code wiki / _hdl_build / nx_access_audit.nx
nx_access_audit.nx source
↩ module page · 44 lines · 2007 B
1// nx_access_audit.nx -- TAMPER-EVIDENT append-only audit log for the access wall (L6; NIST AU family). Every
2// PDP decision (subject, peer-IP, resource, action, verdict-code) is recorded as an entry CHAINED by hash:
3// h[0] = sha256(genesis || entry0); h[i] = sha256(h[i-1] || entry_i)
4// Any alteration, deletion, insertion, or REORDER of entries breaks the chain, so aa_verify (replay) returns 0.
5// This is the forensic record of who was allowed/denied where + why. Reuses the KAT-verified nx_sha256 (no
6// rolled crypto); pairs with the framed-append durability floor (the bytes on disk) -- this adds the integrity
7// proof on top. license_tier: ORIGINAL
8import "nx_sha256.nx"
9import "nx_syscalls.nx"
10
11// chained hash of one entry: out32 = sha256(prev32 || entry[0..elen)).
12func aa_chain(prev: *u8, entry: *u8, elen: i64, out32: *u8) -> i64 {
13 let buf: *u8 = sys_mmap(elen + 64)
14 var i: i64 = 0
15 while i < 32 { buf[i] = prev[i]; i = i + 1 }
16 var j: i64 = 0
17 while j < elen { buf[32 + j] = entry[j]; j = j + 1 }
18 sha256_digest(buf, 32 + elen, out32)
19 return 0
20}
21
22// replay + verify the chain over n entries (entries[] = *u8 ptrs, lens[] = lengths, hashes[] = stored 32-byte
23// hash ptrs) from genesis. returns 1 if the whole chain is intact; 0 if ANY entry or stored hash differs
24// (tamper / delete / reorder / insert all diverge the recomputed chain from the stored hashes).
25func aa_verify(entries: *i64, lens: *i64, hashes: *i64, n: i64, genesis: *u8) -> i64 {
26 let prev: *u8 = sys_mmap(32)
27 var i: i64 = 0
28 while i < 32 { prev[i] = genesis[i]; i = i + 1 }
29 let cur: *u8 = sys_mmap(32)
30 var k: i64 = 0
31 while k < n {
32 aa_chain(prev, entries[k] as *u8, lens[k], cur)
33 let stored: *u8 = hashes[k] as *u8
34 var b: i64 = 0
35 while b < 32 {
36 if cur[b] != stored[b] { return 0 }
37 b = b + 1
38 }
39 var c: i64 = 0
40 while c < 32 { prev[c] = cur[c]; c = c + 1 }
41 k = k + 1
42 }
43 return 1
44}