code wiki / (root) / nx_porkbun_ping_probe.nx
`nx_porkbun_ping_probe.nx` source

↩ module page · 422 lines · 19406 B
1// nx_porkbun_ping_probe.nx -- THROWAWAY DIAGNOSTIC for the Porkbun
2// TLS/HTTP "empty response" failure (nx_porkbun_set_txt).
3//
4// Pinpoints WHERE the round-trip to api.porkbun.com breaks:
5//   PROBE B (root-cause): manual handshake to api.porkbun.com, capture
6//     the server's Certificate handshake message, dump the chain shape
7//     (n_certs, per-cert sig_len/sig_alg/DN, trust-anchor lookup), then
8//     run the EXACT validation the real client runs
9//     (nx_https_cert_pipeline_verify_with_store) and print its sealed
10//     verdict by name.  This says "TLS handshake OK but cert validation
11//     returned NO_TRUST_ANCHOR / CHAIN_SIG_FAIL / LEAF_* / ..." -- the
12//     precise failure point.
13//   PROBE A (end-to-end): full client stack (nx_tls13_client_session_run
14//     + nx_https_post_complete) doing a Porkbun PING POST (read-only;
15//     returns your IP).  Prints session_run's exact stage verdict on
16//     failure, or the HTTP status + body on success.
17//
18// Uses real wall-clock now() + the live Mozilla trust store, matching
19// nx_acme_dns01_issue exactly.  Creds come from the sovereign vault
20// decrypt output /tmp/nxsecret.out (line1=apikey, line2=secretapikey).
21//
22// license_tier: ORIGINAL (throwaway probe; composes shipped primitives)
23
24import "nx_syscalls.nx"
25import "nx_csprng.nx"
26import "nx_url.nx"
27import "nx_https_url_for_fetch.nx"
28import "nx_https_url_connect.nx"
29import "nx_https_post_complete.nx"
30import "nx_tls13.nx"
31import "nx_tls13_record.nx"
32import "nx_tls13_read_record_from_fd.nx"
33import "nx_tls13_client_session.nx"
34import "nx_tls13_client_session_recv_sh.nx"
35import "nx_tls13_client_session_run.nx"
36import "nx_tls13_client_validate_certificate.nx"
37import "nx_tls13_auth.nx"
38import "nx_https_cert_pipeline.nx"
39import "nx_x509.nx"
40import "nx_x509_sig_alg.nx"
41import "nx_x509_trust_store.nx"
42import "nx_trust_store_load_from_certdata.nx"
43import "nx_http_response_parse.nx"
44import "nx_acme_porkbun.nx"
45const K_MAGIC_1024: i64 = 1024
46const K_MAGIC_2048: i64 = 2048
47const K_MAGIC_16645: i64 = 16645
48const K_MAGIC_65536: i64 = 65536
49const K_MAGIC_16384: i64 = 16384
50const K_MAGIC_4194304: i64 = 4194304
51
52// ---- tiny print helpers ----
53func pb_str(fd: i64, s: *u8) -> i64 {
  var n: i64 = 0
  while s[n] != (0 as u8) { n = n + 1 }
  sys_write(fd, s, n)
  return 0
58}
59func pb_dec(fd: i64, v: i64) -> i64 {
  let b: *u8 = sys_mmap(24)
  var x: i64 = v
  if x < 0 { sys_write(fd, "-" as *u8, 1); x = 0 - x }
  var i: i64 = 22
  if x == 0 { b[i] = 0x30 as u8; i = i - 1 }
  else { while x > 0 { b[i] = (0x30 + (x - (x / 10) * 10)) as u8; x = x / 10; i = i - 1 } }
  sys_write(fd, (b as i64 + i + 1) as *u8, 22 - i)
  return 0
68}
69
70// pipeline verdict -> name
71func pb_pipe_name(v: i64) -> *u8 {
  if v == 1 { return "OK" as *u8 }
  if v == 2 { return "CERT_MSG_BAD" as *u8 }
  if v == 3 { return "CERT_PARSE_FAIL" as *u8 }
  if v == 4 { return "LEAF_NOT_YET_VALID" as *u8 }
  if v == 5 { return "LEAF_EXPIRED" as *u8 }
  if v == 6 { return "LEAF_NO_SAN" as *u8 }
  if v == 7 { return "HOSTNAME_MISMATCH" as *u8 }
  if v == 8 { return "LEAF_OTHER" as *u8 }
  if v == 9 { return "CHAIN_DN_MISMATCH" as *u8 }
  if v == 10 { return "CHAIN_SIG_FAIL" as *u8 }
  if v == 11 { return "CHAIN_OTHER" as *u8 }
  if v == 12 { return "NO_TRUST_ANCHOR" as *u8 }
  return "??" as *u8
85}
86// session_run negative -> stage name (pass the positive magnitude)
87func pb_run_name(v: i64) -> *u8 {
  if v == 2 { return "EMIT_CH_FAIL" as *u8 }
  if v == 3 { return "WRITE_CH_FAIL" as *u8 }
  if v == 4 { return "READ_SH_FAIL" as *u8 }
  if v == 5 { return "RECV_SH_FAIL" as *u8 }
  if v == 6 { return "READ_HS_FAIL" as *u8 }
  if v == 7 { return "RECV_HS_FAIL (cert-validate or record-decrypt)" as *u8 }
  if v == 8 { return "EMIT_CF_FAIL" as *u8 }
  if v == 9 { return "WRITE_CF_FAIL" as *u8 }
  if v == 10 { return "DERIVE_APP_FAIL" as *u8 }
  if v == 11 { return "LOOP_BUDGET_EXCEEDED" as *u8 }
  return "??" as *u8
99}
100func pb_found(a: *TrustAnchor) -> i64 {
  if (a as i64) != 0 { return 1 }
  return 0
103}
104// is a full Finished (handshake type 20) message present in the stream?
105func pb_hs_complete(m: *u8, mlen: i64) -> i64 {
  var off: i64 = 0
  while off + 4 <= mlen {
      let ty: i64 = m[off] & 0xff
      let bl: i64 = ((m[off + 1] & 0xff) << 16) | ((m[off + 2] & 0xff) << 8) | (m[off + 3] & 0xff)
      let ml: i64 = 4 + bl
      if off + ml > mlen { return 0 }
      if ty == 20 { return 1 }
      off = off + ml
  }
  return 0
116}
117
118func pb_hex(fd: i64, buf: *u8, n: i64) -> i64 {
  let hexd: *u8 = "0123456789abcdef" as *u8
  let out: *u8 = sys_mmap(4)
  out[1] = 0x20 as u8
  var i: i64 = 0
  while i < n {
      let b: i64 = buf[i] & 0xff
      out[0] = hexd[(b >> 4) & 0xf]
      sys_write(fd, out, 1)
      out[0] = hexd[b & 0xf]
      sys_write(fd, out, 2)
      i = i + 1
      if (i % 16) == 0 { sys_write(fd, "\n" as *u8, 1) }
  }
  sys_write(fd, "\n" as *u8, 1)
  return 0
134}
135// 32-byte HelloRetryRequest magic random (SHA-256 of "HelloRetryRequest", RFC 8446 4.1.3)
136func pb_is_hrr(rnd: *u8) -> i64 {
  let magic: *u8 = sys_mmap(32)
  magic[0]=0xcf as u8; magic[1]=0x21 as u8; magic[2]=0xad as u8; magic[3]=0x74 as u8
  magic[4]=0xe5 as u8; magic[5]=0x9a as u8; magic[6]=0x61 as u8; magic[7]=0x11 as u8
  magic[8]=0xbe as u8; magic[9]=0x1d as u8; magic[10]=0x8c as u8; magic[11]=0x02 as u8
  magic[12]=0x1e as u8; magic[13]=0x65 as u8; magic[14]=0xb8 as u8; magic[15]=0x91 as u8
  magic[16]=0xc2 as u8; magic[17]=0xa2 as u8; magic[18]=0x11 as u8; magic[19]=0x16 as u8
  magic[20]=0x7a as u8; magic[21]=0xbb as u8; magic[22]=0x8c as u8; magic[23]=0x5e as u8
  magic[24]=0x07 as u8; magic[25]=0x9e as u8; magic[26]=0x09 as u8; magic[27]=0xe2 as u8
  magic[28]=0xc8 as u8; magic[29]=0xa8 as u8; magic[30]=0x33 as u8; magic[31]=0x9c as u8
  var i: i64 = 0
  while i < 32 { if (rnd[i] & 0xff) != (magic[i] & 0xff) { return 0 } i = i + 1 }
  return 1
149}
150
151func pb_write_all(fd: i64, buf: *u8, n: i64) -> i64 {
  var off: i64 = 0
  while off < n {
      let w: i64 = sys_write(fd, (buf as i64 + off) as *u8, n - off)
      if w <= 0 { return 0 - 1 }
      off = off + w
  }
  return 0
159}
160
161// dump the captured cert chain + trust-anchor lookup diagnostics
162func pb_dump_chain(cert_msg: *u8, cert_msg_len: i64, store: *TrustStore) -> i64 {
  let offs: *i64 = sys_mmap(64) as *i64
  let lens: *i64 = sys_mmap(64) as *i64
  let np: *i64 = sys_mmap(16) as *i64
  let pv: i64 = tls13_parse_certificate_chain_all(cert_msg, cert_msg_len, offs, lens, np, 8)
  if pv != NX_TLS13_AUTH_VERDICT_OK {
      pb_str(1, "[B]   chain-parse verdict="); pb_dec(1, pv); pb_str(1, "\n"); return 1
  }
  let n: i64 = *np
  pb_str(1, "[B]   n_certs="); pb_dec(1, n); pb_str(1, "\n")
  var i: i64 = 0
  while i < n {
      let cbuf: *u8 = (cert_msg as i64 + offs[i]) as *u8
      let c_raw: *u8 = sys_mmap(256)
      let c: *X509Cert = c_raw as *X509Cert
      let rc: i64 = x509_parse(cbuf, lens[i], c)
      pb_str(1, "[B]   cert["); pb_dec(1, i); pb_str(1, "] der_len="); pb_dec(1, lens[i])
      if rc < 0 { pb_str(1, "  PARSE FAIL rc="); pb_dec(1, rc); pb_str(1, "\n") }
      else {
          let sa: i64 = nx_x509_sig_alg_identify(cbuf, c.sig_alg_off, c.sig_alg_len)
          pb_str(1, "  sig_len="); pb_dec(1, c.sig_len)
          pb_str(1, "  sig_alg#="); pb_dec(1, sa)
          pb_str(1, "  subj_len="); pb_dec(1, c.subject_len)
          pb_str(1, "  iss_len="); pb_dec(1, c.issuer_len)
          let instore: *TrustAnchor = trust_store_lookup_by_subject(store, cbuf, c.subject_off, c.subject_len)
          pb_str(1, "  subj_in_store="); pb_dec(1, pb_found(instore))
          pb_str(1, "\n")
      }
      i = i + 1
  }
  // trust-anchor resolution on the LAST presented cert (what the pipeline keys on)
  let lbuf: *u8 = (cert_msg as i64 + offs[n - 1]) as *u8
  let lc_raw: *u8 = sys_mmap(256)
  let lc: *X509Cert = lc_raw as *X509Cert
  if x509_parse(lbuf, lens[n - 1], lc) >= 0 {
      let by_iss: *TrustAnchor = trust_store_lookup_by_subject(store, lbuf, lc.issuer_off, lc.issuer_len)
      let by_sub: *TrustAnchor = trust_store_lookup_by_subject(store, lbuf, lc.subject_off, lc.subject_len)
      pb_str(1, "[B]   last-cert issuer_in_store="); pb_dec(1, pb_found(by_iss))
      pb_str(1, " (CaseB root-omitted)   subject_in_store="); pb_dec(1, pb_found(by_sub))
      pb_str(1, " (CaseA root-included)\n")
  }
  return 0
204}
205
206// ============ PROBE B: capture Porkbun's cert chain + validate ============
207func pb_probe_cert(store: *TrustStore, now: i64) -> i64 {
  pb_str(1, "=== PROBE B: capture api.porkbun.com cert chain + validate ===\n")
  let host: *u8 = "api.porkbun.com" as *u8
  let host_len: i64 = 15
  let url: *u8 = "https://api.porkbun.com/api/json/v3/ping\x00" as *u8
  let url_p: *NxUrl = nx_url_new()
  let target_raw: *u8 = sys_mmap(32)
  let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
  target.url = url_p
  target.port = 0
  if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { pb_str(2, "[B] url FAIL\n"); return 1 }
  let fd_p: *i64 = sys_mmap(16) as *i64
  let cv: i64 = nx_https_url_connect(target, url, now, fd_p)
  if cv != NX_HTTPS_CONNECT_OK { pb_str(2, "[B] TCP connect FAIL v="); pb_dec(2, cv); pb_str(2, "\n"); return 1 }
  let fd: i64 = *fd_p
  pb_str(1, "[B] TCP connected.\n")
223
  let cr: *u8 = sys_mmap(32)
  let priv: *u8 = sys_mmap(32)
  nx_csprng_fill(cr, 32)
  nx_csprng_fill(priv, 32)
  let s: *Tls13ClientSession = nx_tls13_client_session_new(cr, priv)
  let ch_buf: *u8 = sys_mmap(K_MAGIC_1024)
  let ch_n: i64 = nx_tls13_client_session_emit_ch(s, host, host_len, ch_buf, K_MAGIC_1024)
  if ch_n < 0 { pb_str(2, "[B] emit_ch FAIL\n"); sys_close(fd); return 1 }
  let ch_rec: *u8 = sys_mmap(K_MAGIC_2048)
  ch_rec[0] = (NX_TLS13_CT_HANDSHAKE & 0xff) as u8
  ch_rec[1] = 0x03 as u8
  ch_rec[2] = 0x01 as u8
  ch_rec[3] = ((ch_n >> 8) & 0xff) as u8
  ch_rec[4] = (ch_n & 0xff) as u8
  var ci: i64 = 0
  while ci < ch_n { ch_rec[5 + ci] = ch_buf[ci]; ci = ci + 1 }
  if pb_write_all(fd, ch_rec, 5 + ch_n) < 0 { pb_str(2, "[B] write CH FAIL\n"); sys_close(fd); return 1 }
241
  let sh_rec: *u8 = sys_mmap(K_MAGIC_16645)
  let sh_total: i64 = nx_tls13_read_record_from_fd(fd, sh_rec, K_MAGIC_16645)
  if sh_total < 0 { pb_str(2, "[B] read SH FAIL ret="); pb_dec(2, sh_total); pb_str(2, "\n"); sys_close(fd); return 1 }
  // ---- DIAGNOSTIC: dump the first server record ----
  pb_str(1, "[B] first server record: outer_type="); pb_dec(1, sh_rec[0] & 0xff)
  pb_str(1, " total_len="); pb_dec(1, sh_total)
  if sh_total >= 6 { pb_str(1, " hs_type="); pb_dec(1, sh_rec[5] & 0xff) }
  pb_str(1, "\n")
  var dn: i64 = sh_total
  if dn > 96 { dn = 96 }
  pb_str(1, "[B] record bytes[0.."); pb_dec(1, dn); pb_str(1, "]:\n")
  pb_hex(1, sh_rec, dn)
  // ServerHello random sits at record offset 11 (5 rec-hdr + 4 hs-hdr + 2 legacy_version)
  if sh_total >= 43 {
      if (sh_rec[5] & 0xff) == 2 {
          let is_hrr: i64 = pb_is_hrr((sh_rec as i64 + 11) as *u8)
          pb_str(1, "[B] is_HelloRetryRequest="); pb_dec(1, is_hrr); pb_str(1, "\n")
          // chosen cipher suite is at: 11 + 32 (random) + 1 + session_id_len
          let sidlen: i64 = sh_rec[43] & 0xff
          let csoff: i64 = 44 + sidlen
          if csoff + 1 < sh_total {
              let cs: i64 = ((sh_rec[csoff] & 0xff) << 8) | (sh_rec[csoff + 1] & 0xff)
              pb_str(1, "[B] server-chosen cipher_suite=0x"); pb_dec(1, cs)
              pb_str(1, " (1301=AES128GCM 1302=AES256GCM-SHA384 1303=ChaCha20)\n")
          }
      }
  }
  let rs: i64 = nx_tls13_client_session_recv_sh(s, (sh_rec as i64 + 5) as *u8, sh_total - 5)
  if rs != NX_TLS13_RECV_SH_OK {
      pb_str(1, "[B] recv_sh verdict="); pb_dec(1, rs)
      pb_str(1, " (3=BAD_FORMAT 4=NO_KEYSHARE 5=BAD_GROUP 6=BAD_KS_LEN 8=BAD_CIPHER)\n")
      sys_close(fd); return 1
  }
  pb_str(1, "[B] ServerHello OK; negotiated cipher_suite#="); pb_dec(1, s.cipher_suite); pb_str(1, "\n")
276
  // accumulate encrypted handshake plaintext until the server Finished arrives
  let master: *u8 = sys_mmap(K_MAGIC_65536)
  var mlen: i64 = 0
  var recs: i64 = 0
  var done: i64 = 0
  while done == 0 {
      if recs >= 8 { break }
      let rec: *u8 = sys_mmap(K_MAGIC_16645)
      let rt: i64 = nx_tls13_read_record_from_fd(fd, rec, K_MAGIC_16645)
      if rt < 0 { pb_str(1, "[B] (read returned "); pb_dec(1, rt); pb_str(1, ", stopping)\n"); break }
      recs = recs + 1
      if (rec[0] & 0xff) == NX_TLS13_CT_CHANGE_CIPHER_SPEC { continue }
      let ctlen: i64 = rt - 5 - 16
      if ctlen < 1 { continue }
      let inner: *u8 = sys_mmap(ctlen + 32)
      let rct: *i64 = sys_mmap(16) as *i64
      let rln: *i64 = sys_mmap(16) as *i64
      let dv: i64 = nx_tls13_record_decrypt_v2(s.cipher_suite, s.server_hs_traffic_key, s.server_hs_iv,
                                               s.server_seq, rec, (rec as i64 + 5) as *u8, ctlen,
                                               (rec as i64 + rt - 16) as *u8, inner, rct, rln)
      s.server_seq = s.server_seq + 1
      if dv != NX_TLS13_REC_VERDICT_OK { pb_str(2, "[B] hs record decrypt FAIL v="); pb_dec(2, dv); pb_str(2, "\n"); break }
      if *rct != NX_TLS13_CT_HANDSHAKE { continue }
      var k: i64 = 0
      while k < *rln { master[mlen + k] = inner[k]; k = k + 1 }
      mlen = mlen + *rln
      if pb_hs_complete(master, mlen) == 1 { done = 1 }
  }
  sys_close(fd)
  pb_str(1, "[B] captured handshake bytes="); pb_dec(1, mlen); pb_str(1, " over records="); pb_dec(1, recs); pb_str(1, "\n")
307
  // locate the Certificate message (handshake type 11)
  var off: i64 = 0
  var cert_off: i64 = 0 - 1
  var cert_len: i64 = 0
  while off + 4 <= mlen {
      let ty: i64 = master[off] & 0xff
      let bl: i64 = ((master[off + 1] & 0xff) << 16) | ((master[off + 2] & 0xff) << 8) | (master[off + 3] & 0xff)
      let ml: i64 = 4 + bl
      if ty == 11 { cert_off = off; cert_len = ml; off = mlen }
      else { off = off + ml }
  }
  if cert_off < 0 { pb_str(2, "[B] NO Certificate (type 11) message captured\n"); return 1 }
  let cert_msg: *u8 = (master as i64 + cert_off) as *u8
  pb_str(1, "[B] Certificate msg captured len="); pb_dec(1, cert_len); pb_str(1, "\n")
322
  pb_dump_chain(cert_msg, cert_len, store)
324
  // THE decisive call: exactly what the real TLS client runs at WAIT_CERT.
  pb_str(1, "[B] running nx_https_cert_pipeline_verify_with_store (per-link timing -> stderr)...\n")
  let verdict: i64 = nx_https_cert_pipeline_verify_with_store(cert_msg, cert_len, host, host_len, now, store)
  pb_str(1, "[B] >>> VALIDATION VERDICT = "); pb_dec(1, verdict); pb_str(1, "  ("); pb_str(1, pb_pipe_name(verdict)); pb_str(1, ")\n")
  return 0
330}
331
332// ============ PROBE A: full stack end-to-end Porkbun PING ============
333func pb_probe_e2e(store: *TrustStore, now: i64, ak: *u8, akn: i64, sk: *u8, skn: i64) -> i64 {
  pb_str(1, "=== PROBE A: end-to-end Porkbun PING via full client stack ===\n")
  let url: *u8 = "https://api.porkbun.com/api/json/v3/ping\x00" as *u8
  let url_p: *NxUrl = nx_url_new()
  let target_raw: *u8 = sys_mmap(32)
  let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
  target.url = url_p
  target.port = 0
  if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { pb_str(2, "[A] url FAIL\n"); return 1 }
  let host: *u8 = url + target.url.host_off
  let host_len: i64 = target.url.host_len
  let fd_p: *i64 = sys_mmap(16) as *i64
  let cv: i64 = nx_https_url_connect(target, url, now, fd_p)
  if cv != NX_HTTPS_CONNECT_OK { pb_str(2, "[A] TCP connect FAIL v="); pb_dec(2, cv); pb_str(2, "\n"); return 1 }
  let fd: i64 = *fd_p
  pb_str(1, "[A] TCP connected.\n")
349
  let cr: *u8 = sys_mmap(32)
  let priv: *u8 = sys_mmap(32)
  nx_csprng_fill(cr, 32)
  nx_csprng_fill(priv, 32)
  let vc_raw: *u8 = sys_mmap(64)
  let vc: *TlsValidationContext = vc_raw as *TlsValidationContext
  vc.store = store
  vc.sni_host = host
  vc.sni_host_len = host_len
  vc.now_epoch = now
  let sr: i64 = nx_tls13_client_session_run(fd, host, host_len, cr, priv, vc)
  if sr <= 0 {
      pb_str(1, "[A] *** session_run FAILED *** ret="); pb_dec(1, sr)
      pb_str(1, "  stage="); pb_str(1, pb_run_name(0 - sr)); pb_str(1, "\n")
      sys_close(fd); return 1
  }
  pb_str(1, "[A] TLS handshake + cert validation OK.\n")
  let session: *Tls13ClientSession = sr as *Tls13ClientSession
368
  let body: *u8 = sys_mmap(K_MAGIC_1024)
  var bo: i64 = pk_creds(body, 0, ak, akn, sk, skn)
  bo = pk_put(body, bo, "}" as *u8)
  let resp: *u8 = sys_mmap(K_MAGIC_16384)
  let total: i64 = nx_https_post_complete(session, fd,
                                          url + target.url.path_off, target.url.path_len,
                                          host, host_len,
                                          "application/json" as *u8, 16,
                                          body, bo, resp, K_MAGIC_16384)
  sys_close(fd)
  if total < 0 { pb_str(1, "[A] POST FAILED ret="); pb_dec(1, total); pb_str(1, "\n"); return 1 }
  pb_str(1, "[A] response bytes="); pb_dec(1, total); pb_str(1, "\n")
  let r: *i64 = nx_http_resp_alloc()
  if nx_http_response_parse(resp, total, r) == 0 {
      pb_str(1, "[A] HTTP status="); pb_dec(1, r[1]); pb_str(1, "\n")
      pb_str(1, "[A] body: "); sys_write(1, resp + r[6], total - r[6]); pb_str(1, "\n")
  } else {
      pb_str(1, "[A] raw response: "); sys_write(1, resp, total); pb_str(1, "\n")
  }
  return 0
389}
390
391func main() -> i64 {
  let cdpath: *u8 = "data/mozilla_certdata.txt\x00" as *u8
  let lr: i64 = nx_trust_store_load_from_certdata(cdpath, 300, K_MAGIC_4194304)
  if lr <= 0 { pb_str(2, "trust load FAIL ret="); pb_dec(2, lr); pb_str(2, "\n"); return 1 }
  let store: *TrustStore = lr as *TrustStore
  pb_str(1, "trust store loaded; anchors="); pb_dec(1, trust_store_count(store)); pb_str(1, "\n")
  let now: i64 = sys_now_realtime_sec()
  pb_str(1, "now(real epoch)="); pb_dec(1, now); pb_str(1, "\n")
399
  let raw: *u8 = sys_mmap(K_MAGIC_2048)
  let rawn: i64 = pk_readline_file("/tmp/nxsecret.out\x00" as *u8, raw, K_MAGIC_2048)
  if rawn <= 0 { pb_str(2, "creds read FAIL (/tmp/nxsecret.out)\n"); return 2 }
  var nl: i64 = 0
  while nl < rawn { if raw[nl] == 0x0a { break } nl = nl + 1 }
  let ak: *u8 = raw
  var akn: i64 = nl
  let s2: i64 = nl + 1
  var nl2: i64 = s2
  while nl2 < rawn { if raw[nl2] == 0x0a { break } nl2 = nl2 + 1 }
  let sk: *u8 = raw + s2
  var skn: i64 = nl2 - s2
  if akn > 0 { if raw[akn - 1] == 0x0d { akn = akn - 1 } }
  if skn > 0 { if sk[skn - 1] == 0x0d { skn = skn - 1 } }
  if akn <= 0 { pb_str(2, "apikey empty (line1)\n"); return 2 }
  if skn <= 0 { pb_str(2, "secretapikey empty (line2)\n"); return 2 }
  pb_str(1, "creds loaded: apikey_len="); pb_dec(1, akn); pb_str(1, " secret_len="); pb_dec(1, skn); pb_str(1, "\n\n")
417
  pb_probe_cert(store, now)
  pb_str(1, "\n")
  pb_probe_e2e(store, now, ak, akn, sk, skn)
  return 0
422}
nx_porkbun_ping_probe.nx source

`nx_porkbun_ping_probe.nx` source
