code wiki / (root) / nx_tls13.nx

nx_tls13.nx

buildroot/runtime/nx_tls13.nx

8599 B215 linesdepth 0pulls 0 transitivereach 643 importersview sourcekind librarytopic tls13
docsdependenciesstructsconstsfunctions

about

tls13.nx -- TLS 1.3 (RFC 8446) record-layer constants + framing. This is the skeleton of the TLS 1.3 implementation, not the full state machine. Ships: - ContentType + HandshakeType enum constants - ExtensionType enum constants - Version constants - Record-layer struct definitions + byte-level parse / emit What it does NOT ship (follow-up): - ClientHello / ServerHello / EncryptedExtensions / Finished state-machine driver - HKDF-based key-schedule ordering - 0-RTT / session resumption - Full extension parsing (SNI, ALPN, signature_algorithms, etc.) Pair with AEAD (chacha20-poly1305 shipped; AES-256-GCM pending) + HMAC + HKDF + X25519 + Ed25519 + X.509 primitives that are all already in-tree. References: RFC 8446 (TLS 1.3) -- primary specification RFC 9001 (QUIC TLS) -- alternate framing; outside this file's scope RFC 9578 (X25519Kyber768Draft00) -- PQ hybrid; tls13_extension constants prepared for it license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/ietf/rfc_8446

dependencies 0 imports · 83 importers

nx_tls13.nx nx_dev_api_build_probe.nx nx_edge_daemon.nx nx_edge_serve_static_test.nx nx_h2_frame.nx nx_https_get_complete.nx nx_https_get_happy_test.nx nx_https_get_stream.nx nx_https_ka_probe.nx nx_https_loopback_test.nx nx_https_post_complete.nx

diagram shows first 10 each side; +0 more imports, +73 more importers in the complete lists below.

imports: none

imported by: nx_dev_api_build_probe.nxnx_edge_daemon.nxnx_edge_serve_static_test.nxnx_h2_frame.nxnx_https_get_complete.nxnx_https_get_happy_test.nxnx_https_get_stream.nxnx_https_ka_probe.nxnx_https_loopback_test.nxnx_https_post_complete.nxnx_login_e2e_probe.nxnx_mcp_call.nxnx_mgmt_client.nxnx_mtls_loopback_probe.nxnx_p256_keyshare_test.nxnx_pages_https_daemon.nxnx_porkbun_ping_probe.nxnx_research_ka.nxnx_sovgit_push.nxnx_tls13_alpn_test.nxnx_tls13_app_send_fd.nxnx_tls13_auth.nxnx_tls13_auth_test.nxnx_tls13_ch_adversarial_test.nxnx_tls13_client.nxnx_tls13_client_h2run.nxnx_tls13_client_session.nxnx_tls13_client_session_emit_finished.nxnx_tls13_client_session_emit_finished_test.nxnx_tls13_client_session_recv_hs_test.nxnx_tls13_client_session_recv_sh.nxnx_tls13_client_session_recv_sh_test.nxnx_tls13_client_session_run.nxnx_tls13_client_session_test.nxnx_tls13_client_test.nxnx_tls13_emit_certificate_request.nxnx_tls13_ext.nxnx_tls13_ext_test.nxnx_tls13_full_tcp_test.nxnx_tls13_handshake_io.nxnx_tls13_handshake_tcp_test.nxnx_tls13_hello.nxnx_tls13_hello_test.nxnx_tls13_hrr_test.nxnx_tls13_io.nxnx_tls13_loopback_test.nxnx_tls13_mtls_finished.nxnx_tls13_mtls_loopback_test.nxnx_tls13_mtls_recv_cert.nxnx_tls13_p256_loopback_test.nxnx_tls13_read_record_from_fd_loopback_test.nxnx_tls13_server.nxnx_tls13_server_full_handshake_test.nxnx_tls13_server_recv_client_cert.nxnx_tls13_server_recv_client_cv.nxnx_tls13_server_session.nxnx_tls13_server_session_app_data.nxnx_tls13_server_session_app_data_test.nxnx_tls13_server_session_derive_hs.nxnx_tls13_server_session_derive_hs_test.nxnx_tls13_server_session_derive_traffic.nxnx_tls13_server_session_derive_traffic_test.nxnx_tls13_server_session_emit_certificate.nxnx_tls13_server_session_emit_certificate_test.nxnx_tls13_server_session_emit_certreq.nxnx_tls13_server_session_emit_cv.nxnx_tls13_server_session_emit_cv_test.nxnx_tls13_server_session_emit_ee.nxnx_tls13_server_session_emit_ee_alpn.nxnx_tls13_server_session_emit_ee_test.nxnx_tls13_server_session_emit_hrr.nxnx_tls13_server_session_emit_sf.nxnx_tls13_server_session_emit_sf_test.nxnx_tls13_server_session_emit_sh.nxnx_tls13_server_session_emit_sh_test.nxnx_tls13_server_session_recv_cf.nxnx_tls13_server_session_recv_cf_test.nxnx_tls13_server_session_recv_ch.nxnx_tls13_server_session_recv_ch_test.nxnx_tls13_server_session_run.nxnx_tls13_server_session_run_h2.nxnx_tls13_server_session_run_mtls.nxnx_tls13_sh_probe_test.nx

structs

none

consts

74const TLS_LEGACY_VERSION: i64 = 0x0303 // TLS 1.2 wire value
75const TLS_13_VERSION: i64 = 0x0304 // "real" TLS 1.3 advertised via extension
79const CT_INVALID: i64 = 0
80const CT_CHANGE_CIPHER_SPEC: i64 = 20
81const CT_ALERT: i64 = 21
82const CT_HANDSHAKE: i64 = 22
83const CT_APPLICATION_DATA: i64 = 23
84const CT_HEARTBEAT: i64 = 24
88const HT_CLIENT_HELLO: i64 = 1
89const HT_SERVER_HELLO: i64 = 2
90const HT_NEW_SESSION_TICKET: i64 = 4
91const HT_END_OF_EARLY_DATA: i64 = 5
92const HT_ENCRYPTED_EXTENSIONS: i64 = 8
93const HT_CERTIFICATE: i64 = 11
94const HT_CERTIFICATE_REQUEST: i64 = 13
95const HT_CERTIFICATE_VERIFY: i64 = 15
96const HT_FINISHED: i64 = 20
97const HT_KEY_UPDATE: i64 = 24
98const HT_MESSAGE_HASH: i64 = 254
102const EXT_SERVER_NAME: i64 = 0
103const EXT_MAX_FRAGMENT_LENGTH: i64 = 1
104const EXT_STATUS_REQUEST: i64 = 5
105const EXT_SUPPORTED_GROUPS: i64 = 10
106const EXT_SIGNATURE_ALGORITHMS: i64 = 13
107const EXT_USE_SRTP: i64 = 14
108const EXT_APPLICATION_LAYER_PROTOCOL: i64 = 16 // ALPN
109const EXT_SIGNED_CERTIFICATE_TIMESTAMP: i64 = 18
110const EXT_PADDING: i64 = 21
111const EXT_PRE_SHARED_KEY: i64 = 41
112const EXT_EARLY_DATA: i64 = 42
113const EXT_SUPPORTED_VERSIONS: i64 = 43
114const EXT_COOKIE: i64 = 44
115const EXT_PSK_KEY_EXCHANGE_MODES: i64 = 45
116const EXT_CERTIFICATE_AUTHORITIES: i64 = 47
117const EXT_OID_FILTERS: i64 = 48
118const EXT_POST_HANDSHAKE_AUTH: i64 = 49
119const EXT_SIGNATURE_ALGORITHMS_CERT: i64 = 50
120const EXT_KEY_SHARE: i64 = 51
127const NG_SECP256R1: i64 = 23
128const NG_SECP384R1: i64 = 24
129const NG_SECP521R1: i64 = 25
130const NG_X25519: i64 = 29
131const NG_X448: i64 = 30
133const NG_X25519_KYBER768_DRAFT00: i64 = 0x6399
137const SS_RSA_PKCS1_SHA256: i64 = 0x0401
138const SS_RSA_PKCS1_SHA384: i64 = 0x0501
139const SS_RSA_PKCS1_SHA512: i64 = 0x0601
140const SS_ECDSA_SECP256R1_SHA256: i64 = 0x0403
141const SS_ECDSA_SECP384R1_SHA384: i64 = 0x0503
142const SS_ED25519: i64 = 0x0807
143const SS_ED448: i64 = 0x0808
144const SS_RSA_PSS_RSAE_SHA256: i64 = 0x0804
145const SS_RSA_PSS_RSAE_SHA384: i64 = 0x0805
146const SS_RSA_PSS_RSAE_SHA512: i64 = 0x0806
157const TLS_MAX_RECORD: i64 = 16384 // 2^14 bytes TLSPlaintext cap

functions

162func tls_read_record_header(buf: *u8, buf_len: i64,
176func tls_write_record_header(buf: *u8,
188func tls_read_u24_be(buf: *u8, off: i64) -> i64
called by 3: h2_frame_read_headercr_check_hstls13_client_hello_parse
192func tls_write_u24_be(buf: *u8, off: i64, v: i64) -> i64
called by 7: h2_frame_write_headertls13_build_certificate_requesttls13_client_hello_emit2tls13_client_hello_emit2_h2onlytls13_server_emit_server_hellotls13_hello_retry_request_emit+1
201func tls_read_u16_be(buf: *u8, off: i64) -> i64
called by 18: tls13_parse_encrypted_extensionstls13_parse_certificate_chain_firsttls13_parse_certificate_verifytls13_parse_certificate_chain_alltls13_parse_certificate_requesttls13_certreq_extract_sigalgs+12
205func tls_write_u16_be(buf: *u8, off: i64, v: i64) -> i64
called by 20: h2_frame_write_settings_paramtls13_build_certificate_requesttls13_ext_emit_server_nametls13_ext_emit_supported_versions_tls13tls13_ext_emit_alpn_http11tls13_ext_emit_alpn_h2_http11+14