code wiki / _hdl_build / nx_access_wall.nx
`nx_access_wall.nx` source

1// nx_access_wall.nx -- the unified POLICY DECISION POINT (NIST SP 800-207 PDP) for the access-provisioning
2// wall. ZERO-TRUST: a request is ALLOWED only if EVERY layer permits; DENY-BY-DEFAULT + FAIL-CLOSED otherwise.
3// It does NOT reinvent any security primitive -- it COMPOSES the existing security workstreams:
4//   L1 network tier  -> nx_nettier (nt_meets): is the peer's tier >= the area's required minimum?
5//   L2/L5 identity policy -> nx_vault_acl (acl_eval): deny-by-default, explicit-deny-wins, longest-prefix grant
6//   L3 device        -> a provisioned-device flag (mTLS client cert, nx_device_cert -- R4)
7//   L4 abuse         -> a rate-ok flag (nx_rate_limit)
8// The enforcement point (a daemon, e.g. nx_sites_daemon_v2 / nx_cms_admin) gathers the signals (peer_ip->tier,
9// session->role->policy, cert->device_ok, nx_rate_limit->rate_ok) and calls aw_decide once. The specific deny
10// CODE is returned so nx_access_audit (L6) can log WHY. license_tier: ORIGINAL
11import "nx_vault_acl.nx"
12import "nx_nettier.nx"
13import "nx_syscalls.nx"
14
15const AW_ALLOW:       i64 = 1
16const AW_DENY_RATE:   i64 = 0 - 1
17const AW_DENY_TIER:   i64 = 0 - 2
18const AW_DENY_DEVICE: i64 = 0 - 3
19const AW_DENY_POLICY: i64 = 0 - 4
20
21// the single decision. Order: cheap network/abuse pre-checks first (shed load), then the identity policy.
22// Returns AW_ALLOW only when ALL layers permit; otherwise the layer-specific deny code. FAIL-CLOSED: every
23// path that is not a full ALLOW is a DENY.
24func aw_decide(paths: *i64, lens: *i64, deny: *i64, caps: *i64, nrules: i64, req: *u8, req_len: i64, req_cap: i64,
25               tier: i64, required_tier: i64, device_ok: i64, require_device: i64, rate_ok: i64) -> i64 {
26    if rate_ok != 1 { return AW_DENY_RATE }                              // L4: rate-limited / abuse
27    if nt_meets(tier, required_tier) != 1 { return AW_DENY_TIER }        // L1: network tier insufficient
28    if require_device == 1 { if device_ok != 1 { return AW_DENY_DEVICE } } // L3: device not provisioned
29    if acl_eval(paths, lens, deny, caps, nrules, req, req_len, req_cap) != 1 { return AW_DENY_POLICY } // L2/L5: identity policy
30    return AW_ALLOW
31}
32
33// boolean convenience for the enforcement point.
34func aw_allowed(verdict: i64) -> i64 { if verdict == AW_ALLOW { return 1 } return 0 }
nx_access_wall.nx source

`nx_access_wall.nx` source
