code wiki / _hdl_build / nx_access_pep.nx
`nx_access_pep.nx` source

1// nx_access_pep.nx -- the POLICY ENFORCEMENT POINT glue: ONE call a daemon makes per request that composes the
2// whole access wall. The live daemon (nx_sites_daemon_v2 / nx_cms_admin) extracts peer_ip (sys_accept_with_addr),
3// the device id + signature (request headers), and rate_ok (nx_rate_limit), packs them into the req/area arrays,
4// and calls pep_decide; it derives the network tier (nt_classify), verifies the device's signature over the
5// server challenge (dc_verify), and runs the deny-by-default PDP (aw_decide) -> one verdict. pep_audit chains
6// that decision into the tamper-evident log. The integration seam, built + gateable WITHOUT touching production.
7// (req/area are i64 arrays, not a long arg list, because the compiler caps a call at 16 args.) Composes
8// nx_nettier + nx_device_cert + nx_access_wall + nx_access_audit (all nx_syscalls; no rolled crypto). license_tier: ORIGINAL
9import "nx_access_wall.nx"
10import "nx_device_cert.nx"
11import "nx_nettier.nx"
12import "nx_access_audit.nx"
13import "nx_syscalls.nx"
14
15// req[]  : 0=peer_ip  1=device_id(*u8,0=none)  2=device_sig(*u8)  3=resource(*u8)  4=res_len  5=req_cap  6=rate_ok
16// area[] : 0=nt_nets 1=nt_pfx 2=nt_tiers 3=nt_n  4=dev_ids 5=dev_pubs 6=dev_n  7=paths 8=lens 9=deny 10=caps
17//          11=nrules  12=required_tier 13=require_device  14=challenge(*u8) 15=clen
18func pep_decide(req: *i64, area: *i64) -> i64 {
19    let tier: i64 = nt_classify(req[0], area[0] as *i64, area[1] as *i64, area[2] as *i64, area[3])
20    var device_ok: i64 = 0
21    if req[1] != 0 {
22        device_ok = dc_verify(area[4] as *i64, area[5] as *i64, area[6], req[1] as *u8, area[14] as *u8, area[15], req[2] as *u8)
23    }
24    return aw_decide(area[7] as *i64, area[8] as *i64, area[9] as *i64, area[10] as *i64, area[11],
25                     req[3] as *u8, req[4], req[5], tier, area[12], device_ok, area[13], req[6])
26}
27
28func pep_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o }
29func pep_catn(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o }
30
31// format a decision record + chain it into the tamper-evident audit log. entry "ip=<peer> res=<resource>
32// verdict=<code>" -> entry_out; hash_out = aa_chain(prev, entry). Returns the entry length.
33func pep_audit(prev: *u8, peer_ip: i64, resource: *u8, res_len: i64, verdict: i64, entry_out: *u8, hash_out: *u8) -> i64 {
34    var o: i64 = pep_cat(entry_out, 0, "ip=" as *u8)
35    o = pep_catn(entry_out, o, peer_ip)
36    o = pep_cat(entry_out, o, " res=" as *u8)
37    var i: i64 = 0
38    while i < res_len { entry_out[o] = resource[i]; o = o + 1; i = i + 1 }
39    o = pep_cat(entry_out, o, " verdict=" as *u8)
40    o = pep_catn(entry_out, o, verdict)
41    aa_chain(prev, entry_out, o, hash_out)
42    return o
43}
nx_access_pep.nx source

`nx_access_pep.nx` source
