nx_chain_full_real_test.nx source
↩ module page · 125 lines · 4565 B
1// nx_chain_full_real_test.nx -- verify ALL 4 cert pairs of the real
2// example.com chain, with cert4 verified against the Comodo AAA root
3// (loaded directly from /tmp/comodo_aaa.der as a standalone fixture).
4//
5// Pairs:
6// cert1 (leaf) under cert2 (Cloudflare TLS Issuing ECC CA 1) -- ECDSA-P256-SHA256
7// cert2 under cert3 (SSL.com TLS Transit ECC CA R2) -- ECDSA-SHA384 + P-384 issuer
8// cert3 under cert4 (SSL.com TLS ECC Root CA 2022) -- ECDSA-SHA384 + P-384 issuer
9// cert4 under Comodo AAA Certificate Services -- RSA-PKCS#1-v1.5 SHA-256
10//
11// expect_exit: 0.
12// license_tier: ORIGINAL
13
14import "nx_syscalls.nx"
15import "nx_x509.nx"
16import "nx_x509_verify_under_issuer.nx"
17
18func read_to(path: *u8, out_buf: *u8, max: i64) -> i64 {
19 let len_p: *i64 = sys_mmap(16) as *i64
20 let p: *u8 = sys_read_file(path, len_p)
21 let n: i64 = *len_p
22 if n <= 0 { return 0 - 1 }
23 if n > max { return 0 - 2 }
24 var i: i64 = 0
25 while i < n { out_buf[i] = p[i]; i = i + 1 }
26 return n
27}
28
29func mkpath_cert(out: *u8, num: i64) -> i64 {
30 out[0]=0x2F; out[1]=0x74; out[2]=0x6D; out[3]=0x70
31 out[4]=0x2F; out[5]=0x63; out[6]=0x65; out[7]=0x72
32 out[8]=0x74
33 out[9] = (0x30 + num) as u8
34 out[10]=0x2E; out[11]=0x64; out[12]=0x65; out[13]=0x72
35 out[14] = 0
36 return 14
37}
38
39func mkpath_comodo(out: *u8) -> i64 {
40 let s: *u8 = "/tmp/comodo_aaa.der\x00"
41 var i: i64 = 0
42 while i < 20 { out[i] = s[i]; i = i + 1 }
43 return 19
44}
45
46func dump_dec(l0: i64, l1: i64, l2: i64, v: i64) -> i64 {
47 let lab: *u8 = sys_mmap(8)
48 lab[0]=l0 as u8; lab[1]=l1 as u8; lab[2]=l2 as u8; lab[3]=0x3D
49 sys_write(2, lab, 4)
50 var av: i64 = v
51 if av < 0 {
52 let neg: *u8 = sys_mmap(8); neg[0]=0x2D; sys_write(2, neg, 1)
53 av = 0 - av
54 }
55 let buf: *u8 = sys_mmap(16)
56 var pos: i64 = 0
57 if av == 0 { buf[0]=0x30; pos = 1 }
58 var x: i64 = av
59 while x > 0 {
60 buf[pos] = (0x30 + (x % 10)) as u8
61 x = x / 10; pos = pos + 1
62 }
63 let out: *u8 = sys_mmap(16); var oi: i64 = 0
64 while oi < pos { out[oi] = buf[pos - 1 - oi]; oi = oi + 1 }
65 sys_write(2, out, pos)
66 let nl: *u8 = sys_mmap(8); nl[0]=0x0A; sys_write(2, nl, 1)
67 return 0
68}
69
70func main() -> i64 {
71 // Load all 4 certs + Comodo AAA root.
72 let path: *u8 = sys_mmap(64)
73 mkpath_cert(path, 1)
74 let buf1: *u8 = sys_mmap(4096)
75 let n1: i64 = read_to(path, buf1, 4096)
76 if n1 <= 0 { return 11 }
77 mkpath_cert(path, 2)
78 let buf2: *u8 = sys_mmap(4096)
79 let n2: i64 = read_to(path, buf2, 4096)
80 if n2 <= 0 { return 12 }
81 mkpath_cert(path, 3)
82 let buf3: *u8 = sys_mmap(4096)
83 let n3: i64 = read_to(path, buf3, 4096)
84 if n3 <= 0 { return 13 }
85 mkpath_cert(path, 4)
86 let buf4: *u8 = sys_mmap(4096)
87 let n4: i64 = read_to(path, buf4, 4096)
88 if n4 <= 0 { return 14 }
89 mkpath_comodo(path)
90 let buf5: *u8 = sys_mmap(4096)
91 let n5: i64 = read_to(path, buf5, 4096)
92 if n5 <= 0 { return 15 }
93
94 // Parse each.
95 let c1_raw: *u8 = sys_mmap(512); let c1: *X509Cert = c1_raw as *X509Cert
96 let c2_raw: *u8 = sys_mmap(512); let c2: *X509Cert = c2_raw as *X509Cert
97 let c3_raw: *u8 = sys_mmap(512); let c3: *X509Cert = c3_raw as *X509Cert
98 let c4_raw: *u8 = sys_mmap(512); let c4: *X509Cert = c4_raw as *X509Cert
99 let c5_raw: *u8 = sys_mmap(512); let c5: *X509Cert = c5_raw as *X509Cert
100 if x509_parse(buf1, n1, c1) < 0 { return 21 }
101 if x509_parse(buf2, n2, c2) < 0 { return 22 }
102 if x509_parse(buf3, n3, c3) < 0 { return 23 }
103 if x509_parse(buf4, n4, c4) < 0 { return 24 }
104 if x509_parse(buf5, n5, c5) < 0 { return 25 }
105
106 // Verify each pair.
107 let v1: i64 = nx_x509_verify_under_issuer(buf1, c1, buf2, c2)
108 dump_dec(0x56, 0x50, 0x30, v1) // VP0= cert1->cert2
109 let v2: i64 = nx_x509_verify_under_issuer(buf2, c2, buf3, c3)
110 dump_dec(0x56, 0x50, 0x31, v2) // VP1= cert2->cert3
111 let v3: i64 = nx_x509_verify_under_issuer(buf3, c3, buf4, c4)
112 dump_dec(0x56, 0x50, 0x32, v3) // VP2= cert3->cert4
113 let v4: i64 = nx_x509_verify_under_issuer(buf4, c4, buf5, c5)
114 dump_dec(0x56, 0x50, 0x33, v4) // VP3= cert4->Comodo AAA
115
116 if v1 != NX_X509_VUI_OK { return 100 + v1 }
117 if v2 != NX_X509_VUI_OK { return 110 + v2 }
118 if v3 != NX_X509_VUI_OK { return 120 + v3 }
119 if v4 != NX_X509_VUI_OK { return 130 + v4 }
120
121 let ok: *u8 = sys_mmap(8)
122 ok[0]=0x4F; ok[1]=0x4B; ok[2]=0x21; ok[3]=0x0A // "OK!\n"
123 sys_write(1, ok, 4)
124 return 0
125}