code wiki / _hdl_build / nx_nettier.nx
nx_nettier.nx source
↩ module page · 21 lines · 1303 B
1// nx_nettier.nx -- NETWORK-TIER classifier for the access-provisioning wall (zero-trust L1: a SIGNAL, not the
2// gate). Classifies the peer IP (already extracted by sys_accept_with_addr) into a trust tier via a DATA-DRIVEN
3// longest-prefix CIDR rule table (rule 11): loopback + RFC1918 = LAN, a configured VPN CIDR = VPN, everything
4// else = PUBLIC. DENY-BY-DEFAULT trust: an unknown IP is PUBLIC (least trusted) -- aligns with SECURITY_POSTURE
5// fail-closed. The wall (nx_access_wall) uses tier as ONE input; per NIST 800-207 / BeyondCorp, network location
6// is never sufficient alone. Composes nx_cidr. license_tier: ORIGINAL
7import "nx_cidr.nx"
8import "nx_syscalls.nx"
9
10// trust tiers -- higher = more trusted.
11const NT_PUBLIC: i64 = 0 // open internet -- least trust
12const NT_LAN: i64 = 1 // on the local network
13const NT_VPN: i64 = 2 // tunneled into the network
14
15// classify peer ip (u32 in i64) via the rule table; unknown -> PUBLIC (deny-by-default trust).
16func nt_classify(ip: i64, nets: *i64, prefixes: *i64, tiers: *i64, n: i64) -> i64 {
17 return cidr_tier(ip, nets, prefixes, tiers, n, NT_PUBLIC)
18}
19
20// does a tier meet a required minimum (e.g. an area requires >= NT_LAN)? 1/0.
21func nt_meets(tier: i64, required: i64) -> i64 { if tier >= required { return 1 } return 0 }