code wiki / _hdl_build / nx_socks5_client.nx
nx_socks5_client.nx
buildroot/runtime/_hdl_build/nx_socks5_client.nx
about
nx_socks5_client.nx -- SOVEREIGN SOCKS5 CLIENT (RFC 1928 CONNECT, no-auth method).
The FIRST pluggable-router backend for the privacy no-leak guard's nx_private_fetch
(knowledge/store/media-inventory/privacy_noleak_guard.DESIGN.txt): the guard opens an external
enrichment connection THROUGH a SOCKS5 proxy instead of a direct socket, so the destination is
reached via the proxy. When that proxy is a Tor client's SOCKS port (roadmap), the SAME code path
carries real anonymity -- the target sees the Tor exit, not us.
HONEST SCOPE: a SOCKS5 proxy BY ITSELF is NOT anonymity -- the proxy sees origin IP + timing + dest.
This file is only the transport MECHANISM; nx_anon_transport.nx marks which backends actually hide
the origin. Do NOT mistake a working SOCKS5 tunnel for a working anonymizer.
Sovereign: nx_syscalls only (sys_socket/connect/setsockopt/read/write/close). No libc, no shell.
license_tier: ORIGINAL expect_exit: 0
dependencies 2 imports · 2 importers
imports: nx_syscalls.nxnx_connect.nx
imported by: nx_anon_transport.nxnx_socks5_client_gate.nx
structs
| none |
consts
| 18 | const S5_VER: i64 = 5 // SOCKS protocol version |
| 19 | const S5_METHOD_NOAUTH: i64 = 0 // method 0x00 = NO AUTHENTICATION REQUIRED |
| 20 | const S5_METHOD_REJECT: i64 = 0xff // method 0xFF = NO ACCEPTABLE METHODS (server rejects) |
| 21 | const S5_CMD_CONNECT: i64 = 1 // CMD 0x01 = CONNECT (establish a TCP relay) |
| 22 | const S5_RSV: i64 = 0 // reserved octet, must be 0x00 |
| 23 | const S5_ATYP_IPV4: i64 = 1 // address type 0x01 = IPv4 (4 bytes) |
| 24 | const S5_ATYP_DOMAIN: i64 = 3 // address type 0x03 = domain name (1 len byte + name) |
| 25 | const S5_ATYP_IPV6: i64 = 4 // address type 0x04 = IPv6 (16 bytes) |
| 26 | const S5_REP_SUCCESS: i64 = 0 // reply REP 0x00 = succeeded |
| 29 | const S5_E_SHORT: i64 = 0 - 1 // reply shorter than the protocol minimum for its shape |
| 30 | const S5_E_VERSION: i64 = 0 - 2 // server did not answer version 5 |
| 31 | const S5_E_NOAUTH: i64 = 0 - 3 // server did not select our no-auth method |
| 32 | const S5_E_REPLY: i64 = 0 - 4 // CONNECT reply REP != 0 (proxy refused / failed) |
| 33 | const S5_E_ATYP: i64 = 0 - 5 // reply bound-address type unrecognized |
| 34 | const S5_E_HOSTLEN: i64 = 0 - 6 // domain name length outside [1,255] |
| 35 | const S5_E_SOCKET: i64 = 0 - 7 // socket() failed |
| 36 | const S5_E_CONNECT: i64 = 0 - 8 // connect() to the proxy failed |
| 37 | const S5_E_IO: i64 = 0 - 9 // short / failed read or write on the wire |
functions
| 43 | func s5_build_greeting(out: *u8) -> i64 |
| 52 | func s5_parse_method_reply(buf: *u8, n: i64) -> i64 |
| 64 | func s5_build_connect_domain(host: *u8, hlen: i64, port: i64, out: *u8) -> i64 |
| 80 | func s5_build_connect_ipv4(ip: *u8, port: i64, out: *u8) -> i64 called by 1: part_a |
| 94 | func s5_reply_len(buf: *u8, n: i64) -> i64 called by 1: s5_parse_connect_reply |
| 108 | func s5_parse_connect_reply(buf: *u8, n: i64) -> i64 |
| 122 | func s5_read_full(fd: i64, buf: *u8, want: i64) -> i64 |
| 134 | func s5_set_rcv_timeout(fd: i64, secs: i64) -> i64 |
| 146 | func s5_connect(proxy_ip: *u8, proxy_port: i64, host: *u8, hlen: i64, dport: i64) -> i64 called by 1: anon_connect calls 10: sys_sockets5_set_rcv_timeoutsys_mmapnx_connect_boundedsys_closes5_build_greeting+4 |