nx_tls12_client.nx
buildroot/runtime/nx_tls12_client.nx
about
nx_tls12_client.nx -- INCREMENT 2 of the sovereign TLS-1.2 client: COMPLETE the ECDHE-RSA-AES128-GCM-SHA256
handshake and prove it by DECRYPTING + VERIFYING the server's Finished (definitive: our key schedule matches the
peer's iff its Finished MAC verifies). Composes shipped primitives -- p256_ecdh_* (ECDHE), hmac_sha256 (the TLS
1.2 PRF P_SHA256), sha256_digest (transcript), nx_aes128_gcm_seal/open (record cipher). This is the keystone that
gets nx_gpu_ctl + Porkbun off curl (both hosts are TLS-1.2-only; our shipped stack is 1.3-only).
NOTE(security, INC2): cert-chain + ServerKeyExchange-signature validation are NOT yet wired (INC3 hardening) -- the
handshake completes and is confidential, but not yet authenticated against a MITM. Do NOT ship for auth'd traffic
until INC3 lands. license_tier: ORIGINAL expect_exit: 0
dependencies 19 imports · 0 importers
diagram shows first 10 each side; +9 more imports, +0 more importers in the complete lists below.
imports: nx_syscalls.nxnx_csprng.nxnx_https_url_for_fetch.nxnx_https_url_connect.nxnx_sha256.nxnx_p256_ecdh.nxnx_x509_trust_store.nxnx_trust_store_load_from_certdata.nxnx_tls13_client_validate_certificate.nxnx_x509.nxnx_u4096.nxnx_x509_pubkey_rsa_4096.nxnx_u2048.nxnx_x509_pubkey_rsa.nxnx_rsa_pkcs1_v1_5_sha512.nxnx_x509_verify_rsa_pkcs1_sha256.nxnx_x509_verify_rsa_pkcs1_sha256_4096.nxnx_hmac.nxnx_aes128_gcm.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 30 | const T12_MAGIC_1024: i64 = 1024 |
| 31 | const T12_MAGIC_16384: i64 = 16384 |
| 32 | const T12_MAGIC_2048: i64 = 2048 |
| 33 | const T12_MAGIC_65536: i64 = 65536 |
| 34 | const T12_MAGIC_4194304: i64 = 4194304 |
| 35 | const T12_MAGIC_4096: i64 = 4096 |
| 36 | const T12_MAGIC_1200: i64 = 1200 |
| 37 | const T12_MAGIC_1400: i64 = 1400 |
| 38 | const T12_MAGIC_131072: i64 = 131072 |
| 40 | const T12_HS: i64 = 22 |
| 41 | const T12_CCS: i64 = 20 |
| 42 | const T12_ALERT: i64 = 21 |
functions
| 44 | func t12_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } calls 1: sys_write |
| 45 | func t12_putn(v: i64) -> i64 |
| 51 | func t12_puthex(byte: i64) -> i64 { let hx: *u8="0123456789abcdef" as *u8; let o: *u8=sys_mmap(2); o[0]=hx[(byte>>4)&0xf] as u8; o[1]=hx[byte&0xf] as u8; sys_write(1,o,2); return 0 } |
| 53 | func t12_b1(d: *u8, o: i64, v: i64) -> i64 { d[o]=(v&0xff) as u8; return o+1 } called by 1: t12_client_hello |
| 54 | func t12_b2(d: *u8, o: i64, v: i64) -> i64 { d[o]=((v>>8)&0xff) as u8; d[o+1]=(v&0xff) as u8; return o+2 } called by 1: t12_client_hello |
| 55 | func t12_b3(d: *u8, o: i64, v: i64) -> i64 { d[o]=((v>>16)&0xff) as u8; d[o+1]=((v>>8)&0xff) as u8; d[o+2]=(v&0xff) as u8; return o+3 } called by 1: t12_client_hello |
| 56 | func t12_bytes(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64=0; while i<n { d[o+i]=s[i]; i=i+1 } return o+n } called by 1: t12_client_hello |
| 57 | func t12_strlen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } |
| 58 | func t12_readfile(path: *u8, out: *u8, cap: i64) -> i64 |
| 72 | func t12_u64be(d: *u8, o: i64, v: i64) -> i64 |
| 78 | func t12_write_all(fd: i64, buf: *u8, n: i64) -> i64 calls 1: sys_write |
| 86 | func t12_prf(secret: *u8, secret_len: i64, label: *u8, label_len: i64, seed: *u8, seed_len: i64, out: *u8, out_len: i64) -> i64 |
| 121 | func t12_client_hello(host: *u8, hlen: i64, cr_out: *u8, out: *u8) -> i64 |
| 147 | func t12_hdr_end(b: *u8, n: i64) -> i64 |
| 155 | func t12_lc(c: i64) -> i64 { if c >= 65 { if c <= 90 { return c + 32 } } return c } called by 1: t12_match_ci |
| 156 | func t12_match_ci(b: *u8, i: i64, n: i64, targ: *u8, tlen: i64) -> i64 |
| 163 | func t12_content_length(b: *u8, n: i64) -> i64 calls 1: t12_match_ci |
| 184 | func t12_dechunk(src: *u8, n: i64, start: i64, dst: *u8) -> i64 |
| 228 | func main(argc: i64, argv: *i64) -> i64 calls 1: sys_alarm |