code wiki / _hdl_build / nx_crypto_workspace_canonical_gate_t187.nx
nx_crypto_workspace_canonical_gate_t187.nx source
↩ module page · 63 lines · 4518 B
1import "nx_signed_cookie.nx"
2import "nx_gate_verdict.nx"
3func cw187_hex(bytes:*u8,hex:*u8,n:i64)->i64{
4 let alphabet:*u8="0123456789abcdef";var i:i64=0
5 while i<n{if alphabet[(bytes[i] as i64)/16]!=hex[i*2] || alphabet[(bytes[i] as i64)%16]!=hex[i*2+1]{return 0};i=i+1};return 1
6}
7func main()->i64{
8 let c:*i64=gv_ctr();gv_head("Borrowed crypto workspace closure")
9 let wsbytes:i64=sc_verify_workspace_bytes();let ws:*u8=sys_mmap(wsbytes)
10 let key:*u8=sys_mmap(131);let tag:*u8=sys_mmap(32);let expected:*u8=sys_mmap(32)
11 let token:*u8=sys_mmap(256);let plen:*i64=sys_mmap(SHA256_WIDE_WORD) as *i64
12 var i:i64=0;while i<20{key[i]=11 as u8;i=i+1}
13 let hws:i64=hmac_sha256_workspace_bytes()
14 let r:i64=hmac_sha256_workspace(key,20,"Hi There",8,tag,ws,hws)
15 gv_check("RFC4231 short key vector",r==0 && cw187_hex(tag,"b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7",32)==1,c)
16 i=0;while i<131{key[i]=170 as u8;i=i+1}
17 let msg:*u8="Test Using Larger Than Block-Size Key - Hash Key First"
18 let longrc:i64=hmac_sha256_workspace(key,131,msg,54,tag,ws,hws)
19 gv_check("RFC4231 oversized key vector",longrc==0 && cw187_hex(tag,"60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54",32)==1,c)
20 hmac_sha256(key,131,msg,54,expected)
21 gv_check("legacy independent call parity",ct_memcmp(tag,expected,32)==1,c)
22 tag[0]=90 as u8
23 gv_check("short workspace no output",hmac_sha256_workspace(key,131,msg,54,tag,ws,hws-1)<0 && tag[0]==90 as u8,c)
24 gv_check("workspace input overlap refused",hmac_sha256_workspace(ws,20,msg,54,tag,ws,hws)<0 && tag[0]==90 as u8,c)
25 gv_check("aggregate SHA bit length overflow refused",hmac_sha256_workspace(key,131,msg,SHA256_SIGNED_MAX/SHA256_BITS_PER_BYTE,tag,ws,hws)<0 && tag[0]==90 as u8,c)
26 let value:*u8="tool_a,nx_site_publish~1999999999~187"
27 let vn:i64=37
28 let tn:i64=signed_cookie_sign_workspace(value,vn,key,131,token,256,ws,wsbytes)
29 gv_check("workspace token signed",tn==vn+1+SC_SIGNATURE_BYTES,c)
30 gv_check("workspace valid signature",signed_cookie_verify_workspace(token,tn,key,131,plen,ws,wsbytes)==0 && *plen==vn,c)
31 gv_check("verification output cannot alias cookie",signed_cookie_verify_workspace(token,tn,key,131,token as *i64,ws,wsbytes)==HMAC_E_INPUT,c)
32 gv_check("verification output cannot alias key",signed_cookie_verify_workspace(token,tn,key,131,key as *i64,ws,wsbytes)==HMAC_E_INPUT,c)
33 gv_check("verification output requires integer alignment",signed_cookie_verify_workspace(token,tn,key,131,((plen as *u8)+1) as *i64,ws,wsbytes)==HMAC_E_INPUT,c)
34 let vo:*i64=sys_mmap(SHA256_WIDE_WORD) as *i64
35 gv_check("legacy verifier equality corrected",signed_cookie_verify(token,tn,key,131,vo,plen)==0,c)
36 token[0]=token[0]^1
37 gv_check("payload tamper rejected",signed_cookie_verify_workspace(token,tn,key,131,plen,ws,wsbytes)==SC_ERR_MAC,c)
38 gv_check("legacy tamper rejected",signed_cookie_verify(token,tn,key,131,vo,plen)==SC_ERR_MAC,c)
39 token[0]=token[0]^1;token[tn-1]=token[tn-1]^1
40 gv_check("signature tamper rejected",signed_cookie_verify_workspace(token,tn,key,131,plen,ws,wsbytes)==SC_ERR_MAC,c)
41 token[0]=90 as u8
42 gv_check("exact token capacity refusal no write",signed_cookie_sign_workspace(value,vn,key,131,token,tn-1,ws,wsbytes)<0 && token[0]==90 as u8,c)
43 gv_check("sign workspace input overlap refused",signed_cookie_sign_workspace(ws,20,key,131,token,256,ws,wsbytes)<0,c)
44 // Linux RLIMIT_AS is set to zero only in the isolated fork. All working memory
45 // was allocated before fork; any hidden allocator in this path fails.
46 let limits:*i64=sys_mmap(SHA256_WIDE_WORD*2) as *i64;limits[0]=0;limits[1]=0
47 let status:*i64=sys_mmap(SHA256_WIDE_WORD) as *i64;*status=0
48 let pid:i64=sys_fork()
49 if pid==0{
50 if nx_prlimit(0,RLIMIT_AS,limits as *u8,0 as *u8)!=0{sys_exit_group(20)}
51 let probe:*u8=sys_mmap_try(1);if (probe as i64)>0{sys_exit_group(21)}
52 let minted:i64=signed_cookie_sign_workspace(value,vn,key,131,token,256,ws,wsbytes)
53 if minted!=tn{sys_exit_group(22)}
54 if signed_cookie_verify_workspace(token,minted,key,131,plen,ws,wsbytes)!=0{sys_exit_group(23)}
55 token[0]=token[0]^1
56 if signed_cookie_verify_workspace(token,minted,key,131,plen,ws,wsbytes)!=SC_ERR_MAC{sys_exit_group(24)}
57 sys_exit_group(0)
58 }
59 if pid<0{return 3}
60 let waited:i64=sys_wait4(pid,status,0)
61 gv_check("sign verify and reject under actual allocation denial",waited==pid && wait_status_rc(*status)==0,c)
62 return gv_verdict("crypto-workspace",c,"Fixture keys only; crypto closure exercised with RLIMIT_AS zero, not yet complete HTTP handler qualification")
63}