nx_tls13_ext_test.nx source

1// nx_tls13_ext_test.nx -- byte-exact KAT for TLS 1.3 extension 2// emitters + parsers. 3// 4// Each emit is verified against handcomputed expected bytes per the 5// wire format in RFC 8446 §4.2.x (and RFC 6066 §3 for SNI). Parse 6// is verified by round-trip: emit ServerHello-style extension, 7// re-parse it, recover the input. 8// 9// expect_exit: 0 10// license_tier: ORIGINAL 11 12import "nx_syscalls.nx" 13import "nx_tls13.nx" 14import "nx_tls13_ext.nx" 15 16func main() -> i64 { 17 let buf: *u8 = sys_mmap(256) 18 var n: i64 = 0 19 20 // ---- server_name "example.com" (11 bytes) ---- 21 let host: *u8 = sys_mmap(32) 22 host[0]=0x65; host[1]=0x78; host[2]=0x61; host[3]=0x6d 23 host[4]=0x70; host[5]=0x6c; host[6]=0x65; host[7]=0x2e 24 host[8]=0x63; host[9]=0x6f; host[10]=0x6d 25 n = tls13_ext_emit_server_name(host, 11, buf, 256) 26 if n != 20 { return 1 } // 9 + 11 27 // Expected bytes: 28 // 00 00 ext_type = 0 (server_name) 29 // 00 10 ext_data_len = 16 30 // 00 0e ServerNameList_len = 14 31 // 00 name_type = 0 (host_name) 32 // 00 0b host_name_len = 11 33 // 65 78 61 6d 70 6c 65 2e 63 6f 6d "example.com" 34 if (buf[0] & 0xff) != 0x00 { return 2 } 35 if (buf[1] & 0xff) != 0x00 { return 3 } 36 if (buf[2] & 0xff) != 0x00 { return 4 } 37 if (buf[3] & 0xff) != 0x10 { return 5 } // ext_data_len = 16 38 if (buf[4] & 0xff) != 0x00 { return 6 } 39 if (buf[5] & 0xff) != 0x0e { return 7 } // list_len = 14 40 if (buf[6] & 0xff) != 0x00 { return 8 } // name_type = host_name 41 if (buf[7] & 0xff) != 0x00 { return 9 } 42 if (buf[8] & 0xff) != 0x0b { return 10 } // host_name_len = 11 43 if (buf[9] & 0xff) != 0x65 { return 11 } // 'e' 44 if (buf[19] & 0xff) != 0x6d { return 12 } // 'm' 45 46 // ---- supported_versions client TLS 1.3 only ---- 47 // Post-fix (commit f6c073c5): emit now returns the actual wire byte 48 // count of 7, not the previously-broken 9 that left junk gaps in 49 // the ClientHello extension list. 50 n = tls13_ext_emit_supported_versions_tls13(buf, 256) 51 if n != 7 { return 20 } 52 // Expected: 00 2b 00 03 02 03 04 53 if (buf[0] & 0xff) != 0x00 { return 21 } 54 if (buf[1] & 0xff) != 0x2b { return 22 } // 43 = supported_versions 55 if (buf[2] & 0xff) != 0x00 { return 23 } 56 if (buf[3] & 0xff) != 0x03 { return 24 } // ext_data_len = 3 57 if (buf[4] & 0xff) != 0x02 { return 25 } // versions_list_len = 2 58 if (buf[5] & 0xff) != 0x03 { return 26 } 59 if (buf[6] & 0xff) != 0x04 { return 27 } // 0x0304 = TLS 1.3 60 61 // ---- supported_groups X25519 + secp256r1 ---- 62 // Post-fix (commit f6c073c5): emit now returns 10 (actual wire bytes), 63 // not the previously-broken 12. 64 n = tls13_ext_emit_supported_groups(buf, 256) 65 if n != 10 { return 30 } 66 if (buf[0] & 0xff) != 0x00 { return 31 } 67 if (buf[1] & 0xff) != 0x0a { return 32 } // 10 = supported_groups 68 if (buf[3] & 0xff) != 0x06 { return 33 } // ext_data_len = 6 69 if (buf[5] & 0xff) != 0x04 { return 34 } // list_len = 4 70 if (buf[6] & 0xff) != 0x00 { return 35 } 71 if (buf[7] & 0xff) != 0x1d { return 36 } // X25519 72 if (buf[8] & 0xff) != 0x00 { return 37 } 73 if (buf[9] & 0xff) != 0x17 { return 38 } // secp256r1 = 23 74 75 // ---- signature_algorithms ---- 76 n = tls13_ext_emit_signature_algorithms(buf, 256) 77 if n != 14 { return 40 } 78 if (buf[0] & 0xff) != 0x00 { return 41 } 79 if (buf[1] & 0xff) != 0x0d { return 42 } // 13 = signature_algorithms 80 if (buf[3] & 0xff) != 0x0a { return 43 } // ext_data_len = 10 81 if (buf[5] & 0xff) != 0x08 { return 44 } // schemes_list_len = 8 82 if (buf[6] & 0xff) != 0x08 { return 45 } 83 if (buf[7] & 0xff) != 0x07 { return 46 } // ed25519 = 0x0807 84 if (buf[8] & 0xff) != 0x04 { return 47 } 85 if (buf[9] & 0xff) != 0x03 { return 48 } // ecdsa_secp256r1_sha256 = 0x0403 86 if (buf[10] & 0xff) != 0x08 { return 49 } 87 if (buf[11] & 0xff) != 0x04 { return 50 } // rsa_pss_rsae_sha256 88 if (buf[12] & 0xff) != 0x08 { return 51 } 89 if (buf[13] & 0xff) != 0x05 { return 52 } // rsa_pss_rsae_sha384 90 91 // ---- key_share client X25519 ---- 92 let pubkey: *u8 = sys_mmap(64) 93 var pi: i64 = 0 94 while pi < 32 { 95 pubkey[pi] = 0xa0 + pi 96 pi = pi + 1 97 } 98 n = tls13_ext_emit_key_share_x25519(pubkey, buf, 256) 99 if n != 42 { return 60 } 100 // Expected header: 00 33 00 26 00 24 00 1d 00 20 + 32 pubkey bytes 101 if (buf[0] & 0xff) != 0x00 { return 61 } 102 if (buf[1] & 0xff) != 0x33 { return 62 } // 51 = key_share 103 if (buf[3] & 0xff) != 0x26 { return 63 } // ext_data_len = 38 104 if (buf[5] & 0xff) != 0x24 { return 64 } // client_shares_len = 36 105 if (buf[7] & 0xff) != 0x1d { return 65 } // X25519 106 if (buf[9] & 0xff) != 0x20 { return 66 } // key_exchange_len = 32 107 if (buf[10] & 0xff) != 0xa0 { return 67 } // first pubkey byte 108 if (buf[41] & 0xff) != 0xbf { return 68 } // last pubkey byte (0xa0 + 31) 109 110 // ---- Parse round-trip: supported_versions server-variant ---- 111 // ServerHello supported_versions data is just 2 bytes: the chosen version. 112 let sv_data: *u8 = sys_mmap(8) 113 sv_data[0] = 0x03 114 sv_data[1] = 0x04 115 let parsed_ver: i64 = tls13_ext_parse_supported_versions_server(sv_data, 2) 116 if parsed_ver != TLS_13_VERSION { return 70 } 117 118 // Bad length rejected 119 let bad: i64 = tls13_ext_parse_supported_versions_server(sv_data, 3) 120 if bad != 0 - NX_TLS13_EXT_VERDICT_BAD_FORMAT { return 71 } 121 122 // ---- Parse round-trip: key_share server-variant ---- 123 // ServerHello key_share data: group(2) + ke_len(2) + ke(ke_len) 124 let ks_data: *u8 = sys_mmap(64) 125 ks_data[0] = 0x00 126 ks_data[1] = 0x1d // X25519 127 ks_data[2] = 0x00 128 ks_data[3] = 0x20 // ke_len = 32 129 var ksi: i64 = 0 130 while ksi < 32 { 131 ks_data[4 + ksi] = 0x50 + ksi 132 ksi = ksi + 1 133 } 134 let out_grp: *i64 = sys_mmap(16) as *i64 135 let out_off: *i64 = sys_mmap(16) as *i64 136 let out_len: *i64 = sys_mmap(16) as *i64 137 let v: i64 = tls13_ext_parse_key_share_server(ks_data, 36, out_grp, out_off, out_len) 138 if v != NX_TLS13_EXT_VERDICT_OK { return 80 } 139 if *out_grp != NG_X25519 { return 81 } 140 if *out_off != 4 { return 82 } 141 if *out_len != 32 { return 83 } 142 // The 32 ke bytes start at ks_data[*out_off]; verify first + last 143 if (ks_data[(*out_off) + 0] & 0xff) != 0x50 { return 84 } 144 if (ks_data[(*out_off) + 31] & 0xff) != 0x6f { return 85 } 145 146 // Truncated key_share rejected 147 let bad_ks: i64 = tls13_ext_parse_key_share_server(ks_data, 3, out_grp, out_off, out_len) 148 if bad_ks != 0 - NX_TLS13_EXT_VERDICT_TRUNCATED { return 86 } 149 150 // ks_data says ke_len=32 but we pass only 16 bytes of buffer 151 let trunc_ks: i64 = tls13_ext_parse_key_share_server(ks_data, 16, out_grp, out_off, out_len) 152 if trunc_ks != 0 - NX_TLS13_EXT_VERDICT_TRUNCATED { return 87 } 153 154 // ---- Buffer overflow guards on emit ---- 155 let small: *u8 = sys_mmap(16) 156 let too_small: i64 = tls13_ext_emit_server_name(host, 11, small, 5) 157 if too_small != 0 - NX_TLS13_EXT_VERDICT_BUF_OVERFLOW { return 90 } 158 let bad_host_len: i64 = tls13_ext_emit_server_name(host, 0, buf, 256) 159 if bad_host_len != 0 - NX_TLS13_EXT_VERDICT_BAD_FORMAT { return 91 } 160 161 // ---- Verdict gate ---- 162 if nx_tls13_ext_verdict_is_valid(NX_TLS13_EXT_VERDICT_OK) != 1 { return 100 } 163 if nx_tls13_ext_verdict_is_valid(NX_TLS13_EXT_VERDICT_N) != 0 { return 101 } 164 if nx_tls13_ext_verdict_is_valid(0 - 1) != 0 { return 102 } 165 166 return 0 167}