nx_tls13_client_session_run_test.nx source
↩ module page · 74 lines · 3243 B
1// nx_tls13_client_session_run_test.nx -- KAT for the top-level
2// TLS handshake orchestrator.
3//
4// Note on test scope: full handshake against a real TLS 1.3 server
5// is exercised by Arc A's end-to-end demo (queued). This KAT
6// verifies the orchestrator's CONTRACT SURFACE:
7// - bad fd -> write or read step fails with mapped verdict
8// - verdict gate (all 11 sealed values valid / invalid range
9// rejected)
10//
11// expect_exit: 0
12// license_tier: ORIGINAL
13
14import "nx_syscalls.nx"
15import "nx_x509_trust_store.nx"
16import "nx_tls13_client_validate_certificate.nx"
17import "nx_tls13_client_session_run.nx"
18
19func main() -> i64 {
20 let client_random: *u8 = sys_mmap(32)
21 var i: i64 = 0
22 while i < 32 { client_random[i] = (0xC0 + i) as u8; i = i + 1 }
23 let priv: *u8 = sys_mmap(32)
24 i = 0
25 while i < 32 { priv[i] = (0x40 + i) as u8; i = i + 1 }
26
27 let sni: *u8 = sys_mmap(16)
28 sni[0]=0x65; sni[1]=0x78; sni[2]=0x61; sni[3]=0x6D
29 sni[4]=0x70; sni[5]=0x6C; sni[6]=0x65 // "example"
30
31 let store: *TrustStore = trust_store_alloc(4)
32 let ctx_raw: *u8 = sys_mmap(64)
33 let ctx: *TlsValidationContext = ctx_raw as *TlsValidationContext
34 ctx.store = store
35 ctx.sni_host = sni
36 ctx.sni_host_len = 7
37 ctx.now_epoch = 1718452800
38
39 // ---- Test A: fd=-1 -> failure (write or read step) ----
40 // We expect a NEGATIVE return value mapping to one of:
41 // -NX_TLS13_RUN_WRITE_CH_FAIL (if sys_write rejects -1)
42 // -NX_TLS13_RUN_READ_SH_FAIL (if sys_write somehow succeeds
43 // but read fails)
44 let r: i64 = nx_tls13_client_session_run(
45 0 - 1, sni, 7, client_random, priv, ctx
46 )
47 if r >= 0 { return 1 } // Must be negative on failure
48
49 // Verify the negative value corresponds to a valid verdict
50 let neg_v: i64 = 0 - r
51 if nx_tls13_run_verdict_is_valid(neg_v) != 1 { return 2 }
52 // Accept either WRITE_CH_FAIL or READ_SH_FAIL (platform-dep)
53 if neg_v != NX_TLS13_RUN_WRITE_CH_FAIL {
54 if neg_v != NX_TLS13_RUN_READ_SH_FAIL { return 3 }
55 }
56
57 // ---- Test B: verdict gate ----
58 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_OK) != 1 { return 10 }
59 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_EMIT_CH_FAIL) != 1 { return 11 }
60 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_WRITE_CH_FAIL) != 1 { return 12 }
61 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_READ_SH_FAIL) != 1 { return 13 }
62 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_RECV_SH_FAIL) != 1 { return 14 }
63 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_READ_HS_FAIL) != 1 { return 15 }
64 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_RECV_HS_FAIL) != 1 { return 16 }
65 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_EMIT_CF_FAIL) != 1 { return 17 }
66 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_WRITE_CF_FAIL) != 1 { return 18 }
67 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_DERIVE_APP_FAIL) != 1 { return 19 }
68 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_LOOP_BUDGET_EXCEEDED) != 1 { return 20 }
69 if nx_tls13_run_verdict_is_valid(NX_TLS13_RUN_VERDICT_N) != 0 { return 21 }
70 if nx_tls13_run_verdict_is_valid(0) != 0 { return 22 }
71 if nx_tls13_run_verdict_is_valid(0 - 1) != 0 { return 23 }
72
73 return 0
74}