code wiki / _hdl_build / nx_cms_tls_gate.nx

nx_cms_tls_gate.nx

buildroot/runtime/_hdl_build/nx_cms_tls_gate.nx

22168 B464 linesdepth 19pulls 120 transitivereach 0 importersview sourcekind gate/prooftopic cms
docsdependenciesstructsconstsfunctions

about

nx_cms_tls_gate.nx -- CMS C8 GATE (re-runnable, evidence-driven): the CMS behind OUR TLS 1.3 front, proven with OUR TLS client doing FULL certificate validation. The gate generates a self-signed Ed25519 cert sovereignly (nx_x509_build, the andelinwest daemon's cert shape), makes it the client's ONLY trust anchor, boots the real admin (loopback) behind nx_cms_tls_front (TLS terminator), and walks the admin flow over the encrypted wire: page serve, login (cookie must now carry Secure), editor, edit-publish. NEGATIVE CONTROL: a client with an EMPTY trust store must FAIL the handshake -- proves the validation is real, not pass-through. Appends "CMSGATE row=nx_cms_tls ... verdict=PASS|FAIL". Exit 0 iff all rows pass. license_tier: ORIGINAL

dependencies 14 imports · 0 importers

nx_syscalls.nx nx_connect.nx nx_csprng.nx nx_sha256.nx nx_ed25519_signature.nx nx_x509_build.nx nx_x509.nx nx_x509_trust_store.nx nx_tls13_client_validate_certifica nx_tls13_client_session_run.nx nx_cms_tls_gate.nx

diagram shows first 10 each side; +4 more imports, +0 more importers in the complete lists below.

imports: nx_syscalls.nxnx_connect.nxnx_csprng.nxnx_sha256.nxnx_ed25519_signature.nxnx_x509_build.nxnx_x509.nxnx_x509_trust_store.nxnx_tls13_client_validate_certificate.nxnx_tls13_client_session_run.nxnx_tls13_read_record_from_fd.nxnx_cms_store.nxnx_kill_portable.nxnx_gate_verdict.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap nx_csprng_fill sys_mmap ↻ nx_csprng_urandom_path sys_openat_rd sys_read sys_close ed25519_pub_from_priv sys_mmap ↻ ed25519_sha512 sys_mmap ↻ sha512_init sha512_update sha512_blk_set_byte blk_get_i64 blk_set_i64 sha512_compress sys_mmap ↻ blk_get_i64 ↻ sha512_gamma0 rotr64_v shr64_v sha512_gamma1 rotr64_v ↻ shr64_v ↻ sha512_sigma1 rotr64_v ↻ sha512_ch sha512_k sha512_sigma0 rotr64_v ↻ sha512_maj sha512_final sha512_blk_set_byte ↻ sha512_compress ↻ ge_p3_alloc sys_mmap ↻ fe_alloc nx_scratch

structs

none

consts

30const TG_FRONT_PORT: i64 = 19861
31const TG_BACK_PORT: i64 = 8086
32const TG_SITE: *u8 = "/tmp/_cms_tls_site"
33const TG_SNI: *u8 = "cms.gate.local"
34const TG_SNI_N: i64 = 14

functions

36func tg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 2: tg_rowmain calls 1: sys_write
37func tg_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
called by 2: tg_indextg_post
38func tg_cat(dst: *u8, off: i64, s: *u8) -> i64
called by 3: tg_posttg_getmain
44func tg_catn(dst: *u8, off: i64, s: *u8, n: i64) -> i64
called by 3: tg_posttg_getmain
50func tg_index(hay: *u8, n: i64, needle: *u8) -> i64
called by 2: tg_hasmain calls 1: tg_len
62func tg_has(hay: *u8, n: i64, needle: *u8) -> i64 { if tg_index(hay, n, needle) >= 0 { return 1 } return 0 }
called by 1: main calls 1: tg_index
64func tg_row(id: i64, ok: i64, what: *u8) -> i64
called by 1: main calls 2: tg_wsys_mmap
74func tg_mkdir(path: *u8, mode: i64) -> i64
called by 1: main calls 1: sys_mmap
81func tg_build(name: *u8) -> i64
called by 1: main calls 7: sys_forksys_openat_wrsys_dup3sys_mmapsys_execvesys_exit+1
102func tg_https(store: *TrustStore, req: *u8, rn: i64, resp: *u8, cap: i64) -> i64
called by 1: main calls 12: sys_socketsys_set_socket_timeoutsys_mmapnx_connect_boundedsys_closenx_csprng_fill+6
179func tg_post(req: *u8, path: *u8, cookie: *u8, body: *u8) -> i64
called by 1: main calls 4: tg_cattg_catntg_lensys_mmap
201func tg_get(req: *u8, path: *u8, cookie: *u8) -> i64
called by 1: main calls 2: tg_cattg_catn
214func main() -> i64
calls 39: sys_mmapnx_csprng_filled25519_pub_from_privtg_wsys_exitnx_x509_inputs_init+33