code wiki / _hdl_build / nx_access_audit.nx

nx_access_audit.nx source

↩ module page · 44 lines · 2007 B

1// nx_access_audit.nx -- TAMPER-EVIDENT append-only audit log for the access wall (L6; NIST AU family). Every 2// PDP decision (subject, peer-IP, resource, action, verdict-code) is recorded as an entry CHAINED by hash: 3// h[0] = sha256(genesis || entry0); h[i] = sha256(h[i-1] || entry_i) 4// Any alteration, deletion, insertion, or REORDER of entries breaks the chain, so aa_verify (replay) returns 0. 5// This is the forensic record of who was allowed/denied where + why. Reuses the KAT-verified nx_sha256 (no 6// rolled crypto); pairs with the framed-append durability floor (the bytes on disk) -- this adds the integrity 7// proof on top. license_tier: ORIGINAL 8import "nx_sha256.nx" 9import "nx_syscalls.nx" 10 11// chained hash of one entry: out32 = sha256(prev32 || entry[0..elen)). 12func aa_chain(prev: *u8, entry: *u8, elen: i64, out32: *u8) -> i64 { 13 let buf: *u8 = sys_mmap(elen + 64) 14 var i: i64 = 0 15 while i < 32 { buf[i] = prev[i]; i = i + 1 } 16 var j: i64 = 0 17 while j < elen { buf[32 + j] = entry[j]; j = j + 1 } 18 sha256_digest(buf, 32 + elen, out32) 19 return 0 20} 21 22// replay + verify the chain over n entries (entries[] = *u8 ptrs, lens[] = lengths, hashes[] = stored 32-byte 23// hash ptrs) from genesis. returns 1 if the whole chain is intact; 0 if ANY entry or stored hash differs 24// (tamper / delete / reorder / insert all diverge the recomputed chain from the stored hashes). 25func aa_verify(entries: *i64, lens: *i64, hashes: *i64, n: i64, genesis: *u8) -> i64 { 26 let prev: *u8 = sys_mmap(32) 27 var i: i64 = 0 28 while i < 32 { prev[i] = genesis[i]; i = i + 1 } 29 let cur: *u8 = sys_mmap(32) 30 var k: i64 = 0 31 while k < n { 32 aa_chain(prev, entries[k] as *u8, lens[k], cur) 33 let stored: *u8 = hashes[k] as *u8 34 var b: i64 = 0 35 while b < 32 { 36 if cur[b] != stored[b] { return 0 } 37 b = b + 1 38 } 39 var c: i64 = 0 40 while c < 32 { prev[c] = cur[c]; c = c + 1 } 41 k = k + 1 42 } 43 return 1 44}