code wiki / (root) / nx_x509_leaf_emit.nx

nx_x509_leaf_emit.nx

buildroot/runtime/nx_x509_leaf_emit.nx

10579 B197 linesdepth 10pulls 16 transitivereach 14 importersview sourcekind tooltopic x509

docs dependencies structs consts functions

about

nx_x509_leaf_emit.nx -- self-signed Ed25519 X.509 leaf-certificate emitter (RFC 5280 + RFC 8410). mTLS rung R4 of the NO-COOKIE session carrier. Mints the CLIENT IDENTITY certificate the browser presents at the TLS layer: a self-signed Ed25519 leaf whose Subject CN carries the sovereign identity (e.g. hex(user_id_hash)). R5 derives the keypair from the OPAQUE export_key + packages this cert as PKCS#12; R3 verifies a presented cert's CertificateVerify against the pubkey parsed out of it; R6 reads the Subject CN -> handle -> HR entitlements. Certificate ::= SEQUENCE { tbsCertificate, signatureAlgorithm, signatureValue BIT STRING } TBSCertificate ::= SEQUENCE { [0]{INTEGER v3(2)}, serial INTEGER, sigAlg, issuer Name, validity, subject Name, subjectPublicKeyInfo } (extensions omitted -- OPTIONAL) Self-signed: issuer == subject; signatureValue = Ed25519 over DER(tbsCertificate). SYSCALL-VARIANT NOTE (Rule 23 -- comment the WHY): the x509 VERIFY stack (nx_x509 / nx_x509_validate / nx_ed25519_signature) imports nx_syscalls.nx, but nx_x509_csr_emit imports nx_syscalls_x86_64.nx -- importing both = duplicate sys_* link error. So this file stays on nx_syscalls.nx and reimplements the few small ASN.1 Name/SPKI helpers inline (pure nxae_ compositions) rather than import the CSR emitter. Composes nx_asn1_emit (DER) + nx_ed25519_signature (sign). license_tier: ORIGINAL expect_exit: 0

dependencies 5 imports · 4 importers

imports: nx_syscalls.nxnx_asn1_emit.nxnx_ed25519_signature.nxnx_x509.nxnx_x509_validate.nx

imported by: nx_mtls_authz.nxnx_mtls_identity.nxnx_mtls_pkcs12.nxnx_tls13_server_clientauth.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

24	const K_MAGIC_2048: i64 = 2048
25	const K_MAGIC_4096: i64 = 4096

functions

27	func lf_oid_ed25519(out: *u8) -> i64 { out[0] = 0x2b as u8; out[1] = 0x65 as u8; out[2] = 0x70 as u8; return 3 } called by 2: lf_emit_spki_ed25519 lf_emit_sigalg
28	func lf_oid_cn(out: *u8) -> i64 { out[0] = 0x55 as u8; out[1] = 0x04 as u8; out[2] = 0x03 as u8; return 3 } called by 1: lf_emit_name_cn
31	func lf_emit_spki_ed25519(out: u8, off: i64, cap: i64, pubkey_32: *u8) -> i64 called by 1: nx_x509_leaf_emit_ed25519 calls 5: sys_mmap lf_oid_ed25519 nxae_put_oid nxae_put_tlv nxae_put_bit_string
43	func lf_emit_name_cn(out: u8, off: i64, cap: i64, cn: *u8, cn_n: i64) -> i64 called by 1: nx_x509_leaf_emit_ed25519 calls 5: sys_mmap lf_oid_cn nxae_put_oid nxae_put_utf8 nxae_put_tlv
57	func lf_emit_sigalg(out: u8, off: i64, cap: i64) -> i64 called by 1: nx_x509_leaf_emit_ed25519 calls 4: sys_mmap lf_oid_ed25519 nxae_put_oid nxae_put_tlv
66	func lf_emit_validity(out: u8, off: i64, cap: i64, nb_13: u8, na_13: u8) -> i64 called by 1: nx_x509_leaf_emit_ed25519 calls 2: sys_mmap nxae_put_tlv
76	func nx_x509_leaf_emit_ed25519( called by 5: az_mint nx_mtls_mint_identity_cert main ca_mint main calls 11: sys_mmap nxae_put_int_u8 nxae_put_context_explicit nxae_put_tlv lf_emit_sigalg lf_emit_name_cn+5
127	func lf_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } called by 2: lf_row main calls 1: sys_write
128	func lf_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 1: main
129	func lf_row(name: u8, ok: i64) -> i64 { if ok == 1 { lf_w(" PASS " as u8) } else { lf_w(" FAIL " as u8) } lf_w(name); lf_w("\n" as u8); return ok } called by 1: main calls 1: lf_w
131	func main() -> i64 calls 9: lf_w sys_mmap ed25519_pub_from_priv lf_len nx_x509_leaf_emit_ed25519 lf_row+3