nx_sni_route.nx
buildroot/runtime/nx_sni_route.nx
about
nx_sni_route.nx -- SOVEREIGN TLS SNI extraction + backend routing decision (PURE: no syscalls, no imports,
so it is unit-gateable offline against hand-crafted ClientHellos). Used by nx_aw_sni_router (the :443
passthrough front) to pick a backend by domain WITHOUT terminating TLS. Defensive byte parsing of the
ClientHello (untrusted network input): every offset is bounds-checked; any malformation -> default backend.
license_tier: ORIGINAL
dependencies 0 imports · 3 importers
imports: none
imported by: nx_aw_sni_router.nxnx_aw_sni_router_gate.nxnx_sni_route_gate.nx
structs
| none |
consts
| 7 | const NX_BK_NISHI: i64 = 8443 // sites daemon (nishifamily games + andelinwest static + /search) |
| 8 | const NX_BK_NGINX: i64 = 443 // Synology nginx fallback (keeps ALL other vhosts + DSM exactly as-is) |
functions
| 10 | func sni_be16(b: *u8, i: i64) -> i64 { return ((b[i] as i64) << 8) | (b[i + 1] as i64) } called by 1: sni_extract |
| 14 | func sni_extract(b: *u8, n: i64, out: *u8, outcap: i64) -> i64 |
| 57 | func sni_contains(h: *u8, hn: i64, ndl: *u8, nn: i64) -> i64 |
| 71 | func sni_eq(h: *u8, hn: i64, lit: *u8, ln: i64) -> i64 called by 1: sni_backend |
| 84 | func sni_dom(h: *u8, hn: i64, dom: *u8, dn: i64) -> i64 called by 1: sni_backend |
| 102 | func sni_backend(h: *u8, hn: i64) -> i64 |