nx_tool_http_backend.nx
buildroot/runtime/nx_tool_http_backend.nx
about
nx_tool_http_backend.nx -- HTTP-BACKEND execution mode for the sovereign agent tools API. A tools/call whose
tool name is declared in tool_backends.conf is an ALREADY-RUNNING sovereign HTTP service (search on :18456,
doc, ...), reached IN-PROCESS over LOOPBACK -- ONE general, data-driven mechanism, NOT a per-tool shim binary.
This is the second execution kind alongside fork-exec (nx_tool_exec_allow): a tool is EITHER a vetted ELF OR a
registered HTTP backend. SECURITY: host/port/path are fixed in the operator-curated registry; the caller supplies
ONLY the url-encoded param value (argv[1]) -> no SSRF, no path/header injection. FAIL-CLOSED: no row -> THB_NOROUTE
(the caller then falls back to fork-exec, which also fail-closes). Self-contained loopback client (only nx_syscalls;
sockaddr/parse-ip/read-loop replicate the proven nx_tool_run / nx_http_proxy patterns) -> minimal blast radius in
the crown-jewel daemon. Row (TAB): <name>\t<method>\t<host>\t<port>\t<path>\t<param>
license_tier: ORIGINAL
dependencies 2 imports · 3 importers
imports: nx_syscalls.nxnx_connect.nx
imported by: nx_mgmt_call.nxnx_tool_http_backend_gate.nxnx_tools_api.nx
structs
| none |
consts
| 13 | const TB_MAGIC_262144: i64 = 262144 |
| 14 | const TB_MAGIC_8192: i64 = 8192 |
| 15 | const TB_MAGIC_16384: i64 = 16384 |
| 16 | const TB_MAGIC_1048576: i64 = 1048576 |
| 18 | const TB_CONF: *u8 = "knowledge/tool_backends.conf" as *u8 // server CWD-relative (like tool_allowlist.conf) |
| 19 | const THB_OK: i64 = 1 // fetched -> body in out[0..outlen) |
| 20 | const THB_NOROUTE: i64 = 0 // tool not an HTTP backend -> caller falls back to fork-exec |
| 21 | const THB_ERR: i64 = 0 - 1 // declared but malformed/unreachable |
functions
| 23 | func thb_hex(v: i64) -> i64 { if v < 10 { return 48 + v } return 55 + v } // 0-9 then A-F called by 1: thb_urlenc |
| 24 | func thb_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } |
| 25 | func thb_catb(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n } called by 1: thb_dispatch_from |
| 26 | func thb_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i } called by 1: thb_dispatch_from |
| 29 | func thb_field(buf: *u8, ls: i64, le: i64, idx: i64, out2: *i64) -> i64 |
| 39 | func thb_atoi(buf: *u8, off: i64, len: i64) -> i64 |
| 45 | func thb_urlenc(src: *u8, slen: i64, dst: *u8) -> i64 |
| 70 | func thb_sockaddr(addr: *u8, port: i64, a: i64, b: i64, c: i64, d: i64) -> i64 called by 1: thb_fetch |
| 78 | func thb_parse_ip(s: *u8, slen: i64, out4: *i64) -> i64 called by 1: thb_fetch |
| 90 | func thb_fetch(host: *u8, hostlen: i64, port: i64, req: *u8, reqn: i64, out: *u8, cap: i64) -> i64 called by 2: mainthb_dispatch_from calls 8: sys_mmapthb_parse_ipsys_socketthb_sockaddrnx_connect_boundedsys_close+2 |
| 115 | func thb_read_conf(path: *u8, out_len: *i64) -> *u8 |
| 136 | func thb_dispatch_from(conf: *u8, name: *u8, nlen: i64, argv: *i64, argc: i64, out: *u8, cap: i64, outlen: *i64) -> i64 |
| 202 | func thb_dispatch(name: *u8, nlen: i64, argv: *i64, argc: i64, out: *u8, cap: i64, outlen: *i64) -> i64 |