nx_tls13_client_dispatch_with_validation_test.nx source
↩ module page · 121 lines · 5063 B
1// nx_tls13_client_dispatch_with_validation_test.nx -- KAT for the
2// dispatcher variant that enforces cert validation at WAIT_CERT.
3//
4// We exercise the WRAPPER's contract:
5// - non-WAIT_CERT states delegate to the underlying dispatcher
6// (we test by feeding a malformed message at WAIT_EE and
7// expecting BAD_MSG_TYPE -- proves delegation works)
8// - WAIT_CERT with empty trust store -> CERT_VERIFY_FAIL
9// (cert validation rejects because no trust anchor matches)
10// - WAIT_CERT with malformed cert msg -> CERT_VERIFY_FAIL
11// (the bridge rejects before validation even starts)
12// - sealed verdict gate
13//
14// The full happy-path (handshake complete with cert valid) is
15// proven by nx_https_pipeline_e2e_test for the cert pipeline;
16// the bridge KAT proved the verdict routing; this KAT proves the
17// dispatcher integration.
18//
19// expect_exit: 0
20// license_tier: ORIGINAL
21
22import "nx_syscalls.nx"
23import "nx_x509_trust_store.nx"
24import "nx_tls13_client.nx"
25import "nx_tls13_client_validate_certificate.nx"
26import "nx_tls13_client_dispatch_with_validation.nx"
27
28func main() -> i64 {
29 let hostname: *u8 = sys_mmap(16)
30 hostname[0]=0x65; hostname[1]=0x78; hostname[2]=0x61 // "exa"
31 let hostname_len: i64 = 11
32
33 let store: *TrustStore = trust_store_alloc(4)
34 let ctx_raw: *u8 = sys_mmap(64)
35 let ctx: *TlsValidationContext = ctx_raw as *TlsValidationContext
36 ctx.store = store
37 ctx.sni_host = hostname
38 ctx.sni_host_len = hostname_len
39 ctx.now_epoch = 1718452800
40
41 let new_state_p: *i64 = sys_mmap(16) as *i64
42 let dummy_hs_secret: *u8 = sys_mmap(32)
43 let transcript: *u8 = sys_mmap(128)
44
45 // ---- Test A: WAIT_CERT + malformed cert msg -> CERT_VERIFY_FAIL ----
46 let bad_cert: *u8 = sys_mmap(16)
47 bad_cert[0] = 0x0B // HT_CERTIFICATE
48 bad_cert[1] = 0; bad_cert[2] = 0; bad_cert[3] = 1
49 bad_cert[4] = 0xFF // garbage body
50 let v_a: i64 = tls13_client_dispatch_with_validation(
51 NX_TLS13_CSTATE_WAIT_CERT,
52 bad_cert, 5,
53 dummy_hs_secret, transcript, new_state_p,
54 ctx
55 )
56 if v_a != NX_TLS13_DWV_CERT_VERIFY_FAIL { return 1 }
57
58 // ---- Test B: WAIT_CERT with empty cert msg -> CERT_VERIFY_FAIL ----
59 let empty_cert: *u8 = sys_mmap(8)
60 let v_b: i64 = tls13_client_dispatch_with_validation(
61 NX_TLS13_CSTATE_WAIT_CERT,
62 empty_cert, 0,
63 dummy_hs_secret, transcript, new_state_p,
64 ctx
65 )
66 if v_b != NX_TLS13_DWV_CERT_VERIFY_FAIL { return 2 }
67
68 // ---- Test C: WAIT_EE state + cert msg type -> BAD_MSG_TYPE
69 // (delegated from underlying dispatcher) ----
70 let cert_at_ee: *u8 = sys_mmap(16)
71 cert_at_ee[0] = 0x0B // HT_CERTIFICATE (wrong for WAIT_EE)
72 cert_at_ee[1] = 0; cert_at_ee[2] = 0; cert_at_ee[3] = 0
73 let v_c: i64 = tls13_client_dispatch_with_validation(
74 NX_TLS13_CSTATE_WAIT_EE,
75 cert_at_ee, 4,
76 dummy_hs_secret, transcript, new_state_p,
77 ctx
78 )
79 if v_c != NX_TLS13_DWV_BAD_MSG_TYPE { return 3 }
80
81 // ---- Test D: bad state -> BAD_STATE (delegated) ----
82 // Use an out-of-enum state value.
83 let any_msg: *u8 = sys_mmap(16)
84 any_msg[0] = 0x08 // HT_ENCRYPTED_EXTENSIONS
85 any_msg[1] = 0; any_msg[2] = 0; any_msg[3] = 0
86 let v_d: i64 = tls13_client_dispatch_with_validation(
87 99, // not a real state
88 any_msg, 4,
89 dummy_hs_secret, transcript, new_state_p,
90 ctx
91 )
92 if v_d != NX_TLS13_DWV_BAD_STATE { return 4 }
93
94 // ---- Test E: msg too short -> BAD_FORMAT (delegated) ----
95 // The wrapper SHORT-CIRCUITS to validation FIRST at WAIT_CERT
96 // (validation runs before underlying dispatcher). If msg_len
97 // < 4 at WAIT_CERT, validation rejects -> CERT_VERIFY_FAIL.
98 // At any OTHER state, the wrapper delegates first -> dispatcher
99 // returns BAD_FORMAT. Test with WAIT_EE for clean delegation.
100 let short_msg: *u8 = sys_mmap(8)
101 let v_e: i64 = tls13_client_dispatch_with_validation(
102 NX_TLS13_CSTATE_WAIT_EE,
103 short_msg, 2,
104 dummy_hs_secret, transcript, new_state_p,
105 ctx
106 )
107 if v_e != NX_TLS13_DWV_BAD_FORMAT { return 5 }
108
109 // ---- Test F: sealed verdict gate ----
110 if nx_tls13_dwv_verdict_is_valid(NX_TLS13_DWV_OK) != 1 { return 10 }
111 if nx_tls13_dwv_verdict_is_valid(NX_TLS13_DWV_BAD_MSG_TYPE) != 1 { return 11 }
112 if nx_tls13_dwv_verdict_is_valid(NX_TLS13_DWV_BAD_FORMAT) != 1 { return 12 }
113 if nx_tls13_dwv_verdict_is_valid(NX_TLS13_DWV_SF_BAD_MAC) != 1 { return 13 }
114 if nx_tls13_dwv_verdict_is_valid(NX_TLS13_DWV_BAD_STATE) != 1 { return 14 }
115 if nx_tls13_dwv_verdict_is_valid(NX_TLS13_DWV_CERT_VERIFY_FAIL) != 1 { return 15 }
116 if nx_tls13_dwv_verdict_is_valid(NX_TLS13_DWV_VERDICT_N) != 0 { return 16 }
117 if nx_tls13_dwv_verdict_is_valid(0) != 0 { return 17 }
118 if nx_tls13_dwv_verdict_is_valid(0 - 1) != 0 { return 18 }
119
120 return 0
121}