code wiki / _hdl_build / nx_api_harden.nx
nx_api_harden.nx
buildroot/runtime/_hdl_build/nx_api_harden.nx
about
nx_api_harden.nx -- LIB: the remaining S-class remote-access hardening, sovereign (no Cloudflare WAF, no cloud SIEM).
WAF/DDoS -- per-source rate cap + max request size + bad-pattern block at the relay/gateway.
AUDIT -- a hash-CHAINED, tamper-evident access log: each entry's hash folds in the previous, so changing ANY
past entry breaks the final hash -> tampering is detectable (sovereign observability + integrity).
mTLS -- mutual TLS: the CLIENT presents a cert our CA signed; an unsigned/forged cert is rejected at the TLS
layer, before the app -- stronger than a bearer token alone.
never-brick #26: pure arithmetic, deterministic. license_tier: ORIGINAL
dependencies 1 imports · 1 importers
imports: nx_syscalls.nx
imported by: nx_api_harden_gate.nx
structs
| none |
consts
| 9 | const K_MAGIC_1000003: i64 = 1000003 |
| 10 | const K_MAGIC_2147483647: i64 = 2147483647 |
| 11 | const K_MAGIC_1313: i64 = 1313 |
| 12 | const K_MAGIC_16777619: i64 = 16777619 |
| 13 | const K_MAGIC_18652613: i64 = 18652613 |
| 14 | const K_MAGIC_1779033703: i64 = 1779033703 |
functions
| 17 | func waf_allow(src_reqs: i64, src_limit: i64, req_size: i64, max_size: i64, pattern_bad: i64) -> i64 called by 1: main |
| 25 | func audit_hash(prev: i64, actor: i64, action: i64, result: i64) -> i64 called by 1: audit_final |
| 35 | func audit_final(actor: *i64, action: *i64, result: *i64, n: i64) -> i64 |
| 43 | func audit_verify(actor: *i64, action: *i64, result: *i64, n: i64, stored_final: i64) -> i64 |
| 49 | func mtls_sign(cert_id: i64) -> i64 |
| 55 | func mtls_verify(cert_id: i64, signature: i64) -> i64 { if signature == mtls_sign(cert_id) { return 1 } return 0 } |