nx_x509_dn_match.nx source
↩ module page · 60 lines · 2356 B
1// nx_x509_dn_match.nx -- byte-equality comparison of two X.509
2// Distinguished Names (DER-encoded Name SEQUENCEs).
3//
4// Phase 0b §I.4 piece 6 of the chain-walker arc. Composes the
5// X509Cert.issuer_off/_len and X509Cert.subject_off/_len captured
6// by x509_parse with simple byte-equality to enable issuer ->
7// subject DN matching in the chain walker.
8//
9// Algorithm: RFC 5280 §7.1 says DN comparison MAY use the lexical
10// equality of DER encodings as a conservative match. Real CAs
11// emit byte-equal issuer DN (in child cert) and subject DN (in
12// parent cert) for chains they intend to be walkable, so byte-
13// equality covers ~all real Web PKI. Edge cases (case-folding,
14// PrintableString-vs-UTF8 normalisation) are deliberately out of
15// scope for this primitive -- if a real chain fails to match
16// byte-exact, the caller (chain walker) returns DN_MISMATCH and
17// the operator investigates. This matches BoringSSL's default
18// behavior for "strict" mode.
19//
20// Public API:
21// nx_x509_dn_match(buf_a, off_a, len_a, buf_b, off_b, len_b)
22// -> 1 if byte-equal, 0 if different
23//
24// Per Cardinals 9 (single-responsibility -- just compare; chain
25// orchestration is separate), 12 (defensive at boundaries -- length
26// check first), and 23 (preamble explains why byte-equality is
27// the conservative-but-sufficient strategy).
28//
29// license_tier: INDEPENDENT_REDERIVE
30// genealogy_id: international-research-sources/ietf/rfc_5280
31// lineage_id: nishi_x509_dn_match_q10
32
33// nx_safety_envelope:
34// intended_use: AUTO_APPLIED -- primitive-specific tuning queued
35// sil_target: SIL1
36// evidence: [bulk_applied_2026-05-19, x509-dn-byte-equality]
37// verdict: NOT_YET_EVALUATED
38
39import "nx_syscalls.nx"
40
41// Returns 1 if (buf_a + off_a, len_a) bytes equal
42// (buf_b + off_b, len_b) bytes; 0 otherwise.
43func nx_x509_dn_match(buf_a: *u8, off_a: i64, len_a: i64,
44 buf_b: *u8, off_b: i64, len_b: i64) -> i64 {
45 if len_a != len_b { return 0 }
46 if len_a <= 0 { return 0 }
47 var i: i64 = 0
48 while i < len_a {
49 let ba: i64 = buf_a[off_a + i] & 0xff
50 let bb: i64 = buf_b[off_b + i] & 0xff
51 if ba != bb { return 0 }
52 i = i + 1
53 }
54 return 1
55}
56
57// Compile-only smoke. Real KAT bundled with chain_verify test.
58func main() -> i64 {
59 return 0
60}