nx_stun_server_gate.nx source
↩ module page · 131 lines · 6937 B
1// nx_stun_server_gate.nx -- proves the sovereign STUN reflexive responder two ways:
2// PART A (pure): ss_handle reflects a request's source sockaddr into a valid Binding Response whose
3// XOR-MAPPED-ADDRESS decodes back to that source IP:port, with the txid preserved and a self-consistent
4// FINGERPRINT; a non-STUN packet is ignored (returns 0).
5// PART B (LIVE, real UDP sockets): a fork loopback -- child = the server, parent = a client bound to a
6// KNOWN port -- proves end-to-end that a client sending a real Binding Request LEARNS ITS OWN REFLEXIVE
7// ADDRESS (127.0.0.1:<client port>) back from the server. This is srflx discovery working, sovereignly.
8// license_tier: ORIGINAL expect_exit: 0
9import "nx_syscalls.nx"
10import "nx_stun_server.nx"
11
12func gw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
13func gn(v: i64) -> i64 {
14 let b: *u8=sys_mmap(28); var m: i64=v; if m<0 {sys_write(1,"-" as *u8,1); m=0-m}
15 let t: *u8=sys_mmap(28); var k: i64=0; if m==0 {t[0]=48 as u8;k=1} while m>0 {t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}
16 var i: i64=0; while i<k {b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0
17}
18func gck(pass: i64, name: *u8, fails: *i64) -> i64 {
19 if pass==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8); fails[0]=fails[0]+1 }
20 gw(name); gw("\n" as *u8); return 0
21}
22
23const SGT_SPORT: i64 = 53218 // server loopback port for the live proof
24const SGT_CPORT: i64 = 53219 // client loopback port (its known source port)
25
26func main() -> i64 {
27 let fails: *i64 = sys_mmap(16) as *i64
28 fails[0]=0
29 gw("=== nx_stun_server_gate -- sovereign reflexive responder (pure + live UDP round-trip) ===\n" as *u8)
30
31 // ---- PART A: pure ss_handle ----
32 let txid: *u8 = sys_mmap(16)
33 var ti: i64=0
34 while ti<12 { txid[ti]=(0xc0+ti) as u8; ti=ti+1 }
35 let req: *u8 = sys_mmap(64)
36 st_write_header(req, STUN_BINDING_REQUEST, 0, txid) // a bare Binding Request (20 bytes)
37 let src: *u8 = sys_mmap(16)
38 ss_sockaddr(src, SGT_CPORT, 203, 0, 113, 7) // synthetic source 203.0.113.7:53219
39 let out: *u8 = sys_mmap(64)
40 let rn: i64 = ss_handle(req, 20, src, out)
41
42 var t1: i64=1
43 if rn != 40 { t1=0 } // header 20 + XMA 12 + FINGERPRINT 8
44 if st_type(out) != STUN_BINDING_RESPONSE { t1=0 }
45 if st_magic(out) != STUN_MAGIC { t1=0 }
46 gck(t1, "A1 ss_handle: a Binding Request yields a 40-byte Binding Response" as *u8, fails)
47
48 // XMA value at offset 24 (header 20 + attr type/len 4) decodes to the source addr:port
49 var t2: i64=1
50 let xma: *u8 = (out as i64 + 24) as *u8
51 if st_xma_port(xma) != SGT_CPORT { t2=0 }
52 if st_xma_addr(xma) != 0xCB007107 { t2=0 } // 203.0.113.7
53 gw(" [measure] reflected = " as *u8)
54 let a: i64 = st_xma_addr(xma)
55 gn((a>>24)&0xff); gw("." as *u8); gn((a>>16)&0xff); gw("." as *u8); gn((a>>8)&0xff); gw("." as *u8); gn(a&0xff); gw(":" as *u8); gn(st_xma_port(xma)); gw("\n" as *u8)
56 gck(t2, "A2 XOR-MAPPED-ADDRESS reflects the source 203.0.113.7:53219 exactly" as *u8, fails)
57
58 var t3: i64=1
59 var tq: i64=0
60 while tq<12 { if out[8+tq]!=txid[tq] { t3=0 } tq=tq+1 }
61 gck(t3, "A3 transaction id preserved in the response" as *u8, fails)
62
63 var t4: i64=1
64 if st_fingerprint(out, 32) != st_get32(out, 36) { t4=0 } // FP over first 32 bytes == stored value
65 gck(t4, "A4 response FINGERPRINT is self-consistent (CRC-32)" as *u8, fails)
66
67 var t5: i64=1
68 let junk: *u8 = sys_mmap(32)
69 var ji: i64=0
70 while ji<20 { junk[ji]=(0x55) as u8; ji=ji+1 } // wrong type + wrong magic
71 if ss_handle(junk, 20, src, out) != 0 { t5=0 }
72 if ss_handle(req, 8, src, out) != 0 { t5=0 } // too short
73 gck(t5, "A5 NEG-CONTROL: a non-STUN / too-short packet is ignored (returns 0)" as *u8, fails)
74
75 // ---- PART B: LIVE UDP round-trip (fork loopback; bind server BEFORE fork -- proven no-race pattern) ----
76 var t6: i64=1
77 let ssa: *u8 = sys_mmap(16)
78 ss_sockaddr(ssa, SGT_SPORT, 127, 0, 0, 1)
79 let sfd: i64 = sys_socket(AF_INET, SOCK_DGRAM, 0)
80 var bound: i64=0
81 if sfd>=0 { sys_set_socket_timeout(sfd, 2); if sys_bind(sfd, ssa, 16)>=0 { bound=1 } }
82 if bound==0 { gck(0, "B live bind server 127.0.0.1:53218" as *u8, fails) } else {
83 let pid: i64 = sys_fork()
84 if pid==0 {
85 // CHILD = the STUN server: one recvfrom -> ss_handle -> sendto the source.
86 let rb: *u8 = sys_mmap(2048)
87 let rout: *u8 = sys_mmap(2048)
88 let csrc: *u8 = sys_mmap(16)
89 let cslen: *i64 = sys_mmap(16) as *i64; cslen[0]=16
90 let cn: i64 = sys_recvfrom(sfd, rb, 2048, 0, csrc, cslen)
91 if cn>0 { let rrn: i64 = ss_handle(rb, cn, csrc, rout); if rrn>0 { sys_sendto(sfd, rout, rrn, 0, csrc, cslen[0]) } }
92 sys_close(sfd)
93 sys_exit(0)
94 }
95 // PARENT = the client bound to a KNOWN port so its reflexive address is verifiable.
96 let cfd: i64 = sys_socket(AF_INET, SOCK_DGRAM, 0)
97 sys_set_socket_timeout(cfd, 2)
98 let csa: *u8 = sys_mmap(16); ss_sockaddr(csa, SGT_CPORT, 127, 0, 0, 1)
99 sys_bind(cfd, csa, 16)
100 let ctxid: *u8 = sys_mmap(16)
101 var xi: i64=0
102 while xi<12 { ctxid[xi]=(0x11+xi) as u8; xi=xi+1 }
103 let creq: *u8 = sys_mmap(64)
104 st_write_header(creq, STUN_BINDING_REQUEST, 0, ctxid)
105 let dest: *u8 = sys_mmap(16); ss_sockaddr(dest, SGT_SPORT, 127, 0, 0, 1)
106 sys_sendto(cfd, creq, 20, 0, dest, 16)
107 let resp: *u8 = sys_mmap(2048)
108 let n2: i64 = sys_recvfrom(cfd, resp, 2048, 0, 0 as *u8, 0 as *i64)
109 let st: *i64 = sys_mmap(16) as *i64
110 sys_wait4(pid, st, 0)
111 sys_close(cfd)
112 // the server's response must reflect our OWN loopback address:port
113 if n2 != 40 { t6=0 }
114 if st_type(resp) != STUN_BINDING_RESPONSE { t6=0 }
115 let rxma: *u8 = (resp as i64 + 24) as *u8
116 if st_xma_port(rxma) != SGT_CPORT { t6=0 }
117 if st_xma_addr(rxma) != 0x7F000001 { t6=0 } // 127.0.0.1
118 var tq2: i64=0
119 while tq2<12 { if resp[8+tq2]!=ctxid[tq2] { t6=0 } tq2=tq2+1 }
120 gw(" [measure] LIVE client learned reflexive = " as *u8)
121 let la: i64 = st_xma_addr(rxma)
122 gn((la>>24)&0xff); gw("." as *u8); gn((la>>16)&0xff); gw("." as *u8); gn((la>>8)&0xff); gw("." as *u8); gn(la&0xff); gw(":" as *u8); gn(st_xma_port(rxma)); gw("\n" as *u8)
123 gck(t6, "B6 LIVE UDP: client learns its own reflexive address 127.0.0.1:53219 from the server" as *u8, fails)
124 }
125
126 gw(" fails=" as *u8); gn(fails[0]); gw("\n" as *u8)
127 if fails[0]==0 { gw("VERDICT: verdict=GREEN (sovereign STUN server reflects srflx addresses, proven over real UDP)\n" as *u8); sys_exit(0) }
128 gw("VERDICT: verdict=RED\n" as *u8)
129 sys_exit(1)
130 return 1
131}