nx_nft_read.nx

buildroot/runtime/nx_nft_read.nx

8410 B139 linesdepth 2pulls 2 transitivereach 1 importersview sourcekind tool

docs dependencies structs consts functions

about

nx_nft_read.nx -- R0/R1 of the SOVEREIGN NETFILTER ("our own iptables", from the syscall rung up). READ the kernel's "nat" table info via the LEGACY iptables getsockopt ABI (IPT_SO_GET_INFO) -- NO wheeler iptables binary. Grounds the DNAT mechanism: proves sovereign netfilter-comms + reveals the table (num_entries/size) we'll append a :443->:8444 DNAT to (R2), so DSM + Nishi COEXIST. READ-ONLY -- cannot disturb DSM's rules. The getsockopt return value is itself the grounding: 0=read ok ; -1 EPERM=need root (legacy ABI present) ; -92 ENOPROTOOPT= kernel is nft-only (switch to netlink) ; -2 ENOENT=no nat table. license_tier: ORIGINAL expect_exit: 0

dependencies 1 imports · 1 importers

imports: nx_syscalls.nx

imported by: nx_nft_read_gate.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

14	const NR_ENTRY_BYTES: i64 = 112
15	const NR_EXTENSION_BYTES: i64 = 32
16	const NR_TARGET_OFFSET: i64 = 88
17	const NR_NEXT_OFFSET: i64 = 90

functions

9	func p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 4: nr_ip nr_name nr_emit main calls 1: sys_write
10	func pn(v: i64) -> i64 { let b: *u8=sys_mmap(28); var x: i64=v; if x<0 {b[0]=45;sys_write(1,b,1);x=0-x}; if x==0 {b[0]=48;sys_write(1,b,1);return 0} var d: i64=0; var y: i64=x; while y>0 {d=d+1;y=y/10} var i: i64=d-1; y=x; while i>=0 {b[i]=(48+(y%10)) as u8; y=y/10; i=i-1} sys_write(1,b,d); return 0 } called by 3: nr_ip nr_emit main calls 2: sys_mmap sys_write
11	func ru32(b: *u8, o: i64) -> i64 { return (b[o] as i64) \| ((b[o+1] as i64)<<8) \| ((b[o+2] as i64)<<16) \| ((b[o+3] as i64)<<24) } called by 1: main
19	func nr_u16(b: *u8, o: i64) -> i64 { return (b[o] as i64) \| ((b[o+1] as i64)<<8) } called by 2: nr_validate nr_emit
20	func nr_hex(b: *u8, n: i64) -> i64 called by 1: nr_emit calls 4: sys_mmap sys_write sys_munmap sys_exit
30	func nr_ip(b: *u8) -> i64 called by 1: nr_emit calls 2: p pn
35	func nr_name(b: *u8, n: i64) -> i64 called by 1: nr_emit calls 2: sys_write p
44	func nr_validate(b: *u8, n: i64, expected: i64) -> i64 called by 2: main main calls 1: nr_u16
71	func nr_emit(b: *u8, n: i64) -> i64 called by 1: main calls 6: nr_u16 p pn nr_ip nr_name nr_hex
99	func main() -> i64 calls 9: sys_socket p pn sys_exit sys_mmap sys_close+3