nx_mse_wire_gate.nx source
↩ module page · 77 lines · 5334 B
1// nx_mse_wire_gate.nx -- loopback gate for the reusable MSE wire library (nx_mse_wire).
2// Proves: mse_connect <-> mse_accept complete the handshake, then mse_write/mse_read carry an ENCRYPTED
3// BitTorrent-handshake + payload BOTH directions, decrypting byte-perfect; plus the plaintext/MSE demux
4// classifier. This is the API the seeder + downloader adopt. license_tier: ORIGINAL
5import "nx_mse_wire.nx"
6
7import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
8import "nx_gate_verdict.nx"
9const WG_PORT: i64 = 53911
10
11func wg_sockaddr(sa: *u8, port: i64, a: i64, b: i64, c: i64, d: i64) -> i64 {
12 sa[0]=2 as u8; sa[1]=0 as u8; sa[2]=((port>>8)&0xff) as u8; sa[3]=(port&0xff) as u8
13 sa[4]=a as u8; sa[5]=b as u8; sa[6]=c as u8; sa[7]=d as u8
14 var i: i64=8; while i<16 { sa[i]=0 as u8; i=i+1 } return 16
15}
16func wg_eq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
17
18func main() -> i64 {
19 md_p("MSE-WIRE-GATE authored=organ\n" as *u8)
20 // demux classifier (pure)
21 var cls_ok: i64=0; if mse_classify_first_byte(0x13)==0 { if mse_classify_first_byte(0xab)==1 { if mse_classify_first_byte(0x00)==1 { cls_ok=1 } } }
22 let skey: *u8 = sys_mmap(24); var i: i64=0; while i<20 { skey[i]=(0x51+i) as u8; i=i+1 }
23 let BT: *u8 = "\x13BitTorrent protocol--reserved--infohash--------peer_id-------X" as *u8 // 62-byte stand-in payload A->B
24 let BACK: *u8 = "BITFIELD+UNCHOKE+PIECE bytes flowing B->A over RC4 stream......" as *u8 // 62-byte payload B->A
25 let sa: *u8 = sys_mmap(16); wg_sockaddr(sa, WG_PORT, 127,0,0,1)
26 let lfd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
27 var bound: i64=0
28 if lfd>=0 { let one: *u8=sys_mmap(4); one[0]=1 as u8; one[1]=0 as u8; one[2]=0 as u8; one[3]=0 as u8; sys_setsockopt(lfd, SOL_SOCKET, 2, one, 4); sys_set_socket_timeout(lfd, 5); if sys_bind(lfd, sa, 16)>=0 { if sys_listen(lfd, 4)>=0 { bound=1 } } }
29 if bound==0 { md_p("MSE-WIRE-GATE bound=0 verdict=RED\n" as *u8); sys_exit(1); return 1 }
30
31 let pid: i64 = sys_fork()
32 if pid == 0 {
33 // RECEIVER B: demux first byte, MSE-accept, then wrapped I/O
34 let afd: i64 = sys_accept(lfd); if afd<0 { sys_exit(1); return 1 }
35 sys_set_socket_timeout(afd, 5)
36 let fb: *u8 = sys_mmap(4); if mw_read_n(afd, fb, 1) != 1 { sys_exit(1); return 1 } // peek first byte
37 let mode: i64 = mse_classify_first_byte(fb[0] as i64)
38 if mode != 1 { sys_exit(2); return 2 } // gate initiator uses MSE -> first byte must NOT be 0x13 (1/256 flaky; deterministic keys avoid it)
39 let xb: *i64 = sys_mmap((MSE_N+2)*8) as *i64; bi_zero(xb, MSE_N); xb[0]=0x7fedcba; xb[1]=0x0987654; xb[2]=0x3210fed
40 let ctxb: *MseCtx = sys_mmap(MSE_CTX_BYTES) as *MseCtx
41 if mse_accept_pfx(afd, skey, xb, fb, 1, ctxb) != 1 { sys_exit(3); return 3 } // first byte already read
42 let rb: *u8 = sys_mmap(80); if mse_read(ctxb, afd, rb, 62) != 62 { sys_exit(4); return 4 }
43 if wg_eq(rb, BT, 62) != 1 { sys_exit(5); return 5 } // decrypted A->B payload matches
44 let sb: *u8 = sys_mmap(80); var k: i64=0; while k<62 { sb[k]=BACK[k]; k=k+1 } mse_write(ctxb, afd, sb, 62) // reply encrypted
45 sys_close(afd); sys_exit(0); return 0
46 }
47
48 // INITIATOR A
49 let cfd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0); sys_set_socket_timeout(cfd, 5)
50 var conn: i64=0; if nx_connect_bounded(cfd, sa, 16, NX_CONN_DEFAULT_MS)>=0 { conn=1 }
51 var hs_ok: i64=0; var back_ok: i64=0
52 if conn==1 {
53 let xa: *i64 = sys_mmap((MSE_N+2)*8) as *i64; bi_zero(xa, MSE_N); xa[0]=0x1234567; xa[1]=0x89abcde; xa[2]=0xf011223
54 let ctxa: *MseCtx = sys_mmap(MSE_CTX_BYTES) as *MseCtx
55 if mse_connect(cfd, skey, xa, ctxa) == 1 {
56 hs_ok = 1
57 let wb: *u8 = sys_mmap(80); var k: i64=0; while k<62 { wb[k]=BT[k]; k=k+1 } mse_write(ctxa, cfd, wb, 62) // send encrypted BT handshake
58 let rb: *u8 = sys_mmap(80); if mse_read(ctxa, cfd, rb, 62) == 62 { if wg_eq(rb, BACK, 62)==1 { back_ok=1 } } // decrypt B->A reply
59 }
60 }
61 let st: *i64 = sys_mmap(16) as *i64; sys_wait4(pid, st, 0); sys_close(cfd); sys_close(lfd)
62 let child_code: i64 = (st[0]>>8)&0xff
63 md_p(" classify(0x13->plain,else->mse)=" as *u8); md_p(if_s(cls_ok))
64 md_p(" A: conn=" as *u8); md_p(if_s(conn)); md_p(" mse_connect=" as *u8); md_p(if_s(hs_ok)); md_p(" B->A_decrypted=" as *u8); md_p(if_s(back_ok))
65 md_p(" | B(child) demux+accept+A->B_decrypt+reply exit=" as *u8); let cb: *u8=sys_mmap(8); cb[0]=(48+child_code) as u8; sys_write(1, cb, 1); md_p("\n" as *u8)
66 var allok: i64=0
67 if cls_ok==1 { if conn==1 { if hs_ok==1 { if back_ok==1 { if child_code==0 { allok=1 } } } } }
68 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
69 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
70 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
71 let ctr__dry: *i64 = gv_ctr()
72 ctr__dry[0] = allok
73 ctr__dry[1] = 1
74 let rc__dry: i64 = gv_verdict("MSE-WIRE-GATE" as *u8, ctr__dry, "drop-in encrypted socket: handshake + bidirectional wrapped I/O)" as *u8)
75 sys_exit(rc__dry)
76 return rc__dry
77}