code wiki / _hdl_build / nx_cert_loader.nx
nx_cert_loader.nx source
↩ module page · 29 lines · 1491 B
1// nx_cert_loader.nx -- the DATA bridge from the cert REGISTRY (paths) to the TLS handshake (BYTES). The reconciled
2// daemon (R3-transport) does, per connection: MSG_PEEK ClientHello -> SNI host -> cl_load(registry, sni) -> the
3// DER chain bytes + the key bytes -> nx_tls13_server_session_run(cfd, rnd, priv, chain, chain_len, key). This
4// composes the gated cert matcher (nx_cert_registry / cr_match) + reads the matched chain + key files. Returns 1 +
5// fills the (ptr,len) out-boxes, or 0 (then the daemon falls back to its built-in default cert -- fail-safe, never
6// crash the handshake). license_tier: ORIGINAL
7import "nx_cert_registry.nx"
8
9// SNI host -> (chain bytes, len) + (key bytes, len). chain_pp/key_pp receive the buffer pointer (as i64). 1/0.
10func cl_load(reg: *u8, n: i64, sni: *u8, shn: i64, chain_pp: *i64, chain_lp: *i64, key_pp: *i64, key_lp: *i64) -> i64 {
11 let chainpath: *u8 = sys_mmap(512)
12 let keypath: *u8 = sys_mmap(512)
13 if cr_match(reg, n, sni, shn, chainpath, keypath) == 0 { return 0 }
14 let csz: *i64 = sys_mmap(16) as *i64
15 csz[0] = 0
16 let cb: *u8 = sys_read_file(chainpath, csz)
17 if (cb as i64) == 0 { return 0 }
18 if csz[0] <= 0 { return 0 }
19 let ksz: *i64 = sys_mmap(16) as *i64
20 ksz[0] = 0
21 let kb: *u8 = sys_read_file(keypath, ksz)
22 if (kb as i64) == 0 { return 0 }
23 if ksz[0] <= 0 { return 0 }
24 chain_pp[0] = cb as i64
25 chain_lp[0] = csz[0]
26 key_pp[0] = kb as i64
27 key_lp[0] = ksz[0]
28 return 1
29}