nx_tls13_server_session_emit_certificate_test.nx source
↩ module page · 117 lines · 4383 B
1// Smoke for emit_certificate: wraps caller-supplied DER bytes as
2// a TLS Certificate message + AEAD record.
3//
4// Closed-form invariants:
5// (a) Wrong state -> negative
6// (b) Null cert bytes -> negative
7// (c) Zero cert length -> negative
8// (d) Valid 64-byte synthetic DER -> succeeds; output 0x17 header
9// (e) server_seq increments
10// (f) State stays CERT_SENT (next is emit_cv)
11// (g) emit_cv still works after emit_certificate (full chain)
12//
13// expect_exit: 0
14// license_tier: ORIGINAL
15
16import "nx_syscalls.nx"
17import "nx_x25519.nx"
18import "nx_x25519_ephemeral.nx"
19import "nx_tls13.nx"
20import "nx_tls13_hello.nx"
21import "nx_tls13_server_session.nx"
22import "nx_tls13_server_session_recv_ch.nx"
23import "nx_tls13_server_session_emit_sh.nx"
24import "nx_tls13_server_session_derive_hs.nx"
25import "nx_tls13_server_session_derive_traffic.nx"
26import "nx_tls13_server_session_emit_ee.nx"
27import "nx_tls13_server_session_emit_certificate.nx"
28import "nx_tls13_server_session_emit_cv.nx"
29
30func main() -> i64 {
31 let cli_priv: *u8 = sys_mmap(32)
32 let cli_pub: *u8 = sys_mmap(32)
33 let cli_rand: *u8 = sys_mmap(32)
34 var i: i64 = 0
35 while i < 32 {
36 cli_priv[i] = ((i + 17) & 0xff) as u8
37 cli_rand[i] = ((i + 50) & 0xff) as u8
38 i = i + 1
39 }
40 x25519_keypair_public(cli_priv, cli_pub)
41 let ch_buf: *u8 = sys_mmap(1024)
42 let ch_n: i64 = tls13_client_hello_emit(cli_rand, "nishifamily.com", 15, cli_pub, ch_buf, 1024)
43 if ch_n <= 0 { return 5 }
44
45 let srv_priv: *u8 = sys_mmap(32)
46 let srv_rand: *u8 = sys_mmap(32)
47 let srv_ecdsa: *u8 = sys_mmap(32)
48 var k: i64 = 0
49 while k < 32 {
50 srv_priv[k] = ((k + 80) & 0xff) as u8
51 srv_rand[k] = ((k + 70) & 0xff) as u8
52 srv_ecdsa[k] = ((k + 100) & 0xff) as u8
53 k = k + 1
54 }
55 let s: *Tls13ServerSession = nx_tls13_server_session_new(srv_rand, srv_priv)
56
57 // Synthetic DER cert (64 bytes of any content -- substrate doesn't
58 // validate; just wraps). Real-world callers supply a real DER cert.
59 let fake_cert: *u8 = sys_mmap(64)
60 var ci: i64 = 0
61 while ci < 64 {
62 fake_cert[ci] = ((ci + 200) & 0xff) as u8
63 ci = ci + 1
64 }
65
66 // ===== (a) Wrong state =====
67 let bad_buf: *u8 = sys_mmap(512)
68 let r_wrong: i64 = nx_tls13_server_session_emit_certificate(s, fake_cert, 64, bad_buf, 512)
69 let exp_bad: i64 = 0 - NX_TLS13_SSESSION_BAD_STATE
70 if r_wrong != exp_bad { return 10 }
71
72 // Drive through emit_ee
73 nx_tls13_server_session_recv_ch(s, ch_buf, ch_n)
74 let sh_buf: *u8 = sys_mmap(512)
75 nx_tls13_server_session_emit_sh(s, sh_buf, 512)
76 nx_tls13_server_session_derive_hs_secrets(s)
77 nx_tls13_server_session_derive_traffic(s)
78 let ee_buf: *u8 = sys_mmap(256)
79 nx_tls13_server_session_emit_ee(s, ee_buf, 256)
80 if s.state != NX_TLS13_SSTATE_CERT_SENT { return 20 }
81 if s.server_seq != 1 { return 21 }
82
83 // ===== (b) Null cert =====
84 let r_null: i64 = nx_tls13_server_session_emit_certificate(s, 0 as *u8, 64, bad_buf, 512)
85 if r_null != 0 - NX_TLS13_SSESSION_INTERNAL { return 25 }
86
87 // ===== (c) Zero length =====
88 let r_zero: i64 = nx_tls13_server_session_emit_certificate(s, fake_cert, 0, bad_buf, 512)
89 if r_zero != 0 - NX_TLS13_SSESSION_INTERNAL { return 26 }
90
91 // ===== (d) Valid emit succeeds =====
92 let cert_buf: *u8 = sys_mmap(512)
93 let n_cert: i64 = nx_tls13_server_session_emit_certificate(s, fake_cert, 64, cert_buf, 512)
94 if n_cert <= 0 { return 30 }
95 if cert_buf[0] != 0x17 { return 31 }
96 // Expected total: header(5) + inner(75) + 1 type + 16 tag = 97
97 // (inner = HT(1) + u24(3) + ctx_len(1) + cert_list_len(3) +
98 // cert_data_len(3) + cert_data(64) + ext_len(2) = 77; -2 mistake above)
99 // accept range 80-200
100 if n_cert < 80 { return 32 }
101 if n_cert > 250 { return 33 }
102
103 // ===== (e) server_seq increments (1 -> 2) =====
104 if s.server_seq != 2 { return 40 }
105
106 // ===== (f) State stays CERT_SENT =====
107 if s.state != NX_TLS13_SSTATE_CERT_SENT { return 50 }
108
109 // ===== (g) emit_cv still works AFTER emit_certificate =====
110 let cv_buf: *u8 = sys_mmap(512)
111 let n_cv: i64 = nx_tls13_server_session_emit_cv(s, srv_ecdsa, cv_buf, 512)
112 if n_cv <= 0 { return 60 }
113 if s.state != NX_TLS13_SSTATE_CV_SENT { return 61 }
114 if s.server_seq != 3 { return 62 }
115
116 return 0
117}