code wiki / (root) / nx_tls13_emit_certificate_request.nx

nx_tls13_emit_certificate_request.nx

buildroot/runtime/nx_tls13_emit_certificate_request.nx

9192 B193 linesdepth 2pulls 3 transitivereach 6 importersview sourcekind tooltopic tls13

docs dependencies structs consts functions

about

nx_tls13_emit_certificate_request.nx -- TLS 1.3 CertificateRequest (RFC 8446 §4.3.2) emit + parse. mTLS rung R2 of the NO-COOKIE session carrier (operator 2026-06-22: "we use opaque ... not cookies"). The sovereign TLS 1.3 server is server-auth-only today; to authenticate the BROWSER at the TLS layer (so a top-level navigation carries identity with zero cookie/header/JS) the server must REQUEST a client cert. This file is the pure message PRIMITIVE -- bytes in / bytes out, no socket, no AEAD, no session -- so it is gated in-process (sovereignty exemplar). R3 composes the builder into the live server run loop (AEAD-encrypt after EncryptedExtensions + transcript) and adds receive+verify of the client's response. CertificateRequest (RFC 8446 §4.3.2), inside the Handshake wrapper (msg_type=13 + u24 len): opaque certificate_request_context<0..2^8-1> // server-side: empty (1 len byte = 0x00) Extension extensions<2..2^16-1> // MUST contain signature_algorithms (ext type 13) signature_algorithms ext_data: u16 list_len + SignatureScheme[] (2 bytes each). Composes nx_tls13 (HT_/EXT_/SS_ constants + u16/u24 BE writers). license_tier: ORIGINAL expect_exit: 0

dependencies 2 imports · 3 importers

imports: nx_syscalls.nxnx_tls13.nx

imported by: nx_mtls_loopback_probe.nxnx_tls13_mtls_loopback_test.nxnx_tls13_server_session_emit_certreq.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

19	const NX_CR_OK: i64 = 0
20	const NX_CR_BAD_INPUT: i64 = 1
21	const NX_CR_TRUNCATED: i64 = 2
22	const NX_CR_MAX_SCHEMES: i64 = 16

functions

25	func cr_check_hs(buf: *u8, n: i64, expected_type: i64) -> i64 called by 1: tls13_parse_certificate_request calls 1: tls_read_u24_be
35	func tls13_build_certificate_request(out: u8, cap: i64, schemes: i64, n_schemes: i64) -> i64 called by 4: main main main nx_tls13_server_session_emit_certreq calls 2: tls_write_u24_be tls_write_u16_be
67	func tls13_parse_certificate_request(buf: *u8, n: i64, called by 2: main main calls 2: cr_check_hs tls_read_u16_be
91	func tls13_certreq_extract_sigalgs(buf: u8, exts_off: i64, exts_len: i64, out_schemes: i64, max: i64) -> i64 called by 2: main main calls 1: tls_read_u16_be
118	func cr_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } called by 2: cr_row main calls 1: sys_write
119	func cr_row(name: u8, ok: i64) -> i64 { if ok == 1 { cr_w(" PASS " as u8) } else { cr_w(" FAIL " as u8) } cr_w(name); cr_w("\n" as u8); return ok } called by 1: main calls 1: cr_w
121	func main() -> i64 calls 7: cr_w sys_mmap tls13_build_certificate_request cr_row tls13_parse_certificate_request tls13_certreq_extract_sigalgs+1