nx_chain_pair_leaf_real_test.nx source
↩ module page · 92 lines · 3442 B
1// nx_chain_pair_leaf_real_test.nx -- focused diagnostic for just
2// the leaf→cloudflare pair of the real example.com chain.
3//
4// This pair should already be supported by the substrate today:
5// cert1 (leaf) sig_alg = ecdsa-with-SHA256
6// cert2 (Cloudflare TLS Issuing ECC CA 1) pub_alg = P-256
7//
8// If this pair verifies cleanly, the chain walker is unblocked
9// for the first leaf→intermediate step and only needs P-384 +
10// SHA-384 verify + RSA for the deeper hops. If it FAILS, there
11// is yet another substrate-level bug to find.
12//
13// expect_exit: 0 -- if the pair verifies, the test PASSES;
14// otherwise it surfaces the verdict via exit code.
15// license_tier: ORIGINAL
16
17import "nx_syscalls.nx"
18import "nx_x509.nx"
19import "nx_x509_verify_under_issuer.nx"
20
21func read_to(path: *u8, out_buf: *u8, max: i64) -> i64 {
22 let len_p: *i64 = sys_mmap(16) as *i64
23 let p: *u8 = sys_read_file(path, len_p)
24 let n: i64 = *len_p
25 if n <= 0 { return 0 - 1 }
26 if n > max { return 0 - 2 }
27 var i: i64 = 0
28 while i < n { out_buf[i] = p[i]; i = i + 1 }
29 return n
30}
31
32func dump_dec(label0: i64, label1: i64, v: i64) -> i64 {
33 let lab: *u8 = sys_mmap(8)
34 lab[0]=label0 as u8; lab[1]=label1 as u8; lab[2]=0x3D
35 sys_write(2, lab, 3)
36 var av: i64 = v
37 if av < 0 { let neg: *u8 = sys_mmap(8); neg[0]=0x2D; sys_write(2, neg, 1); av = 0 - av }
38 let buf: *u8 = sys_mmap(16)
39 var pos: i64 = 0
40 if av == 0 { buf[0]=0x30; pos = 1 }
41 var x: i64 = av
42 while x > 0 {
43 buf[pos] = (0x30 + (x % 10)) as u8
44 x = x / 10; pos = pos + 1
45 }
46 let out: *u8 = sys_mmap(16); var oi: i64 = 0
47 while oi < pos { out[oi] = buf[pos - 1 - oi]; oi = oi + 1 }
48 sys_write(2, out, pos)
49 let nl: *u8 = sys_mmap(8); nl[0]=0x0A; sys_write(2, nl, 1)
50 return 0
51}
52
53func main() -> i64 {
54 // ---- Load cert1 (leaf) and cert2 (intermediate) ----
55 let p1: *u8 = sys_mmap(64)
56 p1[0]=0x2F; p1[1]=0x74; p1[2]=0x6D; p1[3]=0x70; p1[4]=0x2F // /tmp/
57 p1[5]=0x63; p1[6]=0x65; p1[7]=0x72; p1[8]=0x74 // cert
58 p1[9]=0x31; p1[10]=0x2E; p1[11]=0x64; p1[12]=0x65; p1[13]=0x72 // 1.der
59 p1[14] = 0
60 let buf1: *u8 = sys_mmap(4096)
61 let n1: i64 = read_to(p1, buf1, 4096)
62 if n1 <= 0 { return 1 }
63 dump_dec(0x4E, 0x31, n1) // "N1="
64
65 let p2: *u8 = sys_mmap(64)
66 p2[0]=0x2F; p2[1]=0x74; p2[2]=0x6D; p2[3]=0x70; p2[4]=0x2F
67 p2[5]=0x63; p2[6]=0x65; p2[7]=0x72; p2[8]=0x74
68 p2[9]=0x32; p2[10]=0x2E; p2[11]=0x64; p2[12]=0x65; p2[13]=0x72
69 p2[14] = 0
70 let buf2: *u8 = sys_mmap(4096)
71 let n2: i64 = read_to(p2, buf2, 4096)
72 if n2 <= 0 { return 2 }
73 dump_dec(0x4E, 0x32, n2) // "N2="
74
75 // ---- Parse both certs ----
76 let cert1_raw: *u8 = sys_mmap(256)
77 let cert1: *X509Cert = cert1_raw as *X509Cert
78 if x509_parse(buf1, n1, cert1) < 0 { return 3 }
79
80 let cert2_raw: *u8 = sys_mmap(256)
81 let cert2: *X509Cert = cert2_raw as *X509Cert
82 if x509_parse(buf2, n2, cert2) < 0 { return 4 }
83
84 // ---- Verify cert1 under cert2's pubkey ----
85 let v: i64 = nx_x509_verify_under_issuer(buf1, cert1, buf2, cert2)
86 dump_dec(0x56, 0x55, v) // "VU=" verdict
87 // 1=OK, 2=SIG_ALG_UNSUPPORTED, 3=PUB_ALG_UNSUPPORTED,
88 // 4=ALG_MISMATCH, 5=PUBKEY_EXTRACT_FAIL, 6=VERIFY_FAIL
89
90 if v != NX_X509_VUI_OK { return 100 + v }
91 return 0
92}