nx_cert_autorenew_gate.nx source

1// nx_cert_autorenew_gate.nx -- SOVEREIGN gate for the per-domain wildcard cert AUTO-RENEWAL logic. 2// Proves the LOGIC the unattended renewer rests on, WITHOUT a heavy live LE issuance (that burns LE budget 3// and needs the Porkbun vault + 4-min DNS propagation): the gate exercises only pure functions. 4// 5// (a) VERDICT: synthesize a validity field, parse notAfter via the REUSED x509_validity_get, and assert 6// cm_verdict -> CM_WARN for a cert inside the 21d window, CM_OK far out, CM_EXPIRED past. This is the 7// exact threshold core the live dual-epoch TLS probe (car_live_verdict) encodes. 8// (b) MAPPING: the domain -> path mapping the driver pushes on is byte-correct -- le_<label>_* for the live 9// SNI cert, /tmp/new_<domain>_* for the issue output -- for BOTH nishifamily.com and andelinwest.com. 10// (c) TRIGGER: car_should_renew fires ONLY on WARN/EXPIRED (never on OK or NOCERT/unreachable). 11// 12// exit 0 = GREEN ; exit N = assertion N failed. license_tier: ORIGINAL 13import "nx_cert_autorenew_lib.nx" 14import "nx_assert.nx" 15 16// write a UTCTime TLV at off: tag 0x17, len 0x0D (13), value "YYMMDDhhmmssZ". returns next offset. 17// (identical fixture shape to nx_cert_monitor_gate -- proven to round-trip through x509_validity_get.) 18func g_time(buf: *u8, off: i64, s: *u8) -> i64 { 19 buf[off] = 0x17 as u8; buf[off+1] = 0x0D as u8 20 var i: i64 = 0; while i < 13 { buf[off+2+i] = s[i]; i = i + 1 } 21 return off + 15 22} 23 24func main() -> i64 { 25 // ===== (a) VERDICT LOGIC on a synthesized fixture cert ===== 26 let v: *u8 = sys_mmap(64); var p: i64 = 0 27 p = g_time(v, p, "200101000000Z" as *u8) // notBefore 2020-01-01 28 p = g_time(v, p, "270101000000Z" as *u8) // notAfter 2027-01-01 (a real epoch to drive cm_verdict) 29 let vlen: i64 = p 30 let cert: *X509Cert = sys_mmap(1024) as *X509Cert 31 cert.validity_off = 0; cert.validity_len = vlen 32 let nb: *i64 = sys_mmap(16) as *i64; let na: *i64 = sys_mmap(16) as *i64 33 if x509_validity_get(v, cert, nb, na) != NX_X509_VALID_OK { return 1 } // sealed enum: OK == 1, NOT 0 34 if na[0] <= 0 { return 2 } 35 nx_puts_err("(a) notAfter_epoch="); nx_puti_err(na[0]) 36 // verdict KAT: hold notAfter fixed, vary "now" across the 21d (CM_WARN_DAYS) window. 37 let now_far: i64 = na[0] - 60 * 86400 // 60d before expiry -> well OUTSIDE the warn window 38 let now_warn: i64 = na[0] - 10 * 86400 // 10d before expiry -> INSIDE the 21d warn window 39 let now_exp: i64 = na[0] + 2 * 86400 // 2d AFTER expiry -> expired 40 if cm_verdict(na[0], now_far, CM_WARN_DAYS) != CM_OK { return 3 } 41 if cm_verdict(na[0], now_warn, CM_WARN_DAYS) != CM_WARN { return 4 } 42 if cm_verdict(na[0], now_exp, CM_WARN_DAYS) != CM_EXPIRED { return 5 } 43 44 // ===== (b) DOMAIN -> PATH MAPPING (the driver pushes le_<label>_*, reads /tmp/new_<domain>_*) ===== 45 let out: *u8 = sys_mmap(256) 46 car_label("nishifamily.com" as *u8, out) 47 if car_streq(out, "nishifamily" as *u8) == 0 { return 6 } 48 car_label("andelinwest.com" as *u8, out) 49 if car_streq(out, "andelinwest" as *u8) == 0 { return 7 } 50 car_issue_der("nishifamily.com" as *u8, out) 51 if car_streq(out, "/tmp/new_nishifamily.com_fullchain.der" as *u8) == 0 { return 8 } 52 car_issue_key("andelinwest.com" as *u8, out) 53 if car_streq(out, "/tmp/new_andelinwest.com_ecdsa_key.bin" as *u8) == 0 { return 9 } 54 car_remote_der("nishifamily" as *u8, out) 55 if car_streq(out, "/volume1/homes/elderwesto/nishihost/certs/le_nishifamily_fullchain.der" as *u8) == 0 { return 10 } 56 car_remote_key("andelinwest" as *u8, out) 57 if car_streq(out, "/volume1/homes/elderwesto/nishihost/certs/le_andelinwest_ecdsa_key.bin" as *u8) == 0 { return 11 } 58 nx_puts_err("(b) le_<label>_* live paths + /tmp/new_<domain>_* issue paths: byte-correct for both domains\n" as *u8) 59 60 // ===== (c) TRIGGER fires ONLY on WARN/EXPIRED ===== 61 if car_should_renew(CM_OK) != 0 { return 12 } // far out -> no renew 62 if car_should_renew(CM_WARN) != 1 { return 13 } // inside 21d -> RENEW 63 if car_should_renew(CM_EXPIRED) != 1 { return 14 } // past expiry -> RENEW 64 if car_should_renew(CM_NOCERT) != 0 { return 15 } // unreachable/unparseable -> do NOT blind-renew 65 66 nx_puts_err("--- vs the gap that started this arc (a per-domain wildcard cert SILENTLY lapsed) ---\n" as *u8) 67 nx_puts_err("nx_cert_autorenew_gate verdict=GREEN pass=15 (verdict thresholds + le_<dom>_* mapping + WARN/EXPIRED trigger)\n" as *u8) 68 return 0 69}