Types
Tls12CryptoInfoAesCcm128 {.packed.} = object info*: TlsCryptoInfo iv*: array[8, uint8] key*: array[16, uint8] salt*: array[4, uint8] recSeq*: array[8, uint8]
Tls12CryptoInfoAesGcm128 {.packed.} = object info*: TlsCryptoInfo iv*: array[8, uint8] key*: array[16, uint8] salt*: array[4, uint8] recSeq*: array[8, uint8]
Tls12CryptoInfoAesGcm256 {.packed.} = object info*: TlsCryptoInfo iv*: array[8, uint8] key*: array[32, uint8] salt*: array[4, uint8] recSeq*: array[8, uint8]
Tls12CryptoInfoAriaGcm128 {.packed.} = object info*: TlsCryptoInfo iv*: array[8, uint8] key*: array[16, uint8] salt*: array[4, uint8] recSeq*: array[8, uint8]
Tls12CryptoInfoAriaGcm256 {.packed.} = object info*: TlsCryptoInfo iv*: array[8, uint8] key*: array[32, uint8] salt*: array[4, uint8] recSeq*: array[8, uint8]
Tls12CryptoInfoChacha20Poly1305 {.packed.} = object info*: TlsCryptoInfo iv*: array[12, uint8] key*: array[32, uint8] salt*: array[0, uint8] recSeq*: array[8, uint8]
Tls12CryptoInfoSm4Ccm {.packed.} = object info*: TlsCryptoInfo iv*: array[8, uint8] key*: array[16, uint8] salt*: array[4, uint8] recSeq*: array[8, uint8]
Tls12CryptoInfoSm4Gcm {.packed.} = object info*: TlsCryptoInfo iv*: array[8, uint8] key*: array[16, uint8] salt*: array[4, uint8] recSeq*: array[8, uint8]
TlsCryptoInfo {.packed.} = object version*: uint16 cipherType*: uint16
- Corresponds to struct tls_crypto_info.
Consts
EKeyExpired = 127
- EKEYEXPIRED: read-after-KeyUpdate until the new RX key is installed (TLS 1.3). Not in Nim's posix, defined here for convenience.
IpProtoTcp = 6
- IPPROTO_TCP: level used to attach the TLS ULP (TCP_ULP).
SolTls = 282
- SOL_TLS socket level for setsockopt/getsockopt.
TcpUlp = 31
- TCP_ULP: attach a Upper Layer Protocol to a TCP socket.
Tls12Version = 0x00000303
Tls13Version = 0x00000304
TlsCipherAesCcm128 = 53
TlsCipherAesGcm128 = 51
TlsCipherAesGcm256 = 52
TlsCipherAriaGcm128 = 57
TlsCipherAriaGcm256 = 58
TlsCipherSm4Ccm = 56
TlsCipherSm4Gcm = 55
TlsRx = 2
- Move the receive (decrypt) path into the kernel.
TlsRxExpectNoPad = 4
- Attempt opportunistic zero-copy on receive.
TlsTx = 1
- Move the transmit (encrypt) path into the kernel.
TlsTxMaxPayloadLen = 5
- Cap the maximum plaintext size per record.
TlsTxZerocopyRo = 3
- TX zerocopy, read-only (sendfile only).
Procs
proc rawEnableUlp(fd: SocketHandle): cint {....raises: [], tags: [], forbids: [].}
- Attach the "tls" ULP: setsockopt(fd, IPPROTO_TCP, TCP_ULP, "tls"). Must be called on an established TCP socket before rawSetTx/rawSetRx. Returns 0 on success, -1 on error.
proc rawGetRx(fd: SocketHandle; buf: pointer; len: var SockLen): cint {. ...raises: [], tags: [], forbids: [].}
- Read back the installed RX crypto state (getsockopt(SOL_TLS, TLS_RX)). Fails (non-zero return) when no RX state is installed.
proc rawGetTx(fd: SocketHandle; buf: pointer; len: var SockLen): cint {. ...raises: [], tags: [], forbids: [].}
- Read back the installed TX crypto state (getsockopt(SOL_TLS, TLS_TX)). Fails (non-zero return) when no TX state is installed.
proc rawSetRx(fd: SocketHandle; cryptoInfo: pointer; infoLen: SockLen): cint {. ...raises: [], tags: [], forbids: [].}
- Install receive crypto state: setsockopt(fd, SOL_TLS, TLS_RX, ...). Same buffer contract as rawSetTx. Returns 0 on success, -1 on error.
proc rawSetRxExpectNoPad(fd: SocketHandle; enable: bool): cint {....raises: [], tags: [], forbids: [].}
- Hint the kernel to attempt opportunistic zero-copy on receive. The kernel takes a 4-byte flag (0/1) and requires TLS 1.3 with RX already configured — call after rawSetRx. Returns 0/-1.
proc rawSetTx(fd: SocketHandle; cryptoInfo: pointer; infoLen: SockLen): cint {. ...raises: [], tags: [], forbids: [].}
- Install transmit crypto state: setsockopt(fd, SOL_TLS, TLS_TX, ...). cryptoInfo must point at one of the Tls12CryptoInfo* structs and infoLen must be its size. Returns 0 on success, -1 on error.
proc rawSetTxMaxPayloadLen(fd: SocketHandle; maxLen: uint16): cint {....raises: [], tags: [], forbids: [].}
- Cap the maximum plaintext payload per TLS record (2-byte value, kernel-validated range, at most 16384). Fails with EBUSY while a record is open. Returns 0 on success, -1 on error.
proc rawSetTxZerocopyRo(fd: SocketHandle; enable: bool): cint {....raises: [], tags: [], forbids: [].}
- Toggle TX zerocopy (sendfile) mode. The kernel takes a 4-byte unsigned int flag (0/1). Returns 0 on success, -1 on error.