nx_tls12_parse_test.nx source

1// nx_tls12_parse_test.nx -- KAT for the TLS 1.2 handshake parsers (rung 2, no network). 2// Builds a synthetic ServerHello (cipher 0xC02F, random 0x50..0x6F) + ServerKeyExchange (secp256r1, 65-byte 3// point starting 0x04, sig_alg 0x0401, 4-byte sig) and round-trips them through the parsers, asserting every 4// extracted field. license_tier: ORIGINAL 5import "nx_syscalls.nx" 6import "nx_tls12_parse.nx" 7 8func tp_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 9func tp_p(s: *u8) -> i64 { sys_write(1, s, tp_slen(s)); return 0 } 10func tp_row(name: *u8, pass: i64) -> i64 { 11 tp_p("ROW " as *u8); tp_p(name) 12 if pass == 1 { tp_p(" PASS\n" as *u8) } else { tp_p(" FAIL\n" as *u8) } 13 return pass 14} 15 16func main() -> i64 { 17 tp_p("=== TLS12 PARSE KAT ===\n" as *u8) 18 19 // ---- synthetic ServerHello ---- 20 let sh: *u8 = sys_mmap(256) 21 sh[0] = 0x03 as u8; sh[1] = 0x03 as u8 22 var i: i64 = 0 23 while i < 32 { sh[2 + i] = (0x50 + i) as u8; i = i + 1 } 24 sh[34] = 0 as u8 // session_id len = 0 25 sh[35] = 0xC0 as u8; sh[36] = 0x2F as u8 // cipher = 0xC02F 26 sh[37] = 0 as u8 // compression = null 27 let sh_len: i64 = 38 28 29 // ---- synthetic ServerKeyExchange ---- 30 let skx: *u8 = sys_mmap(256) 31 skx[0] = 3 as u8 // named_curve 32 skx[1] = 0x00 as u8; skx[2] = 0x17 as u8 // secp256r1 33 skx[3] = 65 as u8 // point len 34 skx[4] = 0x04 as u8 35 i = 1; while i < 65 { skx[4 + i] = 0x11 as u8; i = i + 1 } 36 skx[69] = 0x04 as u8; skx[70] = 0x01 as u8 // sig_alg 0x0401 37 skx[71] = 0x00 as u8; skx[72] = 0x04 as u8 // sig_len 4 38 skx[73] = 0xAA as u8; skx[74] = 0xBB as u8; skx[75] = 0xCC as u8; skx[76] = 0xDD as u8 39 let skx_len: i64 = 77 40 41 var pass: i64 = 0 42 var r: i64 = 0 43 44 let srand: *u8 = sys_mmap(64) 45 let scipher: *i64 = sys_mmap(16) as *i64 46 let shr: i64 = tls12_parse_server_hello(sh, sh_len, srand, scipher) 47 r = 0; if shr == 1 { r = 1 } 48 pass = pass + tp_row("sh-parse-ok" as *u8, r) 49 r = 0; if (srand[0] as i64) == 0x50 { if (srand[31] as i64) == 0x6F { r = 1 } } 50 pass = pass + tp_row("sh-random" as *u8, r) 51 r = 0; if scipher[0] == 0xC02F { r = 1 } 52 pass = pass + tp_row("sh-cipher-c02f" as *u8, r) 53 54 let curve: *i64 = sys_mmap(16) as *i64 55 let pub: *u8 = sys_mmap(256) 56 let publen: *i64 = sys_mmap(16) as *i64 57 let sigalg: *i64 = sys_mmap(16) as *i64 58 let sig: *u8 = sys_mmap(256) 59 let siglen: *i64 = sys_mmap(16) as *i64 60 let kr: i64 = tls12_parse_server_key_exchange(skx, skx_len, curve, pub, publen, sigalg, sig, siglen) 61 r = 0; if kr == 1 { r = 1 } 62 pass = pass + tp_row("skx-parse-ok" as *u8, r) 63 r = 0; if curve[0] == 0x0017 { r = 1 } 64 pass = pass + tp_row("skx-curve-secp256r1" as *u8, r) 65 r = 0; if publen[0] == 65 { if (pub[0] as i64) == 0x04 { r = 1 } } 66 pass = pass + tp_row("skx-pubkey-65" as *u8, r) 67 r = 0; if sigalg[0] == 0x0401 { r = 1 } 68 pass = pass + tp_row("skx-sigalg-0401" as *u8, r) 69 r = 0; if siglen[0] == 4 { if (sig[0] as i64) == 0xAA { if (sig[3] as i64) == 0xDD { r = 1 } } } 70 pass = pass + tp_row("skx-sig" as *u8, r) 71 72 // signed-data = client_random(32) || server_random(32) || params(69) 73 let crand: *u8 = sys_mmap(64) 74 i = 0; while i < 32 { crand[i] = (0x10 + i) as u8; i = i + 1 } 75 let sd: *u8 = sys_mmap(512) 76 let sdl: i64 = tls12_skx_signed_data(crand, srand, skx, 69, sd) 77 r = 0 78 if sdl == 133 { if (sd[0] as i64) == 0x10 { if (sd[32] as i64) == 0x50 { if (sd[64] as i64) == 3 { r = 1 } } } } 79 pass = pass + tp_row("skx-signed-data" as *u8, r) 80 81 tp_p("TLS12-PARSE-KAT rows=9 pass=" as *u8) 82 let pb: *u8 = sys_mmap(16) 83 var pv: i64 = pass 84 if pv == 0 { pb[0] = 48 as u8; sys_write(1, pb, 1) } 85 else { var k: i64 = 0; let t: *u8 = sys_mmap(16); while pv > 0 { t[k] = (48 + (pv % 10)) as u8; pv = pv / 10; k = k + 1 } var j: i64 = 0; while j < k { pb[j] = t[k-1-j]; j = j + 1 } sys_write(1, pb, k) } 86 if pass == 9 { tp_p(" verdict=GREEN\n" as *u8); return 0 } 87 tp_p(" verdict=RED\n" as *u8) 88 return 1 89}