Initial commit

libcurl-7.65.3 + BearSSL/0.6 for Original Xbox

BearSSL-OG/XboxOGBearSSL.sln

@@ -0,0 +1,30 @@
+Microsoft Visual Studio Solution File, Format Version 8.00
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "XboxOGBearSSL", "XboxOGBearSSL.vcproj", "{021C5334-2823-495E-9E54-2DEC11E06040}"
+	ProjectSection(ProjectDependencies) = postProject
+	EndProjectSection
+EndProject
+Global
+	GlobalSection(SolutionConfiguration) = preSolution
+		Debug = Debug
+		Profile = Profile
+		Profile_FastCap = Profile_FastCap
+		Release = Release
+		Release_LTCG = Release_LTCG
+	EndGlobalSection
+	GlobalSection(ProjectConfiguration) = postSolution
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Debug.ActiveCfg = Debug|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Debug.Build.0 = Debug|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Profile.ActiveCfg = Profile|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Profile.Build.0 = Profile|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Profile_FastCap.ActiveCfg = Profile_FastCap|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Profile_FastCap.Build.0 = Profile_FastCap|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Release.ActiveCfg = Release|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Release.Build.0 = Release|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Release_LTCG.ActiveCfg = Release_LTCG|Xbox
+		{021C5334-2823-495E-9E54-2DEC11E06040}.Release_LTCG.Build.0 = Release_LTCG|Xbox
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+	EndGlobalSection
+	GlobalSection(ExtensibilityAddIns) = postSolution
+	EndGlobalSection
+EndGlobal

BearSSL-OG/bearssl_xbox.cpp

@@ -0,0 +1,150 @@
+/*
+ * BearSSL Xbox Integration Implementation
+ * C-compatible wrappers for Xbox-specific SSL functionality
+ */
+
+#include "bearssl_xbox.h"
+#include "certificates.h"
+#include "ca_loader.h"
+#include "session_cache.h"
+#include "ssl_errors.h"
+#include "cert_pinning.h"
+
+extern "C" {
+
+/*
+ * Trust Anchor Management
+ */
+void bearssl_xbox_init_trust_anchors(void)
+{
+    certificates::initialize_trust_anchors();
+}
+
+void bearssl_xbox_cleanup_trust_anchors(void)
+{
+    certificates::close_trust_anchors();
+}
+
+br_x509_trust_anchor* bearssl_xbox_get_trust_anchors(void)
+{
+    return certificates::get_trust_anchors();
+}
+
+size_t bearssl_xbox_get_trust_anchor_count(void)
+{
+    return (size_t)certificates::get_num_trust_anchors();
+}
+
+/*
+ * Session Cache Management
+ */
+void bearssl_xbox_session_init(void)
+{
+    session_cache::initialize();
+}
+
+void bearssl_xbox_session_shutdown(void)
+{
+    session_cache::shutdown();
+}
+
+int bearssl_xbox_session_get(const char* hostname, br_ssl_session_parameters* params)
+{
+    return session_cache::get(hostname, params) ? 1 : 0;
+}
+
+void bearssl_xbox_session_store(const char* hostname, const br_ssl_session_parameters* params)
+{
+    session_cache::store(hostname, params);
+}
+
+void bearssl_xbox_session_remove(const char* hostname)
+{
+    session_cache::remove(hostname);
+}
+
+void bearssl_xbox_session_clear(void)
+{
+    session_cache::clear();
+}
+
+/*
+ * Error Message Utilities
+ */
+const char* bearssl_xbox_error_string(int error)
+{
+    return ssl_errors::error_to_string(error);
+}
+
+const char* bearssl_xbox_alert_string(int alert_code)
+{
+    return ssl_errors::alert_to_string(alert_code);
+}
+
+/*
+ * CA Loader
+ */
+int bearssl_xbox_load_ca_file(const char *path,
+    br_x509_trust_anchor **anchors_out, size_t *count_out)
+{
+    return ca_loader::load_pem_file(path, anchors_out, count_out);
+}
+
+void bearssl_xbox_free_loaded_anchors(br_x509_trust_anchor *anchors,
+    size_t count)
+{
+    ca_loader::free_trust_anchors(anchors, count);
+}
+
+int bearssl_xbox_update_trust_store(void)
+{
+    return ca_loader::update_trust_store(
+        BEARSSL_XBOX_DEFAULT_CA_FILE,
+        certificates::get_trust_anchors(),
+        (size_t)certificates::get_num_trust_anchors());
+}
+
+/*
+ * Certificate Pinning
+ */
+void bearssl_xbox_pin_init(void)
+{
+    cert_pinning::initialize();
+}
+
+void bearssl_xbox_pin_shutdown(void)
+{
+    cert_pinning::shutdown();
+}
+
+int bearssl_xbox_pin_add(const char* hostname, const unsigned char* sha256_hash)
+{
+    return cert_pinning::add_pin(hostname, sha256_hash) ? 1 : 0;
+}
+
+void bearssl_xbox_pin_remove(const char* hostname)
+{
+    cert_pinning::remove_pin(hostname);
+}
+
+void bearssl_xbox_pin_clear(void)
+{
+    cert_pinning::clear();
+}
+
+int bearssl_xbox_pin_has(const char* hostname)
+{
+    return cert_pinning::has_pin(hostname) ? 1 : 0;
+}
+
+int bearssl_xbox_pin_verify_hash(const char* hostname, const unsigned char* cert_sha256)
+{
+    return cert_pinning::verify_hash(hostname, cert_sha256) ? 1 : 0;
+}
+
+int bearssl_xbox_pin_get_hash(const char* hostname, unsigned char* hash_out)
+{
+    return cert_pinning::get_pin_hash(hostname, hash_out) ? 1 : 0;
+}
+
+} /* extern "C" */

BearSSL-OG/bearssl_xbox.h

@@ -0,0 +1,85 @@
+/*
+ * BearSSL Xbox Integration Header
+ * C-compatible wrappers for Xbox-specific SSL functionality
+ *
+ * This provides a C interface to the C++ classes for use by libcurl's bearssl.c
+ */
+
+#ifndef BEARSSL_XBOX_H
+#define BEARSSL_XBOX_H
+
+#include <bearssl.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Default CA bundle path on Xbox HDD.
+ * T:\ maps to E:\TDATA\<TitleID>\ (title-persistent storage).
+ * Drop cacert.pem there to use updated root CAs without recompiling.
+ */
+#define BEARSSL_XBOX_DEFAULT_CA_FILE "T:\\cacert.pem"
+
+/*
+ * Trust Anchor Management
+ * Wraps certificates.cpp functionality
+ */
+void bearssl_xbox_init_trust_anchors(void);
+void bearssl_xbox_cleanup_trust_anchors(void);
+br_x509_trust_anchor* bearssl_xbox_get_trust_anchors(void);
+size_t bearssl_xbox_get_trust_anchor_count(void);
+
+/*
+ * Session Cache Management
+ * Wraps session_cache.cpp functionality
+ */
+void bearssl_xbox_session_init(void);
+void bearssl_xbox_session_shutdown(void);
+int bearssl_xbox_session_get(const char* hostname, br_ssl_session_parameters* params);
+void bearssl_xbox_session_store(const char* hostname, const br_ssl_session_parameters* params);
+void bearssl_xbox_session_remove(const char* hostname);
+void bearssl_xbox_session_clear(void);
+
+/*
+ * Error Message Utilities
+ * Wraps ssl_errors.cpp functionality
+ */
+const char* bearssl_xbox_error_string(int error);
+const char* bearssl_xbox_alert_string(int alert_code);
+
+/*
+ * CA Loader - Runtime PEM certificate loading
+ * Wraps ca_loader.cpp functionality
+ */
+int  bearssl_xbox_load_ca_file(const char *path,
+         br_x509_trust_anchor **anchors_out, size_t *count_out);
+void bearssl_xbox_free_loaded_anchors(br_x509_trust_anchor *anchors,
+         size_t count);
+
+/*
+ * CA Auto-Update
+ * Downloads cacert.pem from curl.se if not already present on disk.
+ * Uses the compiled-in trust anchors (must be initialized first).
+ * Returns 0 on success (file existed or was downloaded), -1 on failure.
+ */
+int  bearssl_xbox_update_trust_store(void);
+
+/*
+ * Certificate Pinning
+ * Wraps cert_pinning.cpp functionality
+ */
+void bearssl_xbox_pin_init(void);
+void bearssl_xbox_pin_shutdown(void);
+int  bearssl_xbox_pin_add(const char* hostname, const unsigned char* sha256_hash);
+void bearssl_xbox_pin_remove(const char* hostname);
+void bearssl_xbox_pin_clear(void);
+int  bearssl_xbox_pin_has(const char* hostname);
+int  bearssl_xbox_pin_verify_hash(const char* hostname, const unsigned char* cert_sha256);
+int  bearssl_xbox_pin_get_hash(const char* hostname, unsigned char* hash_out);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* BEARSSL_XBOX_H */

BearSSL-OG/ca_loader.h

@@ -0,0 +1,65 @@
+#pragma once
+
+#include <bearssl_x509.h>
+#include <stddef.h>
+#include <stdint.h>
+
+/*
+ * Runtime CA certificate loader.
+ *
+ * Parses PEM-encoded CA bundle files (e.g. cacert.pem from curl.se)
+ * into br_x509_trust_anchor arrays that BearSSL can use for certificate
+ * verification.
+ *
+ * Also provides auto-update: downloads a fresh CA bundle over HTTPS
+ * using the compiled-in trust anchors (with time validation bypassed)
+ * and saves it to title-persistent storage on the Xbox HDD.
+ */
+
+/* Where to download the CA bundle from */
+#define CA_BUNDLE_HOST "curl.se"
+#define CA_BUNDLE_PATH "/ca/cacert.pem"
+#define CA_BUNDLE_PORT 443
+
+class ca_loader
+{
+public:
+	/*
+	 * Load trust anchors from a PEM CA bundle file.
+	 * Returns 0 on success, -1 on failure.
+	 */
+	static int load_pem_file(const char *path,
+		br_x509_trust_anchor **anchors_out, size_t *count_out);
+
+	/*
+	 * Free trust anchors that were loaded from a PEM file.
+	 * Deep-frees DN data and key data, then frees the array.
+	 */
+	static void free_trust_anchors(br_x509_trust_anchor *anchors,
+		size_t count);
+
+	/*
+	 * Auto-update the trust store.
+	 *
+	 * If save_path does not exist, downloads a fresh CA bundle from
+	 * curl.se over HTTPS (using the provided trust anchors with time
+	 * validation disabled) and saves it to save_path.
+	 *
+	 * Returns 0 on success (file already existed or was downloaded).
+	 * Returns -1 on failure (download failed, file I/O error, etc.).
+	 */
+	static int update_trust_store(const char *save_path,
+		br_x509_trust_anchor *anchors, size_t anchor_count);
+
+private:
+	/*
+	 * Download an HTTPS resource and save to a file.
+	 * Uses BearSSL with the given trust anchors (time check disabled).
+	 * Follows up to max_redirects HTTP 301/302 redirects.
+	 * Returns 0 on success, -1 on failure.
+	 */
+	static int download_https(const char *host, const char *path,
+		uint16_t port, const char *save_path,
+		br_x509_trust_anchor *anchors, size_t anchor_count,
+		int max_redirects);
+};

BearSSL-OG/cert-ee-ec+rsa.pem

@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICcTCCAVmgAwIBAgIUbmO7Sc5BfgOM9Ubyiq5hCDWwlLMwDQYJKoZIhvcNAQELBQAwJzELMAkG
+A1UEBhMCQ0ExGDAWBgNVBAMTD0ludGVybWVkaWF0ZSBDQTAeFw0xMDAxMDEwMDAwMDBaFw0zNzEy
+MzEyMzU5NTlaMCExCzAJBgNVBAYTAkNBMRIwEAYDVQQDEwlsb2NhbGhvc3QwWTATBgcqhkjOPQIB
+BggqhkjOPQMBBwNCAARfOJ2n/02Kr/Y0OUYa/Drf9COqqer7xQjeAI6+eaU3WExt3QHKq0ffibbH
+Fx84/B0gFN1FwOCPk044C/zpmaFJo2YwZDAfBgNVHSMEGDAWgBR8z6PGKffzxaoZ0MAW6+BAD85E
+pzAdBgNVHQ4EFgQUww6GqnW0FcDllQkyvl6SdankRJswDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL
+gglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggEBAI6JY6ebqBCOnhjQpHrdLIIWjwsO1cpXu19v
+/FcowCG6rZSoF0JF1zH3hFcZRiQ8x0k4P0h6CRrrUbrFdY5MsiWwxyI+5+VG27E2/BuFUbDtgxbw
+OnnaXShq7mogTLBwXrDtem0tGsm0ccLEox0lhjBUsZgmwVHg+DGtZ0id5qFSOyBHyXDagLWk9D9y
+azcwVzksRptE8dlOu6Zf45rFf2y2Zcu/QHKS0Gj2rnl+JMFbaDAoU3FhevQ2ezvCtuwf3DBABA3q
+swrPddO9nqtxcWh/pUFSAOmzruQe8btpxjvV3tLCJWkIPDfM94Jq5ah7agLavaQBMzPz3kYA7HXP
+4H0=
+-----END CERTIFICATE-----

BearSSL-OG/cert-ee-ec.pem

@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBsDCCAVagAwIBAgIUHE0AkWniRqyQfGRcU/H/t8HLbnowCgYIKoZIzj0EAwIwJzELMAkGA1UE
+BhMCQ0ExGDAWBgNVBAMTD0ludGVybWVkaWF0ZSBDQTAeFw0xMDAxMDEwMDAwMDBaFw0zNzEyMzEy
+MzU5NTlaMCExCzAJBgNVBAYTAkNBMRIwEAYDVQQDEwlsb2NhbGhvc3QwWTATBgcqhkjOPQIBBggq
+hkjOPQMBBwNCAARfOJ2n/02Kr/Y0OUYa/Drf9COqqer7xQjeAI6+eaU3WExt3QHKq0ffibbHFx84
+/B0gFN1FwOCPk044C/zpmaFJo2YwZDAfBgNVHSMEGDAWgBTw0PEi+XpIFwZ7Pb249c1VnFw+cDAd
+BgNVHQ4EFgQUww6GqnW0FcDllQkyvl6SdankRJswDAYDVR0TAQH/BAIwADAUBgNVHREEDTALggls
+b2NhbGhvc3QwCgYIKoZIzj0EAwIDSAAwRQIhAJH79ATQ5S4B1IzwF2IP3MyAyhjEQHwnA8s0Aw2b
+yFlNAiAFVWni2KFAMzQOfkkyZB0/ax/QLbcvUgRWr9M3j4eZog==
+-----END CERTIFICATE-----

BearSSL-OG/cert-ee-rsa.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIIDPDCCAiSgAwIBAgIUWNq6Ns3toNpcEDNzjgxkknmSrwMwDQYJKoZIhvcNAQELBQAwJzELMAkG
+A1UEBhMCQ0ExGDAWBgNVBAMTD0ludGVybWVkaWF0ZSBDQTAeFw0xMDAxMDEwMDAwMDBaFw0zNzEy
+MzEyMzU5NTlaMCExCzAJBgNVBAYTAkNBMRIwEAYDVQQDEwlsb2NhbGhvc3QwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDUeh0nuis6Z7KRavvng0TK7Rx1rd1Ng2LWqmiVsiQhexWuKplo
+Fe1m8LhY59P1LsbZKl7nDi7n/GdZwMhhfUukb92f2ciFh2THuhoPKdSWqHiaa2IgqTLQ7qmMKGFH
+olAqY/Yh3trY1fB/xQCCcOajv1yJJ09RkncDw7DMLjvsI/IvU0GviZP/0oCxQ5fe1hmgkhJ6PWZ5
+4cG84Xdwoos9RoRTP+ROQkE3kh4f/Tiz9++HOYDTVs/04BPeZLBypAOExEHtb/o+4soEINLX3CyC
+K3ribaEcSNvPiU80lz0oqFPa58HhcxWjMHZ/jyNCFD1RNNJarTyby8j+f26OQPO9AgMBAAGjZjBk
+MB8GA1UdIwQYMBaAFMUBrXzmY8mcF1/FoqfhUF/o9ajGMB0GA1UdDgQWBBTFAa185mPJnBdfxaKn
+4VBf6PWoxjAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsF
+AAOCAQEAcbNdIcIO19DG+Epzh00iAifQx/j9Gm1iWIIIdiAHwEiS8+mYWusNTlaVY2hNq9QAduA3
+zwsRYVlc3valFFnZJZ9Z2dNehqwdpiwyQhkyE0ALVM1nJra9tJakyh9/N9aodes6gVEwuflKAW/R
+1u1P3z8wYAZnko5hhV8atYyzD2Gp+t9dxGQA6oexM199y6OFJG4sZTvqcz+G0/3o5ALGYWomF1IB
+JVx/qM5pH6xhLLcEr/2kepnLJhVM/3TUcwxXDCbr1yrcXMNBu8Lzzha9jnv76d+rIQ2Rs43Yz8j0
+SbnQ4xZwP7Pe1Acl+kZEUolNicjiyrUzf8chvSjv/mZ0Aw==
+-----END CERTIFICATE-----

BearSSL-OG/cert-ica-ec.pem

@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBqTCCAU6gAwIBAgIUINPr4oz+2uajLF478mY6KzZ7sMowCgYIKoZIzj0EAwIwHDELMAkGA1UE
+BhMCQ0ExDTALBgNVBAMTBFJvb3QwHhcNMTAwMTAxMDAwMDAwWhcNMzcxMjMxMjM1OTU5WjAnMQsw
+CQYDVQQGEwJDQTEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0D
+AQcDQgAEcC6SggEXbG2r4dFjCUhJ0qY1UtM8c7uyiDeYh/GN4Oxlmg4T9e2RYci2bTOEbq6OVYDN
+SZ4Hv9CunebQsycWoaNjMGEwHwYDVR0jBBgwFoAUlUG04meq8X+8j3nzaBRaa5IWokAwHQYDVR0O
+BBYEFPDQ8SL5ekgXBns9vbj1zVWcXD5wMA4GA1UdDwEB/wQEAwIAhjAPBgNVHRMBAf8EBTADAQH/
+MAoGCCqGSM49BAMCA0kAMEYCIQCF40ZomdYCellmHLdPNS0INjhhfgVI2GlDH+tW6a0GDgIhAIJw
+tGIDSUbIVFkF2XjbUxzgbmb1DxQ7yS04EnCRVvmp
+-----END CERTIFICATE-----

BearSSL-OG/cert-ica-rsa.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIIDNDCCAhygAwIBAgIUcA9g7vAHmpxprJdiJk9dBbb5j0gwDQYJKoZIhvcNAQELBQAwHDELMAkG
+A1UEBhMCQ0ExDTALBgNVBAMTBFJvb3QwHhcNMTAwMTAxMDAwMDAwWhcNMzcxMjMxMjM1OTU5WjAn
+MQswCQYDVQQGEwJDQTEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIENBMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAs+hrr5wWUuOBDFCrJc7MDcfyH39Q3yxcNdZiLmMnQafkU6hLJ/oTkaP6
+CUovO17Pd7OKwc1JlZx1DWR07+TXS7mhm2jSMHFI6vdLFN8/R6nYu+yPKMz637QflHyW/AgFKPno
+9C8v7mKcijrghVhgtg8tMLTAQVSRTB9frfEZ8MAipn3YP3k0WUJ7W7VBxGR/Us88NyKhL3kllCRB
+wj/6x3X7SLUNGKf0VPMubthDWMSrUOgFrZG2HgF1s1Sc3qCZFfus8VyXSVHM71gSb3NrszQUAQ9a
+nfqq1pPT4urDq7xO7cxRobj4lLa0LKiGKx/2UUMpUl4TibNqeGBOTsAbpQIDAQABo2MwYTAfBgNV
+HSMEGDAWgBTDCry0kGOWkkW8J6DwWIkq1XgAEjAdBgNVHQ4EFgQUfM+jxin388WqGdDAFuvgQA/O
+RKcwDgYDVR0PAQH/BAQDAgCGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFQ7
+9OrG5OjAWxKyrfq9qfRiA61XTG8Hp0c1dT5IoltxEAGPk5mdp0fjjj6vLboG/tTkl7wQjaalOjzm
+Ics72hPjSiPrvLqlkJGtVW7V3YVLayfSOXYGLtQjW7tVtUk/fS8hy5Z1GZmpmfELuz7HEKeLelK5
+SeQUCHjnPdmYV9r/2rmNZnWAtV2532ll2xbnHsRA5EaKHnYyFueDZ9p4VqsPTFzxcNpmIPT4D/bc
+L3KXa3hAeZ1bbb4DznBCqCpxEd8ugQHqhhKRT9AY7YSkSDC5uXtWPu+N4R/9kLJEhVhvpzB0fPGu
+jJk/8U1XxZVowjay7MJoesCBqVUF58+vUKw=
+-----END CERTIFICATE-----

BearSSL-OG/cert-root-ec.pem

@@ -0,0 +1,9 @@
+-----BEGIN CERTIFICATE-----
+MIIBijCCATCgAwIBAgIBCTAKBggqhkjOPQQDAjAcMQswCQYDVQQGEwJDQTENMAsGA1UEAxMEUm9v
+dDAeFw0xMDAxMDEwMDAwMDBaFw0zNzEyMzEyMzU5NTlaMBwxCzAJBgNVBAYTAkNBMQ0wCwYDVQQD
+EwRSb290MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcXS6q7kwLoHV5Vf58yBoDJz5ZNu0IA1t
+6kDQSm5C/baaaCVE9t97xPze3Xu7xdt8dj9BZkBu26eHwuXYxfN/jaNjMGEwHwYDVR0jBBgwFoAU
+lUG04meq8X+8j3nzaBRaa5IWokAwHQYDVR0OBBYEFJVBtOJnqvF/vI9582gUWmuSFqJAMA4GA1Ud
+DwEB/wQEAwIAhjAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIQCz1GCIAoRtqU2h
+x62hec7E+/XxnUGDORWnkliiGrcmxQIgNPq9NHD7ts0xYjTwZsd0bN62+iY93lM4LHbkNV9q/gA=
+-----END CERTIFICATE-----