nx_ch_census_race_stage.nx source
↩ module page · 87 lines · 3690 B
1// nx_ch_census_race_stage.nx -- NEUTRAL input stager for the CH-census autonomy race
2// (operator: "have the team do an assignment and you do it and see where they can grow to
3// match or exceed you"). Emits the browser's REAL ClientHello (nx_tls13_client_session_emit_ch,
4// deterministic), locates the extension block, and stages THREE race inputs both lanes consume
5// identically:
6// /tmp/race_block.bin the real extension block (the assignment's live data)
7// /tmp/race_trunc.bin the same block cut 3 bytes short (mid-entry truncation)
8// /tmp/race_empty.bin zero bytes (empty extension list)
9// This stager is RACE INFRASTRUCTURE, not a lane: both lanes get byte-identical inputs, so
10// neither lane's author touches the other's data path. license_tier: ORIGINAL
11import "nx_syscalls.nx"
12import "nx_csprng.nx"
13import "nx_tls13_client_session.nx"
14const K_MAGIC_1024: i64 = 1024
15
16func st_dec(label0: i64, label1: i64, v: i64) -> i64 {
17 let lab: *u8 = sys_mmap(8)
18 lab[0] = label0 as u8; lab[1] = label1 as u8; lab[2] = 0x3D
19 sys_write(1, lab, 3)
20 var av: i64 = v
21 if av < 0 {
22 let neg: *u8 = sys_mmap(8); neg[0] = 0x2D; sys_write(1, neg, 1)
23 av = 0 - av
24 }
25 if av == 0 {
26 let z: *u8 = sys_mmap(8); z[0] = 0x30; sys_write(1, z, 1)
27 }
28 if av > 0 {
29 let buf: *u8 = sys_mmap(32)
30 var pos: i64 = 0
31 var x: i64 = av
32 while x > 0 { buf[pos] = (0x30 + (x % 10)) as u8; x = x / 10; pos = pos + 1 }
33 let out: *u8 = sys_mmap(32)
34 var oi: i64 = 0
35 while oi < pos { out[oi] = buf[pos - 1 - oi]; oi = oi + 1 }
36 sys_write(1, out, pos)
37 }
38 let nl: *u8 = sys_mmap(8); nl[0] = 0x0A; sys_write(1, nl, 1)
39 return 0
40}
41
42func st_write_file(path: *u8, b: *u8, n: i64) -> i64 {
43 let fd: i64 = sys_openat_wr(path, 0x1a4)
44 if fd < 0 { return 0 - 1 }
45 if n > 0 { sys_write(fd, b, n) }
46 sys_close(fd)
47 return 0
48}
49
50func main() -> i64 {
51 let host: *u8 = "example.com\x00"
52 let cr: *u8 = sys_mmap(32)
53 let priv: *u8 = sys_mmap(32)
54 var i: i64 = 0
55 nx_csprng_fill(cr, 32); nx_csprng_fill(priv, 32) // CWE-330 (debt 1785970852): were the constants 0xC0../0xA0.. on EVERY session
56 let s: *Tls13ClientSession = nx_tls13_client_session_new(cr, priv)
57 let ch: *u8 = sys_mmap(K_MAGIC_1024)
58 let ch_n: i64 = nx_tls13_client_session_emit_ch(s, host, 11, ch, K_MAGIC_1024)
59 st_dec(0x43, 0x48, ch_n) // CH=
60 if ch_n < 8 { return 1 }
61
62 // walk the ClientHello structure to the extension block:
63 // [hs hdr:4][version:2][random:32][sid:1+n][suites:2+n][comp:1+n][ext_total:2][block]
64 var off: i64 = 4 + 2 + 32
65 if off >= ch_n { return 2 }
66 let sid_len: i64 = ch[off] & 0xff
67 off = off + 1 + sid_len
68 if off + 2 > ch_n { return 3 }
69 let cs_len: i64 = ((ch[off] & 0xff) << 8) | (ch[off + 1] & 0xff)
70 off = off + 2 + cs_len
71 if off >= ch_n { return 4 }
72 let comp_len: i64 = ch[off] & 0xff
73 off = off + 1 + comp_len
74 if off + 2 > ch_n { return 5 }
75 let ext_total: i64 = ((ch[off] & 0xff) << 8) | (ch[off + 1] & 0xff)
76 let block: *u8 = ch + off + 2
77 if off + 2 + ext_total > ch_n { return 6 }
78 st_dec(0x45, 0x4C, ext_total) // EL=
79
80 if st_write_file("/tmp/race_block.bin\x00" as *u8, block, ext_total) != 0 { return 7 }
81 var tn: i64 = ext_total - 3
82 if tn < 0 { tn = 0 }
83 if st_write_file("/tmp/race_trunc.bin\x00" as *u8, block, tn) != 0 { return 8 }
84 if st_write_file("/tmp/race_empty.bin\x00" as *u8, block, 0) != 0 { return 9 }
85 st_dec(0x4F, 0x4B, 1) // OK=
86 return 0
87}