nx_x509_trust_store_test.nx source

1// nx_x509_trust_store_test.nx -- KAT for the trust anchor store. 2// 3// expect_exit: 0 4// license_tier: ORIGINAL 5 6import "nx_syscalls.nx" 7import "nx_x509.nx" 8import "nx_x509_trust_store.nx" 9 10// Helper: write "CN=<letter>" DN bytes (17 bytes total). 11// 30 0F 31 0D 30 0B 06 03 55 04 03 0C 04 <4 letter bytes> 12func write_cn_dn(buf: *u8, off: i64, letter: i64) -> i64 { 13 buf[off] = 0x30; buf[off+1] = 0x0F 14 buf[off+2] = 0x31; buf[off+3] = 0x0D 15 buf[off+4] = 0x30; buf[off+5] = 0x0B 16 buf[off+6] = 0x06; buf[off+7] = 0x03 17 buf[off+8] = 0x55; buf[off+9] = 0x04; buf[off+10] = 0x03 18 buf[off+11] = 0x0C; buf[off+12] = 0x04 19 buf[off+13] = letter as u8 20 buf[off+14] = letter as u8 21 buf[off+15] = letter as u8 22 buf[off+16] = letter as u8 23 return 17 24} 25 26func zero_cert(cert: *X509Cert) -> i64 { 27 cert.tbs_off=0; cert.tbs_len=0 28 cert.serial_off=0; cert.serial_len=0 29 cert.sig_alg_off=0; cert.sig_alg_len=0 30 cert.spki_off=0; cert.spki_len=0 31 cert.sig_off=0; cert.sig_len=0 32 cert.pubkey_off=0; cert.pubkey_len=0 33 cert.pubkey_alg_off=0; cert.pubkey_alg_len=0 34 cert.validity_off=0; cert.validity_len=0 35 cert.extensions_off = 0 - 1; cert.extensions_len=0 36 cert.issuer_off=0; cert.issuer_len=0 37 cert.subject_off=0; cert.subject_len=0 38 return 0 39} 40 41func main() -> i64 { 42 // Three synthetic trust anchors with distinct subject DNs: 43 // anchor_a: subject = "CN=AAAA" 44 // anchor_b: subject = "CN=BBBB" 45 // anchor_c: subject = "CN=CCCC" 46 let buf_a: *u8 = sys_mmap(64) 47 let buf_b: *u8 = sys_mmap(64) 48 let buf_c: *u8 = sys_mmap(64) 49 write_cn_dn(buf_a, 0, 0x41) // 'A' 50 write_cn_dn(buf_b, 0, 0x42) // 'B' 51 write_cn_dn(buf_c, 0, 0x43) // 'C' 52 53 let cert_a: *X509Cert = (sys_mmap(256)) as *X509Cert 54 zero_cert(cert_a) 55 cert_a.subject_off = 0; cert_a.subject_len = 17 56 57 let cert_b: *X509Cert = (sys_mmap(256)) as *X509Cert 58 zero_cert(cert_b) 59 cert_b.subject_off = 0; cert_b.subject_len = 17 60 61 let cert_c: *X509Cert = (sys_mmap(256)) as *X509Cert 62 zero_cert(cert_c) 63 cert_c.subject_off = 0; cert_c.subject_len = 17 64 65 // ---- Test A: alloc + count = 0 ---- 66 let store: *TrustStore = trust_store_alloc(2) 67 if trust_store_count(store) != 0 { return 1 } 68 69 // ---- Test B: add anchor A -> OK + count = 1 ---- 70 if trust_store_add(store, buf_a, cert_a) != NX_TRUST_STORE_OK { return 2 } 71 if trust_store_count(store) != 1 { return 3 } 72 73 // ---- Test C: add anchor B -> OK + count = 2 ---- 74 if trust_store_add(store, buf_b, cert_b) != NX_TRUST_STORE_OK { return 4 } 75 if trust_store_count(store) != 2 { return 5 } 76 77 // ---- Test D: add anchor C -> FULL (cap=2) ---- 78 if trust_store_add(store, buf_c, cert_c) != NX_TRUST_STORE_FULL { return 6 } 79 if trust_store_count(store) != 2 { return 7 } 80 81 // ---- Test E: lookup by matching DN -> returns matching slot ---- 82 let found_a: *TrustAnchor = trust_store_lookup_by_subject(store, buf_a, 0, 17) 83 if (found_a as i64) == 0 { return 10 } 84 if found_a.buf != buf_a { return 11 } 85 if found_a.cert != cert_a { return 12 } 86 87 let found_b: *TrustAnchor = trust_store_lookup_by_subject(store, buf_b, 0, 17) 88 if (found_b as i64) == 0 { return 13 } 89 if found_b.cert != cert_b { return 14 } 90 91 // ---- Test F: lookup by non-matching DN -> NULL ---- 92 let not_found: *TrustAnchor = trust_store_lookup_by_subject(store, buf_c, 0, 17) 93 if (not_found as i64) != 0 { return 20 } 94 95 // ---- Test G: add cert with subject_len == 0 -> BAD ---- 96 let store2: *TrustStore = trust_store_alloc(2) 97 let bad_cert: *X509Cert = (sys_mmap(256)) as *X509Cert 98 zero_cert(bad_cert) 99 // subject_off and subject_len both 0 100 if trust_store_add(store2, buf_a, bad_cert) != NX_TRUST_STORE_BAD { return 30 } 101 if trust_store_count(store2) != 0 { return 31 } 102 103 // ---- Test H: lookup in empty store -> NULL ---- 104 let store3: *TrustStore = trust_store_alloc(4) 105 let null_lookup: *TrustAnchor = trust_store_lookup_by_subject(store3, buf_a, 0, 17) 106 if (null_lookup as i64) != 0 { return 40 } 107 108 // ---- Test I: alternate-buffer match (DN bytes byte-equal but in 109 // different buffer) still finds the anchor ---- 110 let buf_a_copy: *u8 = sys_mmap(64) 111 write_cn_dn(buf_a_copy, 0, 0x41) 112 let found_a_alt: *TrustAnchor = trust_store_lookup_by_subject(store, buf_a_copy, 0, 17) 113 if (found_a_alt as i64) == 0 { return 50 } 114 if found_a_alt.cert != cert_a { return 51 } 115 116 // ---- Test J: lookup at non-zero offset ---- 117 let big_buf: *u8 = sys_mmap(64) 118 var i: i64 = 0 119 while i < 5 { big_buf[i] = 0xCC; i = i + 1 } 120 write_cn_dn(big_buf, 5, 0x42) // "CN=BBBB" at offset 5 121 let found_b_at_off: *TrustAnchor = trust_store_lookup_by_subject(store, big_buf, 5, 17) 122 if (found_b_at_off as i64) == 0 { return 60 } 123 if found_b_at_off.cert != cert_b { return 61 } 124 125 // ---- Test K: verdict gate ---- 126 if nx_trust_store_verdict_is_valid(NX_TRUST_STORE_OK) != 1 { return 70 } 127 if nx_trust_store_verdict_is_valid(NX_TRUST_STORE_FULL) != 1 { return 71 } 128 if nx_trust_store_verdict_is_valid(NX_TRUST_STORE_BAD) != 1 { return 72 } 129 if nx_trust_store_verdict_is_valid(NX_TRUST_STORE_VERDICT_N) != 0 { return 73 } 130 if nx_trust_store_verdict_is_valid(0) != 0 { return 74 } 131 if nx_trust_store_verdict_is_valid(0 - 1) != 0 { return 75 } 132 133 return 0 134}