nx_aw_mtls_inject_gate.nx
buildroot/runtime/nx_aw_mtls_inject_gate.nx
about
nx_aw_mtls_inject_gate.nx -- gate the sovereign mTLS carrier's identity-injection TRUST BOUNDARY.
Proves the two security-floor invariants WITHOUT needing a Nishi mTLS client: the cert is only consulted
when auth==1, but the X-Nishi-Cert-Identity STRIP runs for every auth -> a no-cert/bad-cert client can
never smuggle a spoofed identity to the backend, and a clean request is forwarded byte-exact (never-
lockout). The real-CN inject (auth==1 with a parseable cert) is covered downstream by run_ecdsa_mtls's
loopback+interop gates feeding a real cert. license_tier: ORIGINAL expect_exit: 0
dependencies 3 imports · 0 importers
imports: nx_syscalls.nxnx_aw_mtls_inject.nxnx_mtls_identity.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 11 | func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } |
| 12 | func g_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 1: main |
| 15 | func g_has_ci(buf: *u8, n: i64, lit: *u8) -> i64 |
| 20 | func g_eq(a: *u8, an: i64, b: *u8, bn: i64) -> i64 called by 1: main |
| 26 | func g_check(name: *u8, cond: i64) -> i64 |
| 31 | func main() -> i64 |