sceSslConnect verifies the server's chain under MBEDTLS_SSL_VERIFY_OPTIONAL and returns the first failure the connection's verify options select, with the SSL_ERROR_* codes KytyPS5 lists. The initial options are all five checks, so a connection whose title never sets them fails closed: with no CA loaded it returns SSL_ERROR_UNKNOWN_CA instead of throwing. The result is final for the connection: a failure sends close_notify, later sceSslConnect calls return the same code, and sceSslRead and sceSslWrite throw. A verify callback runs once after the handshake, outside the session lock, with the connection id, that code, handles to a copy of the peer chain that the context's certificate readers accept, the chain length and the user argument; a negative return fails the connect with SSL_ERROR_APPLICATION_VERIFICATION_CALLBACK_CHECK. The ALPN list set with sceSslSetAlpn is split on commas and offered, sceSslGetAlpnSelected returns the protocol the server chose, and the minimum version floors the handshake at TLS 1.2. A socket that would block returns SSL_ERROR_WANT_POLLIN or WANT_POLLOUT from connect, read and write and the next sceSslConnect resumes the handshake; the BIO maps a reset to MBEDTLS_ERR_NET_CONN_RESET, which returns SSL_ERROR_SOCKET_CLOSED, and tells a blocking socket's expired receive timeout, which returns SSL_ERROR_READ_TIMEOUT, apart from a non-blocking would-block. sceSslClose sends close_notify once and marks the connection closed. The debt entry records the default options and the situation-to-code choices as unverified and drops the title IDs.
Brings in main's connection verify options, minimum version, ALPN and
certificate readers. The conflicts in libSceSsl/Export.cpp and the
libSceSsl debt entry take the resolution from blawesom's rebase of this
pull request (blawesom/AnyPS5 rebase/6828 at 925c37aa0): SslConnection
keeps main's verifyOptions, minimumVersion and alpn next to the session,
and the debt entries follow main's structure.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RoU3ZF76A6uR8sCA7NMLch
Implement sceSslGetSerialNumber, sceSslGetSubjectName, sceSslGetIssuerName, sceSslGetNameEntryCount, sceSslGetNameEntryInfo, and sceSslFreeSslCertName. Signatures follow VitaSDK. Mbed TLS extracts the certificate's serial number and X.509 subject and issuer distinguished names, extracting OID attribute short names (or numeric strings) and value strings.
sceSslConnect performs the client handshake on the host socket that the
guest number maps to in the libkernel or libSceNet socket table, and
sceSslRead and sceSslWrite carry application data. Session state comes
from the context's memory pool, and the server is verified against the
CAs loaded with sceSslLoadCert; a loaded client certificate is sent when
the server asks for one.
libkernel exports KernelLookupSocketNative_nid_no_patch, which checks
its own socket table before the one libSceNet registers. Pools take a
lock so connections can allocate outside the library lock.
TLS 1.3 is compiled out. A missing CA, a verify callback, would-block
sockets and every failure whose console code is unknown throw, as
recorded in the libSceSsl debt entry.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RoU3ZF76A6uR8sCA7NMLch
sceSslEnableVerifyOption, sceSslDisableVerifyOption, sceSslSetMinSslVersion,
sceSslSetAlpn and sceSslGetAlpnSelected kept throwing because their
signatures were unknown. SharpProspero, the source already used for the
other connection functions, declares them; the signatures follow it.
The options, minimum version and ALPN list are recorded on the connection
like the verification callback; nothing reads them until sceSslConnect has
a transport. sceSslGetAlpnSelected returns null because no handshake
completes. Unknown connections and terminated contexts throw.
The PPSA07411 functional debt entry moves to libSceJson2.md, now its first
linked library.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01SaSmTp7ZiSYcnUMTDVa7hZ
Implements connection lifecycle and parameter exports in libSceSsl:
sceSslCreateConnection, sceSslConnect, sceSslRead, sceSslWrite,
sceSslDeleteConnection, and sceSslSetVerifyCallback.
The repository has no TLS client, so a connection records its context,
socket, host and verification callback:
- sceSslCreateConnection returns a new connection id, or
SSL_ERROR_INVALID_ID (0x8095F006) for an unknown context. A null host throws.
- sceSslDeleteConnection drops the connection and leaves socket open.
- sceSslSetVerifyCallback stores the callback and argument.
- sceSslConnect, sceSslRead and sceSslWrite throw where handshake starts,
naming the host and the socket peer port.
Carried from @screamm with author attribution preserved.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Gran Turismo 7 (PPSA01317) fails to load on unresolved imports and on
two needed libraries that AnyPS5 does not build (#4782).
- sceAppContentDownloadDataFormat empties /download0, as
sceAppContentTemporaryDataFormat does for /temp0.
- sceNpAuthSetTimeout returns REQUEST_NOT_FOUND for an unknown request
like the other request calls, and OK otherwise; no request reaches the
network the timeouts would bound.
- sceNpWebApi2PushEventSetHandleTimeout throws for an unknown library
context, like sceNpWebApi2GetMemoryPoolStats, and returns OK
otherwise; push event handles are not tracked and nothing waits on
one offline.
- sceSslDisableVerifyOption, sceSslGetAlpnSelected, sceSslSetAlpn,
sceSslSetMinSslVersion, sceAudioOutDeviceIdOpen and the unnamed
libScePsml NIDs xNZM9Y5lf-M and lcZD9tJraAw are declared without
parameters and throw; their signatures are unknown.
- libSceUsbStorage and libSceUsbStorageDialog exist with no exports,
like libSceXml: the title lists both as needed but imports nothing
from them.
Each assumption is recorded in the library's technical debt file.
Co-authored-by: dawid-swiecicki <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
JJenkx