nx_mtls_authz.nx

buildroot/runtime/nx_mtls_authz.nx

8148 B165 linesdepth 11pulls 17 transitivereach 6 importersview sourcekind tooltopic mtls

docs dependencies structs consts functions

about

nx_mtls_authz.nx -- bind a VERIFIED client-cert identity to an access decision. mTLS rung R6 of the NO-COOKIE session carrier. After R3 proves key-possession, this rung answers "who is this, and what may they do." Two pieces, both the security floor: 1. nx_mtls_cert_identity: extract the Subject CN (= hex(user_id_hash), the SAME stable id the OPAQUE/HR stack keys on) from the presented cert -- the cert->identity bridge. 2. nx_mtls_authz_level: DENY-BY-DEFAULT (mirrors Consul Connect mc_intention). Access requires BOTH (a) cryptographic verification by R3 AND (b) enrollment in the roster the live HR/uid index supplies. A valid-but-unenrolled cert, or an unverified cert, gets level 0 (nothing). No fail-open path. The live daemon (R7) feeds the roster from olgd_idx_lookup (uidhex->handle) + the HR level, and emits the per-user entitlement LINKS via the proven he_emit_super (nx_hr_entitle) -- this rung is the DECISION, that is the DATA. Composes nx_x509 (parse). license_tier: ORIGINAL expect_exit: 0

dependencies 4 imports · 3 importers

imports: nx_syscalls.nxnx_x509.nxnx_ed25519_signature.nxnx_x509_leaf_emit.nx

imported by: nx_aw_mtls_inject.nxnx_mtls_serve_decision.nxnx_mtls_test_daemon.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

18	const NX_MAGIC_4096: i64 = 4096
20	const NX_AZ_DENY: i64 = 0 // deny-by-default access level

functions

25	func nx_mtls_cert_identity(cert_der: u8, cert_len: i64, out: u8, cap: i64) -> i64 called by 4: mtls_inject_identity main nx_mtls_serve_decide main calls 2: sys_mmap x509_parse
49	func nx_mtls_authz_level( called by 2: main nx_mtls_serve_decide
70	func az_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } called by 2: az_row main calls 1: sys_write
71	func az_row(name: u8, ok: i64) -> i64 { if ok == 1 { az_w(" PASS " as u8) } else { az_w(" FAIL " as u8) } az_w(name); az_w("\n" as u8); return ok } called by 1: main calls 1: az_w
72	func az_hex(src: u8, n: i64, out: u8) -> i64 called by 4: main az_mint main main
78	func az_streq(a: u8, an: i64, b: u8, bn: i64) -> i64 called by 2: main main
85	func az_mint(uid: u8, cert: u8, cap: i64) -> i64 called by 3: main main main calls 4: sys_mmap ed25519_pub_from_priv az_hex nx_x509_leaf_emit_ed25519
100	func main() -> i64 calls 9: az_w sys_mmap az_hex az_mint nx_mtls_cert_identity az_streq+3