code wiki / _hdl_build / nx_access_pep_gate.nx
`nx_access_pep_gate.nx` source

↩ module page · 144 lines · 9146 B
1// nx_access_pep_gate.nx -- gate for the enforcement-point glue (nx_access_pep). Proves the WHOLE wall composes
2// in one pep_decide call over a request's raw signals: a provisioned device from the public internet with a
3// valid ed25519 signature is ALLOWED; missing device, bad signature, unauthorized resource, rate-limit, and a
4// network-tier shortfall are each DENIED with the right layer code; and pep_audit chains the decisions into a
5// tamper-evident log that verifies. End-to-end, sovereign, NO production touch. Appends "ACCESSGATE row=
6// nx_access_pep enforcement ... verdict=PASS" to knowledge/status/access_gate.log on all-pass. license_tier: ORIGINAL
7import "nx_access_pep.nx"
8import "nx_ed25519_signature.nx"
9import "nx_syscalls.nx"
10
11func pg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12func pg_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
13func pg_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o }
14func pg_catnum(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o }
15func pg_row(id: i64, ok: i64, what: *u8) -> i64 { pg_w("PEPROW " as *u8); pg_num(id); pg_w(" " as *u8); if ok==1 { pg_w("PASS " as *u8) } else { pg_w("FAIL " as *u8) } pg_w(what); pg_w("\n" as *u8); return ok }
16func pg_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
17func pg_mkip(a: i64, b: i64, c: i64, d: i64) -> i64 { return (a << 24) | (b << 16) | (c << 8) | d }
18func pg_hb(c: i64) -> i64 { if c>=0x30 { if c<=0x39 { return c-0x30 } } if c>=0x61 { if c<=0x66 { return c-0x61+10 } } return 0 }
19func pg_hex2(hex: *u8, nb: i64, out: *u8) -> i64 { var i: i64=0; while i<nb { out[i]=((pg_hb(hex[i*2] as i64)<<4)|pg_hb(hex[i*2+1] as i64)) as u8; i=i+1 } return 0 }
20
21// fill a request array: peer_ip, device_id, device_sig, resource, res_len, req_cap, rate_ok
22func setreq(r: *i64, ip: i64, did: i64, sig: i64, res: i64, rlen: i64, cap: i64, rate: i64) -> i64 {
  r[0]=ip; r[1]=did; r[2]=sig; r[3]=res; r[4]=rlen; r[5]=cap; r[6]=rate; return 0
24}
25func pg_contains(buf: *u8, len: i64, ndl: *u8) -> i64 { let nl: i64=pg_slen(ndl); if nl==0 { return 1 } var i: i64=0; while i+nl<=len { var j: i64=0; var m: i64=1; while j<nl { if buf[i+j]!=ndl[j] { m=0; j=nl } else { j=j+1 } } if m==1 { return 1 } i=i+1 } return 0 }
26
27func main() -> i64 {
  // provisioned device: RFC-8032 test key
  let priv: *u8 = sys_mmap(32)
  pg_hex2("9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60" as *u8, 32, priv)
  let pub: *u8 = sys_mmap(32)
  ed25519_pub_from_priv(priv, pub)
  let dev_ids: *i64 = sys_mmap(8*4) as *i64
  let dev_pubs: *i64 = sys_mmap(8*4) as *i64
  dev_ids[0]="laptop-1" as *u8 as i64; dev_pubs[0]=pub as i64
36
  let chal: *u8 = "pep-challenge-0001" as *u8
  let clen: i64 = pg_slen(chal)
  let sig: *u8 = sys_mmap(64)
  ed25519_sign_full(priv, chal, clen, sig)
  let sigBad: *u8 = sys_mmap(64); var cb: i64=0; while cb<64 { sigBad[cb]=sig[cb]; cb=cb+1 }
  if (sig[0] as i64)==0 { sigBad[0]=1 as u8 } else { sigBad[0]=0 as u8 }
43
  // network-tier rules
  let nets: *i64 = sys_mmap(8*8) as *i64
  let pfx:  *i64 = sys_mmap(8*8) as *i64
  let trs:  *i64 = sys_mmap(8*8) as *i64
  nets[0]=pg_mkip(10,8,0,0);    pfx[0]=24; trs[0]=NT_VPN
  nets[1]=pg_mkip(192,168,0,0); pfx[1]=16; trs[1]=NT_LAN
  nets[2]=pg_mkip(127,0,0,0);   pfx[2]=8;  trs[2]=NT_LAN
  let ip_pub: i64 = pg_mkip(203,0,113,5)
  let ip_lan: i64 = pg_mkip(192,168,1,5)
53
  // acl policy: grant /area READ
  let paths: *i64 = sys_mmap(8*4) as *i64
  let lens:  *i64 = sys_mmap(8*4) as *i64
  let deny:  *i64 = sys_mmap(8*4) as *i64
  let caps:  *i64 = sys_mmap(8*4) as *i64
  paths[0]="/area" as *u8 as i64; lens[0]=5; deny[0]=0; caps[0]=CAP_READ
60
  // the area config array (required_tier/require_device set per scenario)
  let area: *i64 = sys_mmap(8*20) as *i64
  area[0]=nets as i64; area[1]=pfx as i64; area[2]=trs as i64; area[3]=3
  area[4]=dev_ids as i64; area[5]=dev_pubs as i64; area[6]=1
  area[7]=paths as i64; area[8]=lens as i64; area[9]=deny as i64; area[10]=caps as i64; area[11]=1
  area[14]=chal as i64; area[15]=clen
  let req: *i64 = sys_mmap(8*8) as *i64
68
  let lid: i64 = "laptop-1" as *u8 as i64
  let r_area: i64 = "/area" as *u8 as i64
  let r_secret: i64 = "/secret" as *u8 as i64
72
  var pass: i64 = 0
  var rows: i64 = 0
  var ok: i64 = 0
76
  // PE0: public internet + provisioned device (valid sig) + authorized -> ALLOW
  area[12]=NT_PUBLIC; area[13]=1
  setreq(req, ip_pub, lid, sig as i64, r_area, 5, CAP_READ, 1)
  ok = 0; if pep_decide(req, area)==AW_ALLOW { ok=1 }
  rows=rows+1; pass=pass+pg_row(0, ok, "remote provisioned device (valid sig) -> ALLOW (provisioned over the internet)" as *u8)
82
  // PE1: no device presented but area requires one -> DENY_DEVICE
  area[12]=NT_PUBLIC; area[13]=1
  setreq(req, ip_pub, 0, sig as i64, r_area, 5, CAP_READ, 1)
  ok = 0; if pep_decide(req, area)==AW_DENY_DEVICE { ok=1 }
  rows=rows+1; pass=pass+pg_row(1, ok, "no device presented -> DENY_DEVICE (neg control)" as *u8)
88
  // PE2: tampered device signature -> DENY_DEVICE
  area[12]=NT_PUBLIC; area[13]=1
  setreq(req, ip_pub, lid, sigBad as i64, r_area, 5, CAP_READ, 1)
  ok = 0; if pep_decide(req, area)==AW_DENY_DEVICE { ok=1 }
  rows=rows+1; pass=pass+pg_row(2, ok, "tampered device signature -> DENY_DEVICE (neg control)" as *u8)
94
  // PE3: on-LAN, no device required, UNAUTHORIZED resource -> DENY_POLICY (zero-trust: LAN != grant)
  area[12]=NT_PUBLIC; area[13]=0
  setreq(req, ip_lan, 0, sig as i64, r_secret, 7, CAP_READ, 1)
  ok = 0; if pep_decide(req, area)==AW_DENY_POLICY { ok=1 }
  rows=rows+1; pass=pass+pg_row(3, ok, "on-LAN but unauthorized resource -> DENY_POLICY (neg control)" as *u8)
100
  // PE4: rate-limited -> DENY_RATE
  area[12]=NT_PUBLIC; area[13]=0
  setreq(req, ip_lan, 0, sig as i64, r_area, 5, CAP_READ, 0)
  ok = 0; if pep_decide(req, area)==AW_DENY_RATE { ok=1 }
  rows=rows+1; pass=pass+pg_row(4, ok, "rate-limited -> DENY_RATE (neg control)" as *u8)
106
  // PE5: area requires on-network (NT_LAN), peer is PUBLIC -> DENY_TIER (even with a valid device)
  area[12]=NT_LAN; area[13]=1
  setreq(req, ip_pub, lid, sig as i64, r_area, 5, CAP_READ, 1)
  ok = 0; if pep_decide(req, area)==AW_DENY_TIER { ok=1 }
  rows=rows+1; pass=pass+pg_row(5, ok, "area requires LAN, peer public -> DENY_TIER (neg control)" as *u8)
112
  // PE6: pep_audit chains the decisions into a tamper-evident log that verifies
  let genesis: *u8 = sys_mmap(32)
  let e0: *u8 = sys_mmap(256); let h0: *u8 = sys_mmap(32)
  let l0: i64 = pep_audit(genesis, ip_pub, "/area" as *u8, 5, AW_ALLOW, e0, h0)
  let e1: *u8 = sys_mmap(256); let h1: *u8 = sys_mmap(32)
  let l1: i64 = pep_audit(h0, ip_pub, "/area" as *u8, 5, AW_DENY_DEVICE, e1, h1)
  let ents: *i64 = sys_mmap(8*4) as *i64; ents[0]=e0 as i64; ents[1]=e1 as i64
  let lns:  *i64 = sys_mmap(8*4) as *i64; lns[0]=l0; lns[1]=l1
  let hsh:  *i64 = sys_mmap(8*4) as *i64; hsh[0]=h0 as i64; hsh[1]=h1 as i64
  ok = aa_verify(ents, lns, hsh, 2, genesis)
  // CONTENT liar-killer (mutation probe 2026-07-14, survivors in pep_audit's resource-copy loop): a
  // hash-chain that verifies is NOT enough -- the entry must actually CONTAIN the audited facts, else a
  // corrupted formatter silently drops the resource from the tamper-evident log while the gate stays GREEN.
  if pg_contains(e0, l0, "res=/area" as *u8) != 1 { ok = 0 }
  if pg_contains(e1, l1, "res=/area" as *u8) != 1 { ok = 0 }
  if pg_contains(e0, l0, "verdict=" as *u8) != 1 { ok = 0 }
  rows=rows+1; pass=pass+pg_row(6, ok, "audit log verifies AND entries carry the real resource+verdict (content, not just chain)" as *u8)
130
  pg_w("NX-ACCESS-PEP-GATE rows=" as *u8); pg_num(rows); pg_w(" pass=" as *u8); pg_num(pass); pg_w("\n" as *u8)
  if pass == rows {
      let line: *u8 = sys_mmap(256)
      var off: i64 = pg_cat(line, 0, "ACCESSGATE row=nx_access_pep enforcement rows=" as *u8)
      off = pg_catnum(line, off, rows); off = pg_cat(line, off, " pass=" as *u8); off = pg_catnum(line, off, pass)
      off = pg_cat(line, off, " verdict=PASS\n" as *u8)
      let gf: i64 = sys_openat_append("knowledge/status/access_gate.log" as *u8, 0x1a4)
      if gf >= 0 { sys_write(gf, line, off); sys_close(gf) }
      pg_w("NX-ACCESS-PEP-GATE verdict=PASS -- enforcement-point glue (ready to wire into the daemons) recorded\n" as *u8)
      sys_exit(0); return 0
  }
  pg_w("NX-ACCESS-PEP-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8)
  sys_exit(1); return 1
144}
nx_access_pep_gate.nx source

`nx_access_pep_gate.nx` source
