Resolve the HTTP/1.x transport merge (#11611): keep both includes in Transport.cpp, and add Cookie and CookieFlood to the test Mode enum after StallUpload, outside the Http10..Http1Plain and EarlyFinal ranges.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Resolve core/libs/tests/GuestHttp2Transport.cpp: keep both sides' Mode values (all before EarlyFinal) and run the cookie-box tests before main's handshake tests, which replace the old Failure(ssl, Mode::Normal, true) call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Keeps main's redirect scenarios in GuestHttp2Transport.cpp next to this
branch's cookie box modes and scenarios.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Reads already wait for END_STREAM when inflation applies, so keep the receive window open while the encoded body is buffered. This lets a gzip response larger than 65,535 bytes inflate instead of failing, and the split test now reads before the content length so it exercises the read path.
With GCC whose exceptions are SEH, as MSYS2 UCRT64 ships it, link_libraries
adds windows_seh_personalities to every later target, nghttp2_static
included. nghttp2's install(EXPORT) then fails at generation because the
object library is in no export set, so the Windows MSYS2 workflow stops at
configure. nghttp2 is C and needs no personality routine; the libraries
that link it still get it from link_libraries.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceHttp2SetMinSslVersion returns 0 for versions 2 (SSL 3.0) to 5 (TLS 1.2)
on a template or an unsent request: the range libSceSsl's
sceSslSetMinSslVersion takes on a 13.40 console (docs/dev/debt/libSceSsl.md).
The floor is not kept, as libSceSsl negotiates TLS 1.2 only, which meets
every accepted floor. Versions 0, 1 and above 5 still throw, as do context
and cookie-box ids and sent requests; unknown and deleted ids still return
0x817B1100.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceHttp2SendRequest threw when sceSslConnect failed. A PS5 payload measured the result against loopback TLS servers: the console returns the handshake failure unchanged for an untrusted or mismatched certificate, an expired one once 0x8 is enabled, a fatal alert, a peer that closes or resets during the handshake and a reply that is not TLS. After a failed send the status call returns 0, the content length and read calls 0x817B1065, and another send the same error.
Each test serves its own CA_LIST.cer through the working-directory
override of the sandbox path. guest_ssl_system_roots checks that a
handshake to the fixture server fails without the helper and passes
with it, that a context authority still works alongside the list, and
that an empty or certificate-free list throws with its path.
guest_http2_system_roots sends a request from a context with no loaded
certificate, which passes only through the transport's helper call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every libSceSsl context started without trust anchors, so a libSceHttp2
request without a verify callback failed the known-CA check. RetroArch's
updater, PS5LM and Porpoise all use version-3 templates over https://
without one. libSceSsl now parses /<sandbox word>/common/cert/CA_LIST.cer,
served by libkernel from the host trust store, once per process into its
own pool, and SslTrustSystemRoots_nid_no_patch links those roots after
the context's own authorities for one connection. The HTTP/2 transport
calls it after creating each connection.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The transport read and stored a bound box's cookies under the request's
state mutex, and the box lookup took the handles mutex, while deleting a
request holds the handles mutex and waits for that state mutex. The cookie
module now records live boxes itself, so the lookup no longer needs the
handles mutex.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceHttp2SetCookieBox and sceHttp2GetCookieBox follow an emulator run of
the firmware 13.42 module: templates and requests take a live box or 0,
other ids and unknown boxes return the invalid-id error, a new request
copies its template's box, and the getter checks a null output first.
A request with a bound box sends the box's matching cookies and stores
every Set-Cookie of the response in the box.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean Galvin