nx_recycler_fetch.nx source
↩ module page · 64 lines · 4743 B
1// nx_recycler_fetch.nx -- the NISHI RECYCLER intake (the inverse of the builder: consume OTHER systems' published
2// GARBAGE -- vulnerabilities, bug classes, postmortems -- and recycle it into OUR hardening). This stage MINES real
3// published-bug corpora sovereignly: it fetches famous, real, citable vulnerability pages (Wikipedia = the operator-
4// allowed orientation source) over our OWN TLS-1.3 stack + Mozilla CA store, saving each to knowledge/fetched/
5// recyc_*.raw so every recycled bug EXISTS SEPARATE as a real fetched artifact (rule 4 / benchmarks-exist-separate:
6// we never assert a bug we didn't fetch). Idempotent (rule 10): a source on disk is skipped. The Amazon-Basics move
7// -- mine third-party complaints, address the stated issue, ship better -- applied to vulnerabilities: their CVE is
8// our regression gate. Mirrors the proven nx_connect_research_fetch pattern. expect_exit: 0 license_tier: ORIGINAL
9import "nx_syscalls.nx"
10import "nx_x509_trust_store.nx"
11import "nx_trust_store_load_from_certdata.nx"
12import "nx_https_fetch_follow.nx"
13const K_MAGIC_4194304: i64 = 4194304
14const K_MAGIC_8388608: i64 = 8388608
15
16func gf_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
17func gf_putn(v: i64) -> i64 { if v==0 { sys_write(1,"0" as *u8,1); return 0 } var m: i64=v; if m<0 { sys_write(1,"-" as *u8,1); m=0-m } let d: *u8=sys_mmap(24); var k: i64=0; while m>0 { d[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } var i: i64=k-1; while i>=0 { let o: *u8=sys_mmap(1); o[0]=d[i]; sys_write(1,o,1); i=i-1 } return 0 }
18func have_file(path: *u8) -> i64 { let fd: i64=sys_openat_rd(path); if fd<0 { return 0 } sys_close(fd); return 1 }
19
20func fetch_save(url: *u8, opath: *u8, store: *TrustStore, out: *u8, cap: i64) -> i64 {
21 if have_file(opath)==1 { gf_puts(opath); gf_puts(" [have-skip]\n" as *u8); return 1 }
22 let status: *i64 = sys_mmap(8) as *i64
23 let n: i64 = nx_https_fetch_follow(url, store, out, cap, 6, status)
24 gf_puts(url); gf_puts(" status=" as *u8); gf_putn(status[0]); gf_puts(" bytes=" as *u8); gf_putn(n)
25 if n<=0 { gf_puts(" FETCH-FAIL\n" as *u8); return 0 }
26 var gz: i64=0
27 if n>=2 { if out[0]==0x1f as u8 { if out[1]==0x8b as u8 { gz=1 } } }
28 if gz==1 { gf_puts(" [GZIP-skip]\n" as *u8); return 0 }
29 let fd: i64=sys_openat_wr(opath, 0x1a4)
30 if fd<0 { gf_puts(" SAVE-FAIL\n" as *u8); return 0 }
31 sys_write(fd, out, n); sys_close(fd)
32 gf_puts(" SAVED\n" as *u8)
33 return 1
34}
35
36func main() -> i64 {
37 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, K_MAGIC_4194304)
38 if r<=0 { gf_puts("RECYC: certdata load failed (need data/mozilla_certdata.txt)\n" as *u8); return 1 }
39 let store: *TrustStore = r as *TrustStore
40 gf_puts("CA roots=" as *u8); gf_putn(trust_store_count(store)); gf_puts("\n" as *u8)
41 let cap: i64 = K_MAGIC_8388608
42 let out: *u8 = sys_mmap(cap)
43 var ok: i64 = 0
44
45 gf_puts("== RECYCLER INTAKE: real published vulnerabilities (mine their garbage -> our hardening) ==\n" as *u8)
46 // MEMORY-SAFETY / BOUNDS (buffer over-read) -- does OUR sovereign TLS bounds-check record parsing?
47 ok = ok + fetch_save("https://en.wikipedia.org/wiki/Heartbleed" as *u8, "knowledge/fetched/recyc_heartbleed.raw" as *u8, store, out, cap)
48 ok = ok + fetch_save("https://en.wikipedia.org/wiki/Buffer_over-read" as *u8, "knowledge/fetched/recyc_bufferoverread.raw" as *u8, store, out, cap)
49 // INJECTION / UNTRUSTED-INTERPRETATION (env-var + log lookup -> RCE)
50 ok = ok + fetch_save("https://en.wikipedia.org/wiki/Shellshock_(software_bug)" as *u8, "knowledge/fetched/recyc_shellshock.raw" as *u8, store, out, cap)
51 ok = ok + fetch_save("https://en.wikipedia.org/wiki/Log4Shell" as *u8, "knowledge/fetched/recyc_log4shell.raw" as *u8, store, out, cap)
52 // SUPPLY-CHAIN (dependency fragility / removal)
53 ok = ok + fetch_save("https://en.wikipedia.org/wiki/Npm_left-pad_incident" as *u8, "knowledge/fetched/recyc_leftpad.raw" as *u8, store, out, cap)
54 // CONCURRENCY / RACE (kernel COW race -> privesc)
55 ok = ok + fetch_save("https://en.wikipedia.org/wiki/Dirty_COW" as *u8, "knowledge/fetched/recyc_dirtycow.raw" as *u8, store, out, cap)
56 // SIDE-CHANNEL (speculative execution)
57 ok = ok + fetch_save("https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)" as *u8, "knowledge/fetched/recyc_spectre.raw" as *u8, store, out, cap)
58 // INTEGER OVERFLOW class
59 ok = ok + fetch_save("https://en.wikipedia.org/wiki/Integer_overflow" as *u8, "knowledge/fetched/recyc_intoverflow.raw" as *u8, store, out, cap)
60
61 gf_puts("RECYCLER-INTAKE sources_ok=" as *u8); gf_putn(ok); gf_puts("/8\n" as *u8)
62 if ok>=1 { return 0 }
63 return 1
64}