nx_url_probe.nx source

1// nx_url_probe.nx -- SOVEREIGN, PARAMETERIZED live URL probe (no curl/wget). A real HTTPS GET through the 2// Nishi TLS-1.3 client + real Mozilla CA chain, argv-driven so it verifies ANY published page (generalizes the 3// hardcoded nx_aw_verify_gate). Prints HTTP status, byte count, and whether an optional marker is in the body; 4// exit 0 iff status==200 AND (no marker requested OR marker present). The reusable "fetch-verify" half of the 5// live-publish loop -- verify via a Nishi gate, never a shell tool. 6// nx_url_probe <host> <path> [marker] 7// e.g. nx_url_probe nishifamily.com /wiki "Nishi" (verify the gated wiki is live) 8// nx_url_probe nishifamily.com /sftp_probe.txt NX (verify a sovereign sftp write round-trips) 9// license_tier: ORIGINAL (HTTPS stack reused from nx_aw_verify_gate) 10import "nx_syscalls.nx" 11import "nx_x509_trust_store.nx" 12import "nx_trust_store_load_from_certdata.nx" 13import "nx_tls13_client_validate_certificate.nx" 14import "nx_tls13_client_session_run.nx" 15import "nx_https_url_for_fetch.nx" 16import "nx_https_url_connect.nx" 17import "nx_https_get.nx" 18import "nx_https_get_complete.nx" 19import "nx_http_response_parse.nx" 20const K_MAGIC_4194304: i64 = 4194304 21const K_MAGIC_1048576: i64 = 1048576 22 23func up_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 24func up_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 25func up_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 26func up_contains(buf: *u8, lo: i64, hi: i64, needle: *u8) -> i64 { 27 let nl: i64=up_slen(needle); if nl==0 { return 0 } 28 var i: i64=lo 29 while i+nl<=hi { var j: i64=0; var ok: i64=1; while j<nl { if buf[i+j]!=needle[j] { ok=0; j=nl } else { j=j+1 } } if ok==1 { return 1 } i=i+1 } 30 return 0 31} 32 33func main(argc: i64, argv: *i64) -> i64 { 34 if argc < 3 { up_w("usage: nx_url_probe <host> <path> [marker]\n" as *u8); sys_exit(2); return 2 } 35 let host: *u8 = argv[1] as *u8 36 let path: *u8 = argv[2] as *u8 37 var marker: *u8 = 0 as *u8 38 if argc >= 4 { marker = argv[3] as *u8 } 39 let hlen: i64 = up_slen(host) 40 let plen: i64 = up_slen(path) 41 42 // build "https://<host><path>" into a buffer 43 let url: *u8 = sys_mmap(hlen + plen + 16); var uo: i64 = 0 44 let pfx: *u8 = "https://" as *u8; var z: i64 = 0; while pfx[z]!=(0 as u8){url[uo]=pfx[z];uo=uo+1;z=z+1} 45 var hi: i64 = 0; while host[hi]!=(0 as u8){url[uo]=host[hi];uo=uo+1;hi=hi+1} 46 var pi: i64 = 0; while path[pi]!=(0 as u8){url[uo]=path[pi];uo=uo+1;pi=pi+1} 47 url[uo] = 0 as u8 48 49 up_w("=== nx_url_probe " as *u8); up_w(url); up_w(" ===\n" as *u8) 50 51 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 300, K_MAGIC_4194304) 52 if r <= 0 { up_w("probe: CA store load FAIL\n" as *u8); sys_exit(1); return 1 } 53 let store: *TrustStore = r as *TrustStore 54 if trust_store_count(store) < 50 { up_w("probe: CA store too small\n" as *u8); sys_exit(1); return 1 } 55 56 let url_p: *NxUrl = nx_url_new() 57 let target: *NxHttpsTarget = sys_mmap(64) as *NxHttpsTarget 58 target.url = url_p 59 target.port = 0 60 if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { up_w("probe: URL parse FAIL\n" as *u8); sys_exit(1); return 1 } 61 62 let fd_p: *i64 = sys_mmap(16) as *i64 63 if nx_https_url_connect(target, url, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK { up_w("probe: connect FAIL\n" as *u8); sys_exit(1); return 1 } 64 let fd: i64 = fd_p[0] 65 66 let cr: *u8 = sys_mmap(32); var i: i64=0; while i<32 { cr[i]=(0xC0+i) as u8; i=i+1 } 67 let priv: *u8 = sys_mmap(32); i=0; while i<32 { priv[i]=(0xA0+i) as u8; i=i+1 } 68 let val_ctx: *TlsValidationContext = sys_mmap(64) as *TlsValidationContext 69 val_ctx.store = store 70 val_ctx.sni_host = ((url as i64) + target.url.host_off) as *u8 71 val_ctx.sni_host_len = target.url.host_len 72 val_ctx.now_epoch = sys_now_realtime_sec() 73 74 let sr: i64 = nx_tls13_client_session_run(fd, ((url as i64)+target.url.host_off) as *u8, target.url.host_len, cr, priv, val_ctx) 75 if sr <= 0 { up_w("probe: TLS session FAIL\n" as *u8); sys_close(fd); sys_exit(1); return 1 } 76 77 let session: *Tls13ClientSession = sr as *Tls13ClientSession 78 let buf: *u8 = sys_mmap(K_MAGIC_1048576) 79 let gc: i64 = nx_https_get_complete(session, fd, path, plen, ((url as i64)+target.url.host_off) as *u8, target.url.host_len, buf, K_MAGIC_1048576) 80 sys_close(fd) 81 if gc <= 0 { up_w("probe: HTTPS GET returned no bytes\n" as *u8); sys_exit(1); return 1 } 82 83 var status: i64=0; var body_off: i64=0 84 let pr: *i64 = sys_mmap(128) as *i64 85 if nx_http_response_parse(buf, gc, pr)==0 { status=pr[1]; body_off=pr[6] } 86 87 var mok: i64 = 1 88 if (marker as i64) != 0 { mok = up_contains(buf, body_off, gc, marker) } 89 90 up_w("probe: status=" as *u8); up_num(status); up_w(" bytes=" as *u8); up_num(gc); up_w(" body_off=" as *u8); up_num(body_off) 91 if (marker as i64) != 0 { up_w(" marker=" as *u8); if mok==1 { up_w("PRESENT" as *u8) } else { up_w("ABSENT" as *u8) } } 92 up_w("\n--- body[0:500] ---\n" as *u8) 93 var snip: i64 = gc - body_off; if snip > 500 { snip = 500 } 94 if snip > 0 { sys_write(1, (buf + body_off) as *u8, snip) } 95 up_w("\n--- end body ---\n" as *u8) 96 97 if status==200 { if mok==1 { up_w("probe: GREEN (200" as *u8); if (marker as i64)!=0 { up_w(" + marker" as *u8) } up_w(")\n" as *u8); sys_exit(0); return 0 } } 98 up_w("probe: RED\n" as *u8); sys_exit(1); return 1 99}