tls13.nx
buildroot/runtime/tls13.nx
about
tls13.nx -- TLS 1.3 (RFC 8446) record-layer constants + framing.
This is the skeleton of the TLS 1.3 implementation, not the full
state machine. Ships:
- ContentType + HandshakeType enum constants
- ExtensionType enum constants
- Version constants
- Record-layer struct definitions + byte-level parse / emit
What it does NOT ship (follow-up):
- ClientHello / ServerHello / EncryptedExtensions / Finished
state-machine driver
- HKDF-based key-schedule ordering
- 0-RTT / session resumption
- Full extension parsing (SNI, ALPN, signature_algorithms, etc.)
Pair with AEAD (chacha20-poly1305 shipped; AES-256-GCM pending)
+ HMAC + HKDF + X25519 + Ed25519 + X.509 primitives that are all
already in-tree.
References:
RFC 8446 (TLS 1.3) -- primary specification
RFC 9001 (QUIC TLS) -- alternate framing; outside this file's scope
RFC 9578 (X25519Kyber768Draft00) -- PQ hybrid; tls13_extension
constants prepared for it
dependencies 1 imports · 0 importers
imports: syscalls.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 35 | const TLS_LEGACY_VERSION: i64 = 0x0303 // TLS 1.2 wire value |
| 36 | const TLS_13_VERSION: i64 = 0x0304 // "real" TLS 1.3 advertised via extension |
| 40 | const CT_INVALID: i64 = 0 |
| 41 | const CT_CHANGE_CIPHER_SPEC: i64 = 20 |
| 42 | const CT_ALERT: i64 = 21 |
| 43 | const CT_HANDSHAKE: i64 = 22 |
| 44 | const CT_APPLICATION_DATA: i64 = 23 |
| 45 | const CT_HEARTBEAT: i64 = 24 |
| 49 | const HT_CLIENT_HELLO: i64 = 1 |
| 50 | const HT_SERVER_HELLO: i64 = 2 |
| 51 | const HT_NEW_SESSION_TICKET: i64 = 4 |
| 52 | const HT_END_OF_EARLY_DATA: i64 = 5 |
| 53 | const HT_ENCRYPTED_EXTENSIONS: i64 = 8 |
| 54 | const HT_CERTIFICATE: i64 = 11 |
| 55 | const HT_CERTIFICATE_REQUEST: i64 = 13 |
| 56 | const HT_CERTIFICATE_VERIFY: i64 = 15 |
| 57 | const HT_FINISHED: i64 = 20 |
| 58 | const HT_KEY_UPDATE: i64 = 24 |
| 59 | const HT_MESSAGE_HASH: i64 = 254 |
| 63 | const EXT_SERVER_NAME: i64 = 0 |
| 64 | const EXT_MAX_FRAGMENT_LENGTH: i64 = 1 |
| 65 | const EXT_STATUS_REQUEST: i64 = 5 |
| 66 | const EXT_SUPPORTED_GROUPS: i64 = 10 |
| 67 | const EXT_SIGNATURE_ALGORITHMS: i64 = 13 |
| 68 | const EXT_USE_SRTP: i64 = 14 |
| 69 | const EXT_APPLICATION_LAYER_PROTOCOL: i64 = 16 // ALPN |
| 70 | const EXT_SIGNED_CERTIFICATE_TIMESTAMP: i64 = 18 |
| 71 | const EXT_PADDING: i64 = 21 |
| 72 | const EXT_PRE_SHARED_KEY: i64 = 41 |
| 73 | const EXT_EARLY_DATA: i64 = 42 |
| 74 | const EXT_SUPPORTED_VERSIONS: i64 = 43 |
| 75 | const EXT_COOKIE: i64 = 44 |
| 76 | const EXT_PSK_KEY_EXCHANGE_MODES: i64 = 45 |
| 77 | const EXT_CERTIFICATE_AUTHORITIES: i64 = 47 |
| 78 | const EXT_OID_FILTERS: i64 = 48 |
| 79 | const EXT_POST_HANDSHAKE_AUTH: i64 = 49 |
| 80 | const EXT_SIGNATURE_ALGORITHMS_CERT: i64 = 50 |
| 81 | const EXT_KEY_SHARE: i64 = 51 |
| 88 | const NG_SECP256R1: i64 = 23 |
| 89 | const NG_SECP384R1: i64 = 24 |
| 90 | const NG_SECP521R1: i64 = 25 |
| 91 | const NG_X25519: i64 = 29 |
| 92 | const NG_X448: i64 = 30 |
| 94 | const NG_X25519_KYBER768_DRAFT00: i64 = 0x6399 |
| 98 | const SS_RSA_PKCS1_SHA256: i64 = 0x0401 |
| 99 | const SS_RSA_PKCS1_SHA384: i64 = 0x0501 |
| 100 | const SS_RSA_PKCS1_SHA512: i64 = 0x0601 |
| 101 | const SS_ECDSA_SECP256R1_SHA256: i64 = 0x0403 |
| 102 | const SS_ECDSA_SECP384R1_SHA384: i64 = 0x0503 |
| 103 | const SS_ED25519: i64 = 0x0807 |
| 104 | const SS_ED448: i64 = 0x0808 |
| 105 | const SS_RSA_PSS_RSAE_SHA256: i64 = 0x0804 |
| 106 | const SS_RSA_PSS_RSAE_SHA384: i64 = 0x0805 |
| 107 | const SS_RSA_PSS_RSAE_SHA512: i64 = 0x0806 |
| 118 | const TLS_MAX_RECORD: i64 = 16384 // 2^14 bytes TLSPlaintext cap |
functions
| 123 | func tls_read_record_header(buf: *u8, buf_len: i64,
called by 1: main |
| 137 | func tls_write_record_header(buf: *u8,
called by 1: main |
| 149 | func tls_read_u24_be(buf: *u8, off: i64) -> i64 { |
| 153 | func tls_write_u24_be(buf: *u8, off: i64, v: i64) -> i64 { |
| 162 | func tls_read_u16_be(buf: *u8, off: i64) -> i64 { |
| 166 | func tls_write_u16_be(buf: *u8, off: i64, v: i64) -> i64 { |
| 174 | func main() -> i64 { |