nx_sites_telemetry.nx source
↩ module page · 125 lines · 5097 B
1// nx_sites_telemetry.nx -- the SENSE layer of the self-improving sites
2// system. Per-connection, append-only telemetry + access-path
3// classification (LAN vs internet).
4//
5// Design cardinals honored:
6// - ADDITIVE-ONLY (Cardinal 13): records are appended to a persistent
7// log and never rewritten/deleted. History is the training data
8// for the DECIDE + IMPROVE layers.
9// - GRACEFUL DEGRADATION (Cardinal 14): telemetry is fire-and-forget;
10// a logging failure must never crash a served request. All emit
11// paths no-op on a bad fd.
12// - SAME EXPERIENCE LAN+INTERNET: access class is OBSERVATIONAL here.
13// The serving path dispatches by Host/path only -- never by source
14// IP -- so both access paths receive byte-identical content. This
15// module only LABELS the connection; it does not branch content.
16// - CONSTANT MEMORY: the caller hoists the line buffer + holds one
17// append fd open for the daemon's lifetime (no per-connection mmap
18// / open-close in the hot path).
19//
20// Record line (text, greppable; the IMPROVE layer parses these):
21// ts=<us> acc=<L|N> vh=<id> hs=<us> by=<n> rc=<n>\n
22// acc: L=LAN (RFC1918/loopback), N=internet.
23// vh: vhost id (0=family/default, 1=andelinwest, 2=wiki).
24// hs: TLS handshake duration in microseconds.
25// by: response bytes served.
26// rc: 0 = handshake OK; negative = the failing -(NX_TLS13_SRUN_*).
27//
28// license_tier: ORIGINAL
29
30import "nx_syscalls.nx"
31
32// Classify a connected peer as LAN (1) or internet (0) from its
33// sockaddr. Handles both IPv4 (AF_INET=2) and IPv6 (AF_INET6=10) so
34// the LAN/internet bit is trustworthy on dual-stack networks.
35//
36// PRIVACY (no-tracking cardinal): this returns only a coarse 1-bit
37// classification. The raw address is NEVER stored or logged -- it is
38// read on the stack to compute the bit, then discarded.
39//
40// IPv4 sockaddr_in: family(2,LE) + port(2,BE) + IPv4(4,BE) -> addr[4..7].
41// IPv6 sockaddr_in6: family(2) + port(2) + flowinfo(4) + IPv6(16) -> addr[8..23].
42func nx_access_is_lan(addr: *u8) -> i64 {
43 let fam: i64 = (addr[0] as i64) & 0xff
44 if fam == 2 {
45 let a: i64 = (addr[4] as i64) & 0xff
46 let b: i64 = (addr[5] as i64) & 0xff
47 if a == 127 { return 1 } // 127.0.0.0/8 loopback
48 if a == 10 { return 1 } // 10.0.0.0/8
49 if a == 192 { if b == 168 { return 1 } } // 192.168.0.0/16
50 if a == 172 { if b >= 16 { if b <= 31 { return 1 } } } // 172.16.0.0/12
51 return 0
52 }
53 if fam == 10 {
54 let b0: i64 = (addr[8] as i64) & 0xff
55 let b1: i64 = (addr[9] as i64) & 0xff
56 // ::1 loopback -> addr[8..22] all zero and addr[23]==1
57 var allzero: i64 = 1
58 var i: i64 = 8
59 while i < 23 {
60 if ((addr[i] as i64) & 0xff) != 0 { allzero = 0; i = 23 } else { i = i + 1 }
61 }
62 if allzero == 1 { if ((addr[23] as i64) & 0xff) == 1 { return 1 } }
63 if b0 == 0xfe { if (b1 & 0xc0) == 0x80 { return 1 } } // fe80::/10 link-local
64 if (b0 & 0xfe) == 0xfc { return 1 } // fc00::/7 unique-local
65 return 0
66 }
67 return 0
68}
69
70// Write decimal (with leading '-' for negatives) at buf+off. No
71// allocation -- safe to call per-connection. Returns the new offset.
72func _tel_dec(buf: *u8, off: i64, v: i64) -> i64 {
73 var x: i64 = v
74 var o: i64 = off
75 if x < 0 { buf[o] = 0x2d as u8; o = o + 1; x = 0 - x }
76 var nd: i64 = 1
77 var t: i64 = x
78 while t >= 10 { t = t / 10; nd = nd + 1 }
79 var i: i64 = nd - 1
80 while i >= 0 {
81 var d: i64 = x
82 var k: i64 = 0
83 while k < i { d = d / 10; k = k + 1 }
84 buf[o + (nd - 1 - i)] = (0x30 + (d % 10)) as u8
85 i = i - 1
86 }
87 return o + nd
88}
89
90// Copy a literal into buf+off. Returns the new offset.
91func _tel_lit(buf: *u8, off: i64, s: *u8, n: i64) -> i64 {
92 var i: i64 = 0
93 while i < n { buf[off + i] = s[i]; i = i + 1 }
94 return off + n
95}
96
97// Format + append one telemetry record. fd is the append-mode log fd
98// (open once for the daemon lifetime); buf is a caller-hoisted scratch
99// buffer (>= 128 bytes). No-op (returns 0) on a bad fd -- never
100// crashes the serving path.
101func nx_telemetry_emit(
102 fd: i64, buf: *u8,
103 ts_us: i64, acc_lan: i64, vhost_id: i64,
104 hs_us: i64, bytes: i64, hs_rc: i64
105) -> i64 {
106 if fd < 0 { return 0 }
107 var o: i64 = 0
108 o = _tel_lit(buf, o, "ts=" as *u8, 3); o = _tel_dec(buf, o, ts_us)
109 o = _tel_lit(buf, o, " acc=" as *u8, 5)
110 if acc_lan == 1 { buf[o] = 0x4c as u8 } else { buf[o] = 0x4e as u8 } // 'L' / 'N'
111 o = o + 1
112 o = _tel_lit(buf, o, " vh=" as *u8, 4); o = _tel_dec(buf, o, vhost_id)
113 o = _tel_lit(buf, o, " hs=" as *u8, 4); o = _tel_dec(buf, o, hs_us)
114 o = _tel_lit(buf, o, " by=" as *u8, 4); o = _tel_dec(buf, o, bytes)
115 var rc: i64 = hs_rc
116 if rc > 0 { rc = 0 }
117 o = _tel_lit(buf, o, " rc=" as *u8, 4); o = _tel_dec(buf, o, rc)
118 buf[o] = 0x0a as u8; o = o + 1
119 sys_write(fd, buf, o)
120 return o
121}
122
123func main() -> i64 {
124 return 0
125}