nx_api_harden_gate.nx source

1// nx_api_harden_gate.nx -- GATE: the remaining S-class remote-access gaps (sovereign WAF + tamper-evident audit + mTLS). 2// T1 WAF -- normal request allowed; over-rate / oversized / bad-pattern all blocked. 3// T2 AUDIT -- a 4-entry hash-chained log verifies intact; tampering ONE past entry breaks the final hash (detected). 4// T3 mTLS -- a CA-signed client cert is accepted; an unsigned/forged cert is rejected. 5// T4 NEVER-BRICK- deterministic. 6// GREEN iff all. Sovereign nx_cc->nxasm. With nx_relay these close the remote-access census GAPs -> full S-class. expect_exit: 0 license_tier: ORIGINAL 7import "nx_api_harden.nx" 8import "nx_syscalls.nx" 9 10func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 11func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 12 13func main() -> i64 { 14 w("=== nx_api_harden_gate: sovereign WAF + tamper-evident audit + mTLS (close the S-class gaps) ===\n" as *u8) 15 var pass: i64 = 0; var total: i64 = 0 16 17 // T1 WAF 18 let ok: i64 = waf_allow(5, 100, 1000, 65536, 0) 19 let b_rate: i64 = waf_allow(200, 100, 1000, 65536, 0) 20 let b_size: i64 = waf_allow(5, 100, 999999, 65536, 0) 21 let b_pat: i64 = waf_allow(5, 100, 1000, 65536, 1) 22 var t1: i64 = 1 23 if ok != 1 { t1=0 } 24 if b_rate != 0 { t1=0 } 25 if b_size != 0 { t1=0 } 26 if b_pat != 0 { t1=0 } 27 total=total+1; if t1==1 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 28 w("T1 WAF/DDoS: normal=" as *u8); wn(ok); w(" over-rate=" as *u8); wn(b_rate); w(" oversized=" as *u8); wn(b_size); w(" bad-pattern=" as *u8); wn(b_pat); w(" (blocked)\n" as *u8) 29 30 // T2 audit hash-chain 31 let actor: *i64=sys_mmap(8*8) as *i64 32 let action: *i64=sys_mmap(8*8) as *i64 33 let result: *i64=sys_mmap(8*8) as *i64 34 actor[0]=4242; action[0]=0; result[0]=200 35 actor[1]=4242; action[1]=1; result[1]=200 36 actor[2]=9999; action[2]=0; result[2]=401 37 actor[3]=4242; action[3]=2; result[3]=200 38 let final0: i64 = audit_final(actor, action, result, 4) 39 let intact: i64 = audit_verify(actor, action, result, 4, final0) 40 result[2] = 200 // tamper: rewrite a past 401 to 200 41 let tampered: i64 = audit_verify(actor, action, result, 4, final0) 42 result[2] = 401 // restore 43 total=total+1; if intact==1 { if tampered==0 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } } else { w(" [FAIL] " as *u8) } 44 w("T2 AUDIT: chain intact=" as *u8); wn(intact); w(" ; after tampering one entry verify=" as *u8); wn(tampered); w(" (tamper-evident)\n" as *u8) 45 46 // T3 mTLS 47 let sig: i64 = mtls_sign(777) 48 let good: i64 = mtls_verify(777, sig) 49 let forged: i64 = mtls_verify(777, sig + 1) 50 let wrong: i64 = mtls_verify(888, sig) 51 var t3: i64 = 1 52 if good != 1 { t3=0 } 53 if forged != 0 { t3=0 } 54 if wrong != 0 { t3=0 } 55 total=total+1; if t3==1 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 56 w("T3 mTLS: CA-signed cert=" as *u8); wn(good); w(" forged=" as *u8); wn(forged); w(" wrong-cert=" as *u8); wn(wrong); w(" (rejected)\n" as *u8) 57 58 // T4 never-brick 59 let a: i64 = audit_final(actor, action, result, 4) 60 total=total+1; if a==final0 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 61 w("T4 never-brick: deterministic audit (" as *u8); wn(a); w("==" as *u8); wn(final0); w(")\n" as *u8) 62 63 w("\n=== nx_api_harden_gate " as *u8); wn(pass); w("/" as *u8); wn(total) 64 if pass == total { w(" GREEN (S-class gaps closed: sovereign WAF/DDoS + hash-chained tamper-evident audit + mTLS client certs)\n" as *u8); sys_exit(0); return 0 } 65 w(" RED\n" as *u8); sys_exit(1); return 1 66}