nx_edge_repoint.nx source
↩ module page · 54 lines · 6327 B
1// nx_edge_repoint.nx -- SOVEREIGN edge repoint: make the sovereign edge (sites.elf :8443) win WAN :443.
2// Fixes the D008 :443 co-squat by adding a PORT-TRANSLATING DNAT on the home GL.iNet: wan:443/tcp ->
3// 192.168.8.227:8443, so WAN clients reach sites.elf directly instead of DSM's nginx (which 301->502s /search).
4// Drives the router over OUR OWN sovereign SSH (nx_ssh_lib); reads the router password by ABSOLUTE path so it
5// runs correctly from any tools-daemon CWD. Reversible by construction: `off` deletes the added redirect.
6// list -> show firewall redirects (inspect the current :443 path BEFORE changing anything)
7// on -> add nishimap443: wan:443/tcp -> 192.168.8.227:8443 DNAT; commit; reload
8// off -> delete nishimap443; commit; reload (revert to the prior WAN :443 path)
9// Map is HARDCODED (443->8443) so the tool cannot be repurposed. license_tier: ORIGINAL
10import "nx_syscalls.nx"
11import "nx_ssh_lib.nx"
12const ER_MAGIC_8192: i64 = 8192
13
14const ER_PW: *u8 = "/volume1/ai/torrent/data/router.pw" as *u8
15const ER_ROUTER: i64 = (192 << 24) | (168 << 16) | (8 << 8) | 1 // 192.168.8.1 (GL.iNet LAN)
16
17func er_app(dst: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8) { dst[o]=s[i]; o=o+1; i=i+1 } return o }
18func er_streq(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8) { if a[i]!=b[i] { return 0 } i=i+1 } if b[i]!=(0 as u8) { return 0 } return 1 }
19
20func main(argc: i64, argv: *i64) -> i64 {
21 var verb: *u8 = "list" as *u8
22 if argc>1 { verb = argv[1] as *u8 }
23 ssh_puts("NX-EDGE-REPOINT verb=" as *u8); ssh_puts(verb); ssh_puts(" (GL.iNet 192.168.8.1 via sovereign SSH+uci)\n" as *u8)
24 let pwbox: *i64 = sys_mmap(16) as *i64
25 let pw: *u8 = sys_read_file(ER_PW, pwbox)
26 if (pw as i64) == 0 { ssh_puts(" cannot read router pw file\n" as *u8); sys_exit(3); return 3 }
27 var pwlen: i64 = pwbox[0]
28 while pwlen > 0 { if pw[pwlen-1] == 10 as u8 { pwlen = pwlen - 1 } else { if pw[pwlen-1] == 13 as u8 { pwlen = pwlen - 1 } else { break } } }
29 let st: *SshState = sys_mmap(SSH_STATE_BYTES) as *SshState
30 if ssh_open_session(st, ER_ROUTER) != 0 { ssh_puts(" SSH session FAILED (router :22 unreachable / KEX mismatch)\n" as *u8); sys_exit(5); return 5 }
31 if ssh_userauth_password(st, "root" as *u8, 4, pw, pwlen) != 1 { ssh_puts(" SSH auth FAILED (wrong router password?)\n" as *u8); sys_close(st.fd); sys_exit(6); return 6 }
32 ssh_puts(" SSH+auth OK -> running uci\n" as *u8)
33 let cmd: *u8 = sys_mmap(ER_MAGIC_8192); var o: i64=0; var handled: i64=0
34 if er_streq(verb, "list" as *u8) == 1 {
35 o = er_app(cmd, o, "echo ===REDIR0===; uci show firewall.@redirect[0]; echo ===REDIR1===; uci show firewall.@redirect[1]; echo ===REDIR2===; uci show firewall.@redirect[2]; echo ===DNS-DOMAIN===; uci show dhcp | grep -iE 'domain|address|rebind'; echo ===DNSMASQ-NISHI===; grep -rsi nishifamily /etc/hosts /etc/dnsmasq.conf /etc/dnsmasq.d /tmp/dnsmasq.d 2>/dev/null | head -20; echo ===ROUTER-PORTS===; netstat -tlnp 2>/dev/null | grep -E ':(443|80) '; echo ===REFLECTION===; uci show firewall | grep -i reflect; echo ===WANIP===; ifstatus wan 2>/dev/null | grep -m1 address" as *u8); handled=1 }
36 if er_streq(verb, "on" as *u8) == 1 {
37 o = er_app(cmd, o, "uci del_list dhcp.@dnsmasq[0].address='/nishifamily.com/192.168.8.240' 2>/dev/null; uci add_list dhcp.@dnsmasq[0].address='/nishifamily.com/75.28.18.94'; i=0; while [ $i -le 14 ]; do n=$(uci -q get dhcp.@domain[$i].name); if [ x$n = xnishifamily.com ]; then uci set dhcp.@domain[$i].ip=75.28.18.94; fi; if [ x$n = xwww.nishifamily.com ]; then uci set dhcp.@domain[$i].ip=75.28.18.94; fi; i=$((i+1)); done; uci commit dhcp; /etc/init.d/dnsmasq restart; echo NISHI_DNSFIX_ON_DONE; uci show dhcp | grep -i nishifamily" as *u8); handled=1 }
38 if er_streq(verb, "off" as *u8) == 1 {
39 o = er_app(cmd, o, "uci del_list dhcp.@dnsmasq[0].address='/nishifamily.com/75.28.18.94' 2>/dev/null; uci add_list dhcp.@dnsmasq[0].address='/nishifamily.com/192.168.8.240'; i=0; while [ $i -le 14 ]; do n=$(uci -q get dhcp.@domain[$i].name); if [ x$n = xnishifamily.com ]; then uci set dhcp.@domain[$i].ip=192.168.8.240; fi; if [ x$n = xwww.nishifamily.com ]; then uci set dhcp.@domain[$i].ip=192.168.8.240; fi; i=$((i+1)); done; uci commit dhcp; /etc/init.d/dnsmasq restart; echo NISHI_DNSFIX_OFF_DONE; uci show dhcp | grep -i nishifamily" as *u8); handled=1 }
40 if er_streq(verb, "fix443" as *u8) == 1 {
41 // DEFUSE THE STALE-IP LANDMINE (2026-08-01): every WAN forward still points at 192.168.8.227,
42 // an address memory marks STALE -- the public site survives only because the NAS happens to
43 // still hold it. Repoint all four to the documented estate host 192.168.8.240 (same box, same
44 // sovereign edge -- verified serving identically on both IPs before this verb was written),
45 // and enable NAT reflection on the web redirects so LAN hairpin becomes possible. Reversible
46 // by revert443. Values HARDCODED so the tool cannot be repurposed.
47 o = er_app(cmd, o, "uci set firewall.cfg163837.dest_ip='192.168.8.240'; uci set firewall.cfg163837.reflection='1'; uci set firewall.cfg153837.dest_ip='192.168.8.240'; uci set firewall.cfg153837.reflection='1'; uci set firewall.nishitcp.dest_ip='192.168.8.240'; uci set firewall.nishiudp.dest_ip='192.168.8.240'; uci commit firewall; /etc/init.d/firewall reload >/dev/null 2>&1; echo NISHI_FIX443_DONE; uci show firewall.cfg163837; uci show firewall.cfg153837; uci show firewall.nishitcp | grep dest_ip; uci show firewall.nishiudp | grep dest_ip" as *u8); handled=1 }
48 if er_streq(verb, "revert443" as *u8) == 1 {
49 o = er_app(cmd, o, "uci set firewall.cfg163837.dest_ip='192.168.8.227'; uci delete firewall.cfg163837.reflection 2>/dev/null; uci set firewall.cfg153837.dest_ip='192.168.8.227'; uci delete firewall.cfg153837.reflection 2>/dev/null; uci set firewall.nishitcp.dest_ip='192.168.8.227'; uci set firewall.nishiudp.dest_ip='192.168.8.227'; uci commit firewall; /etc/init.d/firewall reload >/dev/null 2>&1; echo NISHI_REVERT443_DONE; uci show firewall.cfg163837" as *u8); handled=1 }
50 if handled==0 { o = er_app(cmd, o, "echo verbs: list | on | off | fix443 | revert443" as *u8) }
51 ssh_exec(st, cmd, o)
52 sys_close(st.fd)
53 sys_exit(0); return 0
54}