nx_torrent_live_probe.nx source
↩ module page · 118 lines · 6714 B
1// nx_torrent_live_probe.nx -- sovereign machine-proof that /torrent is LIVE on nishifamily.com.
2//
3// Connects over real TLS 1.3 to the production web server (192.168.8.240:8443) presenting SNI
4// "nishifamily.com", VALIDATES the server cert against the Mozilla CA trust store (the real Let's
5// Encrypt chain), then GETs /torrent with NO session header. The expected response is the OPAQUE
6// gateway's no-cookie BOOTSTRAP -- which proves the full external relay end-to-end:
7// TLS :8443 (sites.elf) -> /torrent route -> gateway :18793 (loopback) -> bootstrap
8// A real session lives only in the browser's sessionStorage, so an unauthenticated probe MUST see the
9// bootstrap (contains "Nishi Media" + "X-Nishi-Session" + "sessionStorage"), NOT the 13KB daemon UI
10// (that would mean the gateway was bypassed) and NOT a /login 302 (that would mean an invalid token).
11// usage: nx_torrent_live_probe (no args; target + CA bundle are fixed)
12// license_tier: ORIGINAL
13import "nx_syscalls.nx"
14import "nx_csprng.nx"
15import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
16import "nx_x509_trust_store.nx"
17import "nx_trust_store_load_from_certdata.nx"
18import "nx_tls13_client_validate_certificate.nx"
19import "nx_tls13_client_session_run.nx"
20import "nx_https_get_complete.nx"
21import "nx_http_response_parse.nx"
22const K_MAGIC_4194304: i64 = 4194304
23const K_MAGIC_8443: i64 = 8443
24const K_MAGIC_131072: i64 = 131072
25const K_MAGIC_2000: i64 = 2000
26
27func pw(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return sys_write(1, s, n) }
28func pn(v: i64) -> i64 {
29 let t: *u8 = sys_mmap(24); var m: i64 = v; var k: i64 = 0
30 if m == 0 { t[0] = 48 as u8; k = 1 }
31 while m > 0 { t[k] = (48 + (m - (m/10)*10)) as u8; m = m/10; k = k + 1 }
32 let o: *u8 = sys_mmap(24); var i: i64 = 0; while i < k { o[i] = t[k-1-i]; i = i + 1 }
33 return sys_write(1, o, k)
34}
35// does hay[0..hn) contain the NUL-terminated needle?
36func contains(hay: *u8, hn: i64, needle: *u8) -> i64 {
37 var nl: i64 = 0; while needle[nl] != (0 as u8) { nl = nl + 1 }
38 if nl == 0 { return 1 }
39 var i: i64 = 0
40 while i + nl <= hn {
41 var j: i64 = 0; var ok: i64 = 1
42 while j < nl { if hay[i+j] != needle[j] { ok = 0; j = nl } else { j = j + 1 } }
43 if ok == 1 { return 1 }
44 i = i + 1
45 }
46 return 0
47}
48
49func main(argc: i64, argv: *i64) -> i64 {
50 // ---- load the real Mozilla CA trust store (in-repo bundle, absolute path) ----
51 let store_r: i64 = nx_trust_store_load_from_certdata("/mnt/c/Users/elder/nishi-core/nxc2/data/mozilla_certdata.txt\x00" as *u8, 300, K_MAGIC_4194304)
52 if store_r <= 0 { pw("TRUST-STORE-LOAD-FAIL r=" as *u8); pn(0 - store_r); pw("\n" as *u8); return 1 }
53 let store: *TrustStore = store_r as *TrustStore
54 pw("CA trust store loaded, anchors=" as *u8); pn(trust_store_count(store)); pw("\n" as *u8)
55
56 // ---- TLS handshake inputs (one-shot probe: fixed cr/priv are fine; not a security context) ----
57 let cr: *u8 = sys_mmap(32); var i: i64 = 0; nx_csprng_fill(cr, 32) // CWE-330 (debt 1785970852): was the constant 0xC0..0xDF
58 let priv: *u8 = sys_mmap(32); i = 0; nx_csprng_fill(priv, 32) // CWE-330: the X25519 scalar was the constant 0xA0..0xBF on EVERY session
59
60 // ---- TCP connect straight to the NAS IP (SNI is set independently, below) ----
61 let host: *u8 = "nishifamily.com\x00" as *u8
62 let fd: i64 = sys_socket(AF_INET, SOCK_STREAM, 0)
63 if fd < 0 { pw("SOCKET-FAIL\n" as *u8); return 2 }
64 sys_set_socket_timeout(fd, 20)
65 let sa: *u8 = sys_mmap(16)
66 sa[0] = 2 as u8; sa[1] = 0 as u8 // AF_INET
67 sa[2] = ((K_MAGIC_8443 >> 8) & 0xff) as u8; sa[3] = (K_MAGIC_8443 & 0xff) as u8 // port K_MAGIC_8443, big-endian
68 sa[4] = 192 as u8; sa[5] = 168 as u8; sa[6] = 8 as u8; sa[7] = 240 as u8 // 192.168.8.240
69 var z: i64 = 8; while z < 16 { sa[z] = 0 as u8; z = z + 1 }
70 if nx_connect_bounded(fd, sa, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); pw("CONNECT-FAIL (192.168.8.240:8443 not reachable)\n" as *u8); return 3 }
71 pw("TCP connected -> 192.168.8.240:8443\n" as *u8)
72
73 // ---- TLS 1.3 handshake with SNI=nishifamily.com, validated against the real CA store ----
74 let val_ctx_raw: *u8 = sys_mmap(64)
75 let val_ctx: *TlsValidationContext = val_ctx_raw as *TlsValidationContext
76 val_ctx.store = store
77 val_ctx.sni_host = host
78 val_ctx.sni_host_len = 15
79 val_ctx.now_epoch = sys_now_realtime_sec()
80 let sr: i64 = nx_tls13_client_session_run(fd, host, 15, cr, priv, val_ctx)
81 if sr <= 0 { sys_close(fd); pw("TLS-HANDSHAKE-FAIL (cert validation?) verdict=" as *u8); pn(0 - sr); pw("\n" as *u8); return 4 }
82 pw("TLS 1.3 handshake OK, cert validated against Let's Encrypt chain\n" as *u8)
83 let session: *Tls13ClientSession = sr as *Tls13ClientSession
84
85 // ---- GET <path> (argv[1], default /torrent; NO X-Nishi-Session) ----
86 var rpath: *u8 = "/torrent\x00" as *u8
87 if argc > 1 { rpath = argv[1] as *u8 }
88 var rplen: i64 = 0; while rpath[rplen] != (0 as u8) { rplen = rplen + 1 }
89 let buf: *u8 = sys_mmap(K_MAGIC_131072)
90 let gc: i64 = nx_https_get_complete(session, fd, rpath, rplen, host, 15, buf, K_MAGIC_131072)
91 sys_close(fd)
92 if gc < 0 { pw("HTTP-FETCH-FAIL verdict=" as *u8); pn(0 - gc); pw("\n" as *u8); return 5 }
93 pw("GET " as *u8); pw(rpath); pw(" -> response bytes=" as *u8); pn(gc); pw("\n" as *u8)
94
95 let r: *i64 = sys_mmap(128) as *i64
96 if nx_http_response_parse(buf, gc, r) == 0 { pw("HTTP status=" as *u8); pn(r[1]); pw("\n" as *u8) }
97
98 // ---- verdict: gateway bootstrap vs daemon-UI-bypass vs login-redirect ----
99 var pass: i64 = 0
100 if contains(buf, gc, "Nishi Media" as *u8) == 1 {
101 if contains(buf, gc, "X-Nishi-Session" as *u8) == 1 {
102 if contains(buf, gc, "sessionStorage" as *u8) == 1 { pass = 1 }
103 }
104 }
105 if pass == 1 {
106 pw("VERDICT: LIVE -- OPAQUE gateway no-cookie bootstrap served over TLS.\n" as *u8)
107 pw(" sites.elf:8443 -> /torrent route -> gateway:18793 relay is PROVEN end-to-end.\n" as *u8)
108 } else {
109 if contains(buf, gc, "<title>Nishi Media</title>" as *u8) == 0 { pw("note: not the bootstrap shell\n" as *u8) }
110 if contains(buf, gc, "Location: /login" as *u8) == 1 { pw("VERDICT: gateway reached but 302 -> /login (token treated as invalid)\n" as *u8) }
111 else { pw("VERDICT: UNEXPECTED body -- inspect the dump (gateway bypassed or route mismatch?)\n" as *u8) }
112 }
113
114 pw("---- first 2000 bytes ----\n" as *u8)
115 var d: i64 = gc; if d > K_MAGIC_2000 { d = K_MAGIC_2000 }
116 sys_write(1, buf, d); pw("\n---- end ----\n" as *u8)
117 return 0
118}