nx_x509_validity.nx
buildroot/runtime/nx_x509_validity.nx
about
nx_x509_validity.nx -- X.509 Validity period parse + check.
Phase 0b §I.2.B of the Nishi TLS 1.3 stack. Composes the
X509Cert.validity_off/len (captured by nx_x509.x509_parse) with
the shipped parse_utctime / parse_gentime helpers in nx_timefmt
to produce notBefore / notAfter as Unix epoch seconds, and
gates a now_epoch against that range.
X.509 Validity ASN.1 (RFC 5280 §4.1.2.5):
Validity ::= SEQUENCE {
notBefore Time,
notAfter Time
}
Time ::= CHOICE {
utcTime UTCTime, -- ASN.1 tag 0x17, 13 bytes "YYMMDDhhmmssZ"
generalTime GeneralizedTime -- ASN.1 tag 0x18, 15 bytes "YYYYMMDDhhmmssZ"
}
Per RFC 5280, dates with year < 2050 use UTCTime; dates >= 2050
must use GeneralizedTime. Web PKI uses UTCTime almost universally
today; GeneralizedTime support is required for parsing Let's
Encrypt's distant-future "magic" notAfter on long-lived roots.
What this primitive does:
- x509_validity_get(buf, cert, out_nb_epoch, out_na_epoch)
parses the two Time fields out of the validity SEQUENCE body
and writes epoch-seconds to caller's out slots. Returns a
sealed verdict.
- x509_validity_check(buf, cert, now_epoch_secs)
calls validity_get internally and decides OK / NOT_YET_VALID /
EXPIRED. This is the function the chain-walker will call.
- nx_x509_validity_verdict_is_valid(v) sealed-enum gate.
What it does NOT do (intentionally split, single-responsibility):
- Outer cert signature verify (x509_verify_signature_ed25519)
- SAN hostname match (queued §I.2.C)
dependencies 4 imports · 6 importers
imports: nx_syscalls.nxnx_asn1.nxnx_x509.nxnx_timefmt.nx
imported by: nx_cert_debug.nxnx_cert_monitor.nxnx_edge_probe.nxnx_x509_leaf_check.nxnx_x509_leaf_check_test.nxnx_x509_validity_test.nx
structs
| none |
consts
| 68 | const NX_X509_VALID_OK: i64 = 1 |
| 69 | const NX_X509_VALID_NOT_YET_VALID: i64 = 2 |
| 70 | const NX_X509_VALID_EXPIRED: i64 = 3 |
| 71 | const NX_X509_VALID_BAD_FORMAT: i64 = 4 |
| 72 | const NX_X509_VALID_BAD_TAG: i64 = 5 |
| 73 | const NX_X509_VALID_BAD_LENGTH: i64 = 6 |
| 74 | const NX_X509_VALID_INVERTED: i64 = 7 // notBefore > notAfter |
| 75 | const NX_X509_VALID_NO_VALIDITY: i64 = 8 // cert.validity_len == 0 |
| 76 | const NX_X509_VALID_VERDICT_N: i64 = 9 |
functions
| 78 | func nx_x509_validity_verdict_is_valid(v: i64) -> i64 called by 1: main |
| 96 | func x509_read_time_tlv(buf: *u8, off: i64, remaining: i64, |
| 138 | func x509_validity_get(buf: *u8, cert: *X509Cert, called by 7: maindbg_certcm_statusmainep_autopsyx509_validity_check+1 calls 2: sys_mmapx509_read_time_tlv |
| 182 | func x509_validity_check(buf: *u8, cert: *X509Cert, |
| 194 | func main() -> i64 |