nx_tls13_chrome_session.nx
buildroot/runtime/nx_tls13_chrome_session.nx
about
nx_tls13_chrome_session.nx -- R2f-A LIVE wiring: a TLS-1.3 client session that sends the Chrome-JA3 ClientHello
(nx_tls13_chrome_hello) so anti-bot CDNs classify us as a browser and complete the handshake. ADDITIVE (Cardinal
19): NEW functions only; the shared nx_tls13_client_session_run + emit_ch are byte-identical (fleet untouched).
run_chrome is a copy of nx_tls13_client_session_run with ONLY the ClientHello emit swapped + one robustness fix
(clamp the SH transcript feed to the parsed ServerHello message length).
LIVE STATUS (2026-07-03): PROVEN end-to-end -- nhentai.net (HTTP 200), wikipedia (301), example.com (200),
rfc-editor.org (200, 180KB body), and **i.nhentai.net image CDN = HANDSHAKE-OK**. The Chrome-JA3 fingerprint
beats the Cloudflare/GitHub TLS wall that dropped our minimal hello (-3); the RSA-PSS CertificateVerify verifier
(nx_rsa_pss_sha256, wired into nx_tls13_client_verify_cv) completes the handshake with the RSA-cert servers that
dominate the web -- the CertificateVerify uses rsa_pss_rsae_sha256 (0x0804), which TLS 1.3 MANDATES for RSA certs
and which we previously fail-closed on. license_tier: ORIGINAL
dependencies 3 imports · 9 importers
imports: nx_tls13_client_session.nxnx_tls13_client_session_run.nxnx_tls13_chrome_hello.nx
imported by: nx_chrome_fetch_probe.nxnx_edge_probe.nxnx_hifigan_stream_fetch.nxnx_https_fetch_file.nxnx_https_fetch_follow.nxnx_https_fetch_lib.nxnx_https_get.nxnx_https_get_cli.nxnx_https_get_cli2.nx
structs
| none |
consts
| 16 | const K_MAGIC_1024: i64 = 1024 |
functions
| 19 | func nx_tls13_session_emit_ch_chrome(s: *Tls13ClientSession, sni: *u8, sni_len: i64, out_buf: *u8, out_cap: i64) -> i64 called by 1: nx_tls13_client_session_run_chrome calls 2: tls13_chrome_hello_emitnx_tls13_transcript_update |
| 30 | func nx_tls13_client_session_run_chrome(fd: i64, sni: *u8, sni_len: i64, client_random: *u8, x25519_priv: *u8, val_ctx: *TlsValidationContext) -> i64 |