code wiki / _hdl_build / nx_nettier.nx

nx_nettier.nx

buildroot/runtime/_hdl_build/nx_nettier.nx

1303 B21 linesdepth 4pulls 4 transitivereach 6 importersview sourcekind library
docsdependenciesstructsconstsfunctions

about

nx_nettier.nx -- NETWORK-TIER classifier for the access-provisioning wall (zero-trust L1: a SIGNAL, not the gate). Classifies the peer IP (already extracted by sys_accept_with_addr) into a trust tier via a DATA-DRIVEN longest-prefix CIDR rule table (rule 11): loopback + RFC1918 = LAN, a configured VPN CIDR = VPN, everything else = PUBLIC. DENY-BY-DEFAULT trust: an unknown IP is PUBLIC (least trusted) -- aligns with SECURITY_POSTURE fail-closed. The wall (nx_access_wall) uses tier as ONE input; per NIST 800-207 / BeyondCorp, network location is never sufficient alone. Composes nx_cidr. license_tier: ORIGINAL

dependencies 2 imports · 3 importers

nx_cidr.nx nx_syscalls.nx nx_nettier.nx nx_access_pep.nx nx_access_wall.nx nx_nettier_gate.nx

imports: nx_cidr.nxnx_syscalls.nx

imported by: nx_access_pep.nxnx_access_wall.nxnx_nettier_gate.nx

structs

none

consts

11const NT_PUBLIC: i64 = 0 // open internet -- least trust
12const NT_LAN: i64 = 1 // on the local network
13const NT_VPN: i64 = 2 // tunneled into the network

functions

16func nt_classify(ip: i64, nets: *i64, prefixes: *i64, tiers: *i64, n: i64) -> i64
called by 2: pep_decidemain calls 1: cidr_tier
21func nt_meets(tier: i64, required: i64) -> i64 { if tier >= required { return 1 } return 0 }
called by 2: aw_decidemain