api

ssl.ch

Declarations in ssl.ch

1 declarationstls

Declarations

Public only
tls#
Publicnamespace
namespace tls
============================================================================
write_u24#
function
func write_u24(val : u32, buf : *u8) : void
─── Utility Functions ──────────────────────────────────────────────────
read_u24#
function
func read_u24(buf : *u8) : u32
Read a 3-byte length (TLS uses 3-byte lengths)
write_u16_be#
function
func write_u16_be(val : u16, buf : *u8) : void
Write a 16-bit big-endian value
read_u16_be#
function
func read_u16_be(buf : *u8) : u16
Read a 16-bit big-endian value
read_u32_be#
function
func read_u32_be(buf : *u8) : u32
tls12_prf#
Publicfunction
func tls12_prf(secret : *u8, secret_len : size_t, label : *char, label_len : size_t, seed : *u8, seed_len : size_t, output : *u8, output_len : size_t) : void
============================================================================
tls12_prf_sha384#
Publicfunction
func tls12_prf_sha384(secret : *u8, secret_len : size_t, label : *char, label_len : size_t, seed : *u8, seed_len : size_t, output : *u8, output_len : size_t) : void
SHA-384 variant of the TLS 1.2 PRF for the AES_256_GCM_SHA384 family.
tls13_hkdf_expand_label#
function
func tls13_hkdf_expand_label(secret : *u8, secret_len : size_t, label : *char, label_len : size_t, context : *u8, context_len : size_t, output : *u8, output_len : size_t) : void
============================================================================
tls13_derive_secret#
Publicfunction
func tls13_derive_secret(secret : *u8, secret_len : size_t, label : *char, label_len : size_t, transcript_hash : *u8, hash_len : size_t, output : *u8, output_len : size_t) : void
TLS 1.3 Derive-Secret (RFC 8446)
tls13_is_sha384#
function
func tls13_is_sha384(ssl : *SSLContext) : bool
tls13_hash_len_for#
function
func tls13_hash_len_for(ssl : *SSLContext) : size_t
TLS13Transcript#
Publicstruct
struct TLS13Transcript { var h256 : Sha256Context var h384 : Sha512Context }
Dual-hash transcript: keeps both SHA-256 and SHA-384 running contexts so
tls13_transcript_init#
function
func tls13_transcript_init(t : *TLS13Transcript) : void
tls13_transcript_update#
function
func tls13_transcript_update(t : *TLS13Transcript, data : *u8, len : size_t) : void
tls13_transcript_finalize#
function
func tls13_transcript_finalize(t : *TLS13Transcript, out : *u8, use_sha384 : bool) : void
tls13_hkdf_extract#
function
func tls13_hkdf_extract(salt : *u8, salt_len : size_t, ikm : *u8, ikm_len : size_t, prk : *u8, hash_len : size_t) : void
============================================================================
tls13_derive_handshake_keys#
Publicfunction
func tls13_derive_handshake_keys(ssl : *SSLContext, shared_secret : *u8, shared_len : size_t, transcript_hash : *u8, psk : *u8, psk_len : size_t, hash_len : size_t, key_len : size_t, cipher_type : u8) : int
Derive handshake traffic keys from the ECDHE shared secret.
tls13_derive_application_keys#
Publicfunction
func tls13_derive_application_keys(ssl : *SSLContext, hs_hash : *u8, hash_len : size_t, res_hash : *u8, res_hash_len : size_t, key_len : size_t, cipher_type : u8) : int
TLS1.3 handshake passes null and delivers the contexts via the struct
tls13_update_send_keys#
Publicfunction
func tls13_update_send_keys(ssl : *SSLContext) : int
application_traffic_secret_N+1 = HKDF-Expand-Label(secret_N, "traffic upd", "", Hash.length)
tls13_update_recv_keys#
Publicfunction
func tls13_update_recv_keys(ssl : *SSLContext) : int
Update the recv side traffic keys (role-aware)
tls13_send_key_update#
Publicfunction
func tls13_send_key_update(ssl : *SSLContext, request_response : bool) : int
Send a KeyUpdate message (TLS 1.3)
tls12_derive_master_secret#
Publicfunction
func tls12_derive_master_secret(pre_master : *u8, pre_master_len : size_t, client_random : *u8, server_random : *u8, master_secret : *u8, use_sha384 : bool) : void
TLS 1.2 Key Derivation (RFC 5246)
tls12_derive_key_block#
Publicfunction
func tls12_derive_key_block(master_secret : *u8, server_random : *u8, client_random : *u8, key_block : *u8, key_block_len : size_t, use_sha384 : bool) : void
Derive key block from master secret (RFC 5246 Section 6.3)
tls12_key_block_size#
Publicfunction
func tls12_key_block_size(info : *CipherSuiteInfo) : size_t
Compute the key block size needed for a cipher suite
tls12_populate_transform#
Publicfunction
func tls12_populate_transform(tr : *Transform, info : *CipherSuiteInfo, key_block : *u8, key_block_len : size_t) : int
Split key block and populate Transform structure
tls12_compute_finished#
Publicfunction
func tls12_compute_finished(master_secret : *u8, is_client : bool, handshake_hash : *u8, hash_len : size_t, verify_data : *u8, use_sha384 : bool) : void
Finished Message Calculation (RFC 5246 Section 7.4.9)
tls12_encrypt_record#
Publicfunction
func tls12_encrypt_record(tr : *Transform, seq_num : *u8, content_type : u8, version_major : u8, version_minor : u8, input : *u8, input_len : size_t, output : *u8, out_max : size_t) : int
Encrypt a TLS record using the provided transform
tls12_decrypt_record#
Publicfunction
func tls12_decrypt_record(tr : *Transform, seq_num : *u8, content_type : u8, version_major : u8, version_minor : u8, input : *u8, input_len : size_t, output : *u8, out_max : size_t) : int
Decrypt a TLS record
ssl_incr_seq_num#
function
func ssl_incr_seq_num(seq : *u8) : void
- Inner content_type is in the last byte of the decrypted payload
tls13_build_nonce#
function
func tls13_build_nonce(static_iv : *u8, seq_num : *u8, nonce : *u8) : void
Build a TLS 1.3 nonce: static_iv (12 bytes) XOR (0x00000000 || seq_num)
tls13_encrypt_record#
Publicfunction
func tls13_encrypt_record(ssl : *SSLContext, content_type : u8, data : *u8, data_len : size_t, output : *u8, out_max : size_t) : int
Encrypt plaintext using TLS 1.3 AEAD record format.
tls13_decrypt_record#
Publicfunction
func tls13_decrypt_record(ssl : *SSLContext, input : *u8, input_len : size_t, output : *u8, out_max : size_t, inner_content_type : *u8) : int
input = encrypted_record (without the 5-byte outer header, which has already been read)
send_record#
function
func send_record(ssl : *SSLContext, content_type : u8, data : *u8, data_len : u16) : int
Send a TLS record
send_alert#
function
func send_alert(ssl : *SSLContext, level : u8, description : u8) : int
Send an alert record
send_handshake_msg#
function
func send_handshake_msg(ssl : *SSLContext, msg_type : u8, data : *u8, data_len : u32) : int
Send a handshake message
ssl_fetch_input#
function
func ssl_fetch_input(ssl : *SSLContext, min_len : size_t) : int
- Multiple records coalesced in a single TCP segment
ssl_read_record#
function
func ssl_read_record(ssl : *SSLContext) : int
Read the next complete record from the input buffer
ssl_consume_record#
Publicfunction
func ssl_consume_record(ssl : *SSLContext) : void
Consume (remove) the current record from the input buffer
read_record_header#
function
func read_record_header(ssl : *SSLContext, hdr : *u8) : int
Read a TLS record header (blocking) - maintains backward compatibility
read_record_payload#
function
func read_record_payload(ssl : *SSLContext, buf : *u8, len : i32) : int
Read record payload - copies from internal buffer to caller's buffer
build_client_hello#
function
func build_client_hello(ssl : *SSLContext, buf : *u8, buf_size : size_t) : int
============================================================================
ssl_send#
function
func ssl_send(ssl : *SSLContext, data : *u8, len : i32) : int
============================================================================
ssl_recv#
function
func ssl_recv(ssl : *SSLContext, buf : *u8, len : i32) : int
read_handshake_msg#
function
func read_handshake_msg(ssl : *SSLContext, hs_type : *u8, hs_len : *u32, hs_buf : *u8, buf_size : size_t) : int
============================================================================
ssl_hash_handshake_msg#
function
func ssl_hash_handshake_msg(hash_ctx : *Sha256Context, msg_type : u8, msg_len : u32, msg_body : *u8) : void
─── Helper: feed a handshake message into the transcript hash ───────
tls12_hash_handshake_msg_both#
function
func tls12_hash_handshake_msg_both(h256 : *Sha256Context, h384 : *Sha512Context, msg_type : u8, msg_len : u32, msg_body : *u8) : void
Dual-hash variant for TLS 1.2: keeps SHA-256 and SHA-384 transcripts in
x509_extract_rsa_pubkey#
Publicfunction
func x509_extract_rsa_pubkey(crt : *X509Cert, rsa : *RSAContext) : int
─── Extract RSA public key from parsed certificate ──────────────────
x509_extract_ecdsa_pubkey#
Publicfunction
func x509_extract_ecdsa_pubkey(crt : *X509Cert, ecdsa : *ECDSAContext) : int
─── Extract ECDSA Public Key from Parsed Certificate ───────────────
x509_verify_cert_ecdsa_signature#
Publicfunction
func x509_verify_cert_ecdsa_signature(crt : *X509Cert, issuer_ecdsa : *ECDSAContext) : int
─── Verify X.509 Certificate ECDSA Signature ───────────────────────
x509_verify_cert_signature#
Publicfunction
func x509_verify_cert_signature(crt : *X509Cert, issuer_rsa : *RSAContext) : int
─── Verify X.509 Certificate RSA Signature ──────────────────────────
x509_verify_hostname#
Publicfunction
func x509_verify_hostname(crt : *X509Cert, hostname : *char) : int
─── X.509 Hostname Verification ──────────────────────────────────────
parse_asn1_time#
function
func parse_asn1_time(time_str : *u8, max_len : size_t, year : *int, month : *int, day : *int, hour : *int, minute : *int, second : *int) : int
─── ASN1_TIME Parser ──────────────────────────────────────────────────
x509_check_date#
Publicfunction
func x509_check_date(crt : *X509Cert) : int
─── X.509 Date Validity Check ────────────────────────────────────────
x509_verify_sig_with_issuer#
function
func x509_verify_sig_with_issuer(cert : *X509Cert, issuer : *X509Cert) : int
─── Helper: verify cert signature with appropriate key type ──────────
x509_dn_equal#
function
func x509_dn_equal(a : *u8, a_len : size_t, b : *u8, b_len : size_t) : bool
─── DN helpers for chain building ────────────────────────────────────
x509_find_cert_by_subject#
function
func x509_find_cert_by_subject(chain : *X509Cert, issuer_raw : *u8, issuer_len : size_t) : *X509Cert
Walk a certificate chain (linked via `next`) looking for the first cert
x509_parse_server_cert_chain#
function
func x509_parse_server_cert_chain(data : *u8, data_len : size_t, tls13 : bool, out_head : **X509Cert) : int
the 4-byte handshake header), `data_len` is the body length.
x509_verify_chain#
Publicfunction
func x509_verify_chain(leaf : *X509Cert, trusted_ca : *X509Cert, hostname : *char) : int
trusted_ca: head of a linked list of trusted root CA certificates, or
parse_server_hello#
function
func parse_server_hello(ssl : *SSLContext, data : *u8, data_len : u32) : int
─── Parse ServerHello and extract key parameters ────────────────────
do_tls12_client_handshake#
function
func do_tls12_client_handshake(ssl : *SSLContext) : int
tls13_fill_psk_binder#
function
func tls13_fill_psk_binder(ssl : *SSLContext, ch_buf : *u8, ch_len : size_t, ch_hdr : *u8) : int
Compute and fill the PSK binder into the ClientHello buffer. Called after
do_tls13_client_handshake#
function
func do_tls13_client_handshake(ssl : *SSLContext) : int
tls_accept#
Publicfunction
func tls_accept(sock : Socket, cert : *X509Cert, priv_key : *void, cipher_suite : int) : *SSLContext
Performs the server-side TLS handshake.
load_system_ca_bundle#
Publicfunction
func load_system_ca_bundle() : *X509Cert
─── Auto CA Bundle Loading ───────────────────────────────────────────
ec_privkey_load_hex_file#
Publicfunction
func ec_privkey_load_hex_file(path : *char) : *ECDSAContext
─── EC Private Key Loading ──────────────────────────────────────────
ecdsa_context_free#
Publicfunction
func ecdsa_context_free(ctx : *ECDSAContext) : void
Free an ECDSA private-key context returned by ec_privkey_load_hex_file.
x509_crt_load_pem_file#
Publicfunction
func x509_crt_load_pem_file(path : *char) : *X509Cert
─── CA Trust Store ───────────────────────────────────────────────────
ssl_set_ca_chain#
Publicfunction
func ssl_set_ca_chain(conf : *SSLConfig, ca : *X509Cert) : void
Set the trusted CA chain for certificate verification
rsa_privkey_load_pem_file#
Publicfunction
func rsa_privkey_load_pem_file(path : *char) : *RSAContext
─── RSA Private Key PEM Loader ───────────────────────────────────────
parse_der_length#
function
func parse_der_length(data : *u8, pos : *size_t, data_len : size_t) : int
Parse DER length field. Returns the length value and advances pos.
parse_der_integer#
function
func parse_der_integer(data : *u8, pos : *size_t, data_len : size_t, out_data : **u8) : int
Parse DER INTEGER. Returns data pointer and length, advances pos.
x509_cert_alloc#
function
func x509_cert_alloc() : *X509Cert
Allocate and initialize a single X509Cert on the heap. malloc'd memory is
ssl_set_own_rsa_key#
Publicfunction
func ssl_set_own_rsa_key(conf : *SSLConfig, rsa_key : *RSAContext) : void
Set the server's own RSA private key for decrypting the pre-master secret
ssl_set_alpn_protocols#
Publicfunction
func ssl_set_alpn_protocols(conf : *SSLConfig, protocols : **char, count : u8) : void
Set ALPN protocols for negotiation
ssl_get_alpn_negotiated#
Publicfunction
func ssl_get_alpn_negotiated(ssl : *SSLContext) : *char
Get the negotiated ALPN protocol after handshake
ssl_config_init#
Publicfunction
func ssl_config_init(endpoint : int) : SSLConfig
Public API - Client Connection
ssl_init#
Publicfunction
func ssl_init(ssl : *SSLContext) : void
Initialize SSL context
ssl_apply_recv_timeout#
function
func ssl_apply_recv_timeout(ssl : *SSLContext) : void
Apply read timeout to the SSL socket (from config, or 5s default)
ssl_set_socket#
Publicfunction
func ssl_set_socket(ssl : *SSLContext, socket : Socket) : void
Set the socket for the SSL connection
ssl_set_hostname#
Publicfunction
func ssl_set_hostname(ssl : *SSLContext, hostname : *char) : void
Set the hostname for SNI and certificate verification
ssl_set_config#
Publicfunction
func ssl_set_config(ssl : *SSLContext, conf : *SSLConfig) : void
Configure the SSL context
build_server_hello#
function
func build_server_hello(ssl : *SSLContext, buf : *u8, buf_size : size_t) : int
─── Server-Side TLS 1.2 Handshake (Minimal) ─────────────────────────
do_tls12_server_handshake#
function
func do_tls12_server_handshake(ssl : *SSLContext) : int
do_tls13_server_handshake#
function
func do_tls13_server_handshake(ssl : *SSLContext) : int
============================================================================
ssl_handshake#
Publicfunction
func ssl_handshake(ssl : *SSLContext) : int
Perform the TLS handshake
ssl_process_new_session_ticket#
function
func ssl_process_new_session_ticket(ssl : *SSLContext, buf : *u8, len : size_t) : void
Process a single NewSessionTicket message (buf points at the handshake
ssl_handle_post_handshake#
function
func ssl_handle_post_handshake(ssl : *SSLContext, buf : *u8, msglen : i32) : int
Process post-handshake handshake messages in a decrypted record payload.
ssl_read#
Publicfunction
func ssl_read(ssl : *SSLContext, buf : *u8, len : i32) : int
Read application data
ssl_write#
Publicfunction
func ssl_write(ssl : *SSLContext, data : *u8, len : i32) : int
Write application data
ssl_close_notify#
Publicfunction
func ssl_close_notify(ssl : *SSLContext) : int
Close the SSL connection (send close_notify)
ssl_free#
Publicfunction
func ssl_free(ssl : *SSLContext) : void
Free SSL context resources (closes socket, frees handshake params)
tls_connect#
Publicfunction
func tls_connect(ssl : *SSLContext, host : *char, port : uint) : int
============================================================================
ssl_read_new_session_ticket#
Publicfunction
func ssl_read_new_session_ticket(ssl : *SSLContext) : int
Read NewSessionTicket post-handshake message
Chemical API Referencechemicallang.com  ·  GitHub