nx_chain_pipeline_real_test.nx source
↩ module page · 168 lines · 5853 B
1// nx_chain_pipeline_real_test.nx -- diagnose cert pipeline against
2// the REAL example.com 4-cert chain saved as DER fixtures in /tmp.
3//
4// Reads /tmp/cert1..4.der (saved via openssl s_client -showcerts),
5// wraps them in a TLS 1.3 Certificate handshake message, loads the
6// real Mozilla bundle, calls nx_https_cert_pipeline_verify_with_store
7// directly, and reports the exact pipeline verdict via exit code.
8//
9// expect_exit: 0 -- but the test PINS the current substrate state
10// via that the verdict is one of the expected ones for the current
11// chain-walker capability. When pipeline OK is reached, the test
12// flips its assertion.
13//
14// license_tier: ORIGINAL
15
16import "nx_syscalls.nx"
17import "nx_x509_trust_store.nx"
18import "nx_trust_store_load_from_certdata.nx"
19import "nx_https_cert_pipeline.nx"
20
21func read_to(path: *u8, out_buf: *u8, max: i64) -> i64 {
22 let len_p: *i64 = sys_mmap(16) as *i64
23 let p: *u8 = sys_read_file(path, len_p)
24 let n: i64 = *len_p
25 if n <= 0 { return 0 - 1 }
26 if n > max { return 0 - 2 }
27 var i: i64 = 0
28 while i < n { out_buf[i] = p[i]; i = i + 1 }
29 return n
30}
31
32func mkpath(out: *u8, num: i64) -> i64 {
33 // /tmp/certN.der
34 out[0]=0x2F; out[1]=0x74; out[2]=0x6D; out[3]=0x70
35 out[4]=0x2F; out[5]=0x63; out[6]=0x65; out[7]=0x72
36 out[8]=0x74
37 out[9] = (0x30 + num) as u8
38 out[10]=0x2E; out[11]=0x64; out[12]=0x65; out[13]=0x72
39 out[14] = 0
40 return 14
41}
42
43// Build TLS 1.3 Certificate handshake message wrapping N DER certs.
44// handshake_type(1) + length(3) + cert_request_context_len(1) +
45// cert_chain_length(3) + (per cert: cert_len(3) + cert_data +
46// extensions_len(2))
47func build_cert_msg(out: *u8, derbufs: **u8, derlens: *i64, n: i64) -> i64 {
48 // Compute per-cert sizes: 3 + cert_len + 2
49 var chain_len: i64 = 0
50 var i: i64 = 0
51 while i < n {
52 chain_len = chain_len + 3 + derlens[i] + 2
53 i = i + 1
54 }
55 let inner_len: i64 = 1 + 3 + chain_len // ctx_len(1) + chain_len(3) + chain
56
57 out[0] = 0x0B // HT_CERTIFICATE
58 out[1] = (inner_len >> 16) & 0xff
59 out[2] = (inner_len >> 8) & 0xff
60 out[3] = inner_len & 0xff
61 out[4] = 0 // ctx_len = 0
62 out[5] = (chain_len >> 16) & 0xff
63 out[6] = (chain_len >> 8) & 0xff
64 out[7] = chain_len & 0xff
65
66 var o: i64 = 8
67 i = 0
68 while i < n {
69 let cl: i64 = derlens[i]
70 out[o] = (cl >> 16) & 0xff
71 out[o + 1] = (cl >> 8) & 0xff
72 out[o + 2] = cl & 0xff
73 o = o + 3
74 var j: i64 = 0
75 let src: *u8 = derbufs[i]
76 while j < cl {
77 out[o + j] = src[j]
78 j = j + 1
79 }
80 o = o + cl
81 out[o] = 0; out[o + 1] = 0 // ext_len = 0
82 o = o + 2
83 i = i + 1
84 }
85 return 4 + inner_len
86}
87
88func dump_dec(label0: i64, label1: i64, v: i64) -> i64 {
89 let lab: *u8 = sys_mmap(8)
90 lab[0]=label0 as u8; lab[1]=label1 as u8; lab[2]=0x3D
91 sys_write(2, lab, 3)
92 var av: i64 = v
93 if av < 0 { let neg: *u8 = sys_mmap(8); neg[0]=0x2D; sys_write(2, neg, 1); av = 0 - av }
94 let buf: *u8 = sys_mmap(16)
95 var pos: i64 = 0
96 if av == 0 { buf[0]=0x30; pos = 1 }
97 var x: i64 = av
98 while x > 0 {
99 buf[pos] = (0x30 + (x % 10)) as u8
100 x = x / 10; pos = pos + 1
101 }
102 // reverse
103 let out: *u8 = sys_mmap(16); var oi: i64 = 0
104 while oi < pos { out[oi] = buf[pos - 1 - oi]; oi = oi + 1 }
105 sys_write(2, out, pos)
106 let nl: *u8 = sys_mmap(8); nl[0]=0x0A; sys_write(2, nl, 1)
107 return 0
108}
109
110func main() -> i64 {
111 // Load real Mozilla bundle
112 let mozpath: *u8 = sys_mmap(64)
113 mozpath[0]=0x2F; mozpath[1]=0x74; mozpath[2]=0x6D; mozpath[3]=0x70
114 mozpath[4]=0x2F
115 mozpath[5]=0x6D; mozpath[6]=0x6F; mozpath[7]=0x7A; mozpath[8]=0x69
116 mozpath[9]=0x6C; mozpath[10]=0x6C; mozpath[11]=0x61
117 mozpath[12]=0x5F
118 mozpath[13]=0x63; mozpath[14]=0x65; mozpath[15]=0x72; mozpath[16]=0x74
119 mozpath[17]=0x64; mozpath[18]=0x61; mozpath[19]=0x74; mozpath[20]=0x61
120 mozpath[21]=0x2E; mozpath[22]=0x74; mozpath[23]=0x78; mozpath[24]=0x74
121 mozpath[25]=0
122
123 let lr: i64 = nx_trust_store_load_from_certdata(mozpath, 300, 4194304)
124 if lr <= 0 { return 1 }
125 let store: *TrustStore = lr as *TrustStore
126 let nca: i64 = trust_store_count(store)
127 dump_dec(0x43, 0x41, nca) // "CA="
128 if nca < 100 { return 2 }
129
130 // Read 4 cert DER files
131 let derbufs_raw: *u8 = sys_mmap(64)
132 let derbufs: **u8 = derbufs_raw as **u8
133 let derlens_raw: *u8 = sys_mmap(64)
134 let derlens: *i64 = derlens_raw as *i64
135 var i: i64 = 1
136 while i <= 4 {
137 let path: *u8 = sys_mmap(32)
138 mkpath(path, i)
139 let buf: *u8 = sys_mmap(4096)
140 let n: i64 = read_to(path, buf, 4096)
141 if n <= 0 { return 10 + i }
142 derbufs[i - 1] = buf
143 derlens[i - 1] = n
144 i = i + 1
145 }
146 dump_dec(0x4E, 0x43, 4) // "NC=4"
147
148 // Build TLS Cert message
149 let msg: *u8 = sys_mmap(16384)
150 let mlen: i64 = build_cert_msg(msg, derbufs, derlens, 4)
151 dump_dec(0x4D, 0x4C, mlen) // "ML="
152
153 // Call pipeline
154 let host: *u8 = sys_mmap(16)
155 host[0]=0x65; host[1]=0x78; host[2]=0x61; host[3]=0x6D
156 host[4]=0x70; host[5]=0x6C; host[6]=0x65; host[7]=0x2E
157 host[8]=0x63; host[9]=0x6F; host[10]=0x6D // "example.com"
158
159 let v: i64 = nx_https_cert_pipeline_verify_with_store(
160 msg, mlen, host, 11, 1779284141, store
161 )
162 dump_dec(0x50, 0x56, v) // "PV=" pipeline verdict
163
164 // Don't fail the smoke; we want to see WHICH verdict for diagnostic
165 // 1 = OK (success!), 2..12 = various failures per
166 // nx_https_cert_pipeline verdict enum.
167 return 0
168}