code wiki / (root) / nx_mtls_issue.nx

nx_mtls_issue.nx

buildroot/runtime/nx_mtls_issue.nx

6618 B105 linesdepth 12pulls 29 transitivereach 0 importersview sourcekind tooltopic mtls
docsdependenciesstructsconstsfunctions

about

nx_mtls_issue.nx -- R7 ISSUANCE: one call the login daemon makes to hand a browser its identity .p12. The enforcement side has its one-call drop-in (nx_hgw_mtls_resolve_handle). This is the issuance twin: after OPAQUE login succeeds, the daemon holds the 32-byte export_key (RFC 9807) + the user_id_hash; this composes R5 (derive the deterministic Ed25519 identity keypair + mint the bound cert, Subject CN = hex(user_id_hash)) and R5b (package key+cert into a password-protected PKCS#12) into the single browser-importable .p12. The private key is NEVER stored server-side -- it is re-derived from export_key on each login, so re-issuing is idempotent (same login -> byte-identical .p12 in dev). The daemon streams the result to the browser ONCE for a one-time cert import; thereafter the cert rides every connection at the TLS layer (the no-cookie carrier). LIVE NOTE: nx_modern_auth_login / olg_login currently DISCARD export_key (R5 header); surfacing it as an additive out-param is the issuance-side daemon edit. Composes nx_mtls_identity (R5) + nx_mtls_pkcs12 (R5b). license_tier: ORIGINAL expect_exit: 0

dependencies 3 imports · 0 importers

nx_syscalls.nx nx_mtls_identity.nx nx_mtls_pkcs12.nx nx_mtls_issue.nx

imports: nx_syscalls.nxnx_mtls_identity.nxnx_mtls_pkcs12.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main iss_w sys_write sys_mmap nx_mtls_issue_identity_p12 sys_mmap ↻ nx_mtls_mint_identity_cert nx_mtls_derive_identity_ke hkdf_expand sys_mmap ↻ hmac_sha256 sys_mmap ↻ sha256_digest sha256_init sha256_update sha256_final ed25519_pub_from_priv sys_mmap ↻ ed25519_sha512 sys_mmap ↻ sha512_init sha512_update sha512_final ge_p3_alloc sys_mmap ↻ fe_alloc fe_zero ed25519_basepoint_p3 sys_mmap ↻ ge_p3_decompress ge_scalar_mul ge_p3_identity ge_p3_alloc ↻ ge_p3_double ge_p3_add ge_p3_cmov ge_p3_compress fe_alloc ↻ fe_invert fe_mul

structs

none

consts

17const NX_MAGIC_4096: i64 = 4096
18const NX_MAGIC_8192: i64 = 8192
20const NX_ISSUE_OK: i64 = 0
21const NX_ISSUE_ERR: i64 = 1

functions

25func nx_mtls_issue_identity_p12(
called by 1: main calls 3: sys_mmapnx_mtls_mint_identity_certnx_mtls_emit_pkcs12
39func iss_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 2: iss_rowmain calls 1: sys_write
40func iss_row(name: *u8, ok: i64) -> i64 { if ok == 1 { iss_w(" PASS " as *u8) } else { iss_w(" FAIL " as *u8) } iss_w(name); iss_w("\n" as *u8); return ok }
called by 1: main calls 1: iss_w
41func iss_eq(a: *u8, an: i64, b: *u8, bn: i64) -> i64 { if an != bn { return 0 } var i: i64 = 0; while i < an { if a[i] != b[i] { return 0 } i = i + 1 } return 1 }
called by 1: main
43func main() -> i64
calls 9: iss_wsys_mmapnx_mtls_issue_identity_p12iss_rowiss_eqnx_mtls_derive_identity_keypair+3