code wiki / _hdl_build / nx_email_auth_gate.nx
nx_email_auth_gate.nx
buildroot/runtime/_hdl_build/nx_email_auth_gate.nx
about
nx_email_auth_gate.nx -- GATE for EMAIL R5 (SPF/DKIM/DMARC, nx_email_auth).
COMPLETENESS : DKIM body hash is identical across bodies that differ
only in trailing blank lines (simple canon); a DKIM
ed25519-sha256 header signature round-trips (sign ->
verify=1); SPF ip4/cidr + exact + all evaluate; DMARC
p= policy parses.
NEG-CONTROL : a non-SPF string -> NONE; a non-DMARC string -> norecord.
TAMPER : a flipped body byte changes bh= (hashes differ); a
flipped signed header fails the signature (forgery
rejected); DMARC "sp=reject; p=quarantine" returns
QUARANTINE -- the boundary-anchored parser does NOT
mistake the subdomain-policy "sp=" for "p=".
Evidence -> knowledge/status/email_auth.log
(AUTHGATE authored=organ ... verdict=GREEN)
license_tier: ORIGINAL
dependencies 3 imports · 0 importers
imports: nx_email_auth.nxnx_syscalls.nxnx_gate_verdict.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 22 | const AUTH_LOG: *u8 = "knowledge/status/email_auth.log" |
functions
| 24 | func ew(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } |
| 25 | func epf(fd: i64, label: *u8, pass: i64) -> i64 |
| 28 | func slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 1: main |
| 29 | func memeq(a: *u8, b: *u8, len: i64) -> i64 { var i: i64 = 0; while i < len { if a[i] != b[i] { return 0 } i = i + 1 } return 1 } called by 1: main |
| 30 | func mkip(a: i64, b: i64, c: i64, d: i64) -> i64 { return (a << 24) | (b << 16) | (c << 8) | d } called by 1: main |
| 32 | func main() -> i64 |