code wiki / _hdl_build / nx_conn_cap_gate.nx

nx_conn_cap_gate.nx

buildroot/runtime/_hdl_build/nx_conn_cap_gate.nx

5884 B97 linesdepth 3pulls 3 transitivereach 0 importersview sourcekind gate/proof
docsdependenciesstructsconstsfunctions

about

nx_conn_cap_gate.nx -- gate for the access-wall DDoS/abuse CONNECTION layer (nx_conn_cap) + a read-only verify of the kernel SYN-cookie edge defense (/proc/sys/net/ipv4/tcp_syncookies). Proves: per-IP cap (allow up to cap, reject beyond), release frees a token, different IPs are independent, table saturation FAILS-CLOSED (a new flooding IP is rejected), cc_count tracks, and full release frees the slot. Positive AND negative controls. Appends "ACCESSGATE row=nx_conn_cap ddos-conn ... verdict=PASS" to knowledge/status/access_gate.log on all-pass. NB the request brute-force layer is nx_rate_limit (self-test GREEN under the harness; the daemon calls nx_rl_try_consume -> rate_ok -> aw_decide, proven DENY_RATE in nx_access_wall_gate). license_tier: ORIGINAL

dependencies 2 imports · 0 importers

nx_conn_cap.nx nx_syscalls.nx nx_conn_cap_gate.nx

imports: nx_conn_cap.nxnx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap mkip cc_acquire cc_find cg_row cg_w sys_write cg_num sys_mmap ↻ sys_write ↻ cc_count cc_find ↻ cc_release cc_find ↻ cg_syn_state sys_openat_rd sys_mmap ↻ sys_read sys_close cg_w ↻ cg_num ↻ cg_cat cg_catnum sys_mmap ↻ sys_openat_append sys_write ↻ sys_close ↻ sys_exit

structs

none

consts

none

functions

11func cg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 2: cg_rowmain calls 1: sys_write
12func cg_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
called by 2: cg_rowmain calls 2: sys_mmapsys_write
13func cg_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o }
called by 1: main
14func cg_catnum(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o }
called by 1: main calls 1: sys_mmap
15func cg_row(id: i64, ok: i64, what: *u8) -> i64 { cg_w("CCROW " as *u8); cg_num(id); cg_w(" " as *u8); if ok==1 { cg_w("PASS " as *u8) } else { cg_w("FAIL " as *u8) } cg_w(what); cg_w("\n" as *u8); return ok }
called by 1: main calls 2: cg_wcg_num
16func mkip(a: i64, b: i64, c: i64, d: i64) -> i64 { return (a << 24) | (b << 16) | (c << 8) | d }
called by 1: main
19func cg_syn_state() -> i64
called by 1: main calls 4: sys_openat_rdsys_mmapsys_readsys_close
31func main() -> i64
calls 15: sys_mmapmkipcc_acquirecg_rowcc_countcc_release+9