nx_ch_census_oracle.nx source

1// nx_ch_census_oracle.nx -- per-assignment ORACLE STAGER for the CH-census race under the 2// generic referee (nx_race_referee). Composes the TEAM's own pieces: _pe_chwalk (STRUCT_WALK- 3// authored) locates the extension block of the real emitted ClientHello; the SHIPPED 4// tls13_ext_find supplies ground-truth offsets (it predates every lane = neutral). Writes: 5// /tmp/race_block.bin /tmp/race_trunc.bin /tmp/race_empty.bin the three case inputs 6// /tmp/race_manifest.txt lanes + cases + 12 rows with oracle wants 7// /tmp/race_manifest_tampered.txt same but row 1's want is +1 -- staging THIS manifest must 8// turn the referee RED (proves the harness can fail) 9// A NEW assignment = a new oracle stager like this one + the same referee. license_tier: ORIGINAL 10import "nx_syscalls.nx" 11import "nx_csprng.nx" 12import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 13import "nx_tls13_client_session.nx" 14import "nx_tls13_hello.nx" 15import "_hdl_build/_pe_chwalk.nx" 16const K_MAGIC_1024: i64 = 1024 17 18func oc_puts(fd: i64, s: *u8) -> i64 { 19 var n: i64 = 0 20 while s[n] != (0 as u8) { n = n + 1 } 21 sys_write(fd, s, n) 22 return 0 23} 24 25// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 26// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 27// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 28// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 29func oc_putn(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 } 30 31func oc_write_file(path: *u8, b: *u8, n: i64) -> i64 { 32 let fd: i64 = sys_openat_wr(path, 0x1a4) 33 if fd < 0 { return 0 - 1 } 34 if n > 0 { sys_write(fd, b, n) } 35 sys_close(fd) 36 return 0 37} 38 39// emit one "row <case> <key> <want>" line 40func oc_row(fd: i64, casen: *u8, key: *u8, want: i64) -> i64 { 41 oc_puts(fd, "row \x00" as *u8) 42 oc_puts(fd, casen) 43 oc_puts(fd, " \x00" as *u8) 44 oc_puts(fd, key) 45 oc_puts(fd, " \x00" as *u8) 46 oc_putn(fd, want) 47 oc_puts(fd, "\n\x00" as *u8) 48 return 0 49} 50 51// write one manifest; tamper=1 bumps the first real-case want by +1 52func oc_manifest(path: *u8, exp: *i64, tamper: i64) -> i64 { 53 let fd: i64 = sys_openat_wr(path, 0x1a4) 54 if fd < 0 { return 0 - 1 } 55 oc_puts(fd, "lane team /tmp/_team_ch_census.elf\n\x00" as *u8) 56 oc_puts(fd, "lane claude /tmp/_claude_ch_census.elf\n\x00" as *u8) 57 oc_puts(fd, "case real /tmp/race_block.bin\n\x00" as *u8) 58 oc_puts(fd, "case trunc /tmp/race_trunc.bin\n\x00" as *u8) 59 oc_puts(fd, "case empty /tmp/race_empty.bin\n\x00" as *u8) 60 var bump: i64 = 0 61 if tamper == 1 { bump = 1 } 62 oc_row(fd, "real\x00" as *u8, "SNI=\x00" as *u8, exp[0] + bump) 63 oc_row(fd, "real\x00" as *u8, "GR=\x00" as *u8, exp[1]) 64 oc_row(fd, "real\x00" as *u8, "SG=\x00" as *u8, exp[2]) 65 oc_row(fd, "real\x00" as *u8, "SV=\x00" as *u8, exp[3]) 66 oc_row(fd, "real\x00" as *u8, "KS=\x00" as *u8, exp[4]) 67 oc_row(fd, "trunc\x00" as *u8, "EXTN=\x00" as *u8, 0 - 1) 68 oc_row(fd, "empty\x00" as *u8, "EXTN=\x00" as *u8, 0) 69 oc_row(fd, "empty\x00" as *u8, "SNI=\x00" as *u8, 0 - 1) 70 oc_row(fd, "empty\x00" as *u8, "GR=\x00" as *u8, 0 - 1) 71 oc_row(fd, "empty\x00" as *u8, "SG=\x00" as *u8, 0 - 1) 72 oc_row(fd, "empty\x00" as *u8, "SV=\x00" as *u8, 0 - 1) 73 oc_row(fd, "empty\x00" as *u8, "KS=\x00" as *u8, 0 - 1) 74 sys_close(fd) 75 return 0 76} 77 78func main() -> i64 { 79 // the real CH + the TEAM's locate 80 let host: *u8 = "example.com\x00" 81 let cr: *u8 = sys_mmap(32) 82 let priv: *u8 = sys_mmap(32) 83 var i: i64 = 0 84 nx_csprng_fill(cr, 32); nx_csprng_fill(priv, 32) // CWE-330 (debt 1785970852): were the constants 0xC0../0xA0.. on EVERY session 85 let s: *Tls13ClientSession = nx_tls13_client_session_new(cr, priv) 86 let ch: *u8 = sys_mmap(K_MAGIC_1024) 87 let ch_n: i64 = nx_tls13_client_session_emit_ch(s, host, 11, ch, K_MAGIC_1024) 88 if ch_n < 8 { return 1 } 89 let out: *i64 = sys_mmap(32) as *i64 90 if _pe_chwalk_locate(ch, ch_n, out) != 0 { return 2 } 91 let blk: *u8 = ch + out[0] 92 let blen: i64 = out[1] 93 if blen < 1 { return 3 } 94 95 // case inputs 96 if oc_write_file("/tmp/race_block.bin\x00" as *u8, blk, blen) != 0 { return 7 } 97 var tn: i64 = blen - 3 98 if tn < 0 { tn = 0 } 99 if oc_write_file("/tmp/race_trunc.bin\x00" as *u8, blk, tn) != 0 { return 8 } 100 if oc_write_file("/tmp/race_empty.bin\x00" as *u8, blk, 0) != 0 { return 9 } 101 102 // shipped-oracle expectations for the real case 103 let exp: *i64 = sys_mmap(64) as *i64 104 let types: *i64 = sys_mmap(64) as *i64 105 types[0] = 0; types[1] = 10; types[2] = 13; types[3] = 43; types[4] = 51 106 let p_off: *i64 = sys_mmap(16) as *i64 107 let p_len: *i64 = sys_mmap(16) as *i64 108 var ti: i64 = 0 109 while ti < 5 { 110 var want: i64 = 0 - 1 111 if tls13_ext_find(blk, blen, types[ti], p_off, p_len) == NX_TLS13_HELLO_VERDICT_OK { want = *p_off } 112 exp[ti] = want 113 ti = ti + 1 114 } 115 116 if oc_manifest("/tmp/race_manifest.txt\x00" as *u8, exp, 0) != 0 { return 10 } 117 if oc_manifest("/tmp/race_manifest_tampered.txt\x00" as *u8, exp, 1) != 0 { return 11 } 118 oc_puts(1, "ORACLE-OK block_len=\x00" as *u8) 119 oc_putn(1, blen) 120 oc_puts(1, " manifests=2\n\x00" as *u8) 121 return 0 122}