nx_anon_transport.nx source

1// nx_anon_transport.nx -- the ANONYMIZING TRANSPORT INTERFACE: the single seam the privacy no-leak 2// guard's nx_private_fetch calls INSTEAD of a raw socket (guard design: 3// knowledge/store/media-inventory/privacy_noleak_guard.DESIGN.txt). A pluggable BACKEND decides HOW the 4// external connection is carried. This is the common foundation every anonymity path (SOCKS5->Tor, 5// native Tor, mixnet) plugs into: the guard codes against anon_* and never against a concrete transport, 6// so the anonymizer can be strengthened underneath it without touching the guard. 7// 8// HONESTY, ENCODED IN CODE: anon_is_anonymizing() returns 1 ONLY for a backend that actually hides the 9// origin from the destination. A bare SOCKS5 proxy does NOT (the proxy sees origin+dest+timing) -- it 10// anonymizes only when it is a Tor client's SOCKS port, which is the ANON_TOR backend (still a roadmap 11// stub, so TODAY every IMPLEMENTED backend returns 0). The guard MUST consult this before any 12// private-category external fetch, so a plain proxy can never be silently mistaken for anonymity. 13// 14// Sovereign: nx_syscalls + nx_socks5_client. No libc, no shell. license_tier: ORIGINAL expect_exit: 0 15import "nx_syscalls.nx" 16import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host 17import "nx_socks5_client.nx" 18 19// ---- backends ---- 20const ANON_DIRECT: i64 = 0 // plain TCP to a caller-supplied IPv4 (NO anonymity; allowlisted/hash-addressed use only) 21const ANON_SOCKS5: i64 = 1 // via a SOCKS5 proxy (anonymity ONLY if that proxy is a Tor SOCKS port) 22const ANON_TOR: i64 = 2 // native Tor client (ROADMAP -- not yet implemented) 23 24// ---- errors ---- 25const ANON_E_BACKEND: i64 = 0 - 20 // unknown backend id 26const ANON_E_NOTIMPL: i64 = 0 - 21 // backend not implemented yet (Tor) 27const ANON_E_SOCKET: i64 = 0 - 22 // direct socket / connect failed 28 29// Does this backend actually hide the ORIGIN from the DESTINATION endpoint? 30// 1 = yes (safe to carry private-category external enrichment); 0 = no (proxy/endpoint still sees IP+timing). 31// The guard's policy gate treats 0 as "private items stay DENY-by-default over this backend". 32func anon_is_anonymizing(backend: i64) -> i64 { 33 if backend == ANON_TOR { return 1 } // real anonymity -- but ANON_TOR is still NOTIMPL, so unreachable today 34 return 0 // DIRECT and bare SOCKS5 do NOT anonymize -- stated honestly 35} 36 37// Human-readable backend name for the guard's audit ledger (rule 18: log WHAT carried the exposure). 38func anon_backend_name(backend: i64) -> *u8 { 39 if backend == ANON_DIRECT { return "direct" as *u8 } 40 if backend == ANON_SOCKS5 { return "socks5" as *u8 } 41 if backend == ANON_TOR { return "tor" as *u8 } 42 return "unknown" as *u8 43} 44 45// Direct TCP connect to a caller-supplied IPv4 (4 bytes) + port. NO name resolution (no local DNS leak), 46// NO anonymity. Provided so the guard can reach an ALLOWLISTED, hash-addressed endpoint by IP. 47func anon_connect_direct(ip: *u8, port: i64) -> i64 { 48 let fd: i64 = sys_socket(2, 1, 0) 49 if fd < 0 { return ANON_E_SOCKET } 50 let sa: *u8 = sys_mmap(16) 51 sa[0] = 2 as u8; sa[1] = 0 as u8 52 sa[2] = ((port >> 8) & 0xff) as u8; sa[3] = (port & 0xff) as u8 53 sa[4] = ip[0]; sa[5] = ip[1]; sa[6] = ip[2]; sa[7] = ip[3] 54 var z: i64 = 8; while z < 16 { sa[z] = 0 as u8; z = z + 1 } 55 if nx_connect_bounded(fd, sa, 16, NX_CONN_DEFAULT_MS) != 0 { sys_close(fd); return ANON_E_SOCKET } 56 return fd 57} 58 59// THE INTERFACE the guard calls. Open a stream to (host,hlen,port) via `backend`, routing through 60// (route_ip, route_port) when the backend needs a relay. Returns a stream fd (>= 0) or a negative error. 61// The returned fd is a plain byte stream: use anon_send / anon_recv / anon_close. 62// ANON_SOCKS5 -> host/hlen/port name the TARGET; route_ip/route_port name the SOCKS proxy. 63// ANON_DIRECT -> route_ip/route_port name the TARGET by IP (host/hlen ignored; no DNS). 64// ANON_TOR -> ANON_E_NOTIMPL (roadmap; never a silent fake). 65func anon_connect(backend: i64, route_ip: *u8, route_port: i64, host: *u8, hlen: i64, port: i64) -> i64 { 66 if backend == ANON_SOCKS5 { return s5_connect(route_ip, route_port, host, hlen, port) } 67 if backend == ANON_DIRECT { return anon_connect_direct(route_ip, route_port) } 68 if backend == ANON_TOR { return ANON_E_NOTIMPL } 69 return ANON_E_BACKEND 70} 71 72// Thin stream ops -- the guard uses THESE, not raw syscalls, so a future backend can frame / pad / mux 73// transparently under the same interface. Today they pass straight through to the socket. 74func anon_send(fd: i64, buf: *u8, n: i64) -> i64 { return sys_write(fd, buf, n) } 75func anon_recv(fd: i64, buf: *u8, cap: i64) -> i64 { return sys_read(fd, buf, cap) } 76func anon_close(fd: i64) -> i64 { return sys_close(fd) }