An empty list, or one with no certificate, made SystemRoots() return a
null chain, so the connection trusted nothing. Throw and name the path,
as the missing-file case does; nothing is cached, so a later call
reads the list again.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every libSceSsl context started without trust anchors, so a libSceHttp2
request without a verify callback failed the known-CA check. RetroArch's
updater, PS5LM and Porpoise all use version-3 templates over https://
without one. libSceSsl now parses /<sandbox word>/common/cert/CA_LIST.cer,
served by libkernel from the host trust store, once per process into its
own pool, and SslTrustSystemRoots_nid_no_patch links those roots after
the context's own authorities for one connection. The HTTP/2 transport
calls it after creating each connection.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The change removed a technical-debt entry from origin/main that documents four
libSceVoiceChat exports it does not touch, left the new include out of the
quoted include group, put a forward declaration away from the other type
declarations, and cited a prototype source without a line anchor.
AnyPS5 resolves a title's imports by NID, so a title that imports a system
function that no AnyPS5 library provides fails to load with an unresolved
import. This declares 222 such exports across 11 PS5 system libraries that
AnyPS5 implements but does not provide.
Each declaration calls NotImplemented_nid_no_patch and returns 0; none of
them implements the function. A declaration with a credible prototype uses
it and cites the source with a pinned commit; the rest are declared without
parameters, which resolves the import without making an ABI claim. The
technical-debt files record the limitation per library.
The list is the intersection of the export table of the console's library
(function symbols only), the pinned aerolib names and the functions not yet
defined anywhere in the repo. Every name recomputes to its NID with
tools/nid_names.py.
libSceAudio3d and libSceVoice are left out because #8331 declares them.
Every unverified point of the libSceSsl debt entry was measured on a PS5 on
system software 13.40 with a ps5-payload-dev payload against a TLS 1.2 test
server presenting leaves issued by the test fixture root. The code follows the
console where it differed: initial verify options 0x25 with the date checks
off, bits outside 0x3F rejected, the verify callback called with the context
id and the bitmask of failed checks and re-run from every later call after a
negative return, sceSslRead flags 0 reading until the requested length,
streams that end without close_notify reading as 0, resets reported with the
libSceNet codes, receive timeouts as SSL_ERROR_WANT_POLLIN, a fatal alert
ending the transport, sceSslClose as a repeatable no-op before the handshake,
read and write before connect running the handshake, SSL_ERROR_INVALID_ID for
unknown or deleted handles and terminated contexts, sceSslSetMinSslVersion
accepting 2 to 5, an empty ALPN list rejected, long attribute names from
sceSslGetNameEntryInfo and sceSslGetSerialNumber leaving the caller's length.
The debt entries record the measured values and what stays unmeasured.
sceSslConnect verifies the server's chain under MBEDTLS_SSL_VERIFY_OPTIONAL and returns the first failure the connection's verify options select, with the SSL_ERROR_* codes KytyPS5 lists. The initial options are all five checks, so a connection whose title never sets them fails closed: with no CA loaded it returns SSL_ERROR_UNKNOWN_CA instead of throwing. The result is final for the connection: a failure sends close_notify, later sceSslConnect calls return the same code, and sceSslRead and sceSslWrite throw. A verify callback runs once after the handshake, outside the session lock, with the connection id, that code, handles to a copy of the peer chain that the context's certificate readers accept, the chain length and the user argument; a negative return fails the connect with SSL_ERROR_APPLICATION_VERIFICATION_CALLBACK_CHECK. The ALPN list set with sceSslSetAlpn is split on commas and offered, sceSslGetAlpnSelected returns the protocol the server chose, and the minimum version floors the handshake at TLS 1.2. A socket that would block returns SSL_ERROR_WANT_POLLIN or WANT_POLLOUT from connect, read and write and the next sceSslConnect resumes the handshake; the BIO maps a reset to MBEDTLS_ERR_NET_CONN_RESET, which returns SSL_ERROR_SOCKET_CLOSED, and tells a blocking socket's expired receive timeout, which returns SSL_ERROR_READ_TIMEOUT, apart from a non-blocking would-block. sceSslClose sends close_notify once and marks the connection closed. The debt entry records the default options and the situation-to-code choices as unverified and drops the title IDs.
Brings in main's connection verify options, minimum version, ALPN and
certificate readers. The conflicts in libSceSsl/Export.cpp and the
libSceSsl debt entry take the resolution from blawesom's rebase of this
pull request (blawesom/AnyPS5 rebase/6828 at 925c37aa0): SslConnection
keeps main's verifyOptions, minimumVersion and alpn next to the session,
and the debt entries follow main's structure.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RoU3ZF76A6uR8sCA7NMLch
Implement sceSslGetSerialNumber, sceSslGetSubjectName, sceSslGetIssuerName, sceSslGetNameEntryCount, sceSslGetNameEntryInfo, and sceSslFreeSslCertName. Signatures follow VitaSDK. Mbed TLS extracts the certificate's serial number and X.509 subject and issuer distinguished names, extracting OID attribute short names (or numeric strings) and value strings.
sceSslConnect performs the client handshake on the host socket that the
guest number maps to in the libkernel or libSceNet socket table, and
sceSslRead and sceSslWrite carry application data. Session state comes
from the context's memory pool, and the server is verified against the
CAs loaded with sceSslLoadCert; a loaded client certificate is sent when
the server asks for one.
libkernel exports KernelLookupSocketNative_nid_no_patch, which checks
its own socket table before the one libSceNet registers. Pools take a
lock so connections can allocate outside the library lock.
TLS 1.3 is compiled out. A missing CA, a verify callback, would-block
sockets and every failure whose console code is unknown throw, as
recorded in the libSceSsl debt entry.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RoU3ZF76A6uR8sCA7NMLch
sceSslEnableVerifyOption, sceSslDisableVerifyOption, sceSslSetMinSslVersion,
sceSslSetAlpn and sceSslGetAlpnSelected kept throwing because their
signatures were unknown. SharpProspero, the source already used for the
other connection functions, declares them; the signatures follow it.
The options, minimum version and ALPN list are recorded on the connection
like the verification callback; nothing reads them until sceSslConnect has
a transport. sceSslGetAlpnSelected returns null because no handshake
completes. Unknown connections and terminated contexts throw.
The PPSA07411 functional debt entry moves to libSceJson2.md, now its first
linked library.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01SaSmTp7ZiSYcnUMTDVa7hZ
Implements connection lifecycle and parameter exports in libSceSsl:
sceSslCreateConnection, sceSslConnect, sceSslRead, sceSslWrite,
sceSslDeleteConnection, and sceSslSetVerifyCallback.
The repository has no TLS client, so a connection records its context,
socket, host and verification callback:
- sceSslCreateConnection returns a new connection id, or
SSL_ERROR_INVALID_ID (0x8095F006) for an unknown context. A null host throws.
- sceSslDeleteConnection drops the connection and leaves socket open.
- sceSslSetVerifyCallback stores the callback and argument.
- sceSslConnect, sceSslRead and sceSslWrite throw where handshake starts,
naming the host and the socket peer port.
Carried from @screamm with author attribution preserved.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Gran Turismo 7 (PPSA01317) fails to load on unresolved imports and on
two needed libraries that AnyPS5 does not build (#4782).
- sceAppContentDownloadDataFormat empties /download0, as
sceAppContentTemporaryDataFormat does for /temp0.
- sceNpAuthSetTimeout returns REQUEST_NOT_FOUND for an unknown request
like the other request calls, and OK otherwise; no request reaches the
network the timeouts would bound.
- sceNpWebApi2PushEventSetHandleTimeout throws for an unknown library
context, like sceNpWebApi2GetMemoryPoolStats, and returns OK
otherwise; push event handles are not tracked and nothing waits on
one offline.
- sceSslDisableVerifyOption, sceSslGetAlpnSelected, sceSslSetAlpn,
sceSslSetMinSslVersion, sceAudioOutDeviceIdOpen and the unnamed
libScePsml NIDs xNZM9Y5lf-M and lcZD9tJraAw are declared without
parameters and throw; their signatures are unknown.
- libSceUsbStorage and libSceUsbStorageDialog exist with no exports,
like libSceXml: the title lists both as needed but imports nothing
from them.
Each assumption is recorded in the library's technical debt file.
Co-authored-by: dawid-swiecicki <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
