nx_chain_pair_real_diag_test.nx source

1// nx_chain_pair_real_diag_test.nx -- per-pair verify diagnostic 2// against the REAL example.com 4-cert chain. 3// 4// Reads /tmp/cert1..4.der and for each (cert[i], issuer=cert[i+1]) 5// pair calls nx_x509_verify_under_issuer directly, then dumps the 6// individual verdict. This isolates which exact rung of the chain 7// is the sig-verify blocker after wiring ECDSA-SHA384 + P-384. 8// 9// expect_exit: 0 (diagnostic always returns 0; assertions in the 10// shell smoke check the per-pair verdict pattern). 11 12import "nx_syscalls.nx" 13import "nx_x509.nx" 14import "nx_x509_verify_under_issuer.nx" 15 16func read_to(path: *u8, out_buf: *u8, max: i64) -> i64 { 17 let len_p: *i64 = sys_mmap(16) as *i64 18 let p: *u8 = sys_read_file(path, len_p) 19 let n: i64 = *len_p 20 if n <= 0 { return 0 - 1 } 21 if n > max { return 0 - 2 } 22 var i: i64 = 0 23 while i < n { out_buf[i] = p[i]; i = i + 1 } 24 return n 25} 26 27func mkpath(out: *u8, num: i64) -> i64 { 28 out[0]=0x2F; out[1]=0x74; out[2]=0x6D; out[3]=0x70 29 out[4]=0x2F; out[5]=0x63; out[6]=0x65; out[7]=0x72 30 out[8]=0x74 31 out[9] = (0x30 + num) as u8 32 out[10]=0x2E; out[11]=0x64; out[12]=0x65; out[13]=0x72 33 out[14] = 0 34 return 14 35} 36 37func dump_dec(l0: i64, l1: i64, l2: i64, v: i64) -> i64 { 38 let lab: *u8 = sys_mmap(8) 39 lab[0]=l0 as u8; lab[1]=l1 as u8; lab[2]=l2 as u8; lab[3]=0x3D 40 sys_write(2, lab, 4) 41 var av: i64 = v 42 if av < 0 { 43 let neg: *u8 = sys_mmap(8); neg[0]=0x2D; sys_write(2, neg, 1) 44 av = 0 - av 45 } 46 let buf: *u8 = sys_mmap(16) 47 var pos: i64 = 0 48 if av == 0 { buf[0]=0x30; pos = 1 } 49 var x: i64 = av 50 while x > 0 { 51 buf[pos] = (0x30 + (x % 10)) as u8 52 x = x / 10; pos = pos + 1 53 } 54 let out: *u8 = sys_mmap(16); var oi: i64 = 0 55 while oi < pos { out[oi] = buf[pos - 1 - oi]; oi = oi + 1 } 56 sys_write(2, out, pos) 57 let nl: *u8 = sys_mmap(8); nl[0]=0x0A; sys_write(2, nl, 1) 58 return 0 59} 60 61func main() -> i64 { 62 let derbufs_raw: *u8 = sys_mmap(64) 63 let derbufs: **u8 = derbufs_raw as **u8 64 let derlens_raw: *u8 = sys_mmap(64) 65 let derlens: *i64 = derlens_raw as *i64 66 var i: i64 = 1 67 while i <= 4 { 68 let path: *u8 = sys_mmap(32) 69 mkpath(path, i) 70 let buf: *u8 = sys_mmap(4096) 71 let n: i64 = read_to(path, buf, 4096) 72 if n <= 0 { return 10 + i } 73 derbufs[i - 1] = buf 74 derlens[i - 1] = n 75 i = i + 1 76 } 77 78 // Parse each DER into a separately-allocated X509Cert struct. 79 // (Avoid array-step pointer arithmetic on *X509Cert until that 80 // is hardened separately.) 81 let c1_raw: *u8 = sys_mmap(512); let c1: *X509Cert = c1_raw as *X509Cert 82 let c2_raw: *u8 = sys_mmap(512); let c2: *X509Cert = c2_raw as *X509Cert 83 let c3_raw: *u8 = sys_mmap(512); let c3: *X509Cert = c3_raw as *X509Cert 84 let c4_raw: *u8 = sys_mmap(512); let c4: *X509Cert = c4_raw as *X509Cert 85 if x509_parse(derbufs[0], derlens[0], c1) < 0 { return 51 } 86 if x509_parse(derbufs[1], derlens[1], c2) < 0 { return 52 } 87 if x509_parse(derbufs[2], derlens[2], c3) < 0 { return 53 } 88 if x509_parse(derbufs[3], derlens[3], c4) < 0 { return 54 } 89 90 // For each pair (cert, issuer), call verify_under_issuer. 91 let v1: i64 = nx_x509_verify_under_issuer(derbufs[0], c1, derbufs[1], c2) 92 dump_dec(0x56, 0x50, 0x30, v1) // VP0= cert1->cert2 93 94 let v2: i64 = nx_x509_verify_under_issuer(derbufs[1], c2, derbufs[2], c3) 95 dump_dec(0x56, 0x50, 0x31, v2) // VP1= cert2->cert3 96 97 let v3: i64 = nx_x509_verify_under_issuer(derbufs[2], c3, derbufs[3], c4) 98 dump_dec(0x56, 0x50, 0x32, v3) // VP2= cert3->cert4 99 return 0 100}