nx_tls13_server_recv_client_cert.nx
buildroot/runtime/nx_tls13_server_recv_client_cert.nx
about
nx_tls13_server_recv_client_cert.nx -- R7 rung 7b: the server receives the client's Certificate record.
In mTLS, after the server's Finished the client sends (encrypted under client_hs_traffic_key): Certificate,
CertificateVerify, Finished. This rung handles the first: AEAD-decrypt the client Certificate record (mirror
recv_cf's decrypt), confirm it is an HT_CERTIFICATE handshake message, parse out the client's leaf cert DER
(via the in-tree nx_tls13_auth parser), and feed the PLAINTEXT into the transcript -- so the subsequent
CertificateVerify can be checked against Transcript-Hash(... up to and including this Certificate) per
RFC 8446 ยง4.4.3. The CV verification itself is the proven R3 (Ed25519) / R5c (ECDSA) path; this rung only
receives + extracts + binds-to-transcript, so it stays purely in the TLS-record closure (no cert-verify
imports -> no closure clash). license_tier: ORIGINAL expect_exit: 0
dependencies 6 imports · 0 importers
imports: nx_syscalls.nxnx_tls13.nxnx_tls13_record.nxnx_tls13_transcript.nxnx_tls13_server_session.nxnx_tls13_auth.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 18 | const NX_RCC_REC_HEADER: i64 = 5 |
| 19 | const NX_RCC_REC_TAG: i64 = 16 |
functions
| 24 | func nx_tls13_server_recv_client_cert( |
| 78 | func rcc_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 79 | func rcc_row(name: *u8, ok: i64) -> i64 { if ok == 1 { rcc_w(" PASS " as *u8) } else { rcc_w(" FAIL " as *u8) } rcc_w(name); rcc_w("\n" as *u8); return ok } |
| 80 | func rcc_u24(b: *u8, o: i64, v: i64) -> i64 { b[o] = ((v >> 16) & 0xff) as u8; b[o+1] = ((v >> 8) & 0xff) as u8; b[o+2] = (v & 0xff) as u8; return o + 3 } called by 1: main |
| 82 | func main() -> i64 |