nx_cert_registry_gate.nx source

1// nx_cert_registry_gate.nx -- PURE gate for the data-driven SNI cert registry. Proves: EXACT host beats wildcard, 2// wildcard serves a sub-label, the '*' default catches the rest, case-insensitivity (DNS), and -- the LOAD-BEARING 3// security test -- ANTI-SPOOF: `evilnishifamily.com` must NOT be served the `*.nishifamily.com` cert. GREEN iff T1..T9. 4// Sovereign: nx_cert_registry + nx_syscalls. license_tier: ORIGINAL 5import "nx_cert_registry.nx" 6import "nx_syscalls.nx" 7 8func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 9func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 10func g_row(name: *u8, ok: i64) -> i64 { 11 if ok == 1 { g_w(" PASS " as *u8) } else { g_w(" FAIL " as *u8) } 12 g_w(name); g_w("\n" as *u8) 13 return ok 14} 15func g_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 } 16 17// match host against the table; assert it matched AND the chain path == want_chain. 18func g_chain(tab: *u8, n: i64, host: *u8, want_chain: *u8) -> i64 { 19 let cb: *u8 = sys_mmap(512); let kb: *u8 = sys_mmap(512) 20 let m: i64 = cr_match(tab, n, host, g_len(host), cb, kb) 21 if m != 1 { return 0 } 22 return g_streq(cb, want_chain) 23} 24 25func main() -> i64 { 26 g_w("cert-registry gate (DATA-DRIVEN SNI cert selection: exact>wildcard>default, label-safe ANTI-SPOOF)\n" as *u8) 27 let tab: *u8 = "# host -> chain key (the forge emits these rows)\nnishifamily.com certs/nf_apex.der certs/nf_apex.key\n*.nishifamily.com certs/nf_wild.der certs/nf_wild.key\n*.andelinwest.com certs/aw_wild.der certs/aw_wild.key\n* certs/default.der certs/default.key\n" as *u8 28 let n: i64 = g_len(tab) 29 var pass: i64 = 0 30 31 pass = pass + g_row("T1 nishifamily.com (apex) -> nf_apex.der (EXACT beats wildcard)\x00" as *u8, g_chain(tab, n, "nishifamily.com" as *u8, "certs/nf_apex.der" as *u8)) 32 pass = pass + g_row("T2 www.nishifamily.com -> nf_wild.der (wildcard sub-label)\x00" as *u8, g_chain(tab, n, "www.nishifamily.com" as *u8, "certs/nf_wild.der" as *u8)) 33 // ★ T3: ANTI-SPOOF -- evilnishifamily.com must NOT get the *.nishifamily.com cert -> falls to the default 34 pass = pass + g_row("T3 evilnishifamily.com -> default.der (ANTI-SPOOF: NOT the *.nishifamily.com cert)\x00" as *u8, g_chain(tab, n, "evilnishifamily.com" as *u8, "certs/default.der" as *u8)) 35 pass = pass + g_row("T4 foo.andelinwest.com -> aw_wild.der (the OTHER domain's wildcard)\x00" as *u8, g_chain(tab, n, "foo.andelinwest.com" as *u8, "certs/aw_wild.der" as *u8)) 36 pass = pass + g_row("T5 random.org -> default.der ('*' default catches the rest)\x00" as *u8, g_chain(tab, n, "random.org" as *u8, "certs/default.der" as *u8)) 37 // T6: a single wildcard label only -- a.b.nishifamily.com is TWO labels -> NOT the wildcard -> default 38 pass = pass + g_row("T6 a.b.nishifamily.com -> default.der (wildcard = exactly ONE label)\x00" as *u8, g_chain(tab, n, "a.b.nishifamily.com" as *u8, "certs/default.der" as *u8)) 39 // T7: case-insensitive (DNS) -- uppercase SNI still matches the wildcard 40 pass = pass + g_row("T7 WWW.NishiFamily.COM -> nf_wild.der (case-insensitive)\x00" as *u8, g_chain(tab, n, "WWW.NishiFamily.COM" as *u8, "certs/nf_wild.der" as *u8)) 41 // T8: the KEY path is returned alongside the chain 42 var t8: i64 = 0 43 let cb: *u8 = sys_mmap(512); let kb: *u8 = sys_mmap(512) 44 if cr_match(tab, n, "www.nishifamily.com" as *u8, 19, cb, kb) == 1 { if g_streq(kb, "certs/nf_wild.key" as *u8) == 1 { t8 = 1 } } 45 pass = pass + g_row("T8 the matched KEY path is returned (nf_wild.key)\x00" as *u8, t8) 46 // T9: NO default '*' + an unknown host -> NO match (caller falls back to its own default; fail-closed) 47 let tab2: *u8 = "nishifamily.com certs/nf_apex.der certs/nf_apex.key\n*.nishifamily.com certs/nf_wild.der certs/nf_wild.key\n" as *u8 48 let n2: i64 = g_len(tab2) 49 let cb2: *u8 = sys_mmap(512); let kb2: *u8 = sys_mmap(512) 50 var t9: i64 = 0 51 if cr_match(tab2, n2, "random.org" as *u8, 10, cb2, kb2) == 0 { t9 = 1 } 52 pass = pass + g_row("T9 no '*' default + unknown host -> NO match (fail-closed)\x00" as *u8, t9) 53 54 if pass == 9 { 55 let lg: i64 = sys_openat_append("knowledge/status/cert_registry_gate.log" as *u8, 0x1a4) 56 if lg >= 0 { sys_write(lg, "CERT-REGISTRY-GATE pass=9/9 verdict=GREEN\n" as *u8, 41); sys_close(lg) } 57 g_w("CERT-REGISTRY GATE GREEN 9/9 (data-driven SNI: exact>wildcard>default, ANTI-SPOOF, case-insensitive)\n" as *u8) 58 sys_exit(0) 59 } 60 g_w("CERT-REGISTRY GATE RED\n" as *u8) 61 sys_exit(1) 62 return 1 63}