nx_iot_fetch_probe.nx source

1// nx_iot_fetch_probe.nx -- DIAGNOSTIC: fetch several URLs on nishifamily.com 2// and DUMP the actual served body to files so we can SEE what each path 3// really returns (no marker-matching self-deception). Sovereign TLS-1.3 GET 4// through the real Mozilla CA chain, same machinery as nx_iot_verify_gate. 5// license_tier: ORIGINAL 6import "nx_syscalls.nx" 7import "nx_x509_trust_store.nx" 8import "nx_trust_store_load_from_certdata.nx" 9import "nx_tls13_client_validate_certificate.nx" 10import "nx_tls13_client_session_run.nx" 11import "nx_https_url_for_fetch.nx" 12import "nx_https_url_connect.nx" 13import "nx_https_get.nx" 14import "nx_https_get_complete.nx" 15import "nx_http_response_parse.nx" 16const K_MAGIC_262144: i64 = 262144 17const K_MAGIC_14000: i64 = 14000 18const K_MAGIC_4194304: i64 = 4194304 19 20func pw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 21func pnum(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 22func pstrlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 23func pcontains(buf: *u8, lo: i64, hi: i64, needle: *u8) -> i64 { 24 let nl: i64=pstrlen(needle); if nl==0 { return 0 } 25 var i: i64=lo 26 while i+nl<=hi { var j: i64=0; var ok: i64=1; while j<nl { if buf[i+j]!=needle[j] { ok=0; j=nl } else { j=j+1 } } if ok==1 { return 1 } i=i+1 } 27 return 0 28} 29 30func probe(store: *TrustStore, url: *u8, path: *u8, plen: i64, outpath: *u8) -> i64 { 31 pw("\n=== GET " as *u8); pw(url as *u8); pw(" (path=" as *u8); pw(path as *u8); pw(") ===\n" as *u8) 32 let url_p: *NxUrl = nx_url_new() 33 let target: *NxHttpsTarget = sys_mmap(64) as *NxHttpsTarget 34 target.url = url_p 35 target.port = 0 36 if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { pw(" url-parse FAIL\n" as *u8); return 0 - 1 } 37 let fd_p: *i64 = sys_mmap(16) as *i64 38 if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK { pw(" connect FAIL\n" as *u8); return 0 - 1 } 39 let fd: i64 = fd_p[0] 40 let cr: *u8 = sys_mmap(32); var i: i64=0; while i<32 { cr[i]=(0xC0+i) as u8; i=i+1 } 41 let priv: *u8 = sys_mmap(32); i=0; while i<32 { priv[i]=(0xA0+i) as u8; i=i+1 } 42 let val_ctx: *TlsValidationContext = sys_mmap(64) as *TlsValidationContext 43 val_ctx.store = store 44 val_ctx.sni_host = ((url as i64) + target.url.host_off) as *u8 45 val_ctx.sni_host_len = target.url.host_len 46 val_ctx.now_epoch = sys_now_realtime_sec() 47 let sr: i64 = nx_tls13_client_session_run(fd, ((url as i64)+target.url.host_off) as *u8, target.url.host_len, cr, priv, val_ctx) 48 if sr <= 0 { pw(" TLS FAIL\n" as *u8); sys_close(fd); return 0 - 1 } 49 let session: *Tls13ClientSession = sr as *Tls13ClientSession 50 let buf: *u8 = sys_mmap(K_MAGIC_262144) 51 let gc: i64 = nx_https_get_complete(session, fd, path, plen, ((url as i64)+target.url.host_off) as *u8, target.url.host_len, buf, K_MAGIC_262144) 52 sys_close(fd) 53 if gc <= 0 { pw(" GET FAIL\n" as *u8); return 0 - 1 } 54 let pr: *i64 = sys_mmap(128) as *i64 55 var status: i64=0; var body_off: i64=0 56 if nx_http_response_parse(buf, gc, pr)==0 { status=pr[1]; body_off=pr[6] } 57 pw(" status=" as *u8); pnum(status); pw(" total_bytes=" as *u8); pnum(gc); pw(" body_off=" as *u8); pnum(body_off); pw("\n" as *u8) 58 pw(" has 'Nishi IoT Hub'=" as *u8); pnum(pcontains(buf, body_off, gc, "Nishi IoT Hub" as *u8)) 59 pw(" has 'nx_iot_page'=" as *u8); pnum(pcontains(buf, body_off, gc, "nx_iot_page" as *u8)) 60 pw(" has '<title'=" as *u8); pnum(pcontains(buf, body_off, gc, "<title" as *u8)); pw("\n" as *u8) 61 // dump the body (capped) so we can READ exactly what was served 62 var dlen: i64 = gc - body_off 63 if dlen > K_MAGIC_14000 { dlen = K_MAGIC_14000 } 64 if dlen < 0 { dlen = 0 } 65 let outfd: i64 = sys_openat_wr(outpath, 0x1a4) 66 if outfd >= 0 { sys_write(outfd, ((buf as i64)+body_off) as *u8, dlen); sys_close(outfd); pw(" dumped " as *u8); pnum(dlen); pw(" body bytes to " as *u8); pw(outpath as *u8); pw("\n" as *u8) } 67 return gc 68} 69 70func main() -> i64 { 71 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 300, K_MAGIC_4194304) 72 if r <= 0 { pw("no CA store\n" as *u8); sys_exit(1); return 1 } 73 let store: *TrustStore = r as *TrustStore 74 probe(store, "https://nishifamily.com/" as *u8, "/" as *u8, 1, "web_assets/probe_root.txt" as *u8) 75 probe(store, "https://nishifamily.com/iot" as *u8, "/iot" as *u8, 4, "web_assets/probe_iot.txt" as *u8) 76 probe(store, "https://nishifamily.com/iot.html" as *u8, "/iot.html" as *u8, 9, "web_assets/probe_iot_html.txt" as *u8) 77 // regression checks: these existing routes MUST still work after the deploy 78 probe(store, "https://nishifamily.com/wiki" as *u8, "/wiki" as *u8, 5, "web_assets/probe_wiki.txt" as *u8) 79 probe(store, "https://nishifamily.com/video" as *u8, "/video" as *u8, 6, "web_assets/probe_video.txt" as *u8) 80 pw("\nprobe done\n" as *u8) 81 sys_exit(0) 82 return 0 83}