nx_ice_gate.nx source
↩ module page · 98 lines · 5619 B
1// nx_ice_gate.nx -- KAT the sovereign ICE primitives against RFC 8445 (priority) + RFC 5769 (2.1 sample
2// request, byte-exact). GREEN => a Nishi endpoint builds ICE connectivity checks that interoperate with any
3// standard peer, from the first byte up, no third-party code.
4// T0 header parse: Binding Request, magic, length 0x58
5// T1 candidate priority: ic_priority(host=126, local=65535, comp=1) == 0x7EFFFFFF (RFC 8445 host example)
6// T2 candidate priority: ic_priority(prflx=110, local=1, comp=1) == 0x6E0001FF (the RFC 5769 2.1 value)
7// T3 build the full connectivity-check request -> 108 bytes BYTE-EXACT vs RFC 5769 2.1 (incl MI + FINGERPRINT)
8// T4 candidate-pair priority comparator orders pairs + honours the controlling>controlled tie-break
9// T5 USE-CANDIDATE is a zero-length flag attribute
10// license_tier: ORIGINAL expect_exit: 0
11import "nx_syscalls.nx"
12import "nx_ice.nx"
13
14func gw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
15func gn(v: i64) -> i64 {
16 let b: *u8=sys_mmap(28); var m: i64=v; if m<0 {sys_write(1,"-" as *u8,1); m=0-m}
17 let t: *u8=sys_mmap(28); var k: i64=0; if m==0 {t[0]=48 as u8;k=1} while m>0 {t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}
18 var i: i64=0; while i<k {b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0
19}
20func gxh(v: i64) -> i64 { gw("0x" as *u8); let d: *u8="0123456789abcdef" as *u8; let b: *u8=sys_mmap(16); var i: i64=7; while i>=0 { b[7-i]=d[(v>>(i*4))&0xf]; i=i-1 } sys_write(1,b,8); return 0 }
21func gck(pass: i64, name: *u8, fails: *i64) -> i64 {
22 if pass==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8); fails[0]=fails[0]+1 }
23 gw(name); gw("\n" as *u8); return 0
24}
25func hxv(c: i64) -> i64 {
26 if c>=48 { if c<=57 { return c-48 } }
27 if c>=97 { if c<=102 { return c-87 } }
28 if c>=65 { if c<=70 { return c-55 } }
29 return 0
30}
31func hexdec(hex: *u8, nbytes: i64, out: *u8) -> i64 { var i: i64=0; while i<nbytes { out[i]=((hxv(hex[i*2] as i64)<<4) | hxv(hex[i*2+1] as i64)) as u8; i=i+1 } return 0 }
32func beq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
33
34func main() -> i64 {
35 let fails: *i64 = sys_mmap(16) as *i64
36 fails[0]=0
37 gw("=== nx_ice_gate -- sovereign ICE (RFC 8445) vs RFC 5769 2.1 sample request ===\n" as *u8)
38
39 // ---- the RFC 5769 2.1 "Sample Request" -- 108 bytes, verbatim from RFC 5769 (fetched authoritative) ----
40 let ref: *u8 = sys_mmap(160)
41 hexdec("000100582112a442b7e7a701bc34d686fa87dfae802200105354554e207465737420636c69656e74002400046e0001ff80290008932ff9b151263b36000600096576746a3a68367659202020000800149aeaa70cbfd8cb56781ef2b5b2d3f249c1b571a280280004e57a3bcf" as *u8, 108, ref)
42
43 var t0: i64 = 1
44 if st_type(ref)!=STUN_BINDING_REQUEST { t0=0 }
45 if st_magic(ref)!=STUN_MAGIC { t0=0 }
46 if st_len(ref)!=0x58 { t0=0 }
47 gck(t0, "T0 header parse: Binding Request, magic 0x2112A442, length 0x58" as *u8, fails)
48
49 // ---- T1/T2: candidate priority formula ----
50 var t1: i64 = 1
51 let p1: i64 = ic_priority(126, 65535, 1)
52 if p1 != 0x7EFFFFFF { t1=0 }
53 gw(" [measure] priority(host 126, lp 65535, comp 1)=" as *u8); gxh(p1); gw(" (RFC 8445 0x7EFFFFFF)\n" as *u8)
54 gck(t1, "T1 candidate priority host == 0x7EFFFFFF" as *u8, fails)
55
56 var t2: i64 = 1
57 let p2: i64 = ic_priority(110, 1, 1)
58 if p2 != 0x6E0001FF { t2=0 }
59 gck(t2, "T2 candidate priority prflx == 0x6E0001FF (the RFC 5769 2.1 PRIORITY value)" as *u8, fails)
60
61 // ---- T3: build the full connectivity-check request and compare byte-exact ----
62 var t3: i64 = 1
63 let txid: *u8 = sys_mmap(16); hexdec("b7e7a701bc34d686fa87dfae" as *u8, 12, txid)
64 let tb8: *u8 = sys_mmap(16); hexdec("932ff9b151263b36" as *u8, 8, tb8)
65 let out: *u8 = sys_mmap(256)
66 let n: i64 = ic_build_check(out, txid, "STUN test client" as *u8, 16, 0x6E0001FF, tb8,
67 "evtj:h6vY" as *u8, 9, "VOkJxbRl1RmTxUk/WvJxBt" as *u8, 22, 0x20)
68 if n != 108 { t3=0 }
69 if beq(out, ref, 108)==0 { t3=0 }
70 gw(" [measure] built " as *u8); gn(n); gw(" bytes (RFC 108); byte-exact=" as *u8); gn(beq(out, ref, 108)); gw("\n" as *u8)
71 gck(t3, "T3 connectivity-check request BYTE-EXACT vs RFC 5769 2.1 (SOFTWARE+PRIORITY+ICE-CONTROLLED+USERNAME+MI+FINGERPRINT)" as *u8, fails)
72
73 // ---- T4: candidate-pair priority comparator ----
74 var t4: i64 = 1
75 // a high pair (host controlling vs prflx controlled) must outrank a tiny pair
76 if ic_pair_cmp(0x7EFFFFFF, 0x6E0001FF, 100, 200) <= 0 { t4=0 }
77 // symmetric: reversing the args flips the sign
78 if ic_pair_cmp(100, 200, 0x7EFFFFFF, 0x6E0001FF) >= 0 { t4=0 }
79 // tie-break: same {min,max} but controlling>controlled wins
80 if ic_pair_cmp(200, 100, 100, 200) != 1 { t4=0 }
81 if ic_pair_cmp(100, 200, 100, 200) != 0 { t4=0 } // identical pairs equal
82 gck(t4, "T4 candidate-pair priority comparator orders pairs + controlling>controlled tie-break" as *u8, fails)
83
84 // ---- T5: USE-CANDIDATE zero-length flag ----
85 var t5: i64 = 1
86 let uc: *u8 = sys_mmap(16)
87 let un: i64 = ic_write_use_candidate(uc, 0)
88 if un != 4 { t5=0 }
89 if st_get16(uc, 0) != ICE_ATTR_USE_CANDIDATE { t5=0 }
90 if st_get16(uc, 2) != 0 { t5=0 }
91 gck(t5, "T5 USE-CANDIDATE is a zero-length flag (type 0x0025, len 0)" as *u8, fails)
92
93 gw(" fails=" as *u8); gn(fails[0]); gw("\n" as *u8)
94 if fails[0]==0 { gw("VERDICT: verdict=GREEN (sovereign NishiLang ICE interoperates byte-exact with RFC 5769 2.1)\n" as *u8); sys_exit(0) }
95 gw("VERDICT: verdict=RED\n" as *u8)
96 sys_exit(1)
97 return 1
98}