code wiki / _hdl_build / nx_dos_timeout_scan.nx

nx_dos_timeout_scan.nx

buildroot/runtime/_hdl_build/nx_dos_timeout_scan.nx

7357 B145 linesdepth 2pulls 2 transitivereach 0 importersview sourcekind tool

docs dependencies structs consts functions

about

nx_dos_timeout_scan.nx -- FLEET DoS-STARVATION GUARD (seq321). A single-threaded accept-loop daemon that loop-reads to Content-Length can be starved FOREVER by one peer that declares a body it never finishes sending = a one-request DoS (hostile OR merely buggy client). The 2-line cure is sys_set_socket_timeout(cfd,N) right after accept (RCVTIMEO+SNDTIMEO). This guard SUPERVISES the class: it scans the organ tree and flags every DAEMON source that has an accept() call but NO socket-timeout tooth, so the fix (fold-in-on-touch) is a visible standing signal, not a one-time audit. Read-only (never patches). Pattern: nx_dup_source_check. nx_dos_timeout_scan -- self-test the detector, then scan buildroot/runtime/_hdl_build; RED if vulns license_tier: ORIGINAL Sovereign: nx_syscalls. expect_exit: 0 when clean.

dependencies 1 imports · 0 importers

imports: nx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

10	const K_MAGIC_131072: i64 = 131072
11	const K_MAGIC_524288: i64 = 524288
12	const K_MAGIC_4096: i64 = 4096
13	const K_MAGIC_524287: i64 = 524287

functions

15	func dw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 3: scan selftest main calls 1: sys_write
16	func dwn(v: i64) -> i64 called by 2: selftest main calls 2: sys_write sys_mmap
22	func dslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 4: ends_nx has_sub name_is_daemon wfile
23	func ends_nx(nm: *u8) -> i64 called by 1: scan calls 1: dslen
30	func has_sub(buf: u8, n: i64, needle: u8) -> i64 called by 2: name_is_daemon is_vuln calls 1: dslen
43	func name_is_daemon(nm: *u8) -> i64 called by 1: scan calls 2: dslen has_sub
54	func join_path(buf: u8, dir: u8, name: *u8) -> i64 called by 1: scan
62	func read_file(path: u8, buf: u8, cap: i64) -> i64 called by 1: scan calls 3: sys_openat_rd sys_read sys_close
72	func is_vuln(buf: *u8, n: i64) -> i64 called by 1: scan calls 1: has_sub
82	func scan(dir: *u8, verbose: i64) -> i64 called by 2: selftest main calls 13: sys_openat_rd sys_mmap sys_getdents64 dirent_type dirent_name ends_nx+7
115	func wfile(path: u8, s: u8) -> i64 { let fd: i64=sys_openat_wr(path, 420); if fd>=0 { sys_write(fd, s, dslen(s)); sys_close(fd) } return 0 } called by 1: selftest calls 4: sys_openat_wr sys_write dslen sys_close
118	func selftest() -> i64 called by 1: main calls 5: sys_mkdir wfile scan dw dwn
128	func main() -> i64 calls 8: dw selftest sys_exit scan dwn sys_openat_wr+2