A validates that response. This is how two Nishi peers confirm a working path.
8// license_tier: ORIGINAL expect_exit: 0
9import "nx_syscalls.nx"
10import "nx_ice.nx"
11
12func gw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
13func gn(v: i64) -> i64 {
14 let b: *u8=sys_mmap(28); var m: i64=v; if m<0 {sys_write(1,"-" as *u8,1); m=0-m}
15 let t: *u8=sys_mmap(28); var k: i64=0; if m==0 {t[0]=48 as u8;k=1} while m>0 {t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}
16 var i: i64=0; while i<k {b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0
17}
18func gck(pass: i64, name: *u8, fails: *i64) -> i64 {
19 if pass==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8); fails[0]=fails[0]+1 }
20 gw(name); gw("\n" as *u8); return 0
21}
22
23const CK_SPORT: i64 = 53240
24
25func main() -> i64 {
26 let fails: *i64 = sys_mmap(16) as *i64
27 fails[0]=0
28 gw("=== nx_ice_check_gate -- ICE connectivity-check exchange (pure + live UDP) ===\n" as *u8)
29
30 let pwd: *u8 = "icePasswordAtLeast22ch" as *u8
31 let pwl: i64 = 22
32 let wrong: *u8 = "wrongPasswordXXXXXXXXX" as *u8
33 let txid: *u8 = sys_mmap(16); var ti: i64=0; while ti<12 { txid[ti]=(0x30+ti) as u8; ti=ti+1 }
34 let tb8: *u8 = sys_mmap(16); var bi: i64=0; while bi<8 { tb8[bi]=(0x90+bi) as u8; bi=bi+1 }
35
36 // ---- PART A ----
37 let req: *u8 = sys_mmap(256)
38 let n: i64 = ic_build_check(req, txid, "nishi-ice" as *u8, 9, ic_priority(126,65535,1), tb8,
39 "RFRAG:LFRAG" as *u8, 11, pwd, pwl, 0)
40
41 var t1: i64=1
42 if ic_verify_fingerprint(req, n) != 1 { t1=0 }
43 if ic_verify_mi(req, n, pwd, pwl) != 1 { t1=0 }
44 gck(t1, "A1 a check verifies its FINGERPRINT + MESSAGE-INTEGRITY under the correct ICE password" as *u8, fails)
45
46 var t2: i64=1
47 if ic_verify_mi(req, n, wrong, 22) != 0 { t2=0 }
48 gck(t2, "A2 NEG-CONTROL: MESSAGE-INTEGRITY FAILS under a wrong password (auth is real)" as *u8, fails)
49
50 // A3: USE-CANDIDATE detection -- build header + USE-CANDIDATE + set length, then detect it
51 var t3: i64=1
52 let uc: *u8 = sys_mmap(64)
53 var o: i64 = st_write_header(uc, STUN_BINDING_REQUEST, 0, txid)
54 o = ic_write_use_candidate(uc, o)
55 st_put16(uc, 2, o-20)
56 if ic_has_use_candidate(uc, o) != 1 { t3=0 }
57 if ic_has_use_candidate(req, n) != 0 { t3=0 } // the plain check has none
58 gck(t3, "A3 USE-CANDIDATE flag is detected when present and absent otherwise" as *u8, fails)
59
60 // A4: a SUCCESS RESPONSE built with the password verifies (MI + FINGERPRINT), and reflects the peer addr
61 var t4: i64=1
62 let resp: *u8 = sys_mmap(256)
63 let rn: i64 = ic_build_success_response(resp, txid, 44321, 0xCB007107, pwd, pwl) // 203.0.113.7:44321
64 if ic_verify_fingerprint(resp, rn) != 1 { t4=0 }
65 if ic_verify_mi(resp, rn, pwd, pwl) != 1 { t4=0 }
66 let xv: i64 = ic_find_attr(resp, rn, STUN_ATTR_XOR_MAPPED_ADDRESS)
67 if xv < 0 { t4=0 } else {
68 let xma: *u8 = (resp as i64 + xv) as *u8
69 if st_xma_port(xma) != 44321 { t4=0 }
70 if st_xma_addr(xma) != 0xCB007107 { t4=0 }
71 }
72 gck(t4, "A4 success response carries XOR-MAPPED-ADDRESS(peer) and verifies under the password" as *u8, fails)
73
74 // ---- PART B: LIVE check exchange over real UDP (fork loopback) ----
75 var t5: i64=1
76 let ssa: *u8 = sys_mmap(16)
77 ssa[0]=2 as u8; ssa[1]=0 as u8; ssa[2]=((CK_SPORT>>8)&0xff) as u8; ssa[3]=(CK_SPORT&0xff) as u8
78 ssa[4]=127 as u8; ssa[5]=0 as u8; ssa[6]=0 as u8; ssa[7]=1 as u8
79 var pk: i64=8; while pk<16 { ssa[pk]=0 as u8; pk=pk+1 }
80 let sfd: i64 = sys_socket(AF_INET, SOCK_DGRAM, 0)
81 var bound: i64=0
82 if sfd>=0 { sys_set_socket_timeout(sfd, 3); if sys_bind(sfd, ssa, 16)>=0 { bound=1 } }
83 if bound==0 { gck(0, "B bind controlled peer 127.0.0.1:53240" as *u8, fails) } else {
84 let pid: i64 = sys_fork()
85 if pid==0 {
86 // CHILD = controlled peer B: recv check, VALIDATE (MI+FINGERPRINT) under pwd, respond with XMA(A).
87 let rb: *u8 = sys_mmap(2048)
88 let rout: *u8 = sys_mmap(2048)
89 let csrc: *u8 = sys_mmap(16)
90 let cslen: *i64 = sys_mmap(16) as *i64; cslen[0]=16
91 let cn: i64 = sys_recvfrom(sfd, rb, 2048, 0, csrc, cslen)
92 if cn>=20 {
93 if ic_verify_fingerprint(rb, cn)==1 { if ic_verify_mi(rb, cn, pwd, pwl)==1 {
94 let sport: i64 = (((csrc[2] as i64)&0xff)<<8) | ((csrc[3] as i64)&0xff)
95 let saddr: i64 = (((csrc[4] as i64)&0xff)<<24) | (((csrc[5] as i64)&0xff)<<16) | (((csrc[6] as i64)&0xff)<<8) | ((csrc[7] as i64)&0xff)
96 let rtx: *u8 = (rb as i64 + 8) as *u8
97 let rrn: i64 = ic_build_success_response(rout, rtx, sport, saddr, pwd, pwl)
98 sys_sendto(sfd, rout, rrn, 0, csrc, cslen[0])
99 } }
100 }
101 sys_close(sfd)
102 sys_exit(0)
103 }
104 // PARENT = controlling peer A: bind a known port, send a check, validate the response.
105 let cfd: i64 = sys_socket(AF_INET, SOCK_DGRAM, 0)
106 sys_set_socket_timeout(cfd, 3)
107 let csa: *u8 = sys_mmap(16)
108 csa[0]=2 as u8; csa[1]=0 as u8; csa[2]=((53241>>8)&0xff) as u8; csa[3]=(53241&0xff) as u8
109 csa[4]=127 as u8; csa[5]=0 as u8; csa[6]=0 as u8; csa[7]=1 as u8
110 var ck2: i64=8; while ck2<16 { csa[ck2]=0 as u8; ck2=ck2+1 }
111 sys_bind(cfd, csa, 16)
112 let creq: *u8 = sys_mmap(256)
113 let cn2: i64 = ic_build_check(creq, txid, "nishi-ice" as *u8, 9, ic_priority(126,65535,1), tb8, "RFRAG:LFRAG" as *u8, 11, pwd, pwl, 0)
114 let dest: *u8 = sys_mmap(16)
115 dest[0]=2 as u8; dest[1]=0 as u8; dest[2]=((CK_SPORT>>8)&0xff) as u8; dest[3]=(CK_SPORT&0xff) as u8
116 dest[4]=127 as u8; dest[5]=0 as u8; dest[6]=0 as u8; dest[7]=1 as u8
117 var dk: i64=8; while dk<16 { dest[dk]=0 as u8; dk=dk+1 }
118 sys_sendto(cfd, creq, cn2, 0, dest, 16)
119 let rresp: *u8 = sys_mmap(2048)
120 let rn2: i64 = sys_recvfrom(cfd, rresp, 2048, 0, 0 as *u8, 0 as *i64)
121 let st: *i64 = sys_mmap(16) as *i64
122 sys_wait4(pid, st, 0)
123 sys_close(cfd)
124 if rn2 < 20 { t5=0 }
125 if st_type(rresp) != STUN_BINDING_RESPONSE { t5=0 }
126 if ic_verify_fingerprint(rresp, rn2) != 1 { t5=0 }
127 if ic_verify_mi(rresp, rn2, pwd, pwl) != 1 { t5=0 } // the response is authenticated too
128 let rxv: i64 = ic_find_attr(rresp, rn2, STUN_ATTR_XOR_MAPPED_ADDRESS)
129 var la: i64 = 0
130 var lp: i64 = 0
131 if rxv < 0 { t5=0 } else {
132 let rxma: *u8 = (rresp as i64 + rxv) as *u8
133 la = st_xma_addr(rxma); lp = st_xma_port(rxma)
134 if la != 0x7F000001 { t5=0 } // A learns its own reflexive addr on this pair
135 if lp != 53241 { t5=0 }
136 }
137 gw(" [measure] LIVE check exchange: peer A validated response, reflexive=" as *u8)
138 gn((la>>24)&0xff); gw("." as *u8); gn((la>>16)&0xff); gw("." as *u8); gn((la>>8)&0xff); gw("." as *u8); gn(la&0xff); gw(":" as *u8); gn(lp); gw("\n" as *u8)
139 gck(t5, "B5 LIVE ICE check: A sends, B validates under pwd + answers, A validates -> path confirmed" as *u8, fails)
140 }
141
142 gw(" fails=" as *u8); gn(fails[0]); gw("\n" as *u8)
143 if fails[0]==0 { gw("VERDICT: verdict=GREEN (sovereign ICE connectivity-check exchange works, authenticated, over real UDP)\n" as *u8); sys_exit(0) }
144 gw("VERDICT: verdict=RED\n" as *u8)
145 sys_exit(1)
146 return 1
147}