AnyPS5/docs/dev/debt/libSceSsl.md

libSceSsl technical debt

Unknown function info

• sceSslCreateConnection, sceSslDeleteConnection, sceSslSetVerifyCallback, sceSslConnect, sceSslRead, sceSslWrite (libSceSsl) - imported by ffmpeg.prx. The repository has no TLS client, so a connection only records its context, socket, host and verification callback, and sceSslConnect, sceSslRead and sceSslWrite throw NotImplemented_nid_no_patch(__func__) until there is a transport. Signatures follow SharpProspero, which also says the socket stays open after sceSslDeleteConnection. An unknown context returns SSL_ERROR_INVALID_ID (0x8095F006), as sceSslGetMemoryPoolStats does on the console and as KytyPS5 and sharpemu return for other context calls; for an unknown connection, a connection whose context was terminated and a null host the console's codes are unknown, so these throw. The socket is not checked when the connection is created, sceSslTerm leaves the context's connections to sceSslDeleteConnection, and sceSslSetVerifyCallback accepts any callback, null included, and returns 0; none of this is verified on the console. SSL_ERROR_BEFORE_INIT (0x8095F001) is never returned, as the library keeps no state apart from its contexts
• sceSslClose (libSceSsl) - unknown signature
• sceSslGetSerialNumber (libSceSsl) - unknown signature
• sceSslLoadCert, sceSslGetCaList, sceSslFreeCaList, sceSslGetCaCerts, sceSslFreeCaCerts, sceSslUnloadCert (libSceSsl) - signatures and layouts follow SharpProspero. PPSA15508/01.002.000 calls sceSslLoadCert with one 1,408-byte PEM CA and null client certificate/key arguments; this confirms that call shape, not console error behavior. Mbed TLS 3.6.7 parses DER/PEM chains and checks an optional client certificate/key pair. Imports are retained per context and committed together; a failed import preserves existing credentials. CA queries return independently owned snapshots; unload clears active credentials while outstanding snapshots remain valid. Appending repeated CA imports, snapshot lifetime across unload, memory overhead and error precedence have not been measured on a PS5. Invalid loads, malformed material, exhausted pools and unsupported keys throw rather than inventing console error codes. No root bundle is shipped; an empty context still returns NOT_FOUND. The existing null-list error, unknown-context behavior and legacy clearing of foreign raw CA lists remain unchanged. Certificate readers remain unimplemented. Loading credentials neither starts a TLS connection nor authenticates a peer
• sceSslEnableVerifyOption, sceSslDisableVerifyOption, sceSslSetMinSslVersion, sceSslSetAlpn, sceSslGetAlpnSelected (libSceSsl) - imported by PPSA01317 and PPSA07411. Signatures follow SharpProspero, the source of the other connection signatures. The verify options, the minimum version and the ALPN protocol list are recorded on the connection; nothing reads them until sceSslConnect has a transport, and how the console applies them is unknown. The initial verify options are unknown and taken as 0. sceSslSetMinSslVersion accepts the SceSslVersion values SharpProspero lists, 0 (none) to 5 (TLS 1.2), and throws for others; whether the console accepts a TLS 1.3 value is unknown. sceSslSetAlpn stores the string up to its terminator and throws for a null list; whether the console expects a comma-separated list or the TLS wire format is unknown. sceSslGetAlpnSelected returns null, as no handshake completes. An unknown connection and a connection whose context was terminated throw, as for sceSslSetVerifyCallback