nx_lib_fetch.nx source
↩ module page · 90 lines · 4070 B
1// nx_lib_fetch.nx -- sovereign HTTPS fetch for the library ingest (retires
2// httpx). WIRES the team's TLS-1.3 stack exactly as nx_semantic_research_fetch:
3// load a CA TrustStore, then per URL: parse -> DNS+TCP connect -> TLS-1.3
4// handshake (cert-verified) -> GET -> response bytes. No OpenSSL, no python.
5// Ready the moment the network is up; + nx_lib_parse -> nx_lib_store completes
6// the fetch->parse->store ingest.
7// license_tier: ORIGINAL | genealogy_id: nishi_library_sovereign_fetch_2026_07_01
8import "nx_syscalls.nx"
9import "nx_csprng.nx"
10import "nx_x509_trust_store.nx"
11import "nx_trust_store_load_from_certdata.nx"
12import "nx_tls13_client_validate_certificate.nx"
13import "nx_tls13_client_session_run.nx"
14import "nx_https_url_for_fetch.nx"
15import "nx_https_url_connect.nx"
16import "nx_https_get_complete.nx"
17import "nx_http_response_parse.nx"
18
19const NX_LIB_CERTDATA: *u8 = "data/mozilla_certdata.txt\x00" // repo-shipped Mozilla NSS CA bundle (sovereign asset, no /tmp staging)
20
21// load the CA trust store; returns *TrustStore or 0 on failure.
22func nx_lib_fetch_store() -> *TrustStore {
23 let r: i64 = nx_trust_store_load_from_certdata(NX_LIB_CERTDATA, 512, 4194304)
24 if r <= 0 { return 0 as *TrustStore }
25 return r as *TrustStore
26}
27
28// fetch url over sovereign TLS-1.3; write the full HTTP response into out_buf;
29// return bytes received (or a negative error code).
30func nx_lib_fetch(store: *TrustStore, url_str: *u8, out_buf: *u8, out_cap: i64) -> i64 {
31 let cr: *u8 = sys_mmap(32)
32 var i: i64 = 0
33 nx_csprng_fill(cr, 32) // CWE-330 (debt 1785970852): was the constant 0xC0..0xDF
34 let priv: *u8 = sys_mmap(32)
35 i = 0
36 nx_csprng_fill(priv, 32) // CWE-330: the X25519 scalar was the constant 0xA0..0xBF on EVERY session
37
38 let url_p: *NxUrl = nx_url_new()
39 let target_raw: *u8 = sys_mmap(32)
40 let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
41 target.url = url_p
42 target.port = 0
43 if nx_https_url_for_fetch(url_str, target) != NX_HTTPS_URL_OK { return 0 - 41 }
44
45 let fd_p: *i64 = sys_mmap(16) as *i64
46 if nx_https_url_connect(target, url_str, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK { return 0 - 42 }
47 let fd: i64 = *fd_p
48
49 let val_ctx_raw: *u8 = sys_mmap(64)
50 let val_ctx: *TlsValidationContext = val_ctx_raw as *TlsValidationContext
51 val_ctx.store = store
52 val_ctx.sni_host = url_str + target.url.host_off
53 val_ctx.sni_host_len = target.url.host_len
54 val_ctx.now_epoch = sys_now_realtime_sec()
55
56 let sr: i64 = nx_tls13_client_session_run(fd, url_str + target.url.host_off, target.url.host_len, cr, priv, val_ctx)
57 if sr <= 0 { sys_close(fd); return 0 - (200 + (0 - sr)) }
58 let session: *Tls13ClientSession = sr as *Tls13ClientSession
59
60 var path_off: i64 = target.url.path_off
61 var path_len: i64 = target.url.path_len
62 let default_path: *u8 = sys_mmap(2)
63 default_path[0] = 0x2F as u8
64 var path_ptr: *u8 = url_str + path_off
65 if path_len == 0 { path_ptr = default_path; path_len = 1 }
66 if target.url.query_len > 0 {
67 let full: *u8 = sys_mmap(path_len + target.url.query_len + 4)
68 var fo: i64 = 0
69 var pci: i64 = 0
70 while pci < path_len { full[fo] = path_ptr[pci]; fo = fo + 1; pci = pci + 1 }
71 full[fo] = 0x3F as u8; fo = fo + 1
72 let qp: *u8 = url_str + target.url.query_off
73 var qci: i64 = 0
74 while qci < target.url.query_len { full[fo] = qp[qci]; fo = fo + 1; qci = qci + 1 }
75 path_ptr = full; path_len = fo
76 }
77
78 let gc: i64 = nx_https_get_complete(session, fd, path_ptr, path_len, url_str + target.url.host_off, target.url.host_len, out_buf, out_cap)
79 sys_close(fd)
80 return gc
81}
82
83// convenience: HTTP status of the fetched response (or the fetch error).
84func nx_lib_fetch_status(store: *TrustStore, url_str: *u8, out_buf: *u8, out_cap: i64) -> i64 {
85 let gc: i64 = nx_lib_fetch(store, url_str, out_buf, out_cap)
86 if gc < 0 { return gc }
87 let rs: *i64 = sys_mmap(128) as *i64
88 nx_http_response_parse(out_buf, gc, rs)
89 return rs[1]
90}