mirror of
https://github.com/libretro/parallel-gx2.git
synced 2026-11-07 04:25:58 -10:00
libretroadmin
a2de2322c8
The core builds with a static Makefile (Makefile + Makefile.common) in the manner of the other ParaLLEl cores, for every target .gitlab-ci.yml has: Linux x86_64/aarch64, Windows (MinGW, native or cross), macOS, iOS, tvOS, Android arm64/x86_64 and webOS. CMake, vcpkg and their overlay ports are gone; the libraries the core needs are submodules built with it (fmt 12.1.0, glm 1.0.1, glslang 15.1.0, libusb 1.0.29, pugixml 1.15, zlib 1.3.1, zstd 1.5.7), with the generated files and the graphic packs produced by the Makefile itself (tools/pack_graphic_packs.c), and a precompiled header for gcc and clang. The core is renamed parallel_gx2 (parallel_gx2_libretro.info, library name "ParaLLEl GX2"). HTTP and TLS go through RetroArch's libretro-common (net_http with the per-request TLS settings, the built-in TLS client, x509, the hashes and the KDF) in place of libcurl, OpenSSL and mbedTLS: dependencies/curl-compat is the small libcurl API nlibcurl and napi use, on one transfer thread with lock-free submission and per-handle event queues, with its own tests against local HTTP and TLS servers, plain and under ASan/UBSan and TSan, in both CIs. The libretro-common files are plain copies from RetroArch. boost is replaced by the few headers the core uses (boost-compat), and the CI files build with the Makefile.
153 lines
6.7 KiB
C
153 lines
6.7 KiB
C
/* Copyright (C) 2010-2020 The RetroArch team
|
|
*
|
|
* ---------------------------------------------------------------------------------------
|
|
* The following license statement only applies to this file (net_socket.h).
|
|
* ---------------------------------------------------------------------------------------
|
|
*
|
|
* Permission is hereby granted, free of charge,
|
|
* to any person obtaining a copy of this software and associated documentation files (the "Software"),
|
|
* to deal in the Software without restriction, including without limitation the rights to
|
|
* use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software,
|
|
* and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
|
|
* INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
|
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
*/
|
|
|
|
#ifndef _LIBRETRO_SDK_NET_SOCKET_SSL_H
|
|
#define _LIBRETRO_SDK_NET_SOCKET_SSL_H
|
|
|
|
#include <stdint.h>
|
|
#include <stdlib.h>
|
|
#include <boolean.h>
|
|
#include <retro_common_api.h>
|
|
/* ssize_t, as net_socket.h gets it. */
|
|
#include <net/net_compat.h>
|
|
|
|
RETRO_BEGIN_DECLS
|
|
|
|
/* How long a TLS read, in the handshake or in a record, waits for the
|
|
* server's next bytes before it fails: a server that goes silent must
|
|
* not hold the caller's thread for good. */
|
|
#ifndef SSL_SOCKET_IO_TIMEOUT_MS
|
|
#define SSL_SOCKET_IO_TIMEOUT_MS 30000
|
|
#endif
|
|
|
|
void* ssl_socket_init(int fd, const char *domain);
|
|
|
|
int ssl_socket_connect(void *state_data, void *data, bool timeout_enable, bool nonblock);
|
|
|
|
/* The TLS library's own code for the most recent failure in
|
|
* ssl_socket_init()/ssl_socket_connect(), as the library reports it
|
|
* (mbedtls: negative, so -0x7780 style; BearSSL: its BR_ERR_* value),
|
|
* or 0 when the last failure was in the socket layer or there was
|
|
* none. For logging: it is what turns "connect failed" into a
|
|
* message the library's error table can decode. */
|
|
int ssl_socket_last_error(void *state_data);
|
|
|
|
int ssl_socket_send_all_blocking(void *state_data, const void *data_, size_t len, bool no_signal);
|
|
|
|
/* Takes as much of @data_ as the connection can accept without
|
|
* blocking and returns how much that was: 0 when the socket is full,
|
|
* -1 on error. Bytes taken may still sit inside the TLS layer; once
|
|
* the last of them is taken, call ssl_socket_flush_nonblocking() until
|
|
* it reports 1. After a 0, the next call must pass the same buffer,
|
|
* at least as long (mbedtls has to finish the record it began). */
|
|
ssize_t ssl_socket_send_all_nonblocking(void *state_data, const void *data_, size_t len, bool no_signal);
|
|
|
|
/* Moves bytes already taken by ssl_socket_send_all_nonblocking() on to
|
|
* the socket without blocking. 1: nothing left pending, 0: the socket
|
|
* is full (wait for it to be writable and call again), -1: error. */
|
|
int ssl_socket_flush_nonblocking(void *state_data);
|
|
|
|
int ssl_socket_receive_all_blocking(void *state_data, void *data_, size_t len);
|
|
|
|
ssize_t ssl_socket_receive_all_nonblocking(void *state_data, bool *error, void *data_, size_t len);
|
|
|
|
void ssl_socket_close(void *state_data);
|
|
|
|
void ssl_socket_free(void *state_data);
|
|
|
|
/* Certificate-verification policy hook. `mode` is a tls_verify_mode value
|
|
* (0 = required, 1 = optional, 2 = disabled, see network/tls_config.h).
|
|
* Called once at startup and whenever the setting changes; the active
|
|
* backend snapshots the value at the next ssl_socket_connect. */
|
|
void ssl_socket_set_verify_mode(unsigned mode);
|
|
|
|
/* Weak logging hooks. The active SSL backend ships no-op defaults so
|
|
* libretro-common still builds/links standalone; RetroArch overrides them
|
|
* in network/tls_log.c to route into RARCH_ERR/RARCH_WARN without dragging
|
|
* verbosity.h into vendored code. `mode_required` != 0 means a hard
|
|
* (REQUIRED) failure; == 0 means a soft (OPTIONAL) failure. */
|
|
void ssl_socket_log_verify_fail(int mode_required, const char *domain,
|
|
const char *verify_info);
|
|
void ssl_socket_log_verify_disabled(const char *domain);
|
|
|
|
/* net_socket_ssl_retro.c only: replace the built-in CA bundle with
|
|
* @pem (concatenated PEM certificates) for the process, NULL to
|
|
* restore. For tests against a local server. */
|
|
void ssl_socket_retro_set_trust_pem(const char *pem, size_t len);
|
|
/* net_socket_ssl_retro.c only: whether the last handshake on
|
|
* @state_data resumed a cached session rather than running in full. */
|
|
int ssl_socket_retro_was_resumed(void *state_data);
|
|
/* net_socket_ssl_retro.c only: 0x0304 for a TLS 1.3 connection,
|
|
* 0x0303 for 1.2, 0 before the handshake. */
|
|
unsigned ssl_socket_retro_version(void *state_data);
|
|
/* net_socket_ssl_retro.c only: the negotiated cipher suite's IANA
|
|
* number (0x1303 is TLS_CHACHA20_POLY1305_SHA256), 0 before the
|
|
* handshake. */
|
|
unsigned ssl_socket_retro_suite(void *state_data);
|
|
|
|
struct rsa_private_key;
|
|
|
|
/* net_socket_ssl_retro.c only: one connection's own settings, for
|
|
* clients that pin their own CAs or present a certificate. Every
|
|
* pointer is borrowed until ssl_socket_connect() returns. */
|
|
struct ssl_socket_retro_config
|
|
{
|
|
/* Trust anchors, DER, in place of the built-in bundle; NULL for
|
|
* the bundle. */
|
|
const uint8_t *const *trust;
|
|
const size_t *trust_lens;
|
|
/* Client certificate chain, DER, leaf first, and the leaf's RSA
|
|
* key: sent when the server asks for one. A connection presenting
|
|
* a certificate runs TLS 1.2. */
|
|
const uint8_t *const *chain;
|
|
const size_t *chain_lens;
|
|
const struct rsa_private_key *key;
|
|
/* TLS 1.2 and 1.3 suites to offer, by IANA number, most preferred
|
|
* first; NULL for the default ECDHE AEAD set. This may name the RSA
|
|
* key exchange and CBC suites, which the default never offers. */
|
|
const unsigned *suites;
|
|
unsigned trust_count;
|
|
unsigned chain_count;
|
|
unsigned suite_count;
|
|
unsigned flags; /* SSL_RETRO_* */
|
|
};
|
|
|
|
/* Accept any server certificate. */
|
|
#define SSL_RETRO_NO_VERIFY (1 << 0)
|
|
/* Check the chain but not that it names the host. */
|
|
#define SSL_RETRO_NO_HOSTNAME (1 << 1)
|
|
|
|
/**
|
|
* ssl_socket_retro_configure:
|
|
* Applies @cfg to a connection between ssl_socket_init() and
|
|
* ssl_socket_connect(). Such a connection neither resumes a cached
|
|
* session nor leaves one in the cache.
|
|
*
|
|
* Returns: 0 on success, -1 when @cfg names no suite this client has.
|
|
**/
|
|
int ssl_socket_retro_configure(void *state_data,
|
|
const struct ssl_socket_retro_config *cfg);
|
|
|
|
RETRO_END_DECLS
|
|
|
|
#endif
|