nx_cert_loader_gate.nx source

1// nx_cert_loader_gate.nx -- gate for the cert data-loader. Writes fixture chain/key files, then asserts cl_load 2// resolves a SNI host (via cr_match) and returns the ACTUAL chain+key bytes -- with anti-spoof carried through and 3// a missing file -> 0 (fail-safe, the daemon uses its default). GREEN iff T1..T5. Sovereign: nx_cert_loader. license_tier: ORIGINAL 4import "nx_cert_loader.nx" 5 6func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 7func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 8func g_row(name: *u8, ok: i64) -> i64 { if ok == 1 { g_w(" PASS " as *u8) } else { g_w(" FAIL " as *u8) } g_w(name); g_w("\n" as *u8); return ok } 9func g_writef(path: *u8, s: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd < 0 { return 0-1 } sys_write(fd, s, g_len(s)); sys_close(fd); return 0 } 10// bytes at ptr (len) == null-terminated expect? 11func g_bytes_eq(ptr: i64, len: i64, exp: *u8) -> i64 { 12 let el: i64 = g_len(exp); if len != el { return 0 } 13 let b: *u8 = ptr as *u8; var i: i64 = 0 14 while i < len { if (b[i] as i64) != (exp[i] as i64) { return 0 } i = i + 1 } 15 return 1 16} 17 18const CL_REG: *u8 = "*.nishifamily.com /tmp/cl_nf.der /tmp/cl_nf.key\n*.andelinwest.com /tmp/cl_aw.der /tmp/cl_aw.key\nbrokensite.com /tmp/cl_missing.der /tmp/cl_missing.key\n* /tmp/cl_def.der /tmp/cl_def.key\n" as *u8 19 20func g_chain(sni: *u8, want: *u8) -> i64 { 21 let cp: *i64 = sys_mmap(8) as *i64; let cl: *i64 = sys_mmap(8) as *i64 22 let kp: *i64 = sys_mmap(8) as *i64; let kl: *i64 = sys_mmap(8) as *i64 23 cp[0]=0; cl[0]=0; kp[0]=0; kl[0]=0 24 let n: i64 = g_len(CL_REG) 25 if cl_load(CL_REG, n, sni, g_len(sni), cp, cl, kp, kl) != 1 { return 0 } 26 return g_bytes_eq(cp[0], cl[0], want) 27} 28 29func main() -> i64 { 30 g_w("cert-loader gate (SNI -> cr_match -> load chain+key BYTES for the handshake)\n" as *u8) 31 g_writef("/tmp/cl_nf.der" as *u8, "NF-CHAIN-DER-BYTES" as *u8) 32 g_writef("/tmp/cl_nf.key" as *u8, "NF-KEY-BYTES" as *u8) 33 g_writef("/tmp/cl_aw.der" as *u8, "AW-CHAIN-DER" as *u8) 34 g_writef("/tmp/cl_aw.key" as *u8, "AW-KEY" as *u8) 35 g_writef("/tmp/cl_def.der" as *u8, "DEFAULT-CHAIN" as *u8) 36 g_writef("/tmp/cl_def.key" as *u8, "DEFAULT-KEY" as *u8) 37 // /tmp/cl_missing.* are deliberately NOT created 38 var pass: i64 = 0 39 40 pass = pass + g_row("T1 www.nishifamily.com -> loaded NF chain bytes\x00" as *u8, g_chain("www.nishifamily.com" as *u8, "NF-CHAIN-DER-BYTES" as *u8)) 41 pass = pass + g_row("T2 foo.andelinwest.com -> loaded AW chain bytes\x00" as *u8, g_chain("foo.andelinwest.com" as *u8, "AW-CHAIN-DER" as *u8)) 42 pass = pass + g_row("T3 evilnishifamily.com -> DEFAULT chain (ANTI-SPOOF carried through the loader)\x00" as *u8, g_chain("evilnishifamily.com" as *u8, "DEFAULT-CHAIN" as *u8)) 43 pass = pass + g_row("T4 random.org -> DEFAULT chain\x00" as *u8, g_chain("random.org" as *u8, "DEFAULT-CHAIN" as *u8)) 44 45 // T5: a row whose cert FILE is missing -> cl_load returns 0 (fail-safe; daemon uses its built-in default) 46 let cp: *i64 = sys_mmap(8) as *i64; let cl: *i64 = sys_mmap(8) as *i64; let kp: *i64 = sys_mmap(8) as *i64; let kl: *i64 = sys_mmap(8) as *i64 47 let n: i64 = g_len(CL_REG) 48 var t5: i64 = 0 49 if cl_load(CL_REG, n, "brokensite.com" as *u8, g_len("brokensite.com" as *u8), cp, cl, kp, kl) == 0 { t5 = 1 } 50 pass = pass + g_row("T5 missing cert file -> cl_load 0 (fail-safe to built-in default)\x00" as *u8, t5) 51 52 if pass == 5 { 53 let lg: i64 = sys_openat_append("knowledge/status/cert_loader_gate.log" as *u8, 0x1a4) 54 if lg >= 0 { sys_write(lg, "CERT-LOADER-GATE pass=5/5 verdict=GREEN\n" as *u8, 39); sys_close(lg) } 55 g_w("CERT-LOADER GATE GREEN 5/5 (SNI -> matched chain+key bytes; anti-spoof + fail-safe)\n" as *u8) 56 sys_exit(0) 57 } 58 g_w("CERT-LOADER GATE RED\n" as *u8) 59 sys_exit(1) 60 return 1 61}