nx_consul_connect_test.nx source

1// nx_consul_connect_test.nx -- CCONNECTGATE: proves the sovereign Connect mTLS mesh. Services web=100 api=200 2// db=300 cache=400. Intentions: web->api ALLOW, web->db DENY. GREEN iff: web->api authorized (valid cert + 3// allow); web->db denied (explicit deny); api->db denied (DEFAULT-DENY, no intention); an unsigned/non-CA cert 4// is denied (mTLS imposter); an identity spoof (presenting api's cert while claiming web) is denied; the 5// cert-validity predicate is correct; and EXPLICIT-DENY-WINS over a co-present allow. exit 0 on 7/7. 6import "nx_consul_connect.nx" 7import "nx_syscalls.nx" 8 9func eg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 10func eg_num(v: i64) -> i64 { let b: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {b[i]=t[k-1-i]; i=i+1}; sys_write(1,b,k); return 0 } 11 12func main() -> i64 { 13 eg_puts("=== SOVEREIGN CONNECT mTLS + INTENTIONS (default-deny service mesh) ===\n" as *u8) 14 let WEB: i64 = 100 15 let API: i64 = 200 16 let DB: i64 = 300 17 18 // intentions: web->api ALLOW, web->db DENY 19 let srcs: *i64 = sys_mmap(24) as *i64 20 let dsts: *i64 = sys_mmap(24) as *i64 21 let acts: *i64 = sys_mmap(24) as *i64 22 srcs[0]=WEB; dsts[0]=API; acts[0]=INTENT_ALLOW 23 srcs[1]=WEB; dsts[1]=DB; acts[1]=INTENT_DENY 24 let ni: i64 = 2 25 26 // valid web cert -> api (allowed) 27 let a_web_api: i64 = mc_authorize(WEB, 1, WEB, API, srcs, dsts, acts, ni) 28 // valid web cert -> db (explicit deny) 29 let a_web_db: i64 = mc_authorize(WEB, 1, WEB, DB, srcs, dsts, acts, ni) 30 // valid api cert -> db (no intention -> default deny) 31 let a_api_db: i64 = mc_authorize(API, 1, API, DB, srcs, dsts, acts, ni) 32 // unsigned/non-CA cert -> api (mTLS imposter) 33 let a_unsigned: i64 = mc_authorize(WEB, 0, WEB, API, srcs, dsts, acts, ni) 34 // identity spoof: presents API's cert while CLAIMING to be WEB 35 let a_spoof: i64 = mc_authorize(API, 1, WEB, API, srcs, dsts, acts, ni) 36 37 // explicit-deny-wins: a pair with BOTH allow and deny present 38 let s2: *i64 = sys_mmap(24) as *i64; let d2: *i64 = sys_mmap(24) as *i64; let c2: *i64 = sys_mmap(24) as *i64 39 s2[0]=WEB; d2[0]=API; c2[0]=INTENT_ALLOW 40 s2[1]=WEB; d2[1]=API; c2[1]=INTENT_DENY 41 let deny_wins: i64 = mc_intention(s2, d2, c2, 2, WEB, API) // expect DENY 42 let allow_only: i64 = mc_intention(s2, d2, c2, 1, WEB, API) // only the ALLOW row -> ALLOW 43 44 eg_puts(" web->api=" as *u8); eg_num(a_web_api); eg_puts(" web->db=" as *u8); eg_num(a_web_db); eg_puts(" api->db=" as *u8); eg_num(a_api_db) 45 eg_puts(" | unsigned=" as *u8); eg_num(a_unsigned); eg_puts(" spoof=" as *u8); eg_num(a_spoof) 46 eg_puts(" | deny_wins=" as *u8); eg_num(deny_wins); eg_puts(" allow_only=" as *u8); eg_num(allow_only); eg_puts("\n" as *u8) 47 48 let r: *i64 = sys_mmap(8*8) as *i64 49 r[0] = 0; if a_web_api == MESH_ALLOW { r[0] = 1 } // valid cert + allow intention 50 r[1] = 0; if a_web_db == MESH_DENY { r[1] = 1 } // explicit deny 51 r[2] = 0; if a_api_db == MESH_DENY { r[2] = 1 } // default-deny (no intention) 52 r[3] = 0; if a_unsigned == MESH_DENY { r[3] = 1 } // non-CA cert rejected (mTLS) 53 r[4] = 0; if a_spoof == MESH_DENY { r[4] = 1 } // identity spoof rejected 54 r[5] = 0; if mc_cert_valid(WEB,1,WEB)==1 { if mc_cert_valid(WEB,0,WEB)==0 { if mc_cert_valid(API,1,WEB)==0 { r[5] = 1 } } } 55 r[6] = 0; if deny_wins == MESH_DENY { if allow_only == MESH_ALLOW { r[6] = 1 } } // explicit-deny-wins 56 57 var pass: i64 = 0; var i: i64 = 0 58 while i < 7 { pass = pass + r[i]; i = i + 1 } 59 eg_puts("----\n passed " as *u8); eg_num(pass); eg_puts("/7\n" as *u8) 60 if pass == 7 { 61 eg_puts("CCONNECTGATE mtls_ca_cert=1 identity_bound=1 default_deny=1 explicit_deny_wins=1 imposter_rejected=1 spoof_rejected=1 exceed[sovereign Consul-Connect service mesh: CA-issued per-service identity (vault CA) + default-deny intentions; only authorized+authenticated peers connect; bits-up] verdict=GREEN\n" as *u8) 62 sys_exit(0); return 0 63 } 64 eg_puts("CCONNECTGATE verdict=RED\n" as *u8); sys_exit(1); return 1 65}