code wiki / (root) / nx_tls13_ch_compat_test.nx
`nx_tls13_ch_compat_test.nx` source

↩ module page · 399 lines · 18930 B
1// nx_tls13_ch_compat_test.nx -- B2-HTTPBIN-CH gate row (browser arc).
2//
3// The B2 defect was "httpbin.org answers our ClientHello with an
4// alert".  ROOT CAUSE (oracle-measured 2026-06-10, openssl census):
5// httpbin.org does NOT speak TLS 1.3 at all (-tls1_3 -> no cipher;
6// -tls1_2 -> ECDHE-RSA-AES128-GCM-SHA256, P-256 temp key).  Its ELB
7// answers a 1.3-only CH with warning close_notify (AL=1 AD=0).  Our
8// CH was never malformed -- the CH-compat suspicion is REFUTED.
9// TLS 1.2 client support = separate named rung (not B2's bar).
10//
11// So this row proves the CH-compat claim with two live legs:
12//
13//   LEG A (httpbin census, live-updating): send the PRODUCT dual-
14//   share CH to httpbin.org and classify the response:
15//     - warning/any close_notify (AD=0) or protocol_version (AD=70)
16//       alert, or a TLS 1.2 ServerHello (no supported_versions ext)
17//       -> the measured TLS-1.2-only signature -> leg PASS
18//     - a TLS 1.3 ServerHello -> httpbin enabled 1.3: the leg now
19//       DEMANDS the full handshake to WAIT_CLIENT_FIN
20//     - any other alert (decode_error 50, illegal_parameter 47,
21//       handshake_failure 40) -> a REAL CH problem -> leg FAIL
22//
23//   LEG B (P-256 live proof): secp256r1-ONLY CH to github.com
24//   (census: completes TLS 1.3 + P-256 + TLS_AES_128_GCM_SHA256).
25//   Server MUST take our P-256 share (GR=23 asserted) and the FULL
26//   encrypted handshake walks to WAIT_CLIENT_FIN -- the live E2E
27//   proof of rung B4's path against an independent implementation,
28//   which dual-share connects can never exercise (servers prefer
29//   x25519 when offered).
30//
31// Exit 0 iff BOTH legs pass.  Markers: L1=/L2= leg verdicts,
32// AL=/AD= alert level/desc, CS=/GR= server cipher + group pick,
33// RC=/CT=/DV=/MT=/DW=/ST= per-record walk (B1 probe pattern).
34// Prereq: /tmp/mozilla_certdata.txt staged (gate self-stages).
35//
36// expect_exit: 0
37// license_tier: ORIGINAL
38
39import "nx_syscalls.nx"
40import "nx_https_url_for_fetch.nx"
41import "nx_https_url_connect.nx"
42import "nx_x509_trust_store.nx"
43import "nx_trust_store_load_from_certdata.nx"
44import "nx_https_cert_pipeline.nx"
45import "nx_tls13_client_session_recv_sh.nx"
46import "nx_tls13_client_session_recv_hs.nx"
47import "nx_tls13_read_record_from_fd.nx"
48
49func cc_dec(label0: i64, label1: i64, v: i64) -> i64 {
  let lab: *u8 = sys_mmap(8)
  lab[0] = label0 as u8; lab[1] = label1 as u8; lab[2] = 0x3D
  sys_write(1, lab, 3)
  var av: i64 = v
  if av < 0 {
      let neg: *u8 = sys_mmap(8); neg[0] = 0x2D; sys_write(1, neg, 1)
      av = 0 - av
  }
  if av == 0 {
      let z: *u8 = sys_mmap(8); z[0] = 0x30; sys_write(1, z, 1)
  }
  if av > 0 {
      let buf: *u8 = sys_mmap(32)
      var pos: i64 = 0
      var x: i64 = av
      while x > 0 { buf[pos] = (0x30 + (x % 10)) as u8; x = x / 10; pos = pos + 1 }
      let out: *u8 = sys_mmap(32)
      var oi: i64 = 0
      while oi < pos { out[oi] = buf[pos - 1 - oi]; oi = oi + 1 }
      sys_write(1, out, pos)
  }
  let nl: *u8 = sys_mmap(8); nl[0] = 0x0A; sys_write(1, nl, 1)
  return 0
73}
74
75// Print CS=/GR= from a ServerHello body; returns chosen group,
76// negative if parse/find failed.  Read-only census.
77func cc_sh_group_census(sh_body: *u8, sh_len: i64) -> i64 {
  let p_lv: *i64 = sys_mmap(16) as *i64
  let p_ro: *i64 = sys_mmap(16) as *i64
  let p_cs: *i64 = sys_mmap(16) as *i64
  let p_eo: *i64 = sys_mmap(16) as *i64
  let p_el: *i64 = sys_mmap(16) as *i64
  if tls13_server_hello_parse(sh_body, sh_len, p_lv, p_ro, p_cs, p_eo, p_el) != NX_TLS13_HELLO_VERDICT_OK {
      return 0 - 1
  }
  cc_dec(0x43, 0x53, *p_cs)                                          // CS=
  let p_off: *i64 = sys_mmap(16) as *i64
  let p_len: *i64 = sys_mmap(16) as *i64
  if tls13_ext_find(sh_body + *p_eo, *p_el, EXT_KEY_SHARE, p_off, p_len) != NX_TLS13_HELLO_VERDICT_OK {
      return 0 - 2
  }
  let d: i64 = *p_eo + *p_off
  if *p_len < 2 { return 0 - 3 }
  let group: i64 = ((sh_body[d] & 0xff) << 8) | (sh_body[d + 1] & 0xff)
  cc_dec(0x47, 0x52, group)                                          // GR=
  return group
97}
98
99// Is this ServerHello a TLS 1.3 negotiation?  RFC 8446: a 1.3 SH
100// carries supported_versions selecting 0x0304; a 1.2 server's SH
101// has no such extension.  Returns 1 / 0 / negative on parse fail.
102func cc_sh_is_tls13(sh_body: *u8, sh_len: i64) -> i64 {
  let p_lv: *i64 = sys_mmap(16) as *i64
  let p_ro: *i64 = sys_mmap(16) as *i64
  let p_cs: *i64 = sys_mmap(16) as *i64
  let p_eo: *i64 = sys_mmap(16) as *i64
  let p_el: *i64 = sys_mmap(16) as *i64
  if tls13_server_hello_parse(sh_body, sh_len, p_lv, p_ro, p_cs, p_eo, p_el) != NX_TLS13_HELLO_VERDICT_OK {
      return 0 - 1
  }
  let p_off: *i64 = sys_mmap(16) as *i64
  let p_len: *i64 = sys_mmap(16) as *i64
  if tls13_ext_find(sh_body + *p_eo, *p_el, EXT_SUPPORTED_VERSIONS, p_off, p_len) != NX_TLS13_HELLO_VERDICT_OK {
      return 0
  }
  let sv: i64 = tls13_ext_parse_supported_versions_server(sh_body + *p_eo + *p_off, *p_len)
  if sv == TLS_13_VERSION { return 1 }
  return 0
119}
120
121// Connect to url (host_len chars of host).  Returns fd or negative.
122func cc_connect(url: *u8, host_len: i64, out_host: *i64) -> i64 {
  let url_p: *NxUrl = nx_url_new()
  let target_raw: *u8 = sys_mmap(32)
  let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
  target.url = url_p
  target.port = 0
  if nx_https_url_for_fetch(url, target) != NX_HTTPS_URL_OK { return 0 - 90 }
  let fd_p: *i64 = sys_mmap(16) as *i64
  let ucv: i64 = nx_https_url_connect(target, url, 1781100001, fd_p)
  cc_dec(0x55, 0x43, ucv)                                            // UC=
  if ucv != NX_HTTPS_CONNECT_OK { return 0 - 91 }
  let fd: i64 = *fd_p
  sys_set_socket_timeout(fd, 10)
  // Flattened on purpose: the chained (url + target.url.host_off)
  // as i64 store shape segfaulted on this lane (expression-shape
  // miscompile class; same family as the 4-deep nested-if landmine).
  let u: *NxUrl = target.url
  let hoff: i64 = u.host_off
  let hp: *u8 = url + hoff
  *out_host = hp as i64
  return fd
143}
144
145// Wrap CH bytes in a plaintext handshake record and send.
146func cc_send_ch(fd: i64, ch_buf: *u8, ch_n: i64) -> i64 {
  let rec: *u8 = sys_mmap(1024 + NX_TLS13_RECORD_HEADER_LEN)
  rec[0] = (NX_TLS13_CT_HANDSHAKE & 0xff) as u8
  rec[1] = 0x03 as u8; rec[2] = 0x01 as u8
  rec[3] = ((ch_n >> 8) & 0xff) as u8
  rec[4] = (ch_n & 0xff) as u8
  var ci: i64 = 0
  while ci < ch_n { rec[NX_TLS13_RECORD_HEADER_LEN + ci] = ch_buf[ci]; ci = ci + 1 }
  var sent: i64 = 0
  let want: i64 = NX_TLS13_RECORD_HEADER_LEN + ch_n
  while sent < want {
      let w: i64 = sys_write(fd, rec + sent, want - sent)
      if w <= 0 { cc_dec(0x57, 0x52, w); return 0 - 1 }              // WR=
      sent = sent + w
  }
  return 0
162}
163
164// Encrypted-handshake walk (B1 probe pattern): drives the session
165// from WAIT_EE to WAIT_CLIENT_FIN.  Returns 0 on verified server
166// Finished, else a fail code (20-91).
167func cc_walk(s: *Tls13ClientSession, fd: i64, val_ctx: *TlsValidationContext) -> i64 {
  var recno: i64 = 0
  var fail: i64 = 0
  var running: i64 = 1
  while running == 1 {
      if s.state == NX_TLS13_CSESSION_STATE_WAIT_CLIENT_FIN { running = 0 }
      if recno >= 16 { running = 0; if fail == 0 { fail = 90 } }
      if running == 1 {
          let hs_record: *u8 = sys_mmap(17000)
          let hs_total: i64 = nx_tls13_read_record_from_fd(fd, hs_record, 17000)
          cc_dec(0x52, 0x43, recno)                                  // RC=
          cc_dec(0x54, 0x4C, hs_total)                               // TL=
          if hs_total < 0 { fail = 20; running = 0 }
          if running == 1 {
              let oct: i64 = hs_record[0] & 0xff
              cc_dec(0x43, 0x54, oct)                                // CT=
              var skip: i64 = 0
              if oct == 20 { skip = 1 }
              if skip == 0 {
                  let header: *u8 = hs_record
                  let ctxt: *u8 = hs_record + NX_TLS13_RECORD_HEADER_LEN
                  let ct_len: i64 = hs_total - NX_TLS13_RECORD_HEADER_LEN - NX_TLS13_RECORD_TAG_LEN
                  let tag: *u8 = hs_record + hs_total - NX_TLS13_RECORD_TAG_LEN
                  let inner: *u8 = sys_mmap(ct_len + 16)
                  let real_ct_p: *i64 = sys_mmap(16) as *i64
                  let real_len_p: *i64 = sys_mmap(16) as *i64
                  let dv: i64 = nx_tls13_record_decrypt_v2(
                      s.cipher_suite, s.server_hs_traffic_key, s.server_hs_iv,
                      s.server_seq, header, ctxt, ct_len, tag,
                      inner, real_ct_p, real_len_p)
                  s.server_seq = s.server_seq + 1
                  cc_dec(0x44, 0x56, dv)                             // DV=
                  if dv != NX_TLS13_REC_VERDICT_OK { fail = 30; running = 0 }
                  if running == 1 {
                      cc_dec(0x49, 0x43, *real_ct_p)                 // IC=
                      if *real_ct_p == 21 {
                          if *real_len_p >= 2 { cc_dec(0x41, 0x44, inner[1] & 0xff) }  // AD=
                          fail = 31; running = 0
                      }
                      if running == 1 { if *real_ct_p != NX_TLS13_CT_HANDSHAKE { fail = 32; running = 0 } }
                  }
                  if running == 1 {
                      let plen: i64 = *real_len_p
                      cc_dec(0x50, 0x4C, plen)                       // PL=
                      var off: i64 = 0
                      let new_state_p: *i64 = sys_mmap(16) as *i64
                      while off < plen {
                          if off + 4 > plen { fail = 33; off = plen }
                          if fail == 0 {
                              let mt: i64 = inner[off] & 0xff
                              let body_len: i64 = ((inner[off + 1] & 0xff) << 16) | ((inner[off + 2] & 0xff) << 8) | (inner[off + 3] & 0xff)
                              let msg_len: i64 = 4 + body_len
                              cc_dec(0x4D, 0x54, mt)                 // MT=
                              if off + msg_len > plen { fail = 34; off = plen }
                              if fail == 0 {
                                  let cstate: i64 = s.state - NX_TLS13_CSESSION_STATE_WAIT_EE + NX_TLS13_CSTATE_WAIT_EE
                                  let dw: i64 = tls13_client_dispatch_with_validation(
                                      cstate, inner + off, msg_len,
                                      s.server_hs_traffic_secret, s.transcript,
                                      new_state_p, val_ctx)
                                  cc_dec(0x44, 0x57, dw)             // DW=
                                  if dw != NX_TLS13_DWV_OK { fail = 40 + dw; off = plen }
                                  if fail == 0 {
                                      if *new_state_p == NX_TLS13_CSTATE_WAIT_EE   { s.state = NX_TLS13_CSESSION_STATE_WAIT_EE }
                                      if *new_state_p == NX_TLS13_CSTATE_WAIT_CERT { s.state = NX_TLS13_CSESSION_STATE_WAIT_CERT }
                                      if *new_state_p == NX_TLS13_CSTATE_WAIT_CV   { s.state = NX_TLS13_CSESSION_STATE_WAIT_CV }
                                      if *new_state_p == NX_TLS13_CSTATE_WAIT_SF   { s.state = NX_TLS13_CSESSION_STATE_WAIT_SF }
                                      if *new_state_p == NX_TLS13_CSTATE_CONNECTED { s.state = NX_TLS13_CSESSION_STATE_WAIT_CLIENT_FIN }
                                      cc_dec(0x53, 0x54, s.state)    // ST=
                                      off = off + msg_len
                                  }
                              }
                          }
                      }
                      if fail != 0 { running = 0 }
                  }
              }
          }
          recno = recno + 1
      }
  }
  if fail == 0 {
      if s.state != NX_TLS13_CSESSION_STATE_WAIT_CLIENT_FIN { fail = 91 }
  }
  return fail
252}
253
254// LEG A: httpbin census with the PRODUCT dual-share CH.
255// Returns 0 = PASS (TLS-1.2-only signature confirmed, OR full 1.3
256// handshake if they enabled it), nonzero = honest fail code.
257func cc_leg_httpbin(store: *TrustStore, epoch: i64) -> i64 {
  let url: *u8 = "https://httpbin.org/\x00"
  let host_len: i64 = 11
  let host_p: *i64 = sys_mmap(16) as *i64
  let fd: i64 = cc_connect(url, host_len, host_p)
  if fd < 0 { return 13 }
  // Flattened: `*host_p as *u8` in one expression miscompiles on
  // this lane (deref+ptr-cast shape; same family as the 4-deep
  // nested-if landmine).  Two statements compile correctly.
  let hv: i64 = host_p[0]
  let host: *u8 = hv as *u8
268
  let cr: *u8 = sys_mmap(32)
  let priv: *u8 = sys_mmap(32)
  var i: i64 = 0
  while i < 32 { cr[i] = (0xC0 + i) as u8; priv[i] = (0xA0 + i) as u8; i = i + 1 }
  let s: *Tls13ClientSession = nx_tls13_client_session_new(cr, priv)
  let ch_buf: *u8 = sys_mmap(1024)
  let ch_n: i64 = nx_tls13_client_session_emit_ch(s, host, host_len, ch_buf, 1024)
  cc_dec(0x43, 0x48, ch_n)                                           // CH=
  if ch_n < 0 { sys_close(fd); return 14 }
  if cc_send_ch(fd, ch_buf, ch_n) != 0 { sys_close(fd); return 15 }
279
  let sh_record: *u8 = sys_mmap(16700)
  let sh_total: i64 = nx_tls13_read_record_from_fd(fd, sh_record, 16700)
  if sh_total < 0 { sys_close(fd); cc_dec(0x52, 0x44, sh_total); return 16 }  // RD=
283
  // Plaintext alert at the CH boundary: classify.
  if (sh_record[0] & 0xff) == 21 {
      let al: i64 = sh_record[NX_TLS13_RECORD_HEADER_LEN] & 0xff
      let ad: i64 = sh_record[NX_TLS13_RECORD_HEADER_LEN + 1] & 0xff
      cc_dec(0x41, 0x4C, al)                                         // AL=
      cc_dec(0x41, 0x44, ad)                                         // AD=
      sys_close(fd)
      if ad == 0  { return 0 }     // close_notify       = no-1.3 signature (measured 2026-06-10)
      if ad == 70 { return 0 }     // protocol_version    = no-1.3, also honest
      return 18                    // any other alert = REAL CH problem
  }
295
  let sh_body: *u8 = sh_record + NX_TLS13_RECORD_HEADER_LEN
  let sh_body_len: i64 = sh_total - NX_TLS13_RECORD_HEADER_LEN
  let is13: i64 = cc_sh_is_tls13(sh_body, sh_body_len)
  cc_dec(0x56, 0x33, is13)                                           // V3= (1 = TLS 1.3 SH)
  if is13 == 0 {
      // TLS 1.2 ServerHello = the no-1.3 signature, leg PASS.
      sys_close(fd)
      return 0
  }
  if is13 < 0 { sys_close(fd); return 19 }
306
  // httpbin speaks TLS 1.3 now: the leg DEMANDS the full handshake.
  cc_sh_group_census(sh_body, sh_body_len)
  let rv: i64 = nx_tls13_client_session_recv_sh(s, sh_body, sh_body_len)
  cc_dec(0x52, 0x56, rv)                                             // RV=
  if rv != NX_TLS13_RECV_SH_OK { sys_close(fd); return 17 }
  let val_ctx_raw: *u8 = sys_mmap(64)
  let val_ctx: *TlsValidationContext = val_ctx_raw as *TlsValidationContext
  val_ctx.store = store
  val_ctx.sni_host = host
  val_ctx.sni_host_len = host_len
  val_ctx.now_epoch = epoch
  let wf: i64 = cc_walk(s, fd, val_ctx)
  sys_close(fd)
  return wf
321}
322
323// LEG B: live P-256 proof -- secp256r1-ONLY CH to github.com,
324// full encrypted handshake to verified server Finished.
325func cc_leg_p256(store: *TrustStore, epoch: i64) -> i64 {
  let url: *u8 = "https://github.com/\x00"
  let host_len: i64 = 10
  let host_p: *i64 = sys_mmap(16) as *i64
  let fd: i64 = cc_connect(url, host_len, host_p)
  if fd < 0 { return 23 }
  // Flattened: `*host_p as *u8` in one expression miscompiles on
  // this lane (deref+ptr-cast shape; see leg A + landmine note).
  let hv: i64 = host_p[0]
  let host: *u8 = hv as *u8
335
  let cr: *u8 = sys_mmap(32)
  let priv: *u8 = sys_mmap(32)
  var i: i64 = 0
  while i < 32 { cr[i] = (0xD0 + i) as u8; priv[i] = (0x90 + i) as u8; i = i + 1 }
  let s: *Tls13ClientSession = nx_tls13_client_session_new(cr, priv)
341
  // P-256-only CH: emit2 with null x25519 share, then mirror
  // emit_ch's transcript + state steps (the session emit keeps
  // the product dual-share contract; this is the census mode).
  let ch_buf: *u8 = sys_mmap(1024)
  let ch_n: i64 = tls13_client_hello_emit2(
      cr, host, host_len, 0 as *u8, s.p256_pub, ch_buf, 1024
  )
  cc_dec(0x43, 0x48, ch_n)                                           // CH=
  if ch_n < 0 { sys_close(fd); return 24 }
  nx_tls13_transcript_update(s.transcript, ch_buf, ch_n)
  s.state = NX_TLS13_CSESSION_STATE_CH_SENT
  if cc_send_ch(fd, ch_buf, ch_n) != 0 { sys_close(fd); return 25 }
354
  let sh_record: *u8 = sys_mmap(16700)
  let sh_total: i64 = nx_tls13_read_record_from_fd(fd, sh_record, 16700)
  if sh_total < 0 { sys_close(fd); cc_dec(0x52, 0x44, sh_total); return 26 }  // RD=
  if (sh_record[0] & 0xff) == 21 {
      cc_dec(0x41, 0x4C, sh_record[NX_TLS13_RECORD_HEADER_LEN] & 0xff)        // AL=
      cc_dec(0x41, 0x44, sh_record[NX_TLS13_RECORD_HEADER_LEN + 1] & 0xff)    // AD=
      sys_close(fd)
      return 28
  }
  let sh_body: *u8 = sh_record + NX_TLS13_RECORD_HEADER_LEN
  let sh_body_len: i64 = sh_total - NX_TLS13_RECORD_HEADER_LEN
  let gr: i64 = cc_sh_group_census(sh_body, sh_body_len)
  // The whole point of leg B: server took the secp256r1 share.
  if gr != 23 { sys_close(fd); return 29 }
  let rv: i64 = nx_tls13_client_session_recv_sh(s, sh_body, sh_body_len)
  cc_dec(0x52, 0x56, rv)                                             // RV=
  if rv != NX_TLS13_RECV_SH_OK { sys_close(fd); return 27 }
372
  let val_ctx_raw: *u8 = sys_mmap(64)
  let val_ctx: *TlsValidationContext = val_ctx_raw as *TlsValidationContext
  val_ctx.store = store
  val_ctx.sni_host = host
  val_ctx.sni_host_len = host_len
  val_ctx.now_epoch = epoch
  let wf: i64 = cc_walk(s, fd, val_ctx)
  sys_close(fd)
  return wf
382}
383
384func main() -> i64 {
  let epoch: i64 = sys_now_realtime_sec()   // real clock (B1 lesson)
  let r: i64 = nx_trust_store_load_from_certdata("/tmp/mozilla_certdata.txt\x00" as *u8, 300, 4194304)
  if r <= 0 { cc_dec(0x4C, 0x4F, r); return 11 }                     // LO=
  let store: *TrustStore = r as *TrustStore
  cc_dec(0x43, 0x41, trust_store_count(store))                       // CA=
390
  let la: i64 = cc_leg_httpbin(store, epoch)
  cc_dec(0x4C, 0x31, la)                                             // L1=
  let lb: i64 = cc_leg_p256(store, epoch)
  cc_dec(0x4C, 0x32, lb)                                             // L2=
395
  if la != 0 { return la }
  if lb != 0 { return 100 + lb }
  return 0
399}
nx_tls13_ch_compat_test.nx source

`nx_tls13_ch_compat_test.nx` source
