`nx_tls12_req.nx` source

↩ module page · 537 lines · 33784 B
1// nx_tls12_req.nx -- REUSABLE sovereign TLS-1.2 HTTPS request (ECDHE-RSA-AES128-GCM-SHA256). LIBRARY (no main):
2// one call t12_request(full_url, method, token, body, ...) does connect -> ECDHE-RSA handshake -> encrypted request
3// -> incremental-decrypt response, returning the plaintext HTTP response (headers+body). This is what gets nx_gpu_ctl
4// (and Porkbun) off curl: console.vast.ai + Porkbun are TLS-1.2-only while the shipped stack is 1.3-only. Composes
5// the shipped crypto primitives (p256_ecdh_*, hmac_sha256 PRF, nx_aes128_gcm_seal/open, sha256_digest). SILENT: no
6// stdout chatter, so a caller gets clean response bytes. Proven end-to-end (authenticated account GET) 2026-07-14.
7// NOTE(security): cert-chain + ServerKeyExchange-signature validation NOT yet wired -- confidential but not yet
8// MITM-authenticated; harden before trusting for adversarial networks. license_tier: ORIGINAL
9import "nx_syscalls.nx"
10import "nx_csprng.nx"
11import "nx_https_url_for_fetch.nx"
12import "nx_https_url_connect.nx"
13import "nx_sha256.nx"
14import "nx_p256_ecdh.nx"
15import "nx_hmac.nx"                          // was hmac.nx: SAME hmac_sha256 signature but the LEGACY family (syscalls.nx + sha256.nx).
16// Importing it alongside the nx_ family gave DUPLICATE hmac_sha256 the moment nx_https_fetch_follow
17// started importing this file, breaking every organ whose closure held both. This organ already
18// imports nx_sha256.nx, so the legacy pull-in was redundant as well as harmful.
19import "nx_aes128_gcm.nx"
20import "nx_trust_store_load_from_certdata.nx"   // trust store loader
21import "nx_https_cert_pipeline.nx"              // chain + hostname + validity verify (+ NX_HTTPS_PIPELINE_OK, x509_parse, X509Cert)
22import "nx_x509_pubkey_rsa.nx"                  // leaf RSA pubkey extract (2048)
23import "nx_x509_pubkey_rsa_4096.nx"             // leaf RSA pubkey extract (4096/3072)
24import "nx_x509_verify_rsa_pkcs1_sha256.nx"     // generic RSA-PKCS1-SHA256 verify -- used on the SKE signature
25import "nx_x509_verify_rsa_pkcs1_sha256_4096.nx"
26import "nx_u2048.nx"
27import "nx_u4096.nx"
28const TR_MAGIC_2048: i64 = 2048
29const TR_MAGIC_4096: i64 = 4096
30const TR_MAGIC_3072: i64 = 3072
31const TR_MAGIC_1024: i64 = 1024
32const TR_MAGIC_16384: i64 = 16384
33const TR_MAGIC_65536: i64 = 65536
34const TR_MAGIC_32768: i64 = 32768
35const TR_MAGIC_4194304: i64 = 4194304
36const TR_MAGIC_40960: i64 = 40960
37const TR_MAGIC_8192: i64 = 8192
38const TR_MAGIC_8300: i64 = 8300
39const TR_MAGIC_262144: i64 = 262144
40
41const TR_HS: i64 = 22
42const TR_CCS: i64 = 20
43const TR_ALERT: i64 = 21
44
45func tr_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
46func tr_b1(d: *u8, o: i64, v: i64) -> i64 { d[o]=(v&0xff) as u8; return o+1 }
47func tr_b2(d: *u8, o: i64, v: i64) -> i64 { d[o]=((v>>8)&0xff) as u8; d[o+1]=(v&0xff) as u8; return o+2 }
48func tr_b3(d: *u8, o: i64, v: i64) -> i64 { d[o]=((v>>16)&0xff) as u8; d[o+1]=((v>>8)&0xff) as u8; d[o+2]=(v&0xff) as u8; return o+3 }
49func tr_bytes(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64=0; while i<n { d[o+i]=s[i]; i=i+1 } return o+n }
50func tr_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ d[o+i]=s[i]; i=i+1 } return o+i }
51func tr_catn(d: *u8, o: i64, v: i64) -> i64 {
  let t: *u8=sys_mmap(24); var m: i64=v; var k: i64=0
  if m < 0 { d[o] = 45 as u8; o = o + 1; m = 0 - m }
  if m==0 { t[0]=48 as u8; k=1 }
  while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 }
  var w: i64=o; var i: i64=0; while i<k { d[w]=t[k-1-i]; w=w+1; i=i+1 } return w
57}
58func tr_u64be(d: *u8, o: i64, v: i64) -> i64 {
  d[o]=((v>>56)&0xff) as u8; d[o+1]=((v>>48)&0xff) as u8; d[o+2]=((v>>40)&0xff) as u8; d[o+3]=((v>>32)&0xff) as u8
  d[o+4]=((v>>24)&0xff) as u8; d[o+5]=((v>>16)&0xff) as u8; d[o+6]=((v>>8)&0xff) as u8; d[o+7]=(v&0xff) as u8
  return o+8
62}
63func tr_write_all(fd: i64, buf: *u8, n: i64) -> i64 {
  var off: i64=0
  while off<n { let w: i64=sys_write(fd, ((buf as i64)+off) as *u8, n-off); if w<=0 { return 0-1 } off=off+w }
  return 0
67}
68// TLS 1.2 PRF = P_SHA256(secret, label||seed)
69func tr_prf(secret: *u8, secret_len: i64, label: *u8, label_len: i64, seed: *u8, seed_len: i64, out: *u8, out_len: i64) -> i64 {
  let ls_len: i64 = label_len + seed_len
  let ls: *u8 = sys_mmap(ls_len + 8)
  var i: i64 = 0
  while i < label_len { ls[i] = label[i]; i = i + 1 }
  i = 0
  while i < seed_len { ls[label_len + i] = seed[i]; i = i + 1 }
  let a: *u8 = sys_mmap(32); let a_next: *u8 = sys_mmap(32)
  hmac_sha256(secret, secret_len, ls, ls_len, a)
  let tmp: *u8 = sys_mmap(32 + ls_len + 8); let block: *u8 = sys_mmap(32)
  var off: i64 = 0
  while off < out_len {
      var j: i64 = 0
      while j < 32 { tmp[j] = a[j]; j = j + 1 }
      j = 0
      while j < ls_len { tmp[32 + j] = ls[j]; j = j + 1 }
      hmac_sha256(secret, secret_len, tmp, 32 + ls_len, block)
      var c: i64 = 32
      if out_len - off < 32 { c = out_len - off }
      j = 0
      while j < c { out[off + j] = block[j]; j = j + 1 }
      off = off + c
      hmac_sha256(secret, secret_len, a, 32, a_next)
      j = 0
      while j < 32 { a[j] = a_next[j]; j = j + 1 }
  }
  return 0
96}
97func tr_client_hello(host: *u8, hlen: i64, cr_out: *u8, out: *u8) -> i64 {
  let body: *u8 = sys_mmap(TR_MAGIC_1024); var o: i64 = 0
  o = tr_b2(body, o, 0x0303)
  nx_csprng_fill(cr_out, 32)
  o = tr_bytes(body, o, cr_out, 32)
  o = tr_b1(body, o, 0)
  o = tr_b2(body, o, 2); o = tr_b2(body, o, 0xC02F)
  o = tr_b1(body, o, 1); o = tr_b1(body, o, 0)
  let ext: *u8 = sys_mmap(512); var e: i64 = 0
  e = tr_b2(ext, e, 0x0000); e = tr_b2(ext, e, hlen + 5); e = tr_b2(ext, e, hlen + 3); e = tr_b1(ext, e, 0); e = tr_b2(ext, e, hlen); e = tr_bytes(ext, e, host, hlen)
  e = tr_b2(ext, e, 0x000A); e = tr_b2(ext, e, 4); e = tr_b2(ext, e, 2); e = tr_b2(ext, e, 0x0017)
  e = tr_b2(ext, e, 0x000B); e = tr_b2(ext, e, 2); e = tr_b1(ext, e, 1); e = tr_b1(ext, e, 0)
  // signature_algorithms: advertise ONLY what tr_verify_ske_sig can verify (rsa_pkcs1_sha256, 0x0401).
  // MEASURED 2026-08-18 (debt 1787075987): this hello offered sha384/sha512 too, the verifier is
  // fail-closed to sha256, so every server that PREFERRED a stronger hash (whatwg-class) signed the
  // SKE with 0x0601 and the leg died at t12-ske-signature rc=-2937 -- A PRODUCER AND A CONSUMER EACH
  // CORRECT IN ISOLATION STILL DISAGREED ON THE WIRE. Offering only 0x0401 makes the server sign
  // sha256 or abort the handshake, which is never worse than the guaranteed failure it replaces.
  e = tr_b2(ext, e, 0x000D); e = tr_b2(ext, e, 4); e = tr_b2(ext, e, 2); e = tr_b2(ext, e, 0x0401)
  o = tr_b2(body, o, e); o = tr_bytes(body, o, ext, e)
  let body_len: i64 = o
  var r: i64 = 0
  r = tr_b1(out, r, TR_HS); r = tr_b2(out, r, 0x0303); r = tr_b2(out, r, body_len + 4)
  r = tr_b1(out, r, 1); r = tr_b3(out, r, body_len); r = tr_bytes(out, r, body, body_len)
  return r
122}
123func tr_hdr_end(b: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i + 3 < n { if b[i]==(13 as u8) { if b[i+1]==(10 as u8) { if b[i+2]==(13 as u8) { if b[i+3]==(10 as u8) { return i+4 } } } } i = i + 1 }
  return 0 - 1
127}
128func tr_lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c }
129func tr_match_ci(b: *u8, i: i64, n: i64, targ: *u8, tlen: i64) -> i64 {
  if i + tlen > n { return 0 }
  var j: i64 = 0
  while j < tlen { if tr_lc(b[i+j]&0xff) != (targ[j] as i64) { return 0 } j = j + 1 }
  return 1
134}
135func tr_content_length(b: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i + 15 < n {
      if tr_match_ci(b, i, n, "content-length:" as *u8, 15) == 1 {
          var p: i64 = i + 15; var sk: i64 = 1
          while sk == 1 { if p < n { if b[p]==(32 as u8) { p = p + 1 } else { sk = 0 } } else { sk = 0 } }
          var val: i64 = 0; var any: i64 = 0; var go: i64 = 1
          while go == 1 { if p < n { let c: i64 = b[p]&0xff; if c >= 48 { if c <= 57 { val = val*10 + (c-48); any = 1; p = p + 1 } else { go = 0 } } else { go = 0 } } else { go = 0 } }
          if any == 1 { return val }
          return 0 - 1
      }
      i = i + 1
  }
  return 0 - 1
149}
150// Does the header block declare the chunked transfer coding? Bounded to the headers so a body that merely
151// contains the word cannot flip it.
152func tr_is_chunked(b: *u8, hdr_end: i64) -> i64 {
  var i: i64 = 0
  while i + 7 <= hdr_end {
      if tr_match_ci(b, i, hdr_end, "chunked" as *u8, 7) == 1 { return 1 }
      i = i + 1
  }
  return 0
159}
160// Has the TERMINAL zero-length chunk arrived? Looks for CRLF "0" CRLF -- that byte run can only be the
161// last-chunk marker, because every other chunk-size line is hex with a non-CR byte following the digit
162// (a size of 0x0a reads "0a\r\n", so b[i+3] is 'a', not CR).
163func tr_chunk_done(b: *u8, from: i64, n: i64) -> i64 {
  var i: i64 = from
  while i + 5 <= n {
      if b[i]==(13 as u8) { if b[i+1]==(10 as u8) { if b[i+2]==(48 as u8) { if b[i+3]==(13 as u8) { if b[i+4]==(10 as u8) { return 1 } } } } }
      i = i + 1
  }
  return 0
170}
171// build request-line + headers (+ body) into out; returns length
172func tr_http_req(method: *u8, mlen: i64, target: *u8, tlen: i64, host: *u8, hlen: i64, token: *u8, tn: i64, body: *u8, blen: i64, out: *u8) -> i64 {
  var o: i64 = 0
  o = tr_bytes(out, o, method, mlen); out[o]=0x20 as u8; o=o+1
  o = tr_bytes(out, o, target, tlen)
  o = tr_cat(out, o, " HTTP/1.1\r\nHost: " as *u8)
  o = tr_bytes(out, o, host, hlen)
  if tn > 0 { o = tr_cat(out, o, "\r\nAuthorization: Bearer " as *u8); o = tr_bytes(out, o, token, tn) }
  if blen > 0 { o = tr_cat(out, o, "\r\nContent-Type: application/json\r\nContent-Length: " as *u8); o = tr_catn(out, o, blen) }
  o = tr_cat(out, o, "\r\nUser-Agent: nishi-tls12\r\nConnection: close\r\n\r\n" as *u8)
  if blen > 0 { o = tr_bytes(out, o, body, blen) }
  return o
183}
184
185// Reformat a TLS-1.2 Certificate message body ([3B list_len][ {3B certlen}{DER} ...]) into a TLS-1.3 Certificate
186// message ([1B ctx=0][3B list_len][ {3B certlen}{DER}{2B ext_len=0} ...]) so the shipped 1.3 chain+hostname+validity
187// pipeline (nx_https_cert_pipeline_verify_with_store) validates it unchanged. Returns the 1.3 message length.
188func tr_certs12_to_13(body12: *u8, len12: i64, out13: *u8) -> i64 {
  var o: i64 = 0
  out13[o]=11 as u8; o=o+1                                 // HT_CERTIFICATE handshake type (the parser checks this)
  let hdrpos: i64 = o
  out13[o]=0 as u8; out13[o+1]=0 as u8; out13[o+2]=0 as u8; o=o+3   // reserve 3-byte handshake-message length
  out13[o]=0 as u8; o=o+1                                  // certificate_request_context length = 0
  let listpos: i64 = o
  out13[o]=0 as u8; out13[o+1]=0 as u8; out13[o+2]=0 as u8; o=o+3   // reserve 3-byte certificate_list length
  var i: i64 = 3                                           // skip the 1.2 cert-list's own 3-byte length
  while i + 3 <= len12 {
      let cl: i64 = ((body12[i]&0xff)<<16)|((body12[i+1]&0xff)<<8)|(body12[i+2]&0xff)
      if cl <= 0 { i = len12 } else {
          out13[o]=body12[i]; out13[o+1]=body12[i+1]; out13[o+2]=body12[i+2]; o=o+3
          var z: i64=0; while z<cl { out13[o+z]=body12[i+3+z]; z=z+1 } o=o+cl
          out13[o]=0 as u8; out13[o+1]=0 as u8; o=o+2       // per-cert extensions length = 0
          i = i + 3 + cl
      }
  }
  let ll: i64 = o - (listpos+3)                            // certificate_list content length
  out13[listpos]=((ll>>16)&0xff) as u8; out13[listpos+1]=((ll>>8)&0xff) as u8; out13[listpos+2]=(ll&0xff) as u8
  let total: i64 = o - (hdrpos+3)                          // handshake-message length = everything after the 4B header
  out13[hdrpos]=((total>>16)&0xff) as u8; out13[hdrpos+1]=((total>>8)&0xff) as u8; out13[hdrpos+2]=(total&0xff) as u8
  return o
211}
212
213// Verify the ServerKeyExchange signature: the server signs SHA256(client_random || server_random || ecdhe_params)
214// with its certificate's private key; we verify with the leaf cert's PUBLIC key. This BINDS the ECDHE key we're
215// about to use to the (already chain-validated) cert -- closing the active-MITM gap (an attacker replaying a valid
216// cert with its own ECDHE key can't produce this signature). We only offer ECDHE_RSA (0xC02F) so the signature is
217// always RSA-PKCS1. Returns 1 on valid; 2=cert-parse 3=pubkey-extract 4=SIG-INVALID 5=malformed; 1000+alg=unsupported.
218func tr_verify_ske_sig(cr: *u8, sr: *u8, ske: *u8, ske_len: i64, leaf_der: *u8, leaf_len: i64) -> i64 {
  if ske_len < 8 { return 5 }
  let pubkey_len: i64 = ske[3] & 0xff
  let params_len: i64 = 4 + pubkey_len                    // curve_type(1)+named_curve(2)+pklen(1)+pubkey
  if params_len + 4 > ske_len { return 5 }
  let sig_alg: i64 = ((ske[params_len]&0xff)<<8)|(ske[params_len+1]&0xff)
  let sig_len: i64 = ((ske[params_len+2]&0xff)<<8)|(ske[params_len+3]&0xff)
  let sig_ptr: *u8 = ((ske as i64) + params_len + 4) as *u8
  if params_len + 4 + sig_len > ske_len { return 5 }
  if sig_alg != 0x0401 { return 1000 + sig_alg }          // only rsa_pkcs1_sha256 wired (fail-closed for others)
  // tbs = client_random(32) || server_random(32) || ecdhe_params(params_len)
  let tbs: *u8 = sys_mmap(512); var o: i64 = 0
  var z: i64 = 0; while z < 32 { tbs[o]=cr[z]; o=o+1; z=z+1 }
  z = 0; while z < 32 { tbs[o]=sr[z]; o=o+1; z=z+1 }
  z = 0; while z < params_len { tbs[o]=ske[z]; o=o+1; z=z+1 }
  let leaf_raw: *u8 = sys_mmap(256); let leaf: *X509Cert = leaf_raw as *X509Cert
  if x509_parse(leaf_der, leaf_len, leaf) < 0 { return 2 }
  if sig_len == 256 {
      let n: *i64 = u2048_alloc(); let e_p: *i64 = sys_mmap(16) as *i64
      if nx_x509_pubkey_extract_rsa(leaf_der, leaf, n, e_p) != NX_X509_PUBKEY_RSA_OK { return 3 }
      if nx_x509_verify_rsa_pkcs1_sha256(tbs, o, sig_ptr, sig_len, n, *e_p) == NX_X509_RSA_PKCS1_SHA256_OK { return 1 }
      return 4
  }
  if sig_len == 512 {
      let n4: *i64 = u4096_alloc(); let e4: *i64 = sys_mmap(16) as *i64
      if nx_x509_pubkey_extract_rsa_4096(leaf_der, leaf, n4, e4) != NX_X509_PUBKEY_RSA_4096_OK { return 3 }
      if nx_x509_verify_rsa_pkcs1_sha256_4096(tbs, o, sig_ptr, sig_len, n4, *e4) == NX_X509_RSA_PKCS1_SHA256_4096_OK { return 1 }
      return 4
  }
  return 5
248}
249
250// THE reusable request. full_url = "https://host/path?query". method/token/body optional (token/body=0 to omit).
251// Fills `out` with the plaintext HTTP response (status line + headers + body); returns its length, or <0 on error:
252//   -1 bad url  -2 connect  -3 handshake(no server random/pubkey)  -4 ECDHE  -5 request write
253const TR_READ_TIMEOUT_SECS: i64 = 20   // declared: per-read ceiling, so a stalling peer fails fast
254// A PASS THAT DECRYPTS NO NEW PLAINTEXT MADE NO PROGRESS. This bounds a STALLING peer, and deliberately
255// NOT the size of a transfer: the old `rreads > 60` counted EVERY pass, so a large body was cut off after
256// 60 reads no matter how well it was going -- a transfer ceiling wearing a timeout's name. Paired with the
257// 20s per-read socket ceiling above, 60 consecutive no-progress passes is the outer bound on a dribbling peer.
258const TR_MAX_STALL_PASSES: i64 = 60
259const TR_TRUNCATED: i64 = 9        // returned negated: the peer declared a Content-Length we did not reach
260const TR_RECORD_OVERSIZE: i64 = 10 // returned negated: one record exceeds the whole receive window (protocol violation)
261const TR_ALERTED: i64 = 11         // returned negated: the peer answered the ClientHello with a TLS alert record (a 1.3-only host refusing 1.2) -- an ANSWER, never a slow flight
262func tr_puts(s: *u8) -> i64 { sys_write(2, s, tr_slen(s)); return 0 }
263func tr_putn(v: i64) -> i64 {
  if v == 0 { sys_write(2, "0" as *u8, 1); return 0 }
  var m: i64 = v
  if m < 0 { sys_write(2, "-" as *u8, 1); m = 0 - m }
  let d: *u8 = sys_mmap(24); var k: i64 = 0
  while m > 0 { d[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  let o: *u8 = sys_mmap(24); var wi: i64 = 0
  while wi < k { o[wi] = d[k - 1 - wi]; wi = wi + 1 }
  sys_write(2, o, k)
  return 0
273}
274func t12_request(full_url: *u8, method: *u8, mlen: i64, token: *u8, tn: i64, body: *u8, blen: i64, out: *u8, outcap: i64) -> i64 {
  let target_raw: *u8 = sys_mmap(64); let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
  target.url = nx_url_new(); target.port = 0
  if nx_https_url_for_fetch(full_url, target) != NX_HTTPS_URL_OK { return 0 - 1 }
  let host: *u8 = ((full_url as i64) + target.url.host_off) as *u8
  let hlen: i64 = target.url.host_len
  // request-target = everything in the URL AFTER the host (path + ?query) -- NOT the parsed path (drops query)
  let reqtgt: *u8 = ((full_url as i64) + target.url.host_off + hlen) as *u8
  let reqtlen: i64 = tr_slen(reqtgt)
  let now: i64 = sys_now_realtime_sec()
  let fd_p: *i64 = sys_mmap(16) as *i64
  if nx_https_url_connect(target, full_url, now, fd_p) != NX_HTTPS_CONNECT_OK { return 0 - 2 }
  let fd: i64 = fd_p[0]
  // Bound every read. Required now that a close-delimited response legitimately reads until EOF: without
  // this, a keep-alive peer that sends neither Content-Length nor a terminal chunk would block forever.
  sys_set_socket_timeout(fd, TR_READ_TIMEOUT_SECS)
290
  let tr: *u8 = sys_mmap(TR_MAGIC_16384); var trlen: i64 = 0
  let cr: *u8 = sys_mmap(32); let ch: *u8 = sys_mmap(TR_MAGIC_2048)
  let chlen: i64 = tr_client_hello(host, hlen, cr, ch)
  if tr_write_all(fd, ch, chlen) < 0 { sys_close(fd); return 0 - 5 }
  trlen = tr_bytes(tr, trlen, ((ch as i64)+5) as *u8, chlen-5)
296
  let buf: *u8 = sys_mmap(TR_MAGIC_65536); var total: i64 = 0
  let sr: *u8 = sys_mmap(32); let spub: *u8 = sys_mmap(65)
  let cert12: *u8 = sys_mmap(TR_MAGIC_32768); var cert12_len: i64 = 0; var got_cert: i64 = 0
  let ske_body: *u8 = sys_mmap(TR_MAGIC_4096); var ske_len: i64 = 0
  var got_sr: i64 = 0; var got_spub: i64 = 0; var got_shd: i64 = 0; var reads: i64 = 0
  var alert_desc: i64 = 0 - 1   // the alert description byte when the first flight is an alert record
  while got_shd == 0 {
      if reads > 40 { got_shd = 2 }
      let n: i64 = sys_read(fd, ((buf as i64)+total) as *u8, TR_MAGIC_65536-total)
      if n <= 0 { got_shd = 2 } else {
          total = total + n; reads = reads + 1
          var p: i64 = 0
          while p + 5 <= total {
              let rtype: i64 = buf[p]&0xff; let rlen: i64 = ((buf[p+3]&0xff)<<8)|(buf[p+4]&0xff)
              if p+5+rlen > total { p = total } else {
                  if rtype == TR_HS {
                      var hp: i64 = p+5; let rend: i64 = p+5+rlen
                      while hp + 4 <= rend { let ht: i64 = buf[hp]&0xff; let hl: i64 = ((buf[hp+1]&0xff)<<16)|((buf[hp+2]&0xff)<<8)|(buf[hp+3]&0xff); if ht==14 { got_shd=1 } hp=hp+4+hl }
                  }
                  if rtype == TR_ALERT { if rlen >= 2 { alert_desc = buf[p+6]&0xff } got_shd = 3 }
                  p = p + 5 + rlen
              }
          }
      }
  }
  // A TLS ALERT IN THE FIRST FLIGHT IS AN ANSWER, NOT A SLOW FLIGHT (2026-09-17): a 1.3-only host answers the
  // 1.2 ClientHello with protocol_version (desc 70) or handshake_failure (40) and closes. This used to fall
  // out of the loop on the close and report -3 "no SH/SKE inside the read budget", sending every caller to
  // the read budget when the peer had already said no. Named here, with its description byte.
  if got_shd == 3 { tr_puts("T12-ALERT desc="); tr_putn(alert_desc); tr_puts("\n"); sys_close(fd); return 0 - TR_ALERTED }
  var p: i64 = 0
  while p + 5 <= total {
      let rtype: i64 = buf[p]&0xff; let rlen: i64 = ((buf[p+3]&0xff)<<8)|(buf[p+4]&0xff)
      if rtype == TR_HS {
          trlen = tr_bytes(tr, trlen, ((buf as i64)+p+5) as *u8, rlen)
          var hp: i64 = p+5; let rend: i64 = p+5+rlen
          while hp + 4 <= rend {
              let ht: i64 = buf[hp]&0xff; let hl: i64 = ((buf[hp+1]&0xff)<<16)|((buf[hp+2]&0xff)<<8)|(buf[hp+3]&0xff); let bp: i64 = hp+4
              if ht == 2 { var z: i64=0; while z<32 { sr[z]=buf[bp+2+z]; z=z+1 } got_sr=1 }
              if ht == 11 { var z: i64=0; while z<hl { cert12[z]=buf[bp+z]; z=z+1 } cert12_len=hl; got_cert=1 }
              if ht == 12 { var z: i64=0; while z<65 { spub[z]=buf[bp+4+z]; z=z+1 } var w: i64=0; while w<hl { ske_body[w]=buf[bp+w]; w=w+1 } ske_len=hl; got_spub=1 }
              hp = hp + 4 + hl
          }
      }
      p = p + 5 + rlen
  }
  if got_sr==0 { sys_close(fd); return 0 - 3 }
  if got_spub==0 { sys_close(fd); return 0 - 3 }
  if got_cert==0 { sys_close(fd); return 0 - 6 }
  // ---- CERT VALIDATION: chain (to Mozilla roots) + hostname + validity, via the shipped 1.3 pipeline after a
  // 1.2->1.3 reformat. FAIL-CLOSED: a cert that doesn't chain to a trusted root / doesn't cover the host / is
  // expired ABORTS the connection (return -8) before we send the Bearer token. NOTE(residual): the
  // ServerKeyExchange SIGNATURE (which binds the ECDHE key to this cert) is not yet verified -- so this stops
  // self-signed / wrong-host / expired certs but not a sophisticated active MITM that replays a valid cert with
  // its own ECDHE key. That SKE-sig check (RSA/ECDSA over client_random||server_random||params) is the final step.
  let store_r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, TR_MAGIC_4194304)
  if store_r <= 0 { sys_close(fd); return 0 - 7 }
  let store: *TrustStore = store_r as *TrustStore
  let c13: *u8 = sys_mmap(TR_MAGIC_40960)
  let c13len: i64 = tr_certs12_to_13(cert12, cert12_len, c13)
  let cv: i64 = nx_https_cert_pipeline_verify_with_store(c13, c13len, host, hlen, now, store)
  if cv != NX_HTTPS_PIPELINE_OK { sys_close(fd); return 0 - 200 - cv }   // encode pipeline verdict for diagnosis
  // ---- SKE-SIGNATURE verify: bind the ECDHE key to the validated leaf cert (closes the active-MITM gap) ----
  let leaf_len: i64 = ((cert12[3]&0xff)<<16)|((cert12[4]&0xff)<<8)|(cert12[5]&0xff)
  let leaf_der: *u8 = ((cert12 as i64)+6) as *u8
  let sv: i64 = tr_verify_ske_sig(cr, sr, ske_body, ske_len, leaf_der, leaf_len)
  if sv != 1 { sys_close(fd); return 0 - 400 - sv }   // encode SKE-verify verdict for diagnosis
364
  let seed: *u8 = sys_mmap(32); nx_csprng_fill(seed, 32)
  let mypriv: *u8 = sys_mmap(32)
  if p256_ecdh_derive_priv(seed, mypriv) != NX_P256_ECDH_OK { sys_close(fd); return 0 - 4 }
  let mypub: *u8 = sys_mmap(65)
  if p256_ecdh_pub(mypriv, mypub) != NX_P256_ECDH_OK { sys_close(fd); return 0 - 4 }
  let premaster: *u8 = sys_mmap(32)
  if p256_ecdh_shared(mypriv, spub, 65, premaster) != NX_P256_ECDH_OK { sys_close(fd); return 0 - 4 }
372
  let crsr: *u8 = sys_mmap(64); tr_bytes(crsr, 0, cr, 32); tr_bytes(crsr, 32, sr, 32)
  let srcr: *u8 = sys_mmap(64); tr_bytes(srcr, 0, sr, 32); tr_bytes(srcr, 32, cr, 32)
  let master: *u8 = sys_mmap(48); tr_prf(premaster, 32, "master secret" as *u8, 13, crsr, 64, master, 48)
  let kb: *u8 = sys_mmap(40); tr_prf(master, 48, "key expansion" as *u8, 13, srcr, 64, kb, 40)
  let cwk: *u8 = ((kb as i64)+0) as *u8
  let swk: *u8 = ((kb as i64)+16) as *u8
  let civ: *u8 = ((kb as i64)+32) as *u8
  let siv: *u8 = ((kb as i64)+36) as *u8
381
  let cke: *u8 = sys_mmap(128); var ck: i64 = 0
  ck = tr_b1(cke, ck, TR_HS); ck = tr_b2(cke, ck, 0x0303); ck = tr_b2(cke, ck, 4 + 66)
  let cke_hs: i64 = ck
  ck = tr_b1(cke, ck, 16); ck = tr_b3(cke, ck, 66); ck = tr_b1(cke, ck, 65); ck = tr_bytes(cke, ck, mypub, 65)
  if tr_write_all(fd, cke, ck) < 0 { sys_close(fd); return 0 - 5 }
  trlen = tr_bytes(tr, trlen, ((cke as i64)+cke_hs) as *u8, ck - cke_hs)
388
  let ccs: *u8 = sys_mmap(8); var cc: i64=0
  cc = tr_b1(ccs, cc, TR_CCS); cc = tr_b2(ccs, cc, 0x0303); cc = tr_b2(ccs, cc, 1); cc = tr_b1(ccs, cc, 1)
  if tr_write_all(fd, ccs, cc) < 0 { sys_close(fd); return 0 - 5 }
392
  let thash: *u8 = sys_mmap(32); sha256_digest(tr, trlen, thash)
  let cvd: *u8 = sys_mmap(12); tr_prf(master, 48, "client finished" as *u8, 15, thash, 32, cvd, 12)
  let fin: *u8 = sys_mmap(16); var fo: i64=0
  fo = tr_b1(fin, fo, 20); fo = tr_b3(fin, fo, 12); fo = tr_bytes(fin, fo, cvd, 12)
  trlen = tr_bytes(tr, trlen, fin, 16)
  let nonce: *u8 = sys_mmap(12); var q: i64=0; while q<4 { nonce[q]=civ[q]; q=q+1 } while q<12 { nonce[q]=0; q=q+1 }
  let aad: *u8 = sys_mmap(13); q=0; while q<8 { aad[q]=0; q=q+1 } aad[8]=22 as u8; aad[9]=3 as u8; aad[10]=3 as u8; aad[11]=0 as u8; aad[12]=16 as u8
  let fct: *u8 = sys_mmap(16); let ftag: *u8 = sys_mmap(16)
  nx_aes128_gcm_seal(cwk, nonce, aad, 13, fin, 16, fct, ftag)
  let frec: *u8 = sys_mmap(64); var fr: i64=0
  fr = tr_b1(frec, fr, TR_HS); fr = tr_b2(frec, fr, 0x0303); fr = tr_b2(frec, fr, 8+16+16)
  q=0; while q<8 { frec[fr]=0 as u8; fr=fr+1; q=q+1 }
  fr = tr_bytes(frec, fr, fct, 16); fr = tr_bytes(frec, fr, ftag, 16)
  if tr_write_all(fd, frec, fr) < 0 { sys_close(fd); return 0 - 5 }
407
  // drain server CCS + Finished (don't strictly verify here; the request+response GCM auth already proves keys)
  let rbuf: *u8 = sys_mmap(TR_MAGIC_16384); var rtot: i64 = 0; var rr: i64 = 0; var server_done: i64 = 0
  while server_done == 0 {
      if rr > 30 { server_done = 2 }
      let n: i64 = sys_read(fd, ((rbuf as i64)+rtot) as *u8, TR_MAGIC_16384-rtot)
      if n <= 0 { server_done = 2 } else {
          rtot = rtot + n; rr = rr + 1
          var pp: i64 = 0
          while pp + 5 <= rtot {
              let rtype: i64 = rbuf[pp]&0xff; let rlen: i64 = ((rbuf[pp+3]&0xff)<<8)|(rbuf[pp+4]&0xff)
              if pp+5+rlen > rtot { pp = rtot } else { if rtype==TR_ALERT { server_done=3 } if rtype==TR_HS { server_done=1 } pp = pp + 5 + rlen }
          }
      }
  }
422
  // send the application request (client app seq = 1: Finished was seq 0)
  let reqb: *u8 = sys_mmap(TR_MAGIC_8192)
  let rq: i64 = tr_http_req(method, mlen, reqtgt, reqtlen, host, hlen, token, tn, body, blen, reqb)
  let anonce: *u8 = sys_mmap(12); var az: i64=0; while az<4 { anonce[az]=civ[az]; az=az+1 } tr_u64be(anonce, 4, 1)
  let aaad: *u8 = sys_mmap(13); tr_u64be(aaad, 0, 1); aaad[8]=23 as u8; aaad[9]=3 as u8; aaad[10]=3 as u8; aaad[11]=((rq>>8)&0xff) as u8; aaad[12]=(rq&0xff) as u8
  let act: *u8 = sys_mmap(TR_MAGIC_8192); let atag: *u8 = sys_mmap(16)
  nx_aes128_gcm_seal(cwk, anonce, aaad, 13, reqb, rq, act, atag)
  let arec: *u8 = sys_mmap(TR_MAGIC_8300); var ar: i64=0
  ar = tr_b1(arec, ar, 23); ar = tr_b2(arec, ar, 0x0303); ar = tr_b2(arec, ar, 8+rq+16)
  ar = tr_u64be(arec, ar, 1); ar = tr_bytes(arec, ar, act, rq); ar = tr_bytes(arec, ar, atag, 16)
  if tr_write_all(fd, arec, ar) < 0 { sys_close(fd); return 0 - 5 }
434
  // read + decrypt response app-data (server app seq = 1); stop on complete HTTP response (Content-Length) or close
  // 🔴 THE 256 KiB SILENT TRUNCATION LIVED HERE (found 2026-08-20). respbuf is a CIPHERTEXT window and
  // v1 NEVER COMPACTED IT: rp walked forward over consumed records while resptot only ever grew, so once
  // resptot reached TR_MAGIC_262144 the read below asked for `262144 - 262144` = ZERO bytes, sys_read
  // returned 0, and `if n <= 0 { reading = 0 }` ended the loop AS IF THE PEER HAD CLOSED. The plaintext
  // decrypted so far was then returned as a COMPLETE body, status 200, and saved as a clean mirror.
  // MEASURED by a sibling lane: an 814,052-byte PDF saved 255,935 bytes TWICE, byte-identical -- and it is
  // deterministic precisely because TLS record boundaries are.
  // ★★★★★★A FIXED WINDOW THAT IS NEVER COMPACTED IS NOT A BUFFER, IT IS A TRANSFER CEILING -- AND ITS
  // EXHAUSTION IS INDISTINGUISHABLE FROM END-OF-FILE, SO IT REPORTS SUCCESS.
  // THE FIX IS NOT A BIGGER NUMBER. The window is compacted after every pass, so it only ever has to hold
  // ONE TLS record plus a partial (max 16,384 + 2,048 + 5 bytes) -- the constant stops being a limit at all
  // and cannot be reached by any legal stream. A raise would only have moved the cliff.
  let respbuf: *u8 = sys_mmap(TR_MAGIC_262144); var resptot: i64 = 0
  var rp: i64 = 0; var rseq: i64 = 1; var plain_total: i64 = 0
  var reading: i64 = 1; var stalls: i64 = 0; var last_plain: i64 = 0 - 1; var oversize: i64 = 0
  while reading == 1 {
      var more: i64 = 1
      while more == 1 {
          if rp + 5 > resptot { more = 0 } else {
              let rt: i64 = respbuf[rp]&0xff; let rl: i64 = ((respbuf[rp+3]&0xff)<<8)|(respbuf[rp+4]&0xff)
              if rp+5+rl > resptot { more = 0 } else {
                  if rt == 21 { reading = 0 }
                  if rt == 23 {
                      let pl: i64 = rl - 8 - 16
                      let dn: *u8 = sys_mmap(12); var dz: i64=0; while dz<4 { dn[dz]=siv[dz]; dz=dz+1 } while dz<12 { dn[dz]=respbuf[rp+5+(dz-4)]; dz=dz+1 }
                      let dad: *u8 = sys_mmap(13); tr_u64be(dad, 0, rseq); dad[8]=23 as u8; dad[9]=3 as u8; dad[10]=3 as u8; dad[11]=((pl>>8)&0xff) as u8; dad[12]=(pl&0xff) as u8
                      let dtag: *u8 = sys_mmap(16); dz=0; while dz<16 { dtag[dz]=respbuf[rp+5+8+pl+dz]; dz=dz+1 }
                      let dpt: *u8 = sys_mmap(TR_MAGIC_65536)
                      if nx_aes128_gcm_open(swk, dn, dad, 13, ((respbuf as i64)+rp+5+8) as *u8, pl, dtag, dpt) == 0 {
                          var cz: i64=0; while cz<pl { if plain_total+cz < outcap { out[plain_total+cz]=dpt[cz] } cz=cz+1 } plain_total=plain_total+pl
                      }
                      rseq = rseq + 1
                  }
                  rp = rp + 5 + rl
              }
          }
      }
      // ---- COMPACT THE CIPHERTEXT WINDOW. This one loop is the whole truncation fix: everything before
      // rp has already been decrypted into `out`, so it is dead weight holding the window shut.
      if rp > 0 {
          var mv: i64 = 0
          while rp + mv < resptot { respbuf[mv] = respbuf[rp+mv]; mv = mv + 1 }
          resptot = resptot - rp
          rp = 0
      }
      // PROGRESS, NOT PASSES. A pass that produced new plaintext resets the stall budget, so an arbitrarily
      // large body never runs out of reads; only a peer that keeps the socket open while delivering nothing
      // decodable does. The old counter bounded the TRANSFER and called itself a timeout.
      if plain_total > last_plain { stalls = 0; last_plain = plain_total } else { stalls = stalls + 1 }
      if stalls > TR_MAX_STALL_PASSES { reading = 0 }
      // TERMINATION. v1 read "no Content-Length" as "the response is complete" and stopped the instant
      // the headers landed -- so every CHUNKED reply (Apache 2.2's default for dynamic content, which is
      // exactly what graphis.ne.jp serves) came back as headers plus a ZERO-length body. Downstream
      // nx_http_dechunk then dechunked 0 bytes into 0, and the fetch ladder reported that as a handshake
      // failure, sending two sessions hunting a TLS bug that was never there. debt 1785971025.
      // ★A 200 ALONGSIDE AN EMPTY BODY IS A PARSE BUG, NOT A TRANSPORT ONE.
      let he: i64 = tr_hdr_end(out, plain_total)
      if he >= 0 {
          let cl: i64 = tr_content_length(out, plain_total)
          if cl >= 0 { if plain_total - he >= cl { reading = 0 } }
          else {
              var cfrom: i64 = he - 2
              if cfrom < 0 { cfrom = 0 }
              if tr_is_chunked(out, he) == 1 { if tr_chunk_done(out, cfrom, plain_total) == 1 { reading = 0 } }
              // Neither Content-Length nor chunked = close-delimited (HTTP/1.0 style): keep reading until
              // the peer closes. The socket timeout and the rreads cap bound it in both directions.
          }
      }
      if reading == 1 {
          let room: i64 = TR_MAGIC_262144 - resptot
          // AFTER COMPACTION THIS CAN ONLY MEAN ONE RECORD IS BIGGER THAN THE WHOLE WINDOW, which no
          // legal TLS stream produces. It is a distinct, LOUD state -- never a quiet short read.
          if room <= 0 { oversize = 1; reading = 0 } else {
              let n: i64 = sys_read(fd, ((respbuf as i64)+resptot) as *u8, room)
              if n <= 0 { reading = 0 } else { resptot = resptot + n }
          }
      }
  }
  sys_close(fd)
  if oversize == 1 {
      tr_puts("T12-RECORD-OVERSIZE: a single TLS record exceeds the "); tr_putn(TR_MAGIC_262144)
      tr_puts("-byte receive window -- refusing to return a partial body\n" as *u8)
      return 0 - TR_RECORD_OVERSIZE
  }
  // ---- TRUNCATION WITNESS. THE PEER ALREADY TOLD US HOW LONG THE BODY IS; NOT CHECKING IT IS WHAT MADE
  // A CUT DOCUMENT INDISTINGUISHABLE FROM A WHOLE ONE. A short body now REFUSES with both numbers, so no
  // caller can pin it as evidence. Only fires when a Content-Length was DECLARED: a close-delimited or
  // chunked response is not judged here, because for those the peer never stated a length to fall short of.
  let he_f: i64 = tr_hdr_end(out, plain_total)
  if he_f >= 0 {
      let cl_f: i64 = tr_content_length(out, plain_total)
      if cl_f >= 0 {
          if plain_total - he_f < cl_f {
              tr_puts("T12-TRUNCATED expected="); tr_putn(cl_f)
              tr_puts(" got="); tr_putn(plain_total - he_f)
              tr_puts(" -- the peer declared a Content-Length this read did not reach; REFUSING to return a partial body\n" as *u8)
              return 0 - TR_TRUNCATED
          }
      }
  }
  return plain_total
537}
nx_tls12_req.nx source

`nx_tls12_req.nx` source
