`nx_tlsprobe.nx` source

↩ module page · 139 lines · 6649 B
1// nx_tlsprobe.nx -- TLS HANDSHAKE / CERTLOOP OBSERVABILITY PROBE (F834; the regression tooth for the F799
2// certloop cure). Does TWO real TLS 1.3 handshakes to the sovereign edge (loopback 127.0.0.1:8443, SNI +
3// cert-name = nishifamily.com) in one run:
4//   1. COLD: fresh validation context, no cached cert -> full ECDSA chain walk (~certloop). cert_out captures
5//            the presented Certificate message.
6//   2. WARM: cached_cert = the cert captured in pass 1 -> the validator's fast path skips the chain crypto
7//            (CertificateVerify possession proof STILL runs both times = MITM-safe by construction).
8// Emits BOTH whole-handshake wall times (ms) as METRIC rows into the netobs ledger, so /netobs shows the
9// cold vs warm handshake as a continuous series and the F799 saving can NEVER silently regress. A clock beat.
10// Rule 26: read-only network probe, zero hardware writes. Envelope: 2 handshakes/beat, loopback-only,
11// 8s socket timeout, cert-capture <= 16 KiB. license_tier: ORIGINAL   expect_exit: 0
12import "nx_sovjson_lib.nx"
13import "nx_connect.nx"   // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
14import "nx_syscalls.nx"
15import "nx_csprng.nx"
16import "nx_x509_trust_store.nx"
17import "nx_trust_store_load_from_certdata.nx"
18import "nx_tls13_client_validate_certificate.nx"
19import "nx_tls13_client_session_run.nx"
20const TP_MAGIC_8443: i64 = 8443
21const TP_MAGIC_4194304: i64 = 4194304
22const TP_MAGIC_4096: i64 = 4096
23
24const TP_CERTDATA: *u8 = "data/mozilla_certdata.txt" as *u8
25const TP_CERT_CAP: i64 = 16384
26const TP_LEDGER:   *u8 = "knowledge/status/netobs_metrics.log"
27
28func tp_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
29func tp_wn(v: i64) -> i64 { let b: *u8 = sys_mmap(24); var m: i64 = v; if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m } let t: *u8 = sys_mmap(24); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } var i: i64 = 0; while i < k { b[i] = t[k-1-i]; i = i + 1 } sys_write(1, b, k); return 0 }
30func tp_cat(d: *u8, o: i64, s: *u8) -> i64 { return sj_cat(d, o, s) }
31func tp_catn(d: *u8, o: i64, v: i64) -> i64 { return sj_catn(d, o, v) }
32func tp_mrow(lb: *u8, o: i64, name: *u8, ts: i64, val: i64) -> i64 {
33    var p: i64 = tp_cat(lb, o, "METRIC " as *u8)
34    p = tp_cat(lb, p, name)
35    p = tp_cat(lb, p, " t_us=" as *u8)
36    p = tp_catn(lb, p, sys_now_us())
37    p = tp_cat(lb, p, " ts=" as *u8)
38    p = tp_catn(lb, p, ts)
39    p = tp_cat(lb, p, " value=" as *u8)
40    p = tp_catn(lb, p, val)
41    p = tp_cat(lb, p, " unit=ms src=nx_tlsprobe\n" as *u8)
42    return p
43}
44func tp_append(buf: *u8, n: i64) -> i64 {
45    var fd: i64 = sys_openat_append(TP_LEDGER, 420)
46    if fd < 0 { let cf: i64 = sys_openat_wr(TP_LEDGER, 420); if cf >= 0 { sys_close(cf) } fd = sys_openat_append(TP_LEDGER, 420) }
47    if fd < 0 { return 0 }
48    var w: i64 = 0
49    while w < n { let src: *u8 = ((buf as i64) + w) as *u8; let r: i64 = sys_write(fd, src, n - w); if r <= 0 { w = n } else { w = w + r } }
50    sys_close(fd)
51    return 0
52}
53// one loopback handshake to 127.0.0.1:8443, SNI/cert-name = host. returns handshake wall-ms, or -1 on fail.
54// vc is caller-owned (pre-set cached_cert / cert_out for the cold/warm distinction). store passed in.
55func tp_handshake(store: *TrustStore, host: *u8, host_len: i64, now: i64, vc: *TlsValidationContext) -> i64 {
56    let fd: i64 = sys_socket(2, 1, 0)
57    if fd < 0 { return 0 - 1 }
58    sys_set_socket_timeout(fd, 8)
59    let sa: *u8 = sys_mmap(16)
60    sa[0] = 2 as u8
61    sa[1] = 0 as u8
62    sa[2] = ((TP_MAGIC_8443 >> 8) & 0xff) as u8
63    sa[3] = (TP_MAGIC_8443 & 0xff) as u8
64    sa[4] = 127 as u8
65    sa[5] = 0 as u8
66    sa[6] = 0 as u8
67    sa[7] = 1 as u8
68    var zi: i64 = 8
69    while zi < 16 { sa[zi] = 0 as u8; zi = zi + 1 }
70    if nx_connect_bounded(fd, sa, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); return 0 - 1 }
71    let cr: *u8 = sys_mmap(32)
72    nx_csprng_fill(cr, 32)
73    let priv: *u8 = sys_mmap(32)
74    nx_csprng_fill(priv, 32)
75    vc.store = store
76    vc.sni_host = host
77    vc.sni_host_len = host_len
78    vc.now_epoch = now
79    let t0: i64 = sys_now_ms()
80    let sr: i64 = nx_tls13_client_session_run(fd, host, host_len, cr, priv, vc)
81    let t1: i64 = sys_now_ms()
82    sys_close(fd)
83    if sr <= 0 { return 0 - 1 }
84    return t1 - t0
85}
86
87func main(argc: i64, argv: *i64) -> i64 {
88    let now: i64 = sys_now_realtime_sec()
89    let r: i64 = nx_trust_store_load_from_certdata(TP_CERTDATA, 512, TP_MAGIC_4194304)
90    if r <= 0 { tp_w("NX-TLSPROBE FAIL trust-store load (data/mozilla_certdata.txt on cwd?)\n" as *u8); sys_exit(1); return 1 }
91    let store: *TrustStore = r as *TrustStore
92    let host: *u8 = "nishifamily.com\x00" as *u8
93    let hlen: i64 = 15
94
95    // ---- COLD pass: no cached cert -> full validation; capture the presented cert ----
96    let vcc: *TlsValidationContext = sys_mmap(128) as *TlsValidationContext
97    let certbuf: *u8 = sys_mmap(TP_CERT_CAP)
98    vcc.cached_cert = 0 as *u8
99    vcc.cached_cert_len = 0
100    vcc.cert_out = certbuf
101    vcc.cert_out_cap = TP_CERT_CAP
102    vcc.cert_out_len = 0
103    let cold: i64 = tp_handshake(store, host, hlen, now, vcc)
104    if cold < 0 { tp_w("NX-TLSPROBE FAIL cold handshake (edge 127.0.0.1:8443 down?)\n" as *u8); sys_exit(2); return 2 }
105
106    // ---- WARM pass: feed the captured cert as cached -> validator fast path skips the chain crypto ----
107    var warm: i64 = 0 - 1
108    if vcc.cert_out_len > 0 {
109        let vcw: *TlsValidationContext = sys_mmap(128) as *TlsValidationContext
110        vcw.cached_cert = certbuf
111        vcw.cached_cert_len = vcc.cert_out_len
112        vcw.cert_out = 0 as *u8
113        vcw.cert_out_cap = 0
114        vcw.cert_out_len = 0
115        warm = tp_handshake(store, host, hlen, now, vcw)
116    }
117
118    // ---- emit metric rows (netobs series) ----
119    let lb: *u8 = sys_mmap(TP_MAGIC_4096)
120    var o: i64 = tp_mrow(lb, 0, "netobs_tls_hs_cold_ms" as *u8, now, cold)
121    if warm >= 0 {
122        o = tp_mrow(lb, o, "netobs_tls_hs_warm_ms" as *u8, now, warm)
123        var saved: i64 = cold - warm
124        if saved < 0 { saved = 0 }
125        o = tp_mrow(lb, o, "netobs_tls_certloop_saved_ms" as *u8, now, saved)
126    }
127    tp_append(lb, o)
128
129    tp_w("NX-TLSPROBE cold_hs_ms=" as *u8)
130    tp_wn(cold)
131    tp_w(" warm_hs_ms=" as *u8)
132    tp_wn(warm)
133    tp_w(" cert_bytes=" as *u8)
134    tp_wn(vcc.cert_out_len)
135    if warm >= 0 { tp_w(" saved_ms=" as *u8); var sv: i64 = cold - warm; if sv < 0 { sv = 0 } tp_wn(sv) }
136    tp_w(" envelope=2-handshakes,loopback-8443,tmo-8s,cert-cap-16KiB VERDICT=GREEN\n" as *u8)
137    sys_exit(0)
138    return 0
139}
nx_tlsprobe.nx source

`nx_tlsprobe.nx` source
