code wiki / _hdl_build / nx_consul_connect.nx
`nx_consul_connect.nx` source

1// nx_consul_connect.nx -- sovereign service-mesh CONNECT mTLS + INTENTIONS (HashiCorp Consul Connect-class;
2// CONSUL-005, the arc capstone). Every service gets an identity cert issued by OUR CA (production: the vault
3// CA via nx_vault_transit/auth + ed25519/p256 signing). A mesh connection source->dest is authorized IFF:
4//   (1) the peer presents a cert that is CA-ISSUED and whose identity == its claimed source service (mTLS), AND
5//   (2) an INTENTION permits source->dest. Intentions are DEFAULT-DENY with EXPLICIT-DENY-WINS -- the secure
6// posture: no connection unless explicitly allowed, and a deny always overrides an allow.
7// Pure logic; cert validity is modeled as (issued-by-our-CA flag + identity match) -- the live signature check
8// is nx_ed25519/p256 against the vault CA pubkey. license_tier: ORIGINAL
9import "nx_syscalls.nx"
10
11const INTENT_DENY:  i64 = 0
12const INTENT_ALLOW: i64 = 1
13const MESH_DENY:    i64 = 0
14const MESH_ALLOW:   i64 = 1
15
16// is the presented cert valid for mTLS? it must be issued by OUR CA AND its identity must equal the claimed
17// source service (no presenting service B's cert while claiming to be A).
18func mc_cert_valid(cert_service: i64, ca_signed: i64, claimed_source: i64) -> i64 {
19    if ca_signed != 1 { return 0 }
20    if cert_service != claimed_source { return 0 }
21    return 1
22}
23
24// intention lookup for src->dst: EXPLICIT-DENY-WINS, DEFAULT-DENY (no matching intention => no connection).
25func mc_intention(srcs: *i64, dsts: *i64, acts: *i64, n: i64, src: i64, dst: i64) -> i64 {
26    var allow: i64 = 0
27    var i: i64 = 0
28    while i < n {
29        if srcs[i] == src { if dsts[i] == dst {
30            if acts[i] == INTENT_DENY { return MESH_DENY }   // a deny anywhere = denied
31            allow = 1
32        } }
33        i = i + 1
34    }
35    if allow == 1 { return MESH_ALLOW }
36    return MESH_DENY
37}
38
39// full mesh authorization: valid mTLS cert AND an allowing intention.
40func mc_authorize(cert_service: i64, ca_signed: i64, claimed_source: i64, dest: i64, srcs: *i64, dsts: *i64, acts: *i64, n: i64) -> i64 {
41    if mc_cert_valid(cert_service, ca_signed, claimed_source) != 1 { return MESH_DENY }
42    return mc_intention(srcs, dsts, acts, n, claimed_source, dest)
43}
nx_consul_connect.nx source

`nx_consul_connect.nx` source
