code wiki / _hdl_build / nx_torrent_gw.nx
nx_torrent_gw.nx
buildroot/runtime/_hdl_build/nx_torrent_gw.nx
about
nx_torrent_gw.nx -- the MEDIA/TORRENT acquirer's OPAQUE auth gateway (loopback HTTP, :18793).
Sits behind sites_daemon's fail-closed /torrent reverse-proxy (mirrors the /hub -> hub_gw topology). Per
request it resolves the OPAQUE no-cookie X-Nishi-Session token against the SITE-ADMIN realm (== the
operator/owner; the same keys/store the :9091 login daemon mints from), and acts FAIL-CLOSED:
valid session -> inject the TRUSTED internal header `X-Nishi-Level: 3` (OWNER) + reverse-proxy to the
torrent daemon (127.0.0.1:8097); the daemon trusts that header (Cardinal 12).
no token -> serve the no-cookie bootstrap (JS reads sessionStorage -> re-fetch WITH the header).
invalid token -> 302 /login.
ISOLATED from the daemon + the login daemon ON PURPOSE: a bug here can never regress them. The injected
X-Nishi-Level is PREPENDED right after the request line, so it is the FIRST one the daemon's d_trusted_level
sees -> a client-spoofed X-Nishi-Level (necessarily later) is ignored. Sovereign, no 3rd party. ORIGINAL.
dependencies 5 imports · 0 importers
imports: nx_opaque_login.nxnx_hub_gw_decide.nxnx_http_client.nxnx_torrent_access.nxnx_connect.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 18 | const TGW_MAGIC_65536: i64 = 65536 |
| 19 | const TGW_MAGIC_262144: i64 = 262144 |
| 20 | const TGW_MAGIC_18793: i64 = 18793 |
| 21 | const TGW_MAGIC_14400: i64 = 14400 |
| 22 | const TGW_MAGIC_16400: i64 = 16400 |
| 23 | const TGW_MAGIC_1000000000: i64 = 1000000000 |
| 24 | const TGW_MAGIC_16383: i64 = 16383 |
| 26 | const TGW_KEYS: *u8 = "/volume1/homes/elderwesto/nishihost/opaque_keys.bin" |
| 27 | const TGW_STORE: *u8 = "/volume1/homes/elderwesto/nishihost/opaque_store.log" |
| 28 | const TGW_BACKEND_PORT: i64 = 8097 |
| 29 | const TGW_BOOTSTRAP: *u8 = "<!DOCTYPE html><html lang='en'><head><meta charset='utf-8'><meta name='viewport' content='width=device-width, initial-scale=1'><title>Nishi Media</title></head><body><script>(function(){var t=localStorage.getItem('nsess')||sessionStorage.getItem('nsess');if(t){localStorage.setItem('nsess',t)}if(!t){location='/login?return=/torrent';return}fetch(location.pathname,{headers:{'X-Nishi-Session':t}}).then(function(r){return r.ok?r.text():null}).then(function(x){if(x){document.open();document.write(x);document.close()}else{localStorage.removeItem('nsess');sessionStorage.removeItem('nsess');location='/login?return=/torrent'}})})();</script></body></html>" |
functions
| 31 | func tgw_atoi(s: *u8) -> i64 { var v: i64=0; var i: i64=0; while s[i]!=(0 as u8){ let c: i64=s[i] as i64; if c<48{return v} if c>57{return v} v=v*10+(c-48); i=i+1 } return v } called by 1: main |
| 32 | func tgw_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var i: i64=0; while s[i]!=(0 as u8){dst[o]=s[i];o=o+1;i=i+1} return o } |
| 33 | func tgw_itoa(dst: *u8, off: i64, v: i64) -> i64 { let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var o: i64=off; var q: i64=k-1; while q>=0{dst[o]=t[q];o=o+1;q=q-1} return o } |
| 34 | func tgw_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } |
| 35 | func tgw_w(s: *u8) -> i64 { sys_write(1, s, tgw_slen(s)); return 0 } |
| 40 | func tgw_hexv(c: i64) -> i64 |
| 46 | func tgw_query_nsess(req: *u8, rn: i64, out: *u8, cap: i64) -> i64 called by 1: main |
| 67 | func tgw_reqline_noq(fwd: *u8, o: i64, req: *u8, rl: i64) -> i64 called by 1: tgw_proxy |
| 89 | func tgw_req_has(req: *u8, rn: i64, needle: *u8, nl: i64) -> i64 called by 1: main |
| 100 | func tgw_send(cfd: i64, scratch: *u8, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64 |
| 109 | func tgw_redirect(cfd: i64, scratch: *u8, loc: *u8) -> i64 |
| 118 | func tgw_proxy(cfd: i64, req: *u8, rn: i64, level: i64) -> i64 called by 1: main calls 8: tgw_reqline_noqtgw_cattgw_itoasys_socketnx_http_client_sockaddr_ipv4nx_connect_bounded+2 |
| 143 | func main(argc: i64, argv: *i64) -> i64 |