nx_site_dispatch_gate.nx source

1// nx_site_dispatch_gate.nx -- PURE gate for the reconciled daemon's data-driven brain. Proves the WHOLE decision 2// the hardcoded cascade made is now a composition of three DATA tables: /gallery is PROXIED (data row), a hub 3// domain is SERVED STATIC from its vhost docroot, an unknown host is 404, the SNI cert is selected per-request 4// (wildcard + ANTI-SPOOF), all with NO hardcoded routes/certs/hosts. GREEN iff T1..T8. 5// Sovereign: nx_site_dispatch + nx_syscalls. license_tier: ORIGINAL 6import "nx_site_dispatch.nx" 7import "nx_syscalls.nx" 8 9func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 10func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 11func g_row(name: *u8, ok: i64) -> i64 { 12 if ok == 1 { g_w(" PASS " as *u8) } else { g_w(" FAIL " as *u8) } 13 g_w(name); g_w("\n" as *u8) 14 return ok 15} 16func g_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 } 17 18const G_RT: *u8 = "nishifamily.com /gallery 18190 stream\nnishifamily.com /torrent 18793 stream\n" as *u8 19const G_CT: *u8 = "nishifamily.com certs/nf.der certs/nf.key\n*.nishifamily.com certs/nfw.der certs/nfw.key\nbradrwest.com certs/brad.der certs/brad.key\njensendwest.com certs/jen.der certs/jen.key\n* certs/def.der certs/def.key\n" as *u8 20const G_VT: *u8 = "bradrwest.com web_assets/sites/bradrwest/index.html\njensendwest.com web_assets/sites/jensendwest/index.html\n" as *u8 21 22func g_disp(sni: *u8, host: *u8, path: *u8, want_o: i64, want_port: i64, want_mode: i64, want_chain: *u8, want_dr: *u8) -> i64 { 23 let pb: *i64 = sys_mmap(8) as *i64; let mb: *i64 = sys_mmap(8) as *i64; pb[0] = 0; mb[0] = 0 24 let cb: *u8 = sys_mmap(512); let kb: *u8 = sys_mmap(512); let dr: *u8 = sys_mmap(2048); cb[0] = 0 as u8; dr[0] = 0 as u8 25 let rtn: i64 = g_len(G_RT); let ctn: i64 = g_len(G_CT); let vtn: i64 = g_len(G_VT) 26 let o: i64 = sd_dispatch(G_RT, rtn, G_CT, ctn, G_VT, vtn, sni, g_len(sni), host, g_len(host), path, g_len(path), pb, mb, cb, kb, dr) 27 if o != want_o { return 0 } 28 if g_streq(cb, want_chain) == 0 { return 0 } 29 if o == SD_PROXY { if pb[0] != want_port { return 0 } if mb[0] != want_mode { return 0 } } 30 if o == SD_STATIC { if g_streq(dr, want_dr) == 0 { return 0 } } 31 return 1 32} 33 34func main() -> i64 { 35 g_w("site-dispatch gate (the reconciled daemon BRAIN: cert+route+vhost = 3 data tables, no hardcoding)\n" as *u8) 36 var pass: i64 = 0 37 38 // ★ T1: /gallery is PROXIED to 18190 (data row) with the nishifamily cert -- the gallery, data-driven 39 pass = pass + g_row("T1 nishifamily.com /gallery -> PROXY 18190 stream + cert nf.der (gallery is DATA)\x00" as *u8, g_disp("nishifamily.com" as *u8, "nishifamily.com" as *u8, "/gallery" as *u8, SD_PROXY, 18190, RT_STREAM, "certs/nf.der" as *u8, "" as *u8)) 40 // T2: a hub domain with no app route -> SERVE STATIC from its vhost docroot + its own cert 41 pass = pass + g_row("T2 bradrwest.com / -> SERVE-STATIC docroot + cert brad.der (the hub site)\x00" as *u8, g_disp("bradrwest.com" as *u8, "bradrwest.com" as *u8, "/" as *u8, SD_STATIC, 0, 0, "certs/brad.der" as *u8, "web_assets/sites/bradrwest/index.html" as *u8)) 42 // T3: unknown host/path -> 404 + the default cert 43 pass = pass + g_row("T3 unknown.com /x -> 404 + default cert (fail-closed)\x00" as *u8, g_disp("unknown.com" as *u8, "unknown.com" as *u8, "/x" as *u8, SD_NOTFOUND, 0, 0, "certs/def.der" as *u8, "" as *u8)) 44 // ★ T4: ANTI-SPOOF -- cert is by SNI; an evil SNI gets the DEFAULT cert even if the Host header says nishifamily 45 pass = pass + g_row("T4 SNI=evilnishifamily.com -> default cert (ANTI-SPOOF, even with Host: nishifamily)\x00" as *u8, g_disp("evilnishifamily.com" as *u8, "nishifamily.com" as *u8, "/gallery" as *u8, SD_PROXY, 18190, RT_STREAM, "certs/def.der" as *u8, "" as *u8)) 46 // T5: /torrent proxied to its own backend+mode 47 pass = pass + g_row("T5 nishifamily.com /torrent -> PROXY 18793 stream\x00" as *u8, g_disp("nishifamily.com" as *u8, "nishifamily.com" as *u8, "/torrent" as *u8, SD_PROXY, 18793, RT_STREAM, "certs/nf.der" as *u8, "" as *u8)) 48 // T6: wildcard SNI cert (www.) selected, route still resolves by Host 49 pass = pass + g_row("T6 SNI=www.nishifamily.com /gallery -> wildcard cert nfw.der + PROXY 18190\x00" as *u8, g_disp("www.nishifamily.com" as *u8, "nishifamily.com" as *u8, "/gallery" as *u8, SD_PROXY, 18190, RT_STREAM, "certs/nfw.der" as *u8, "" as *u8)) 50 // T7: the second hub domain serves its own docroot + cert 51 pass = pass + g_row("T7 jensendwest.com / -> SERVE-STATIC its docroot + cert jen.der\x00" as *u8, g_disp("jensendwest.com" as *u8, "jensendwest.com" as *u8, "/" as *u8, SD_STATIC, 0, 0, "certs/jen.der" as *u8, "web_assets/sites/jensendwest/index.html" as *u8)) 52 // T8: boundary-safe still holds in the full pipe -- /generated is NOT /gen (no /gen row here -> 404) 53 pass = pass + g_row("T8 nishifamily.com /galleryX -> 404 (boundary-safe: /galleryX != /gallery)\x00" as *u8, g_disp("nishifamily.com" as *u8, "nishifamily.com" as *u8, "/galleryX" as *u8, SD_NOTFOUND, 0, 0, "certs/nf.der" as *u8, "" as *u8)) 54 55 if pass == 8 { 56 let lg: i64 = sys_openat_append("knowledge/status/site_dispatch_gate.log" as *u8, 0x1a4) 57 if lg >= 0 { sys_write(lg, "SITE-DISPATCH-GATE pass=8/8 verdict=GREEN\n" as *u8, 41); sys_close(lg) } 58 g_w("SITE-DISPATCH GATE GREEN 8/8 (cert+route+vhost composed; gallery=data, anti-spoof, boundary-safe, fail-closed)\n" as *u8) 59 sys_exit(0) 60 } 61 g_w("SITE-DISPATCH GATE RED\n" as *u8) 62 sys_exit(1) 63 return 1 64}