Not sure if it's the right thread or even forum but:
ENVARC:SYS/Certificates/ca-bundle.crt - does anyone maintain this? I see the certs are quite outdated (as in 8 years) - would a refresh-patch be okay? Any preferred way to do it?
Are patches to OpenSSL welcome? Any rules for committing them?
The AROS port in
contrib/development/libs/openssl builds and links fine, but a TLS client handshake fails.
SSL_connect() returns an error and
tls_validate_record_header reports:
At the same time, fragments of the executable may appear on stdout.
The problem is not in TLS itself.
On AROS, sockets come from
bsdsocket.library / AROSTCP, and bsdsocket descriptors are
not C library file descriptors. They use a separate descriptor namespace.
In
include/internal/sockets.h, AROS currently falls through to the generic POSIX definitions:
#define readsocket(s, b, n) read((s), (b), (n))
#define writesocket(s, b, n) write((s), (b), (n))
#define closesocket(s) close(s)
#define ioctlsocket(a, b, c) ioctl(a, b, c)
This means OpenSSL passes a bsdsocket descriptor to libc.
If libc resolves the same integer as a DOS file handle, the TLS
ClientHello gets written to a file, and the supposed server response is read back from it. That explains both the invalid TLS record header and executable bytes appearing on stdout.
The fix is to keep socket I/O inside
bsdsocket.library, as the existing AROS port already does elsewhere:
#elif defined(OPENSSL_SYS_AROS)
#define ioctlsocket(a, b, c) IoctlSocket((a), (b), (char *)(c))
#define closesocket(s) CloseSocket(s)
#define readsocket(s, b, n) recv((s), (b), (n), 0)
#define writesocket(s, b, n) send((s), (b), (n), 0)
#define writesocket_ex(s, b, n, f) send((s), (b), (n), (f))
This should be placed before the final
#else in the
readsocket /
writesocket block of
include/internal/sockets.h.
recv() and
send() are the bsdsocket implementations, so the descriptor stays in the correct namespace.
The existing
openssl-4.0.1-aros.diff already modifies this file to avoid including
<poll.h> on AROS, so this can naturally extend the same patch.
With this change applied,
bss_sock.o builds cleanly, and a TLS 1.3 client handshake against a real HTTPS server succeeds on AROS x86_64.
Have I read something wrong?