nx_tls13_alpn_test.nx source
↩ module page · 68 lines · 2685 B
1// nx_tls13_alpn_test.nx -- smoke for the ALPN (RFC 7301) extension
2// emitter. Verifies tls13_ext_emit_alpn_http11 produces the correct
3// 15-byte wire sequence for advertising the single protocol
4// "http/1.1" and that buffer-overflow detection works.
5
6import "nx_syscalls.nx"
7import "nx_tls13.nx"
8import "nx_tls13_ext.nx"
9
10func main() -> i64 {
11 let buf: *u8 = sys_mmap(32)
12 let n: i64 = tls13_ext_emit_alpn_http11(buf, 32)
13 if n != 15 { return 1 }
14
15 // Byte 0-1: ext_type = 0x0010 = 16
16 if (buf[0] & 0xff) != 0 { return 10 }
17 if (buf[1] & 0xff) != 16 { return 11 }
18
19 // Byte 2-3: ext_data_len = 11
20 if (buf[2] & 0xff) != 0 { return 20 }
21 if (buf[3] & 0xff) != 11 { return 21 }
22
23 // Byte 4-5: protocol_name_list_len = 9
24 if (buf[4] & 0xff) != 0 { return 30 }
25 if (buf[5] & 0xff) != 9 { return 31 }
26
27 // Byte 6: protocol_name_len = 8
28 if (buf[6] & 0xff) != 8 { return 40 }
29
30 // Byte 7-14: "http/1.1"
31 if (buf[7] & 0xff) != 104 { return 50 } // 'h'
32 if (buf[8] & 0xff) != 116 { return 51 } // 't'
33 if (buf[9] & 0xff) != 116 { return 52 } // 't'
34 if (buf[10] & 0xff) != 112 { return 53 } // 'p'
35 if (buf[11] & 0xff) != 47 { return 54 } // '/'
36 if (buf[12] & 0xff) != 49 { return 55 } // '1'
37 if (buf[13] & 0xff) != 46 { return 56 } // '.'
38 if (buf[14] & 0xff) != 49 { return 57 } // '1'
39
40 // ---- Buffer overflow detection ----
41 // out_cap = 14 (one byte short of 15) -> should return negative
42 // NX_TLS13_EXT_VERDICT_BUF_OVERFLOW.
43 let n_overflow: i64 = tls13_ext_emit_alpn_http11(buf, 14)
44 if n_overflow >= 0 { return 70 }
45
46 // out_cap = 0 -> still negative
47 let n_zero: i64 = tls13_ext_emit_alpn_http11(buf, 0)
48 if n_zero >= 0 { return 71 }
49
50 // out_cap = exactly 15 -> succeeds (n returned == 15 again)
51 let buf2: *u8 = sys_mmap(16)
52 let n2: i64 = tls13_ext_emit_alpn_http11(buf2, 15)
53 if n2 != 15 { return 72 }
54
55 // ---- Wire-correctness via direct byte read: ext_data_len at
56 // offset 2-3 must equal exactly 11 (the count of bytes after
57 // the 4-byte ext header). This is the property any RFC-7301-
58 // compliant server uses to walk the extension list. ----
59 let claimed_ext_data_len: i64 = ((buf[2] & 0xff) * 256) + (buf[3] & 0xff)
60 if claimed_ext_data_len != 11 { return 80 }
61 // The list-length field (offset 4-5) must equal exactly 9 (= 1 + 8).
62 let claimed_list_len: i64 = ((buf[4] & 0xff) * 256) + (buf[5] & 0xff)
63 if claimed_list_len != 9 { return 81 }
64 // Total wire = 4-byte header + 11 declared = 15, which equals n.
65 if (4 + claimed_ext_data_len) != n { return 82 }
66
67 return 0
68}