code wiki / _hdl_build / nx_apistack_mtls.nx
nx_apistack_mtls.nx source
↩ module page · 29 lines · 1519 B
1// nx_apistack_mtls.nx -- CAP-API-MTLS: mutual-TLS client authentication for /api via certificate-fingerprint
2// PINNING. A presented client cert's fingerprint is allowed only if it's in the pinned allowlist (mtls_pins.conf,
3// one hex fingerprint per line); deny-by-default. Sovereign pinning as DATA (add a peer = a row) -- no CA-chain
4// trust-anyone, the sovereign exceed over permissive mTLS. license_tier: ORIGINAL
5import "nx_syscalls.nx"
6import "nx_site_lock_lib.nx"
7const K_MAGIC_65536: i64 = 65536
8
9func mt_read_file(path: *u8, out: *u8, cap: i64) -> i64 {
10 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 }
11 var total: i64 = 0; var go: i64 = 1
12 while go == 1 { let tail: *u8 = (out as i64 + total) as *u8; let nr: i64 = sys_read(fd, tail, cap - total); if nr <= 0 { go = 0 } if nr > 0 { total = total + nr } if total >= cap { go = 0 } }
13 sys_close(fd); return total
14}
15// 1 iff the presented client-cert fingerprint is pinned (deny-by-default). Empty -> 0.
16func mt_pinned(conf_path: *u8, fp: *u8, fp_n: i64) -> i64 {
17 if fp_n <= 0 { return 0 }
18 let buf: *u8 = sys_mmap(K_MAGIC_65536); let n: i64 = mt_read_file(conf_path, buf, K_MAGIC_65536)
19 var ls: i64 = 0
20 while ls < n {
21 let le: i64 = slk_line_end(buf, n, ls)
22 var e: i64 = le; if e > ls { if buf[e - 1] == (13 as u8) { e = e - 1 } }
23 if e > ls { if buf[ls] != (35 as u8) {
24 if slk_eq(slk_at(buf, ls), e - ls, fp, fp_n) == 1 { return 1 }
25 } }
26 ls = le + 1
27 }
28 return 0
29}