nx_tls13_ed25519_test_daemon.nx source
↩ module page · 128 lines · 4893 B
1// nx_tls13_ed25519_test_daemon.nx -- V-HOST-2+1-4b runtime roundtrip daemon.
2//
3// Minimal test daemon proving V-HOST-2+1 Ed25519 TLS sig path works
4// end-to-end against a real TLS 1.3 client (openssl s_client).
5//
6// FLOW:
7// 1. Read /tmp/nx_cert_gen_demo_ed25519_cert.der + priv.bin (32B)
8// (PREREQ: nx_cert_gen smoke produced these via V-HOST-4c Ed25519 path)
9// 2. nx_csprng_fill 32B server_random + 32B server_x25519_priv
10// 3. nx_http_server_listen on 127.0.0.1:7443
11// 4. Accept ONE connection; call nx_tls13_server_session_run_ed25519
12// 5. After handshake completes, send tiny HTTP body via session.app_send
13// 6. Close + exit
14//
15// Per Cardinal 7 (Test Before Ship) + operator "no not finished arcs":
16// this daemon is the runtime gate that proves the V-HOST-2+1 Ed25519
17// TLS sig path actually works (not just compiles).
18//
19// COMPOSES (all sovereign):
20// nx_syscalls (sys_read_file + sys_close + sys_exit + sys_write)
21// nx_csprng (random for server_random + x25519 priv)
22// nx_http_server (sovereign HTTP/TCP server primitives -- listen + accept)
23// nx_tls13_server_session_run_ed25519 (V-HOST-2+1-2 LIVE)
24// nx_tls13_server_session_app_send (send encrypted record per TLS 1.3)
25
26import "nx_syscalls.nx"
27import "nx_csprng.nx"
28import "nx_http_server.nx"
29import "nx_tls13_server_session.nx"
30import "nx_tls13_server_session_run.nx"
31import "nx_tls13_server_session_app_data.nx"
32
33const NX_T13TD_PORT: i64 = 7443
34
35// Tiny HTTP/1.0 response (so TLS 1.3 client gets a parseable reply).
36const NX_T13TD_HTTP_RESP: *u8 = "HTTP/1.0 200 OK\r\nContent-Type: text/plain\r\nContent-Length: 3\r\nConnection: close\r\n\r\nOK\n" as *u8
37const NX_T13TD_HTTP_RESP_N: i64 = 86
38
39const NX_T13TD_OK: i64 = 0
40const NX_T13TD_ENOENT: i64 = 1
41const NX_T13TD_BAD_PRIV_SIZE: i64 = 2
42const NX_T13TD_BIND_FAILED: i64 = 3
43const NX_T13TD_ACCEPT_FAILED: i64 = 4
44const NX_T13TD_HS_FAILED: i64 = 5
45const NX_T13TD_APP_SEND_FAILED: i64 = 6
46const NX_T13TD_WRITE_FAILED: i64 = 7
47
48func main() -> i64 {
49 // 1. Read Ed25519 cert + priv
50 let cert_path: *u8 = "/tmp/nx_cert_gen_demo_ed25519_cert.der" as *u8
51 let priv_path: *u8 = "/tmp/nx_cert_gen_demo_ed25519_priv.bin" as *u8
52
53 let cert_len_box: *i64 = (sys_mmap(8)) as *i64
54 cert_len_box[0] = 0
55 let cert_der: *u8 = sys_read_file(cert_path, cert_len_box)
56 if (cert_der as i64) == 0 { return NX_T13TD_ENOENT }
57 let cert_der_len: i64 = cert_len_box[0]
58 if cert_der_len < 100 { return NX_T13TD_ENOENT }
59
60 let priv_len_box: *i64 = (sys_mmap(8)) as *i64
61 priv_len_box[0] = 0
62 let ed25519_priv: *u8 = sys_read_file(priv_path, priv_len_box)
63 if (ed25519_priv as i64) == 0 { return NX_T13TD_ENOENT }
64 if priv_len_box[0] != 32 { return NX_T13TD_BAD_PRIV_SIZE }
65
66 // 2. Generate server_random (32B) + server x25519 priv (32B)
67 let server_random: *u8 = sys_mmap(32)
68 let server_x25519_priv: *u8 = sys_mmap(32)
69 if nx_csprng_fill(server_random, 32) != 0 { return NX_T13TD_BIND_FAILED }
70 if nx_csprng_fill(server_x25519_priv, 32) != 0 { return NX_T13TD_BIND_FAILED }
71
72 // 3. Bind 127.0.0.1:7443
73 let addr_buf: *u8 = sys_mmap(16)
74 nx_http_server_addr_loopback(addr_buf, NX_T13TD_PORT)
75 let lv: *i64 = (sys_mmap(8)) as *i64
76 let lfd: i64 = nx_http_server_listen(addr_buf, 4, lv)
77 if lfd < 0 { return NX_T13TD_BIND_FAILED }
78
79 // Banner so smoke can detect daemon ready
80 let banner: *u8 = "ed25519-test-daemon listening 127.0.0.1:7443\n" as *u8
81 sys_write(1, banner, 45)
82
83 // 4. Accept ONE connection
84 let av: *i64 = (sys_mmap(8)) as *i64
85 let cfd: i64 = nx_http_server_accept_one(lfd, av)
86 if cfd < 0 {
87 sys_close(lfd)
88 return NX_T13TD_ACCEPT_FAILED
89 }
90
91 // 5. Run Ed25519 TLS handshake (V-HOST-2+1-2 path)
92 let hs_rc: i64 = nx_tls13_server_session_run_ed25519(
93 cfd,
94 server_random,
95 server_x25519_priv,
96 cert_der, cert_der_len,
97 ed25519_priv)
98 if hs_rc <= 0 {
99 sys_close(cfd)
100 sys_close(lfd)
101 return NX_T13TD_HS_FAILED
102 }
103 let s: *Tls13ServerSession = hs_rc as *Tls13ServerSession
104
105 // 6. Send tiny HTTP response over encrypted channel
106 let out_rec: *u8 = sys_mmap(NX_T13TD_HTTP_RESP_N + 256)
107 let out_n: i64 = nx_tls13_server_session_app_send(
108 s, NX_T13TD_HTTP_RESP, NX_T13TD_HTTP_RESP_N,
109 out_rec, NX_T13TD_HTTP_RESP_N + 256)
110 if out_n <= 0 {
111 sys_close(cfd)
112 sys_close(lfd)
113 return NX_T13TD_APP_SEND_FAILED
114 }
115 if sys_write(cfd, out_rec, out_n) != out_n {
116 sys_close(cfd)
117 sys_close(lfd)
118 return NX_T13TD_WRITE_FAILED
119 }
120
121 // 7. Done -- exit 0 (operator-clean shutdown)
122 sys_close(cfd)
123 sys_close(lfd)
124
125 let done: *u8 = "ed25519-test-daemon: handshake OK; HTTP OK sent; clean exit\n" as *u8
126 sys_write(1, done, 60)
127 return NX_T13TD_OK
128}