code wiki / _hdl_build / nx_site_dispatch.nx
`nx_site_dispatch.nx` source

1// nx_site_dispatch.nx -- the RECONCILED sites daemon's BRAIN: the complete, PURE, DATA-DRIVEN per-request
2// decision that REPLACES the hardcoded if-cascade + the hardcoded cert + the hardcoded vhost list. Composes the
3// three gated cores: cert = cr_match(SNI host) [nx_cert_registry] ; if an app ROUTE matches -> PROXY(port,mode)
4// [nx_route_table] ; else if the host is a known VHOST -> SERVE_STATIC(docroot) ; else -> 404. NO hardcoded
5// routes/certs/hosts -- all three are DATA TABLES (proxy_routes.conf / certs_generated.conf / sites.conf, all
6// emitted by nx_domain_forge). The TLS/socket transport (io) is a thin shell over THIS. Operator: "fix all the
7// hardcoding ... s-class exceed ... append a domain and the builders emit it." license_tier: ORIGINAL
8import "nx_route_table.nx"
9import "nx_cert_registry.nx"
10
11const SD_PROXY: i64 = 0       // an app route matched -> reverse-proxy to (port, mode)
12const SD_STATIC: i64 = 1      // no app route, but the host is a provisioned vhost -> serve its docroot
13const SD_NOTFOUND: i64 = 2    // unknown host/path -> 404 (fail-closed; never a wrong backend)
14
15// vhost docroot lookup: EXACT host match over the vhost table (host<TAB>docroot rows). 1 + drbuf set, or 0.
16func sd_vhost(vt: *u8, n: i64, host: *u8, hn: i64, drbuf: *u8) -> i64 {
17    let offs: *i64 = sys_mmap(64) as *i64
18    let lens: *i64 = sys_mmap(64) as *i64
19    var cur: i64 = 0
20    while cur < n {
21        let le: i64 = cr_eol(vt, n, cur)
22        var ok_line: i64 = 1
23        if le <= cur { ok_line = 0 }
24        if ok_line == 1 { if (vt[cur] as i64) == 35 { ok_line = 0 } }
25        if ok_line == 1 {
26            let nf: i64 = cr_split(vt, cur, le, offs, lens, 8)
27            if nf >= 2 {
28                if cr_host_eq_ci(vt, offs[0], lens[0], host, hn) == 1 { cr_copyz(drbuf, vt, offs[1], lens[1]); return 1 }
29            }
30        }
31        cur = le + 1
32    }
33    return 0
34}
35
36// THE DISPATCH: data-driven decision for a request. Always fills chainbuf/keybuf with the SNI cert (if cr_match
37// finds one; else the caller uses its built-in default). Returns SD_PROXY (port_out/mode_out set), SD_STATIC
38// (drbuf set), or SD_NOTFOUND. This single function is what the whole hardcoded cascade becomes.
39func sd_dispatch(rt: *u8, rtn: i64, ct: *u8, ctn: i64, vt: *u8, vtn: i64, sni: *u8, shn: i64, host: *u8, hn: i64, path: *u8, pn: i64, port_out: *i64, mode_out: *i64, chainbuf: *u8, keybuf: *u8, drbuf: *u8) -> i64 {
40    cr_match(ct, ctn, sni, shn, chainbuf, keybuf)
41    if rt_match(rt, rtn, host, hn, path, pn, port_out, mode_out) == 1 { return SD_PROXY }
42    if sd_vhost(vt, vtn, host, hn, drbuf) == 1 { return SD_STATIC }
43    return SD_NOTFOUND
44}
nx_site_dispatch.nx source

`nx_site_dispatch.nx` source
