code wiki / _hdl_build / nx_nist_verify_gate.nx
nx_nist_verify_gate.nx source
↩ module page · 98 lines · 6233 B
1// nx_nist_verify_gate.nx -- SOVEREIGN live-page verifier for the NIST STEM scorecard (NO curl/wget). Does a
2// real HTTPS GET of https://nishifamily.com/wiki/nist_stem.html through the Nishi TLS-1.3 client + the real
3// Mozilla CA chain, and asserts: CA store loads, TLS session connects + cert validates, HTTP 200, and the
4// served body carries the regrade markers proving the CODATA external-reference loop is live. This REPLACES
5// the curl fetch-verify -- the operator's law: "we dont want unproven anything; tests reproducible by OUR
6// system." Every step here is a Nishi organ (own TLS, own CA validation, own HTTP parse). GREEN iff 6/6.
7// Durable knowledge/status/nist_verify_gate.log. Cloned from nx_aw_verify_gate (DRY). license_tier: ORIGINAL
8import "nx_syscalls.nx"
9import "nx_x509_trust_store.nx"
10import "nx_trust_store_load_from_certdata.nx"
11import "nx_tls13_client_validate_certificate.nx"
12import "nx_tls13_client_session_run.nx"
13import "nx_https_url_for_fetch.nx"
14import "nx_https_url_connect.nx"
15import "nx_https_get.nx"
16import "nx_https_get_complete.nx"
17import "nx_http_response_parse.nx"
18
19func vg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
20func vg_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
21func vg_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
22func vg_contains(buf: *u8, lo: i64, hi: i64, needle: *u8) -> i64 {
23 let nl: i64=vg_strlen(needle); if nl==0 { return 0 }
24 var i: i64=lo
25 while i+nl<=hi { var j: i64=0; var ok: i64=1; while j<nl { if buf[i+j]!=needle[j] { ok=0; j=nl } else { j=j+1 } } if ok==1 { return 1 } i=i+1 }
26 return 0
27}
28func vg_row(id: i64, ok: i64, what: *u8) -> i64 {
29 vg_w(" R" as *u8); vg_num(id); vg_w(" " as *u8); vg_w(what); vg_w(": " as *u8)
30 if ok==1 { vg_w("YES PASS\n" as *u8) } else { vg_w("NO FAIL\n" as *u8) }
31 return ok
32}
33
34func main() -> i64 {
35 vg_w("=== NIST VERIFY GATE (sovereign HTTPS GET of nishifamily.com/wiki/nist_stem.html, no curl) ===\n" as *u8)
36 var pass: i64=0; let rows: i64=6
37
38 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 300, 4194304)
39 var caok: i64=0; var nca: i64=0
40 if r > 0 { let store0: *TrustStore = r as *TrustStore; nca = trust_store_count(store0); if nca >= 50 { caok=1 } }
41 pass=pass+vg_row(1, caok, "Mozilla CA store loads (>=50 anchors)" as *u8)
42 if caok==0 { vg_w("NIST-VERIFY abort: no CA store\n" as *u8); sys_exit(1); return 1 }
43 let store: *TrustStore = r as *TrustStore
44
45 let url: *u8 = "https://nishifamily.com/wiki/nist_stem.html" as *u8
46 let url_p: *NxUrl = nx_url_new()
47 let target: *NxHttpsTarget = sys_mmap(64) as *NxHttpsTarget
48 target.url = url_p
49 target.port = 0
50 var urlok: i64=0
51 if nx_https_url_for_fetch(url, target) == NX_HTTPS_URL_OK { urlok=1 }
52
53 let fd_p: *i64 = sys_mmap(16) as *i64
54 var conn: i64=0
55 if urlok==1 { if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd_p) == NX_HTTPS_CONNECT_OK { conn=1 } }
56 let fd: i64 = fd_p[0]
57
58 let cr: *u8 = sys_mmap(32); var i: i64=0; while i<32 { cr[i]=(0xC0+i) as u8; i=i+1 }
59 let priv: *u8 = sys_mmap(32); i=0; while i<32 { priv[i]=(0xA0+i) as u8; i=i+1 }
60 let val_ctx: *TlsValidationContext = sys_mmap(64) as *TlsValidationContext
61 val_ctx.store = store
62 val_ctx.sni_host = ((url as i64) + target.url.host_off) as *u8
63 val_ctx.sni_host_len = target.url.host_len
64 val_ctx.now_epoch = sys_now_realtime_sec()
65
66 var sr: i64=0
67 if conn==1 { sr = nx_tls13_client_session_run(fd, ((url as i64)+target.url.host_off) as *u8, target.url.host_len, cr, priv, val_ctx) }
68 pass=pass+vg_row(2, (sr>0) as i64, "TLS-1.3 session connects + cert validates" as *u8)
69
70 var gc: i64=0
71 let buf: *u8 = sys_mmap(262144)
72 if sr>0 {
73 let session: *Tls13ClientSession = sr as *Tls13ClientSession
74 gc = nx_https_get_complete(session, fd, "/wiki/nist_stem.html" as *u8, 20, ((url as i64)+target.url.host_off) as *u8, target.url.host_len, buf, 262144)
75 sys_close(fd)
76 }
77 pass=pass+vg_row(3, (gc>0) as i64, "HTTPS GET returns response bytes" as *u8)
78
79 var status: i64=0; var body_off: i64=0
80 if gc>0 { let pr: *i64 = sys_mmap(128) as *i64; if nx_http_response_parse(buf, gc, pr)==0 { status=pr[1]; body_off=pr[6] } }
81 pass=pass+vg_row(4, (status==200) as i64, "HTTP status 200" as *u8)
82
83 var m1: i64=0; var m2: i64=0
84 if gc>0 { if vg_contains(buf, body_off, gc, "nx_codata_gate 12/12 GREEN" as *u8)==1 { m1=1 } if vg_contains(buf, body_off, gc, "LIVE-VERIFIED vs NIST CODATA-2022" as *u8)==1 { m2=1 } }
85 pass=pass+vg_row(5, m1, "served body proves 'nx_codata_gate 12/12 GREEN'" as *u8)
86 pass=pass+vg_row(6, m2, "served body proves 'LIVE-VERIFIED vs NIST CODATA-2022'" as *u8)
87
88 vg_w("----\nNIST-VERIFY rows=" as *u8); vg_num(rows); vg_w(" pass=" as *u8); vg_num(pass); vg_w(" status=" as *u8); vg_num(status); vg_w(" bytes=" as *u8); vg_num(gc); vg_w("\n" as *u8)
89 let lg: i64=sys_openat_append("knowledge/status/nist_verify_gate.log" as *u8, 0x1a4)
90 if lg>=0 {
91 let line: *u8=sys_mmap(256); var o: i64=0
92 var s: *u8="NIST-VERIFY nist_stem.html pass=" as *u8; var z: i64=0; while s[z]!=(0 as u8){line[o]=s[z];o=o+1;z=z+1}
93 let t: *u8=sys_mmap(28); var mm: i64=pass; var k: i64=0; if mm==0{t[0]=48 as u8;k=1}; while mm>0{t[k]=(48+(mm%10)) as u8;mm=mm/10;k=k+1}; var q: i64=0; while q<k{line[o]=t[k-1-q];o=o+1;q=q+1}
94 if pass==rows { var g: *u8=" verdict=GREEN\n" as *u8; z=0; while g[z]!=(0 as u8){line[o]=g[z];o=o+1;z=z+1} } else { var rr: *u8=" verdict=RED\n" as *u8; z=0; while rr[z]!=(0 as u8){line[o]=rr[z];o=o+1;z=z+1} }
95 sys_write(lg, line, o); sys_close(lg) }
96 if pass==rows { vg_w("NIST-VERIFY GREEN -- nist_stem.html is LIVE and the CODATA loop regrade is served, proven by OUR stack\n" as *u8); sys_exit(0); return 0 }
97 vg_w("NIST-VERIFY RED -- not fully verified live\n" as *u8); sys_exit(1); return 1
98}