nx_tls13_mtls_recv_cert.nx
buildroot/runtime/nx_tls13_mtls_recv_cert.nx
about
nx_tls13_mtls_recv_cert.nx -- R7: receive the client's Certificate record, EMPTY-cert aware.
When the server requests a client cert (CertReq) but the browser has none suitable, RFC 8446 ยง4.4.2 says it
MUST still send a Certificate message with an EMPTY certificate_list. The server MUST fold that empty
message into the transcript (or the client's Finished MAC won't verify) and continue -- this is exactly the
NEVER-LOCKOUT path that lets a non-cert browser complete the handshake and fall back to the header session.
On a real cert: decrypt + extract the leaf DER + present=1. Extracted from the run loop so the empty-cert
branch is GATED, not just compile-checked. license_tier: ORIGINAL expect_exit: 0
dependencies 6 imports · 1 importers
imports: nx_syscalls.nxnx_tls13.nxnx_tls13_record.nxnx_tls13_transcript.nxnx_tls13_server_session.nxnx_tls13_auth.nx
imported by: nx_tls13_server_session_run_mtls.nx
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 16 | const NX_MRC_REC_HEADER: i64 = 5 |
| 17 | const NX_MRC_REC_TAG: i64 = 16 |
functions
| 21 | func nx_tls13_mtls_recv_client_cert( |
| 57 | func mrc_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 58 | func mrc_row(name: *u8, ok: i64) -> i64 { if ok == 1 { mrc_w(" PASS " as *u8) } else { mrc_w(" FAIL " as *u8) } mrc_w(name); mrc_w("\n" as *u8); return ok } |
| 59 | func mrc_u24(b: *u8, o: i64, v: i64) -> i64 { b[o] = ((v >> 16) & 0xff) as u8; b[o+1] = ((v >> 8) & 0xff) as u8; b[o+2] = (v & 0xff) as u8; return o + 3 } called by 1: main |
| 61 | func mrc_seal(msg: *u8, msg_len: i64, key: *u8, iv: *u8, rec: *u8) -> i64 |
| 71 | func mrc_mksession(key: *u8, iv: *u8) -> *Tls13ServerSession |
| 78 | func main() -> i64 |