code wiki / (root) / nx_hgw_mtls_resolve.nx

nx_hgw_mtls_resolve.nx

buildroot/runtime/nx_hgw_mtls_resolve.nx

9550 B156 linesdepth 13pulls 19 transitivereach 0 importersview sourcekind tool
docsdependenciesstructsconstsfunctions

about

nx_hgw_mtls_resolve.nx -- R7 ENFORCEMENT wiring: the mTLS-first handle resolution the doc wall plugs in. nx_hub_gw_decide.nx:91-94 is the bug, in three lines: it reads the `X-Nishi-Session:` header, resolves the token -> handle, and routes on that handle. A top-level browser NAVIGATION carries no custom header -> the handle is empty -> mr_route DENY -> 302 /login = "logs in but isn't let in". The mTLS fix lives exactly here: the verified client cert rides EVERY connection (nav/refresh/new-tab) at the TLS layer, so resolve the handle from the CERT first, and fall back to the header token only when no cert was presented (never-lockout). This is that resolution, pure + gated (composes nx_mtls_serve_decide). The live hgw_decide swaps its three lines for ONE call to nx_hgw_mtls_resolve_handle, passing the run loop's out_auth + client cert; everything downstream (mr_route + the status map) is byte-identical. The uid->handle index models the proven live olgd_idx_lookup; the sessions registry is the existing token->handle fallback. license_tier: ORIGINAL expect_exit: 0

dependencies 2 imports · 0 importers

nx_syscalls.nx nx_mtls_serve_decision.nx nx_hgw_mtls_resolve.nx

imports: nx_syscalls.nxnx_mtls_serve_decision.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main hr_w sys_write sys_mmap az_hex az_mint sys_mmap ↻ ed25519_pub_from_priv sys_mmap ↻ ed25519_sha512 sys_mmap ↻ sha512_init sha512_update sha512_blk_set_byte blk_get_i64 blk_set_i64 sha512_compress sys_mmap ↻ blk_get_i64 ↻ sha512_gamma0 sha512_gamma1 sha512_sigma1 sha512_ch sha512_k sha512_sigma0 sha512_maj sha512_final sha512_blk_set_byte ↻ sha512_compress ↻ ge_p3_alloc sys_mmap ↻ fe_alloc nx_scratch nx_scratch_init nx_scratch_oom sys_mmap ↻ fe_zero ed25519_basepoint_p3 sys_mmap ↻ ge_p3_decompress

structs

none

consts

16const NX_MAGIC_4096: i64 = 4096
18const NX_HMH_REJECT: i64 = 0 - 1 // a cert was presented but FAILED verify -> caller returns 403, never falls back

functions

21func hmh_lookup(reg: *u8, reglen: i64, key: *u8, keylen: i64, out: *u8, cap: i64) -> i64
called by 1: nx_hgw_mtls_resolve_handle
54func nx_hgw_mtls_resolve_handle(
called by 1: main calls 3: sys_mmapnx_mtls_serve_decidehmh_lookup
79func hr_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 2: hr_rowmain calls 1: sys_write
80func hr_row(name: *u8, ok: i64) -> i64 { if ok == 1 { hr_w(" PASS " as *u8) } else { hr_w(" FAIL " as *u8) } hr_w(name); hr_w("\n" as *u8); return ok }
called by 1: main calls 1: hr_w
81func hr_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 1: hr_streq
82func hr_streq(a: *u8, an: i64, b: *u8) -> i64 { let bn: i64 = hr_slen(b); if an != bn { return 0 } var i: i64 = 0; while i < an { if a[i] != b[i] { return 0 } i = i + 1 } return 1 }
called by 1: main calls 1: hr_slen
83func hr_put(buf: *u8, off: i64, key: *u8, keylen: i64, val: *u8, vallen: i64) -> i64
called by 1: main
92func main() -> i64
calls 9: hr_wsys_mmapaz_hexaz_minthr_putnx_hgw_mtls_resolve_handle+3