nx_nss_certdata_parse.nx
buildroot/runtime/nx_nss_certdata_parse.nx
about
nx_nss_certdata_parse.nx -- bits-up parser for Mozilla NSS's
`certdata.txt` CA bundle format.
Phase 0b §I.4 piece 11 of the chain-walker arc. The PARSER that
turns Mozilla's certdata.txt text format into our internal bundle
wire format -- closes the gap between "real CA bundle exists" and
"TrustStore is populated". Per
[[feedback-bits-up-exceed-never-match]]: re-derives the parser
from the certdata.txt spec rather than adopting any third-party
extractor binary.
certdata.txt format (PKCS#11-style flat text, RFC-free):
#
# Certificate "GTS Root R1"
#
CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
CKA_TOKEN CK_BBOOL CK_TRUE
CKA_LABEL UTF8 "GTS Root R1"
CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
CKA_SUBJECT MULTILINE_OCTAL
\060\107\061\013... <-- 3-digit octal escapes
\003\125\123\061... <-- continues across lines
END
CKA_ID UTF8 "0"
CKA_VALUE MULTILINE_OCTAL
\060\202\005\025... <-- full DER cert
...
END
Trust records (CKO_NSS_TRUST) typically follow each cert and
carry CKA_TRUST_SERVER_AUTH = CKT_NSS_TRUSTED_DELEGATOR. This
first-cut parser TRUSTS EVERY listed cert (conservative; matches
what most CA bundle extractors do at the "load all certs" layer).
Filtering by trust-record attributes is queued for piece 11b.
Algorithm: line-by-line state machine.
State IDLE:
Looking for `CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE`
-> transition to IN_CERT
dependencies 1 imports · 2 importers
imports: nx_syscalls.nx
imported by: nx_nss_certdata_parse_test.nxnx_trust_store_load_from_certdata.nx
structs
| none |
consts
| 87 | const NX_NSS_CD_OK: i64 = 1 |
| 88 | const NX_NSS_CD_TRUNCATED: i64 = 2 |
| 89 | const NX_NSS_CD_BAD_ESCAPE: i64 = 3 |
| 90 | const NX_NSS_CD_OUTPUT_FULL: i64 = 4 |
| 91 | const NX_NSS_CD_NO_CERTS: i64 = 5 |
| 92 | const NX_NSS_CD_TOO_MANY: i64 = 6 |
| 93 | const NX_NSS_CD_BAD_DER_SIZE: i64 = 7 |
| 94 | const NX_NSS_CD_VERDICT_N: i64 = 8 |
| 96 | const NX_NSS_CD_MAX_CERTS: i64 = 256 // cap on certs per bundle |
| 97 | const NX_NSS_CD_MAX_DER_SIZE: i64 = 16384 // 16KB per cert (real roots are 1-3KB) |
| 100 | const _ST_IDLE: i64 = 0 |
| 101 | const _ST_IN_CERT: i64 = 1 |
| 102 | const _ST_IN_VALUE: i64 = 2 |
functions
| 104 | func nx_nss_certdata_verdict_is_valid(v: i64) -> i64 called by 1: main |
| 113 | func _is_space(b: i64) -> i64 called by 1: _parse_octal_line |
| 121 | func _is_octal(b: i64) -> i64 called by 1: _decode_octal_escape |
| 129 | func _starts_with(buf: *u8, off: i64, in_len: i64, called by 1: nx_nss_certdata_parse |
| 142 | func _find_newline(buf: *u8, off: i64, in_len: i64) -> i64 called by 1: nx_nss_certdata_parse |
| 153 | func _pat_class_cert(buf: *u8) -> i64 called by 1: nx_nss_certdata_parse |
| 169 | func _pat_value_octal(buf: *u8) -> i64 called by 1: nx_nss_certdata_parse |
| 181 | func _pat_end(buf: *u8) -> i64 called by 1: nx_nss_certdata_parse |
| 189 | func _decode_octal_escape(buf: *u8, off: i64, in_len: i64, |
| 206 | func _parse_octal_line( |
| 232 | func nx_nss_certdata_parse( |
| 341 | func main() -> i64 |