nx_nist_unwall.nx source

1// nx_nist_unwall.nx -- R-RSI-006 (NIST-blog-unwalled). The nist.gov blog was filed WALLED 2// (exit-2, "h2/ALPN suspect"). Wall-triage (nx_wall_triage + _wt_probe_one, 2026-06-14) REFUTED 3// that for the blog PATH: https://www.nist.gov/blogs returns HTTP/1.1 200 via OUR sovereign 4// client; only the apex https://www.nist.gov/ hangs (124, redirect/apex, NOT an ALPN wall). 5// This organ un-walls it for real: fetch the blog with nx_https_get (the team's sovereign HTTPS 6// GET) and STORE the body to knowledge/library/nist_blog.txt (a real library source, like the 7// R-RSI-004 fetches). NEGATIVE CONTROL: a known h2-only host (rumble.com) must STILL FETCH-FAIL 8// our HTTP/1.1 client -- so a 200 from nist proves reachability, not a trivially-succeeding fetch. 9// Sovereign (nx_cc->nxasm_x86, no gcc); egress is the operator-provided real-world dependency. 10// license_tier: ORIGINAL 11import "nx_str.nx" 12import "nx_syscalls.nx" 13import "nx_csprng.nx" 14import "nx_x509_trust_store.nx" 15import "nx_pem_loader.nx" 16import "nx_https_get.nx" 17const NU_MAGIC_2097152: i64 = 2097152 18const NU_MAGIC_262144: i64 = 262144 19 20const NU_BLOG: *u8 = "https://www.nist.gov/blogs" 21const NU_RUMBLE: *u8 = "https://rumble.com/" 22const NU_OUT: *u8 = "knowledge/library/nist_blog.txt" 23const NU_CA: *u8 = "/etc/ssl/certs/ca-certificates.crt\x00" 24 25func nu_puts(s: *u8) -> i64 { sys_write(1, s, nx_str_len(s)); return 0 } 26func nu_putn(v: i64) -> i64 { let bb: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {bb[i]=t[k-1-i]; i=i+1}; sys_write(1, bb, k); return 0 } 27 28// substring search: does buf[0,n) contain NUL-term needle? 1/0. 29func nu_contains(buf: *u8, n: i64, needle: *u8) -> i64 { 30 var m: i64 = 0; while needle[m] != (0 as u8) { m = m + 1 } 31 if m == 0 { return 0 } 32 var i: i64 = 0 33 while i + m <= n { 34 var j: i64 = 0; var ok: i64 = 1 35 while j < m { if buf[i + j] != needle[j] { ok = 0; j = m } else { j = j + 1 } } 36 if ok == 1 { return 1 } 37 i = i + 1 38 } 39 return 0 40} 41 42// sovereign HTTPS GET into out[cap]; returns byte count (>0) or negative verdict. 43func nu_fetch(url: *u8, out: *u8, cap: i64) -> i64 { 44 let store: *TrustStore = trust_store_alloc(400) 45 if nx_pem_trust_load_file(NU_CA, store) <= 0 { return 0 - 99 } 46 let cr: *u8 = sys_mmap(32); nx_csprng_fill(cr, 32) 47 let pk: *u8 = sys_mmap(32); nx_csprng_fill(pk, 32) 48 return nx_https_get(url, cr, pk, store, sys_now_realtime_sec(), out, cap) 49} 50 51func main() -> i64 { 52 let out: *u8 = sys_mmap(NU_MAGIC_2097152) 53 let r: i64 = nu_fetch(NU_BLOG, out, NU_MAGIC_2097152) 54 var status200: i64 = 0 55 var blog_bytes: i64 = 0 56 var stored: i64 = 0 57 if r > 0 { 58 blog_bytes = r 59 var hn: i64 = r; if hn > 64 { hn = 64 } 60 if nu_contains(out, hn, "200 OK" as *u8) == 1 { status200 = 1 } 61 let fd: i64 = sys_openat_wr(NU_OUT, 0x1a4) 62 if fd >= 0 { 63 var off: i64 = 0 64 while off < r { let w: i64 = sys_write(fd, (((out as i64) + off) as *u8), r - off); if w <= 0 { off = r } else { off = off + w } } 65 sys_close(fd) 66 stored = 1 67 } 68 } 69 // NEGATIVE CONTROL: a known h2-only wall (rumble) must STILL fail our HTTP/1.1 fetch. 70 let out2: *u8 = sys_mmap(NU_MAGIC_262144) 71 let r2: i64 = nu_fetch(NU_RUMBLE, out2, NU_MAGIC_262144) 72 var rumble_walled: i64 = 0 73 if r2 <= 0 { rumble_walled = 1 } 74 75 nu_puts("NISTUNWALL status200=" as *u8); nu_putn(status200) 76 nu_puts(" blog_bytes=" as *u8); nu_putn(blog_bytes) 77 nu_puts(" stored=" as *u8); nu_putn(stored) 78 nu_puts(" rumble_walled=" as *u8); nu_putn(rumble_walled) 79 80 var ok: i64 = 1 81 if status200 != 1 { ok = 0 } 82 if blog_bytes < 1000 { ok = 0 } 83 if stored != 1 { ok = 0 } 84 if rumble_walled != 1 { ok = 0 } 85 if ok == 1 { nu_puts(" verdict=GREEN\n" as *u8); return 0 } 86 nu_puts(" verdict=RED\n" as *u8) 87 return 1 88}