nx_live_https_reach.nx source
↩ module page · 54 lines · 2545 B
1// nx_live_https_reach.nx -- LIVE reach test of the sovereign TLS 1.3 client
2// against a real HTTPS host. Empty CA store (chain validation will refuse,
3// which is the honest verdict), so this proves how far we get: TCP :443 +
4// TLS handshake engagement with a real server. Full validated HTTPS needs the
5// CA trust store populated (PEM->X509 loader -> trust_store_add) -- the bounded
6// next step.
7import "nx_str.nx"
8import "nx_syscalls.nx"
9import "nx_csprng.nx"
10import "nx_x509_trust_store.nx"
11import "nx_https_get.nx"
12const K_MAGIC_65536: i64 = 65536
13
14func nx_putc(c: i64) -> i64 { let b: *u8 = sys_mmap(1); b[0] = c; sys_write(1, b, 1); return 0 }
15func nx_puts(s: *u8) -> i64 { sys_write(1, s, nx_str_len(s)); return 0 }
16func nx_pi(n: i64) -> i64 {
17 if n == 0 { nx_putc(0x30); return 0 }
18 var v: i64 = n; if v < 0 { nx_putc(0x2D); v = 0 - v }
19 let t: *u8 = sys_mmap(32); var k: i64 = 0
20 while v > 0 { t[k] = 0x30 + (v - (v/10)*10); v = v/10; k = k+1 }
21 while k > 0 { k = k-1; sys_write(1, (((t as i64)+k) as *u8), 1) }
22 return 0
23}
24
25func main() -> i64 {
26 let cr: *u8 = sys_mmap(32)
27 let pk: *u8 = sys_mmap(32)
28 nx_csprng_fill(cr, 32)
29 nx_csprng_fill(pk, 32)
30 let store: *TrustStore = trust_store_alloc(4) // empty (reach probe)
31 let out: *u8 = sys_mmap(K_MAGIC_65536)
32 let url: *u8 = "https://example.com/"
33 let now: i64 = sys_now_realtime_sec()
34
35 nx_puts("=== LIVE HTTPS reach: sovereign TLS 1.3 client -> example.com:443 ===\n")
36 let r: i64 = nx_https_get(url, cr, pk, store, now, out, K_MAGIC_65536)
37 if r > 0 {
38 nx_puts("FULL OK: fetched "); nx_pi(r); nx_puts(" bytes over a validated TLS session\n")
39 return 0
40 }
41 let v: i64 = 0 - r
42 if v == NX_HTTPS_GET_BAD_URL { nx_puts("BAD_URL\n"); return 1 }
43 if v == NX_HTTPS_GET_CONNECT_FAIL { nx_puts("CONNECT_FAIL: could not TCP-connect :443 (egress to 443 blocked?)\n"); return 1 }
44 if v == NX_HTTPS_GET_HANDSHAKE_FAIL {
45 nx_puts("HANDSHAKE stage: TCP connected + TLS handshake ENGAGED with the real server;\n")
46 nx_puts("chain validation refused (empty CA store -- EXPECTED). Live TLS reach to a real\n")
47 nx_puts("HTTPS host is CONFIRMED. Bounded next step: populate the CA trust store\n")
48 nx_puts("(PEM->X509 loader -> trust_store_add) for a fully-validated fetch.\n")
49 return 0
50 }
51 if v == NX_HTTPS_GET_FETCH_FAIL { nx_puts("FETCH_FAIL: handshake OK but the HTTP round-trip failed\n"); return 1 }
52 nx_puts("verdict "); nx_pi(v); nx_putc(0x0A)
53 return 1
54}