nx_api_harden_gate.nx source

1// nx_api_harden_gate.nx -- GATE: the remaining S-class remote-access gaps (sovereign WAF + tamper-evident audit + mTLS). 2// T1 WAF -- normal request allowed; over-rate / oversized / bad-pattern all blocked. 3// T2 AUDIT -- a 4-entry hash-chained log verifies intact; tampering ONE past entry breaks the final hash (detected). 4// T3 mTLS -- a CA-signed client cert is accepted; an unsigned/forged cert is rejected. 5// T4 NEVER-BRICK- deterministic. 6// GREEN iff all. Sovereign nx_cc->nxasm. With nx_relay these close the remote-access census GAPs -> full S-class. expect_exit: 0 license_tier: ORIGINAL 7import "nx_api_harden.nx" 8import "nx_syscalls.nx" 9import "nx_gate_verdict.nx" 10 11func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 12func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 13 14func main() -> i64 { 15 w("=== nx_api_harden_gate: sovereign WAF + tamper-evident audit + mTLS (close the S-class gaps) ===\n" as *u8) 16 var pass: i64 = 0; var total: i64 = 0 17 18 // T1 WAF 19 let ok: i64 = waf_allow(5, 100, 1000, 65536, 0) 20 let b_rate: i64 = waf_allow(200, 100, 1000, 65536, 0) 21 let b_size: i64 = waf_allow(5, 100, 999999, 65536, 0) 22 let b_pat: i64 = waf_allow(5, 100, 1000, 65536, 1) 23 var t1: i64 = 1 24 if ok != 1 { t1=0 } 25 if b_rate != 0 { t1=0 } 26 if b_size != 0 { t1=0 } 27 if b_pat != 0 { t1=0 } 28 total=total+1; if t1==1 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 29 w("T1 WAF/DDoS: normal=" as *u8); wn(ok); w(" over-rate=" as *u8); wn(b_rate); w(" oversized=" as *u8); wn(b_size); w(" bad-pattern=" as *u8); wn(b_pat); w(" (blocked)\n" as *u8) 30 31 // T2 audit hash-chain 32 let actor: *i64=sys_mmap(8*8) as *i64 33 let action: *i64=sys_mmap(8*8) as *i64 34 let result: *i64=sys_mmap(8*8) as *i64 35 actor[0]=4242; action[0]=0; result[0]=200 36 actor[1]=4242; action[1]=1; result[1]=200 37 actor[2]=9999; action[2]=0; result[2]=401 38 actor[3]=4242; action[3]=2; result[3]=200 39 let final0: i64 = audit_final(actor, action, result, 4) 40 let intact: i64 = audit_verify(actor, action, result, 4, final0) 41 result[2] = 200 // tamper: rewrite a past 401 to 200 42 let tampered: i64 = audit_verify(actor, action, result, 4, final0) 43 result[2] = 401 // restore 44 total=total+1; if intact==1 { if tampered==0 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } } else { w(" [FAIL] " as *u8) } 45 w("T2 AUDIT: chain intact=" as *u8); wn(intact); w(" ; after tampering one entry verify=" as *u8); wn(tampered); w(" (tamper-evident)\n" as *u8) 46 47 // T3 mTLS 48 let sig: i64 = mtls_sign(777) 49 let good: i64 = mtls_verify(777, sig) 50 let forged: i64 = mtls_verify(777, sig + 1) 51 let wrong: i64 = mtls_verify(888, sig) 52 var t3: i64 = 1 53 if good != 1 { t3=0 } 54 if forged != 0 { t3=0 } 55 if wrong != 0 { t3=0 } 56 total=total+1; if t3==1 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 57 w("T3 mTLS: CA-signed cert=" as *u8); wn(good); w(" forged=" as *u8); wn(forged); w(" wrong-cert=" as *u8); wn(wrong); w(" (rejected)\n" as *u8) 58 59 // T4 never-brick 60 let a: i64 = audit_final(actor, action, result, 4) 61 total=total+1; if a==final0 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 62 w("T4 never-brick: deterministic audit (" as *u8); wn(a); w("==" as *u8); wn(final0); w(")\n" as *u8) 63 64 w("\n=== nx_api_harden_gate " as *u8); wn(pass); w("/" as *u8); wn(total) 65 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 66 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 67 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 68 let ctr__dry: *i64 = gv_ctr() 69 ctr__dry[0] = pass 70 ctr__dry[1] = total 71 let rc__dry: i64 = gv_verdict("API-HARDEN-GATE" as *u8, ctr__dry, "S-class gaps closed: sovereign WAF/DDoS + hash-chained tamper-evident audit + mTLS client certs)" as *u8) 72 sys_exit(rc__dry) 73 return rc__dry 74}