nx_access_wall_gate.nx source

1// nx_access_wall_gate.nx -- gate for the unified PDP (nx_access_wall). Proves ZERO-TRUST / DENY-BY-DEFAULT / 2// FAIL-CLOSED over composed signals: ALLOW only when network-tier AND identity-policy AND device AND rate all 3// permit; each layer denies INDEPENDENTLY (with its own code); deny-by-default on an ungranted resource; and 4// the reused nx_vault_acl explicit-deny-wins. Positive AND negative controls. Appends "ACCESSGATE row= 5// nx_access_wall pdp ... verdict=PASS" to knowledge/status/access_gate.log on all-pass. Exit 0 iff all pass. 6// license_tier: ORIGINAL 7import "nx_access_wall.nx" 8import "nx_syscalls.nx" 9 10func aw_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 11func aw_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 12func aw_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o } 13func aw_catnum(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o } 14func aw_row(id: i64, ok: i64, what: *u8) -> i64 { aw_w("AWROW " as *u8); aw_num(id); aw_w(" " as *u8); if ok==1 { aw_w("PASS " as *u8) } else { aw_w("FAIL " as *u8) } aw_w(what); aw_w("\n" as *u8); return ok } 15func aw_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 16 17func main() -> i64 { 18 // ---- admin role policy: grant /admin (R+W), grant /studio (R), explicit-DENY /admin/danger ---- 19 let paths: *i64 = sys_mmap(8*8) as *i64 20 let lens: *i64 = sys_mmap(8*8) as *i64 21 let deny: *i64 = sys_mmap(8*8) as *i64 22 let caps: *i64 = sys_mmap(8*8) as *i64 23 paths[0]="/admin" as *u8 as i64; lens[0]=6; deny[0]=0; caps[0]=CAP_READ|CAP_WRITE 24 paths[1]="/studio" as *u8 as i64; lens[1]=7; deny[1]=0; caps[1]=CAP_READ 25 paths[2]="/admin/danger" as *u8 as i64; lens[2]=13; deny[2]=1; caps[2]=0 26 let nr: i64 = 3 27 28 // ---- public role policy: grant /studio (R) only ---- 29 let ppaths: *i64 = sys_mmap(8*8) as *i64 30 let plens: *i64 = sys_mmap(8*8) as *i64 31 let pdeny: *i64 = sys_mmap(8*8) as *i64 32 let pcaps: *i64 = sys_mmap(8*8) as *i64 33 ppaths[0]="/studio" as *u8 as i64; plens[0]=7; pdeny[0]=0; pcaps[0]=CAP_READ 34 let pnr: i64 = 1 35 36 let r_save: *u8 = "/admin/save" as *u8 37 let r_secret: *u8 = "/secret" as *u8 38 let r_studio: *u8 = "/studio" as *u8 39 let r_danger: *u8 = "/admin/danger" as *u8 40 41 var pass: i64 = 0 42 var rows: i64 = 0 43 var ok: i64 = 0 44 45 // R0: ALL layers permit -> ALLOW (admin writing /admin/save from LAN with a provisioned device, not rate-limited) 46 ok = 0; if aw_decide(paths,lens,deny,caps,nr, r_save, aw_slen(r_save), CAP_WRITE, NT_LAN, NT_LAN, 1, 1, 1)==AW_ALLOW { ok=1 } 47 rows=rows+1; pass=pass+aw_row(0, ok, "ALL layers permit -> ALLOW (identity+tier+device+rate)" as *u8) 48 49 // R1: rate-limited -> DENY_RATE (abuse layer) 50 ok = 0; if aw_decide(paths,lens,deny,caps,nr, r_save, aw_slen(r_save), CAP_WRITE, NT_LAN, NT_LAN, 1, 1, 0)==AW_DENY_RATE { ok=1 } 51 rows=rows+1; pass=pass+aw_row(1, ok, "rate-limited -> DENY_RATE (neg control)" as *u8) 52 53 // R2: network tier too low -> DENY_TIER (PUBLIC peer, area requires LAN) 54 ok = 0; if aw_decide(paths,lens,deny,caps,nr, r_save, aw_slen(r_save), CAP_WRITE, NT_PUBLIC, NT_LAN, 1, 1, 1)==AW_DENY_TIER { ok=1 } 55 rows=rows+1; pass=pass+aw_row(2, ok, "tier below required -> DENY_TIER (neg control)" as *u8) 56 57 // R3: device required but not provisioned -> DENY_DEVICE 58 ok = 0; if aw_decide(paths,lens,deny,caps,nr, r_save, aw_slen(r_save), CAP_WRITE, NT_LAN, NT_LAN, 0, 1, 1)==AW_DENY_DEVICE { ok=1 } 59 rows=rows+1; pass=pass+aw_row(3, ok, "device required but absent -> DENY_DEVICE (neg control)" as *u8) 60 61 // R4: deny-by-default -> an ungranted resource is DENIED even for admin with all other layers ok 62 ok = 0; if aw_decide(paths,lens,deny,caps,nr, r_secret, aw_slen(r_secret), CAP_READ, NT_LAN, NT_LAN, 1, 1, 1)==AW_DENY_POLICY { ok=1 } 63 rows=rows+1; pass=pass+aw_row(4, ok, "ungranted resource -> DENY_POLICY (deny-by-default)" as *u8) 64 65 // R5: explicit-deny-wins (reused from nx_vault_acl) -> /admin/danger denied despite the /admin grant 66 ok = 0; if aw_decide(paths,lens,deny,caps,nr, r_danger, aw_slen(r_danger), CAP_READ, NT_LAN, NT_LAN, 1, 1, 1)==AW_DENY_POLICY { ok=1 } 67 rows=rows+1; pass=pass+aw_row(5, ok, "explicit-deny-wins -> /admin/danger DENIED (reused acl)" as *u8) 68 69 // R6: PUBLIC area -> public role reads /studio from the open internet, no device -> ALLOW 70 ok = 0; if aw_decide(ppaths,plens,pdeny,pcaps,pnr, r_studio, aw_slen(r_studio), CAP_READ, NT_PUBLIC, NT_PUBLIC, 0, 0, 1)==AW_ALLOW { ok=1 } 71 rows=rows+1; pass=pass+aw_row(6, ok, "public area: PUBLIC read /studio, no device -> ALLOW" as *u8) 72 73 // R7: public role lacks WRITE on /studio -> DENY_POLICY (capability check, reused acl) 74 ok = 0; if aw_decide(ppaths,plens,pdeny,pcaps,pnr, r_studio, aw_slen(r_studio), CAP_WRITE, NT_PUBLIC, NT_PUBLIC, 0, 0, 1)==AW_DENY_POLICY { ok=1 } 75 rows=rows+1; pass=pass+aw_row(7, ok, "public lacks WRITE cap -> DENY_POLICY (neg control)" as *u8) 76 77 // R8: aw_allowed boolean maps ALLOW->1 and any deny->0 78 ok = 0 79 let va: i64 = aw_decide(paths,lens,deny,caps,nr, r_save, aw_slen(r_save), CAP_WRITE, NT_LAN, NT_LAN, 1, 1, 1) 80 let vd: i64 = aw_decide(paths,lens,deny,caps,nr, r_save, aw_slen(r_save), CAP_WRITE, NT_LAN, NT_LAN, 1, 1, 0) 81 if aw_allowed(va)==1 { if aw_allowed(vd)==0 { ok=1 } } 82 rows=rows+1; pass=pass+aw_row(8, ok, "aw_allowed: ALLOW->1, deny->0 (the PEP boolean)" as *u8) 83 84 aw_w("NX-ACCESS-WALL-GATE rows=" as *u8); aw_num(rows); aw_w(" pass=" as *u8); aw_num(pass); aw_w("\n" as *u8) 85 if pass == rows { 86 let line: *u8 = sys_mmap(256) 87 var off: i64 = aw_cat(line, 0, "ACCESSGATE row=nx_access_wall pdp rows=" as *u8) 88 off = aw_catnum(line, off, rows); off = aw_cat(line, off, " pass=" as *u8); off = aw_catnum(line, off, pass) 89 off = aw_cat(line, off, " verdict=PASS\n" as *u8) 90 let gf: i64 = sys_openat_append("knowledge/status/access_gate.log" as *u8, 0x1a4) 91 if gf >= 0 { sys_write(gf, line, off); sys_close(gf) } 92 aw_w("NX-ACCESS-WALL-GATE verdict=PASS -- zero-trust PDP recorded in access_gate.log\n" as *u8) 93 sys_exit(0); return 0 94 } 95 aw_w("NX-ACCESS-WALL-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8) 96 sys_exit(1); return 1 97}