nx_sni_route_gate.nx source

1// nx_sni_route_gate.nx -- OFFLINE unit gate for the PURE SNI backend-routing decision (sni_backend). 2// Proves the sovereign-edge cutover: ONLY apex nishifamily.com -> :8443 (sovereign sites daemon), and 3// EVERYTHING else (www.nishifamily.com [LE cert has no www SAN], andelinwest, west-family WordPress vhosts, 4// no-SNI/malformed) -> Synology nginx :443 fallback. sni_backend is pure logic: no sockets, no network, no 5// fork -- so this runs safely as a plain unit test. Composes nx_sni_route. license_tier: ORIGINAL expect_exit: 0 6import "nx_syscalls.nx" 7import "nx_sni_route.nx" 8 9func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 10func g_puti(v: i64) -> i64 { let b: *u8=sys_mmap(24); var x: i64=v; if x<0 {b[0]=45;sys_write(1,b,1);x=0-x}; if x==0 {b[0]=48;sys_write(1,b,1);return 0} var d: i64=0; var y: i64=x; while y>0 {d=d+1;y=y/10} var i: i64=d-1; y=x; while i>=0 {b[i]=(48+(y%10)) as u8; y=y/10; i=i-1} sys_write(1,b,d); return 0 } 11 12// copy a null-terminated (already-lowercased) literal into a fresh mmap'd host buffer -- mirrors the `out` 13// buffer that sni_extract lowercases the real SNI into, so we route on a genuine byte buffer, not a literal ptr. 14func mkhost(s: *u8) -> *u8 { let b: *u8=sys_mmap(256); var i: i64=0; while s[i]!=(0 as u8){ b[i]=s[i]; i=i+1 } return b } 15 16// one case: run sni_backend(host,hlen), compare to the expected port, print PASS/FAIL + the returned port. 17// returns 1 on FAIL (so main can sum -> nonzero exit), 0 on PASS. 18func gcase(label: *u8, host: *u8, hlen: i64, expect: i64) -> i64 { 19 let got: i64 = sni_backend(host, hlen) 20 if got == expect { g_puts(" [PASS] " as *u8); g_puts(label); g_puts(" -> " as *u8); g_puti(got); g_puts("\n" as *u8); return 0 } 21 g_puts(" [FAIL] " as *u8); g_puts(label); g_puts(" -> got " as *u8); g_puti(got); g_puts(" (expected " as *u8); g_puti(expect); g_puts(")\n" as *u8); return 1 22} 23 24func main() -> i64 { 25 g_puts("=== nx_sni_route_gate: sovereign-edge SNI backend routing (PURE sni_backend, offline) ===\n" as *u8) 26 var fails: i64 = 0 27 28 // T1: apex nishifamily.com -> 8443 (the ONLY sovereign route) 29 let h1: *u8 = mkhost("nishifamily.com" as *u8) 30 fails = fails + gcase("T1 nishifamily.com (len 15) [sovereign apex]" as *u8, h1, 15, 8443) 31 32 // T2: www.nishifamily.com -> 443 (LE cert has NO www SAN; exact-match must NOT catch it) 33 let h2: *u8 = mkhost("www.nishifamily.com" as *u8) 34 fails = fails + gcase("T2 www.nishifamily.com (len 19) [no www SAN -> nginx]" as *u8, h2, 19, 443) 35 36 // T3: andelinwest.com -> 8443 (sovereign since the 2026-07-02 cutover; nginx's andelinwest 37 // cert lapsed Jun 26 -- sites.elf holds the valid pair) 38 let h3: *u8 = mkhost("andelinwest.com" as *u8) 39 fails = fails + gcase("T3 andelinwest.com (len 15) [sovereign apex]" as *u8, h3, 15, 8443) 40 41 // T4: bradrwest.com -> 443 (west-family stays on nginx) 42 let h4: *u8 = mkhost("bradrwest.com" as *u8) 43 fails = fails + gcase("T4 bradrwest.com (len 13) [west-family -> nginx]" as *u8, h4, 13, 443) 44 45 // T5: empty / no-SNI / malformed ClientHello -> 443 (fall back to nginx; host never dereferenced) 46 let h5: *u8 = sys_mmap(256) 47 fails = fails + gcase("T5 <empty> (len 0) [no-SNI -> nginx]" as *u8, h5, 0, 443) 48 49 // T6/T7: the capability subdomains (operator's global split) -> 8443 via the WHOLE-DOMAIN suffix 50 // match, where sites.elf terminates with the *.andelinwest.com wildcard + proxy_routes host rows. 51 let h6: *u8 = mkhost("admin.andelinwest.com" as *u8) 52 fails = fails + gcase("T6 admin.andelinwest.com (len 21) [capability -> sovereign]" as *u8, h6, 21, 8443) 53 let h7: *u8 = mkhost("mail.andelinwest.com" as *u8) 54 fails = fails + gcase("T7 mail.andelinwest.com (len 20) [capability -> sovereign]" as *u8, h7, 20, 8443) 55 56 // T8 NEG-CONTROL: a suffix-spoof host embedding a routed name must NOT match (label-boundary check). 57 let h8: *u8 = mkhost("admin.andelinwest.com.evil.com" as *u8) 58 fails = fails + gcase("T8 admin.andelinwest.com.evil.com (len 30) [spoof -> nginx]" as *u8, h8, 30, 443) 59 60 // T9: www.andelinwest.com NOW rides the sovereign stack too (whole-domain routing; the wildcard cert 61 // covers it) -- proves the CLASS fix: any andelinwest subdomain works with no per-host rule. 62 let h9: *u8 = mkhost("www.andelinwest.com" as *u8) 63 fails = fails + gcase("T9 www.andelinwest.com (len 19) [whole-domain -> sovereign]" as *u8, h9, 19, 8443) 64 65 // T10 NEG-CONTROL: the look-alike apex evilandelinwest.com must NOT match (byte before suffix != '.') 66 let h10: *u8 = mkhost("evilandelinwest.com" as *u8) 67 fails = fails + gcase("T10 evilandelinwest.com (len 19) [look-alike -> nginx]" as *u8, h10, 19, 443) 68 69 // T11: a nishifamily SUBDOMAIN stays on nginx (its other services live there; only the apex is sovereign) 70 let h11: *u8 = mkhost("chat.nishifamily.com" as *u8) 71 fails = fails + gcase("T11 chat.nishifamily.com (len 20) [other service -> nginx]" as *u8, h11, 20, 443) 72 73 g_puts("\n=== nx_sni_route_gate " as *u8); g_puti(11-fails); g_puts("/11 ===\n" as *u8) 74 // persist the verdict (census-readable; the referee line, not a claim) 75 let lg: i64 = sys_openat_append("knowledge/status/sni_route.log" as *u8, 0x1a4) 76 if lg >= 0 { 77 if fails==0 { let m: *u8 = "SNI-ROUTE rows=11 pass=11 verdict=GREEN\n" as *u8; sys_write(lg, m, 40) } 78 else { let m2: *u8 = "SNI-ROUTE verdict=RED\n" as *u8; sys_write(lg, m2, 22) } 79 sys_close(lg) 80 } 81 if fails==0 { g_puts("SNI-ROUTE-GATE GREEN\n" as *u8); sys_exit(0); return 0 } 82 g_puts("SNI-ROUTE-GATE RED\n" as *u8); sys_exit(1); return 1 83}