code wiki / _hdl_build / nx_access_pep.nx
nx_access_pep.nx
buildroot/runtime/_hdl_build/nx_access_pep.nx
about
nx_access_pep.nx -- the POLICY ENFORCEMENT POINT glue: ONE call a daemon makes per request that composes the
whole access wall. The live daemon (nx_sites_daemon_v2 / nx_cms_admin) extracts peer_ip (sys_accept_with_addr),
the device id + signature (request headers), and rate_ok (nx_rate_limit), packs them into the req/area arrays,
and calls pep_decide; it derives the network tier (nt_classify), verifies the device's signature over the
server challenge (dc_verify), and runs the deny-by-default PDP (aw_decide) -> one verdict. pep_audit chains
that decision into the tamper-evident log. The integration seam, built + gateable WITHOUT touching production.
(req/area are i64 arrays, not a long arg list, because the compiler caps a call at 16 args.) Composes
nx_nettier + nx_device_cert + nx_access_wall + nx_access_audit (all nx_syscalls; no rolled crypto). license_tier: ORIGINAL
dependencies 5 imports · 1 importers
imports: nx_access_wall.nxnx_device_cert.nxnx_nettier.nxnx_access_audit.nxnx_syscalls.nx
imported by: nx_access_pep_gate.nx
structs
| none |
consts
| none |
functions
| 18 | func pep_decide(req: *i64, area: *i64) -> i64 |
| 28 | func pep_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o } called by 1: pep_audit |
| 29 | func pep_catn(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o } |
| 33 | func pep_audit(prev: *u8, peer_ip: i64, resource: *u8, res_len: i64, verdict: i64, entry_out: *u8, hash_out: *u8) -> i64 |