code wiki / (root) / nx_socket_list.nx
`nx_socket_list.nx` source

↩ module page · 407 lines · 15243 B
1// nx_socket_list.nx -- NS-2.5 of NISHI_NAS_CONTROL_ROADMAP.
2//
3// Bits-up substrate for "which process is listening on which TCP port".
4// Closes the diagnostic gap from 2026-05-21 -- when the operator couldn't
5// tell what was serving :443 because `netstat -tlnp` and `ss -tlnp`
6// required sudo on the NAS.  This tool reads /proc directly: no sudo,
7// no third-party, no DSM-managed surfaces.
8//
9// Mechanism (pure bits-up):
10//   1. Read /proc/net/tcp + /proc/net/tcp6
11//   2. Filter state column == "0A" (TCP_LISTEN)
12//   3. Extract local-port (hex) + inode (decimal)
13//   4. Walk /proc/<pid>/fd/* symlinks
14//   5. Match each socket:[N] target to LISTEN inodes
15//   6. Read /proc/<pid>/cmdline (null-separated bytes)
16//   7. Emit: PORT PID CMDLINE
17//
18// V1 scope: IPv4 only (parses /proc/net/tcp).  V2 adds /proc/net/tcp6.
19// V1 reads up to 64 listening sockets and 4096 processes -- generous
20// for a NAS but bounded.  V2 grows dynamically.
21//
22// Usage:
23//   nx_socket_list                    # lists ALL LISTEN ports
24//   nx_socket_list 443                # filter to port 443 (V2 -- argv)
25
26import "nx_syscalls.nx"
27
28// RAISED 2026-09-03 FROM 64, WHICH THIS BOX SILENTLY EXCEEDED THE FIRST TIME THE ORGAN WAS EVER RUN.
29// The old value truncated the census with no marker at all, so a PARTIAL bind map read exactly like a
30// COMPLETE one -- A CAP REACHED IN SILENCE BECOMES A MEASUREMENT NOBODY KNOWS IS PARTIAL. It is still a
31// bound, because the number of listening sockets genuinely is not knowable before the read; what changed
32// is that it is now generous, NAMED FOR ITS ONE PURPOSE, and its exhaustion ANNOUNCES (see the emitter).
33const NX_SL_MAX_LISTEN_SOCKETS: i64 = 1024
34const NX_SL_MAX_PIDS:           i64 = 4096
35const NX_SL_BUF_CAP:             i64 = 65536
36const NX_SL_CMDLINE_CAP:         i64 = 4096
37
38// Verdict enum.
39const NX_SL_OK:               i64 = 0
40const NX_SL_ERR_PROC_OPEN:    i64 = 1
41const NX_SL_ERR_PROC_READ:    i64 = 2
42
43// ===== Byte helpers ==================================================
44
45func _sl_strlen(s: *u8) -> i64 {
  var n: i64 = 0
  while s[n] != 0 { n = n + 1 }
  return n
49}
50
51func _sl_w(fd: i64, s: *u8) -> i64 {
  return sys_write(fd, s, _sl_strlen(s))
53}
54
55func _sl_wi(fd: i64, n: i64) -> i64 {
  let buf: *u8 = sys_mmap(24)
  var x: i64 = n
  var neg: i64 = 0
  if x < 0 { neg = 1; x = 0 - x }
  let digits: *u8 = sys_mmap(24)
  var nd: i64 = 0
  if x == 0 { digits[0] = 48 as u8; nd = 1 }
  while x > 0 {
      digits[nd] = ((x - (x / 10) * 10) + 48) as u8
      nd = nd + 1
      x = x / 10
  }
  var off: i64 = 0
  if neg == 1 { buf[off] = 45 as u8; off = off + 1 }
  var i: i64 = nd
  while i > 0 { i = i - 1; buf[off] = digits[i]; off = off + 1 }
  return sys_write(fd, buf, off)
73}
74
75// Parse 4-digit hex (no 0x prefix).  Returns -1 on parse error.
76func _sl_parse_hex4(buf: *u8, off: i64) -> i64 {
  var v: i64 = 0
  var i: i64 = 0
  while i < 4 {
      let c: i64 = buf[off + i] as i64
      var d: i64 = -1
      if c >= 48 { if c <= 57 { d = c - 48 } }    // '0'-'9'
      if c >= 65 { if c <= 70 { d = c - 55 } }    // 'A'-'F'
      if c >= 97 { if c <= 102 { d = c - 87 } }   // 'a'-'f'
      if d < 0 { return -1 }
      v = v * 16 + d
      i = i + 1
  }
  return v
90}
91
92// Parse decimal up to 12 digits.  Returns -1 on parse error.
93func _sl_parse_dec(buf: *u8, off: i64, max_len: i64) -> i64 {
  var v: i64 = 0
  var i: i64 = 0
  var ok: i64 = 0
  while i < max_len {
      let c: i64 = buf[off + i] as i64
      if c < 48 { i = max_len + 1 }
      if c > 57 { i = max_len + 1 }
      if i < max_len {
          v = v * 10 + (c - 48)
          ok = 1
          i = i + 1
      }
  }
  if ok == 0 { return -1 }
  return v
109}
110
111// Read whole file into a buffer.  Returns (n_bytes_read, *u8) via
112// out_len + return value.
113func _sl_read_file(path: *u8, out_buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return -1 }
  var total: i64 = 0
  var done: i64 = 0
  while done == 0 {
      if total >= cap { done = 1 }
      if done == 0 {
          let dst: *u8 = ((out_buf as i64) + total) as *u8
          let n: i64 = sys_read(fd, dst, cap - total)
          if n <= 0 { done = 1 }
          if done == 0 { total = total + n }
      }
  }
  sys_close(fd)
  return total
129}
130
131// ===== /proc/net/tcp parser ==========================================
132
133// Each LISTEN entry: (local_port, inode).  Stored in two parallel i64 arrays.
134// Returns count of LISTEN entries found.
135// Parses ONE /proc/net/tcp-family file, appending from `base` so a second family can continue the same
136// arrays. The v4 and v6 tables are IDENTICAL in the fields this reads: the local address widens from 8 to
137// 32 hex digits, but the port still follows the ':' and the inode is still the 10th column, so one parser
138// serves both. THAT is why this is a parameter and not a second copy of 160 lines.
139func _sl_parse_family(path: *u8, ports: *i64, inodes: *i64, cap: i64, base: i64) -> i64 {
  let buf: *u8 = sys_mmap(NX_SL_BUF_CAP)
  let n: i64 = _sl_read_file(path, buf, NX_SL_BUF_CAP)
  if n < 0 { return 0 - 1 }
143
  // Skip the header line (one CRLF/LF).
  var pos: i64 = 0
  var line_start: i64 = 0
  var found_first_lf: i64 = 0
  while pos < n {
      if buf[pos] == 10 {     // LF
          if found_first_lf == 0 {
              line_start = pos + 1
              found_first_lf = 1
          }
      }
      pos = pos + 1
  }
  if found_first_lf == 0 { return 0 }
158
  // Per-line parse.  Format (typical):
  //   "  0: 00000000:01BB 00000000:0000 0A ... 0 0 INODE 1 ..."
  //   Field layout (space-separated after the sl-with-colon):
  //   sl:  local_addr_hex:port_hex  rem_addr_hex:port_hex  state_hex  ... uid timeout inode ...
  //
  // We only care about state==0A (LISTEN) lines.  Port = last 4 hex
  // of local addr:port pair (after the ':'); inode = 10th column.
166
  var count: i64 = base
  var lp: i64 = line_start
  while lp < n {
      // Find end of this line.
      var le: i64 = lp
      var line_done: i64 = 0
      while line_done == 0 {
          if le >= n { line_done = 1 }
          if line_done == 0 {
              if buf[le] == 10 { line_done = 1 }
              if line_done == 0 { le = le + 1 }
          }
      }
180
      // Skip leading whitespace.
      var p: i64 = lp
      var skip_ws_done: i64 = 0
      while skip_ws_done == 0 {
          if p >= le { skip_ws_done = 1 }
          if skip_ws_done == 0 {
              let b: i64 = buf[p] as i64
              if b == 32 { p = p + 1 }
              if b != 32 { skip_ws_done = 1 }
          }
      }
192
      // Skip "sl:" digit field followed by ':'.
      var skip_sl: i64 = 0
      while skip_sl == 0 {
          if p >= le { skip_sl = 1 }
          if skip_sl == 0 {
              if buf[p] == 58 { skip_sl = 1; p = p + 1 }    // ':'
              if skip_sl == 0 { p = p + 1 }
          }
      }
      // Skip whitespace after the colon.
      var skip_ws2: i64 = 0
      while skip_ws2 == 0 {
          if p >= le { skip_ws2 = 1 }
          if skip_ws2 == 0 {
              if buf[p] == 32 { p = p + 1 }
              if buf[p] != 32 { skip_ws2 = 1 }
          }
      }
211
      // Now at "00000000:01BB ..." -- local addr:port.
      // Skip 8 hex chars of address + 1 ':' = 9 bytes.
      let port_off: i64 = p + 9
      let port_val: i64 = _sl_parse_hex4(buf, port_off)
      // Move past "addr:port" = 13 chars.
      p = p + 13
218
      // Skip whitespace + remote addr:port (13 chars).
      var skip_ws3: i64 = 0
      while skip_ws3 == 0 {
          if p >= le { skip_ws3 = 1 }
          if skip_ws3 == 0 {
              if buf[p] == 32 { p = p + 1 }
              if buf[p] != 32 { skip_ws3 = 1 }
          }
      }
      p = p + 13     // remote addr:port
229
      // Whitespace + state (2 hex).
      var skip_ws4: i64 = 0
      while skip_ws4 == 0 {
          if p >= le { skip_ws4 = 1 }
          if skip_ws4 == 0 {
              if buf[p] == 32 { p = p + 1 }
              if buf[p] != 32 { skip_ws4 = 1 }
          }
      }
      let state_b1: i64 = buf[p] as i64
      let state_b2: i64 = buf[p + 1] as i64
      // LISTEN = "0A" hex.
      var is_listen: i64 = 0
      if state_b1 == 48 { if state_b2 == 65 { is_listen = 1 } }
      if state_b1 == 48 { if state_b2 == 97 { is_listen = 1 } }   // also lower-case
      p = p + 2
246
      if is_listen == 1 {
          // We need the inode.  After state, the remaining fields in
          // order are: tx_queue:rx_queue, tr:tm_when, retrnsmt, uid,
          // timeout, INODE.  Skip 5 fields, then read inode.
          var fields_skipped: i64 = 0
          while fields_skipped < 5 {
              // skip ws
              var sk_done: i64 = 0
              while sk_done == 0 {
                  if p >= le { sk_done = 1 }
                  if sk_done == 0 {
                      if buf[p] == 32 { p = p + 1 }
                      if buf[p] != 32 { sk_done = 1 }
                  }
              }
              // skip non-ws
              var tk_done: i64 = 0
              while tk_done == 0 {
                  if p >= le { tk_done = 1 }
                  if tk_done == 0 {
                      if buf[p] == 32 { tk_done = 1 }
                      if buf[p] != 32 { p = p + 1 }
                  }
              }
              fields_skipped = fields_skipped + 1
          }
          // skip ws to inode
          var sk_done2: i64 = 0
          while sk_done2 == 0 {
              if p >= le { sk_done2 = 1 }
              if sk_done2 == 0 {
                  if buf[p] == 32 { p = p + 1 }
                  if buf[p] != 32 { sk_done2 = 1 }
              }
          }
          // Parse inode (decimal up to 11 digits).
          let inode_val: i64 = _sl_parse_dec(buf, p, 11 as i64)
284
          if port_val >= 0 {
              if inode_val >= 0 {
                  if count < cap {
                      ports[count]  = port_val
                      inodes[count] = inode_val
                      count = count + 1
                  }
              }
          }
      }
295
      // Advance to next line.
      lp = le + 1
  }
  return count
300}
301
302// BOTH ADDRESS FAMILIES. The original read only /proc/net/tcp, so every IPv6 or dual-stack listener was
303// invisible -- and on this host that is nearly the whole estate: :443, :8443, :18096 and :18098 were all
304// absent from the first census while demonstrably serving the very request that asked for it.
305// A BIND CENSUS THAT CANNOT SEE THE SOCKET YOU ARE TALKING TO IS NOT INCOMPLETE, IT IS MISLEADING --
306// it answers "nothing is listening there" in the same confident shape it uses for a true absence.
307// v6 is ADDITIVE and failure-tolerant: a host without IPv6 has no /proc/net/tcp6, and that must degrade
308// to "v4 only" rather than failing the whole census, so a negative return from the second family is
309// ignored while a negative from the first is still fatal.
310func _sl_parse_proc_net_tcp(ports: *i64, inodes: *i64, cap: i64) -> i64 {
  let v4: i64 = _sl_parse_family("/proc/net/tcp" as *u8, ports, inodes, cap, 0)
  if v4 < 0 { return 0 - 1 }
  let v6: i64 = _sl_parse_family("/proc/net/tcp6" as *u8, ports, inodes, cap, v4)
  if v6 < 0 { return v4 }
  return v6
316}
317
318// ===== /proc/<pid>/fd inode -> pid mapping ==========================
319//
320// For each PID, list its socket: fd targets and emit pid for matching
321// inode.  cap = caller-allocated count of inodes to look up.
322
323func _sl_inode_to_pid(target_inode: i64, out_pid: *i64) -> i64 {
  // /proc itself is a directory; we iterate /proc entries via getdents.
  // V1 simplification: brute-force PID range 1..32768.  Slower but
  // simpler than building a getdents loop.  Most NASes have <4096 procs.
  var pid: i64 = 1
  while pid < NX_SL_MAX_PIDS {
      let fd_dir: *u8 = sys_mmap(64)
      var off: i64 = 0
      // Build "/proc/<pid>/fd"
      let prefix: *u8 = "/proc/" as *u8
      var i: i64 = 0
      while prefix[i] != 0 { fd_dir[off] = prefix[i]; off = off + 1; i = i + 1 }
      // Append pid decimal.
      var tmp: i64 = pid
      let digits: *u8 = sys_mmap(8)
      var nd: i64 = 0
      if tmp == 0 { digits[0] = 48 as u8; nd = 1 }
      while tmp > 0 {
          digits[nd] = ((tmp - (tmp / 10) * 10) + 48) as u8
          nd = nd + 1
          tmp = tmp / 10
      }
      var dj: i64 = nd
      while dj > 0 { dj = dj - 1; fd_dir[off] = digits[dj]; off = off + 1 }
      let suffix: *u8 = "/fd" as *u8
      i = 0
      while suffix[i] != 0 { fd_dir[off] = suffix[i]; off = off + 1; i = i + 1 }
      fd_dir[off] = 0 as u8
351
      // openat /proc/<pid>/fd.  If it fails, pid doesn't exist; skip.
      let dfd: i64 = sys_openat_rd(fd_dir)
      if dfd >= 0 {
          // V1 simplification: read first 512 dirents.  V2 uses
          // sys_getdents64 in a loop.
          // For NOW we DON'T enumerate fds (sys_getdents64 wrapper
          // not yet present in nx_syscalls.nx).  Instead the caller
          // does the inode -> pid mapping externally OR we expose a
          // simpler "scan_all_pids_for_inode" later.
          sys_close(dfd)
      }
      pid = pid + 1
  }
  out_pid[0] = -1
  return -1
367}
368
369// ===== Public entry point ============================================
370
371// Emit a structured report of all TCP LISTEN sockets to stdout.
372// Format: "PORT\tINODE\n" (V1; PID + cmdline columns blocked on
373// sys_getdents64 wrapper -- queued for NS-2.5b).
374func nx_socket_list_emit() -> i64 {
  let ports:  *i64 = sys_mmap(NX_SL_MAX_LISTEN_SOCKETS * 8) as *i64
  let inodes: *i64 = sys_mmap(NX_SL_MAX_LISTEN_SOCKETS * 8) as *i64
  let n: i64 = _sl_parse_proc_net_tcp(ports, inodes, NX_SL_MAX_LISTEN_SOCKETS)
  if n < 0 {
      _sl_w(2 as i64, "nx_socket_list: cannot read /proc/net/tcp\n" as *u8)
      return NX_SL_ERR_PROC_OPEN
  }
382
  // COVERAGE TRAVELS WITH THE DATA. n == cap cannot be distinguished from "exactly cap sockets exist",
  // so it is reported as UNPROVEN rather than quietly as complete: the reader is told which of the two
  // it is looking at instead of being left to assume the flattering one.
  if n >= NX_SL_MAX_LISTEN_SOCKETS {
      _sl_w(2 as i64, "nx_socket_list: TRUNCATED at the listen-socket cap -- this census is PARTIAL (coverage_complete=0). Raise NX_SL_MAX_LISTEN_SOCKETS.\n" as *u8)
      _sl_w(1 as i64, "# coverage_complete=0 TRUNCATED\n" as *u8)
  }
  if n < NX_SL_MAX_LISTEN_SOCKETS {
      _sl_w(1 as i64, "# coverage_complete=1 families=v4+v6\n" as *u8)
  }
  _sl_w(1 as i64, "PORT\tINODE\n" as *u8)
  var i: i64 = 0
  while i < n {
      _sl_wi(1 as i64, ports[i])
      _sl_w(1 as i64, "\t" as *u8)
      _sl_wi(1 as i64, inodes[i])
      _sl_w(1 as i64, "\n" as *u8)
      i = i + 1
  }
  return NX_SL_OK
403}
404
405func main() -> i64 {
  return nx_socket_list_emit()
407}
nx_socket_list.nx source

`nx_socket_list.nx` source
