nx_tls13_chrome_hello.nx
buildroot/runtime/nx_tls13_chrome_hello.nx
about
nx_tls13_chrome_hello.nx -- emit a ClientHello whose JA3 fingerprint MATCHES a real Chrome (~v120), so
Cloudflare-class anti-bot CDNs (which drop our minimal 2-cipher/6-extension/no-GREASE hello at the ClientHello)
classify us as a browser and complete the handshake. This is R2f-A (the curl-impersonate/uTLS approach, native).
ADDITIVE (Cardinal 19): the fleet's live tls13_client_hello_emit2 is UNTOUCHED; only the manga-fetch path calls
this. Emitted INLINE (not via the shared ext emitters) for byte-exact JA3 control. GREASE (0x0a0a/0x1a1a) is
placed in ciphers[0] + a leading extension + supported_groups[0] + key_share[0] + supported_versions[0] (JA3
filters GREASE, so the specific value is irrelevant to the hash). Cipher order + extension order + curves +
point-formats reproduce Chrome's JA3 string exactly (gated in nx_tls13_chrome_hello_gate: our JA3 == the known
Chrome JA3). Cipher coverage: we advertise Chrome's full list incl 0x1302 (AES-256-GCM) -- with nx_aes256_gcm
now shipped we can complete whichever TLS-1.3 suite CF picks (0x1301/0x1302/0x1303). license_tier: ORIGINAL
dependencies 1 imports · 2 importers
imports: nx_syscalls.nx
imported by: nx_tls13_chrome_hello_gate.nxnx_tls13_chrome_session.nx
structs
| none |
consts
| 13 | const CH_GREASE_A: i64 = 0x0a0a |
| 14 | const CH_GREASE_B: i64 = 0x1a1a |
functions
| 16 | func ch_u16(out: *u8, o: i64, v: i64) -> i64 { out[o] = ((v >> 8) & 0xff) as u8; out[o+1] = (v & 0xff) as u8; return o + 2 } |
| 17 | func ch_u8(out: *u8, o: i64, v: i64) -> i64 { out[o] = (v & 0xff) as u8; return o + 1 } |
| 20 | func ch_exts(out: *u8, o0: i64, sni: *u8, sni_len: i64, pub32: *u8, p256_pub65: *u8) -> i64 |
| 78 | func tls13_chrome_hello_emit(random32: *u8, sni: *u8, sni_len: i64, pub32: *u8, p256_pub65: *u8, out: *u8, out_cap: i64) -> i64 |