code wiki / _hdl_build / nx_cert_registry_gate.nx

nx_cert_registry_gate.nx

buildroot/runtime/_hdl_build/nx_cert_registry_gate.nx

4707 B63 linesdepth 3pulls 3 transitivereach 0 importersview sourcekind gate/prooftopic cert
docsdependenciesstructsconstsfunctions

about

nx_cert_registry_gate.nx -- PURE gate for the data-driven SNI cert registry. Proves: EXACT host beats wildcard, wildcard serves a sub-label, the '*' default catches the rest, case-insensitivity (DNS), and -- the LOAD-BEARING security test -- ANTI-SPOOF: `evilnishifamily.com` must NOT be served the `*.nishifamily.com` cert. GREEN iff T1..T9. Sovereign: nx_cert_registry + nx_syscalls. license_tier: ORIGINAL

dependencies 2 imports · 0 importers

nx_cert_registry.nx nx_syscalls.nx nx_cert_registry_gate.nx

imports: nx_cert_registry.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main g_w sys_write g_len g_row g_w ↻ g_chain sys_mmap cr_match sys_mmap ↻ cr_eol cr_split cr_is_sep cr_host_eq_ci cr_lc cr_wild_match cr_lc ↻ cr_tok_eq_ci cr_slen cr_lc ↻ cr_copyz g_len ↻ g_streq sys_mmap ↻ cr_match ↻ g_streq ↻ sys_openat_append sys_write ↻ sys_close sys_exit

structs

none

consts

none

functions

8func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 2: g_rowmain calls 1: sys_write
9func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 2: g_chainmain
10func g_row(name: *u8, ok: i64) -> i64
called by 1: main calls 1: g_w
15func g_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] != (0 as u8) { return 0 } return 1 }
called by 2: g_chainmain
18func g_chain(tab: *u8, n: i64, host: *u8, want_chain: *u8) -> i64
called by 1: main calls 4: sys_mmapcr_matchg_leng_streq
25func main() -> i64
calls 11: g_wg_leng_rowg_chainsys_mmapcr_match+5