Networking

NURL reaches the network through a pure-POSIX socket layer in the C runtime. No external framework exists at that layer. Every primitive is dual-stack IPv4/IPv6. Each integrates with the fiber reactor for async I/O.

TCP, UDP, and DNS

stdlib/std/net.nu, stdlib/std/udp.nu, and stdlib/std/dns.nu hold these.

HTTP

stdlib/ext/http_server.nu and its neighbors (http_router.nu, http_middleware.nu, http_static.nu, http_multipart.nu) build a routing HTTP/1.1 server on top of the TCP layer. server_run_pool drives it on a thread pool. server_run_async drives the same handlers on fibers with no code changes. Routing, middleware, and the request parser are ordinary functions either way.

stdlib/ext/http.nu / http_cli.nu are the HTTP client side, and http2_client.nu / http2_server.nu / http2_frame.nu / http2_hpack.nu implement HTTP/2.

TLS

You can use TLS in two ways:

• At the socket layer, via tcp_listen_tls / tcp_connect_tls, which drive the pure-NURL stack below over a plain socket — the HTTP server stack picks this up transparently by swapping tcp_listen for tcp_listen_tls. ALPN (needed for HTTP/2) is negotiated on a listener made with tcp_listen_tls_with_alpn, and offered by a client through tcp_connect_tls_alpn. Per-hostname SNI certificates (tcp_tls_add_sni), mutual TLS client-certificate verification (tcp_tls_require_client_cert), live certificate reload (tcp_tls_reload), and dual classical + post-quantum certificate listeners (tcp_listen_tls_dual) are all built in. For STARTTLS upgrades on an existing TcpConn in safe code, use tcp_starttls.
• Pure-NURL TLS 1.3, in stdlib/std/tls.nu / tls_server.nu — a from-scratch handshake, record layer, and certificate verification with no OpenSSL and no FFI beyond the plain TCP socket. By default it negotiates hybrid post-quantum X25519MLKEM768 key exchange (falling back to X25519 or P-256) with ChaCha20-Poly1305 or AES-128/256-GCM, and supports both classical and ML-DSA (FIPS 204) certificates. It verifies against the system trust store by default. (tls_attach / tls_attach_verify operate on raw socket descriptors and are raw / unsafe-only; prefer tcp_starttls on TcpConn in safe code.)

Either way, a program that uses TLS links libc only.

QUIC and HTTP/3

stdlib/std/quic*.nu (quic.nu, quic_pkt.nu, quic_crypto.nu, quic_conn.nu, quic_loss.nu, quic_tls.nu) implements a pure-NURL QUIC v1 transport (RFC 9000, RFC 9001 TLS 1.3 key schedule and header protection, RFC 9002 loss detection and congestion control) over UDP sockets.

On top of QUIC, stdlib/ext/http3_client.nu, http3_server.nu, http3_frame.nu, and http3_qpack.nu provide HTTP/3 (RFC 9114) and QPACK header compression (RFC 9204), passing 49/49 h3spec conformance checks.

MQTT

stdlib/ext/mqtt.nu is a full MQTT 5.0 client over the TCP/TLS layer, with no dependency beyond the standard library (its TLS is the pure-NURL client stack):

$ `stdlib/ext/mqtt.nu`

@ main → i {
    : !MqttClient MqttErr r ( mqtt_connect
        `broker.example.com` 8883 `client-id` `user` `pass` )
    ?? r {
        T cl → {
            ( mqtt_subscribe cl `sensors/#` )
            ( mqtt_publish1 cl `sensors/temp` `21.4` )
            ( mqtt_disconnect cl )
            ^ 0
        }
        F e → { ( nurl_eprint ( mqtt_err_name e ) ) ^ 1 }
    }
}

It covers QoS 0/1/2 publishing with the full acknowledgment handshake, multi-topic subscribe, TLS by default (tls_verify on), and typed errors that separate transport faults from broker rejections. NURL does not yet support pipelined (multiple-in-flight) publishing. One packet is in flight at a time.

Next

• Cryptography — the primitives TLS and MQTT sit on.
• Concurrency — how these calls behave inside a fiber.
• For the exhaustive endpoint and flag list, see docs/NETWORKING.md.