feat(libSceLibreSsl3): accept null X509 item disposal

core/libs/prx/libSceLibreSsl3/AdditionalExports.cpp

@@ -120,10 +120,6 @@ int APS5_VABI TLS_server_method_nid_postfix() {
     NotImplemented_nid_no_patch(__func__);
 }
 
-int APS5_VABI X509_EXTENSION_free_nid_postfix() {
-    NotImplemented_nid_no_patch(__func__);
-}
-
 int APS5_VABI X509_STORE_CTX_get0_param_nid_postfix() {
     NotImplemented_nid_no_patch(__func__);
 }
@@ -224,10 +220,6 @@ int APS5_VABI tls_handshake_nid_postfix() {
     NotImplemented_nid_no_patch(__func__);
 }
 
-int APS5_VABI AUTHORITY_KEYID_free_nid_postfix() {
-    NotImplemented_nid_no_patch(__func__);
-}
-
 int APS5_VABI X509V3_EXT_d2i_nid_postfix() {
     NotImplemented_nid_no_patch(__func__);
 }
@@ -274,10 +266,6 @@ int APS5_VABI BIO_meth_set_create_nid_postfix() {
     NotImplemented_nid_no_patch(__func__);
 }
 
-int APS5_VABI X509_CRL_free_nid_postfix() {
-    NotImplemented_nid_no_patch(__func__);
-}
-
 int APS5_VABI tls_config_error_nid_postfix() {
     NotImplemented_nid_no_patch(__func__);
 }

core/libs/prx/libSceLibreSsl3/CMakeLists.txt

@@ -320,3 +320,18 @@ if(BUILD_TESTING AND CMAKE_SYSTEM_NAME STREQUAL "Linux")
     add_test(NAME guest_libressl3_pkey_lifecycle COMMAND guest_libressl3_pkey_lifecycle_tests ${pkeyLifecycleDirectory})
     set_tests_properties(guest_libressl3_pkey_lifecycle PROPERTIES TIMEOUT 20)
 endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_libressl3_x509_item_free_tests ${CMAKE_CURRENT_SOURCE_DIR}/tests/X509ItemFree.cpp)
+    target_include_directories(guest_libressl3_x509_item_free_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl3_x509_item_free_tests PRIVATE libSceLibreSsl3)
+    configure_windows_unwind(guest_libressl3_x509_item_free_tests)
+    add_test(NAME guest_libressl3_x509_item_free COMMAND guest_libressl3_x509_item_free_tests)
+    set_tests_properties(guest_libressl3_x509_item_free PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_libressl3_x509_item_free PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl3>")
+    endif()
+endif()
+
+target_sources(libSceLibreSsl3 PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src/X509ItemFree.cpp)

core/libs/prx/libSceLibreSsl3/include/Api.hpp

@@ -246,7 +246,7 @@ int APS5_VABI SSL_set_alpn_protos_nid_postfix();
 int APS5_VABI SSL_set_info_callback_nid_postfix();
 int APS5_VABI TLS_method_nid_postfix();
 int APS5_VABI TLS_server_method_nid_postfix();
-int APS5_VABI X509_EXTENSION_free_nid_postfix();
+void APS5_VABI X509_EXTENSION_free_nid_postfix(void* extension);
 int APS5_VABI X509_STORE_CTX_get0_param_nid_postfix();
 int APS5_VABI X509_STORE_load_locations_nid_postfix();
 int APS5_VABI X509_VERIFY_PARAM_set_flags_nid_postfix(LibreSslX509VerifyParam* param, std::uint64_t flags);
@@ -276,7 +276,7 @@ int APS5_VABI SSL_SESSION_get_protocol_version_nid_postfix();
 int APS5_VABI X509_NAME_add_entry_by_txt_nid_postfix();
 int APS5_VABI BIO_meth_free_nid_postfix();
 int APS5_VABI tls_handshake_nid_postfix();
-int APS5_VABI AUTHORITY_KEYID_free_nid_postfix();
+void APS5_VABI AUTHORITY_KEYID_free_nid_postfix(void* authorityKeyId);
 int APS5_VABI X509V3_EXT_d2i_nid_postfix();
 int APS5_VABI Unknown_3KZ_minus_L4y1gak_nid_no_patch();
 int APS5_VABI EVP_chacha20_poly1305_nid_postfix();
@@ -289,7 +289,7 @@ int APS5_VABI tls_accept_socket_nid_postfix();
 int APS5_VABI Unknown_4pEl_minus_5DmrrM_nid_no_patch();
 int APS5_VABI BIO_meth_set_write_nid_postfix();
 int APS5_VABI BIO_meth_set_create_nid_postfix();
-int APS5_VABI X509_CRL_free_nid_postfix();
+void APS5_VABI X509_CRL_free_nid_postfix(void* crl);
 int APS5_VABI tls_config_error_nid_postfix();
 int APS5_VABI BIO_meth_set_read_nid_postfix();
 int APS5_VABI EC_POINT_set_affine_coordinates_GFp_nid_postfix();

core/libs/prx/libSceLibreSsl3/src/X509ItemFree.cpp

@@ -0,0 +1,21 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
+#include "prx/libc/include/General.hpp"
+
+extern "C" {
+
+void APS5_VABI AUTHORITY_KEYID_free_nid_postfix(void* authorityKeyId) {
+    if (!authorityKeyId) return;
+    NotImplemented_nid_no_patch(__func__);
+}
+
+void APS5_VABI X509_EXTENSION_free_nid_postfix(void* extension) {
+    if (!extension) return;
+    NotImplemented_nid_no_patch(__func__);
+}
+
+void APS5_VABI X509_CRL_free_nid_postfix(void* crl) {
+    if (!crl) return;
+    NotImplemented_nid_no_patch(__func__);
+}
+
+}

core/libs/prx/libSceLibreSsl3/tests/X509ItemFree.cpp

@@ -0,0 +1,55 @@
+#include "prx/libSceLibreSsl3/libSceLibreSsl3.hpp"
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <source_location>
+#include <stdexcept>
+
+namespace {
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "LibreSSL3 X509 item free check failed at line %u\n", location.line());
+    std::abort();
+}
+
+template<typename TAction>
+void RequireNoException(TAction action, std::source_location location = std::source_location::current()) {
+    try {
+        action();
+    } catch (...) {
+        Require(false, location);
+    }
+}
+
+template<typename TAction>
+void RequireNotImplemented(TAction action, std::source_location location = std::source_location::current()) {
+    try {
+        action();
+    } catch (const std::runtime_error&) {
+        return;
+    }
+    Require(false, location);
+}
+
+void TestNull() {
+    RequireNoException([] { AUTHORITY_KEYID_free_nid_postfix(nullptr); });
+    RequireNoException([] { X509_EXTENSION_free_nid_postfix(nullptr); });
+    RequireNoException([] { X509_CRL_free_nid_postfix(nullptr); });
+}
+
+void TestNonNull() {
+    void* const unreadable = reinterpret_cast<void*>(std::uintptr_t{1});
+    RequireNotImplemented([&] { AUTHORITY_KEYID_free_nid_postfix(unreadable); });
+    RequireNotImplemented([&] { X509_EXTENSION_free_nid_postfix(unreadable); });
+    RequireNotImplemented([&] { X509_CRL_free_nid_postfix(unreadable); });
+}
+
+}
+
+int main() {
+    TestNull();
+    TestNonNull();
+    std::puts("LibreSSL3 X509 item free tests passed");
+}

docs/dev/debt/libSceLibreSsl3.md

@@ -4,6 +4,8 @@
 - [`X509_PUBKEY_get0_param`](../../../core/libs/prx/libSceLibreSsl3/src/X509PubkeyParam.cpp) follows LibreSSL 4.0.0 `crypto/asn1/x_pubkey.c` at [`ce488b78e0bd994780569df718596b9776ff681a`](https://github.com/libressl/openbsd/blob/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/asn1/x_pubkey.c) and its `x509_local.h`, `x509.h` and `asn1.h` layouts. The function returns borrowed pointers and writes the encoded key length only when the key output is requested. The PS5 layout and malformed-object behavior are not verified on hardware; layout assertions match the pinned x86-64 source declarations.
 ### Functional
 
+- [AUTHORITY_KEYID_free, X509_EXTENSION_free and X509_CRL_free](../../../core/libs/prx/libSceLibreSsl3/src/X509ItemFree.cpp) - not measured on a PS5; non-null object disposal remains unsupported and throws before dereference. The null no-op follows LibreSSL 4.0.0 [`AUTHORITY_KEYID_free`](https://github.com/libressl/openbsd/blob/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/x509/x509_akeya.c#L124-L128), [`X509_EXTENSION_free`](https://github.com/libressl/openbsd/blob/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/asn1/x_exten.c#L137-L141), [`X509_CRL_free`](https://github.com/libressl/openbsd/blob/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/asn1/x_crl.c#L507-L511) and their [`ASN1_item_free` dispatcher](https://github.com/libressl/openbsd/blob/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/asn1/tasn_fre.c#L72-L99).
+
 - [OpenSSL_version](../../../core/libs/prx/libSceLibreSsl3/Export.cpp) - other firmware revisions are unverified. Selectors 0 through 5 follow the public firmware 13.40 measurements in [discussion #8981](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214); unknown selectors follow LibreSSL 4.0.0 and return `not available`. No independent console test was run.
 
 - [ERR_load_crypto_strings and ERR_peek_last_error](../../../core/libs/prx/libSceLibreSsl3/Export.cpp) have no console execution verification. [Firmware 13.42 modules run on a PC](https://github.com/boykopovar/AnyPS5/pull/9535#issuecomment-6407060914) retained numeric-only output after loaders and matched queue order/overflow; whether the two firmware modules share a queue was not tested. This implementation reads libSceLibreSsl's calling-thread queue. `ERR_print_errors_cb` remains throwing because guest thread identifiers and diagnostic metadata are unverified.
@@ -54,7 +56,7 @@
 
 ### Additional callable export inventory
 
-- [Additional exports](../../../core/libs/prx/libSceLibreSsl3/AdditionalExports.cpp) declare 164 remaining callable exports: 154 named and 10 known only by NID. Every entry throws. Parameterless `int` declarations are unknown-signature placeholders, not verified ABI contracts. Names/NIDs match the 13.60 export table. No functional implementation or title unblock is claimed.
+- [Additional exports](../../../core/libs/prx/libSceLibreSsl3/AdditionalExports.cpp) declare 161 remaining callable exports: 151 named and 10 known only by NID. Every entry throws. Parameterless `int` declarations are unknown-signature placeholders, not verified ABI contracts. Names/NIDs match the 13.60 export table. No functional implementation or title unblock is claimed.
 
 | Name | NID |
 | --- | --- |
@@ -67,7 +69,6 @@
 | `SSL_SESSION_get_timeout` | `0JcHkrKJ9iw` |
 | `BIO_meth_free` | `13BHMSblVyY` |
 | `tls_handshake` | `27Fuliv3Om8` |
-| `AUTHORITY_KEYID_free` | `2bIZM-OfE8Y` |
 | `X509V3_EXT_d2i` | `2l+JidqxyZQ` |
 | `TLS_method` | `31eWdro1jqs` |
 | `unknown` | `3KZ-L4y1gak` |
@@ -82,7 +83,6 @@
 | `SSL_set_accept_state` | `5BoCLZK9mGk` |
 | `BIO_meth_set_write` | `5DhOJmgra8E` |
 | `BIO_meth_set_create` | `5NBoRJYLH0U` |
-| `X509_CRL_free` | `5PWK0cYOpHs` |
 | `i2d_SSL_SESSION` | `5aSlVeVSKVc` |
 | `tls_config_error` | `5ex+694ri90` |
 | `tls_read` | `7RvDjfy4gUA` |
@@ -212,7 +212,6 @@
 | `ASN1_OCTET_STRING_free` | `vo-cv5gnPUA` |
 | `SSL_CTX_set_post_handshake_auth` | `wHdymWL7CbE` |
 | `tls_config_insecure_noverifyname` | `wNQT6Zn4UG4` |
-| `X509_EXTENSION_free` | `wbJDMMsje6s` |
 | `ASN1_TYPE_free` | `whL1IRBxFZA` |
 | `ECDSA_SIG_set0` | `xVv3qlSRldc` |
 | `OBJ_obj2txt` | `xZ1BME5qDv0` |
@@ -223,7 +222,7 @@
 | `ECDSA_SIG_get0` | `z8fsXF8JuL0` |
 | `EVP_MD_block_size` | `zCa75KLWWn4` |
 
-- 106 of the 126 exports the 13.60 table lists only by NID carry, in the table above and in [Additional exports](../../../core/libs/prx/libSceLibreSsl3/AdditionalExports.cpp), the LibreSSL names whose `tools/nid_names.py` hash equals the NID; the names were taken from the identifiers of the LibreSSL 3.8.4 and 4.0.0 `include`, `crypto`, `ssl` and `tls` sources. A name match does not show that the console function has LibreSSL's prototype or behavior; each keeps the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`. `AES_wrap_key`, `ECDSA_SIG_free`, `ECDSA_do_verify`, `ERR_load_ERR_strings`, `ERR_print_errors_fp` and `i2d_PUBKEY` also hash to the NIDs of six `unknown` rows, which keep their NID names; `PBYz0kpXwg8` hashes to no identifier of those sources.
+- 103 of the 126 exports the 13.60 table lists only by NID carry, in the table above and in [Additional exports](../../../core/libs/prx/libSceLibreSsl3/AdditionalExports.cpp), the LibreSSL names whose `tools/nid_names.py` hash equals the NID; the names were taken from the identifiers of the LibreSSL 3.8.4 and 4.0.0 `include`, `crypto`, `ssl` and `tls` sources. A name match does not show that the console function has LibreSSL's prototype or behavior; each keeps the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`. `AES_wrap_key`, `ECDSA_SIG_free`, `ECDSA_do_verify`, `ERR_load_ERR_strings`, `ERR_print_errors_fp` and `i2d_PUBKEY` also hash to the NIDs of six `unknown` rows, which keep their NID names; `PBYz0kpXwg8` hashes to no identifier of those sources.
 
 ### Functional