aowlspt_tls.h

Source: abi/aowlspt_tls.h — 373 lines, 14 file-scope functions.

What this header owns

Reproduced verbatim from the header's own banner comment — these notes are frequently the only written record of why the subsystem is shaped the way it is.

 aowlspt_tls.h -- a TLS transport shim under the backend's HTTP loop.

Post-1.0 Escape From Tarkov talks to its backend over HTTPS on port 443 and
*disables* certificate validation, so a self-signed cert is accepted. The
emulator's poller in `aowlspt_net.h` speaks plain HTTP over raw Winsock; this
header is the transport underneath it. When the server is started in TLS mode
every accepted connection gets an OpenSSL `SSL` handle, the handshake is
driven from the same `WSAPoll` loop, and `SSL_read`/`SSL_write` replace
`recv`/`send`. Nothing above the byte stream changes: the framing, the router,
the database and every composed byte are still the nimony above.

------------------------------------------------------------------------
Why the DLLs are loaded by name rather than linked
------------------------------------------------------------------------

OpenSSL 3 ships as `libssl-3-x64.dll` + `libcrypto-3-x64.dll` in the msys2
ucrt64 toolchain this repo builds with. Linking `-lssl` would need the import
library on the machine that *links*, and would make the two DLLs a hard load
dependency of `aowlspt-backend.exe` -- so a copy without them beside the exe
or on `PATH` would fail to start at all, before it could say why. Loading them
by name at runtime is the same idiom `aowlspt_overlay.h` uses for WinHTTP and
`aowlspt_net.h`/`aowllaunch` use for ws2_32/iphlpapi: a plain-HTTP test build
never touches OpenSSL, and a `--tls` run that cannot find the DLLs reports it.

------------------------------------------------------------------------
How want-read / want-write fold into the existing poll loop
------------------------------------------------------------------------

The poller and the workers already understand exactly one "not now" signal:
`recv`/`send` returning < 0 with `WSAGetLastError() == WSAEWOULDBLOCK`. So the
one-shot read/write helpers here translate OpenSSL's `SSL_ERROR_WANT_READ` and
`SSL_ERROR_WANT_WRITE` into precisely that -- they set `WSAEWOULDBLOCK` and
return -1 -- and translate a clean TLS close into a 0 return, the same shape a
peer's orderly `recv` == 0 already has. That is what lets the transport swap
be a handful of call-site substitutions in `aowlspt_net.h` rather than a
rewrite of its state machine: every existing `WSAEWOULDBLOCK` branch, every
deadline, every re-poll is reused unchanged. The one signal that has no
`recv`/`send` analogue is a handshake that wants the socket *writable* -- a
non-blocking `SSL_do_handshake` mid-flight -- and for that the poller adds
`POLLWRNORM` to that one connection's poll events until the handshake settles.

A blocking hot-read (a worker with `SO_RCVTIMEO` set to the grace window) is
the one place `WSAEWOULDBLOCK` must *not* be synthesised: there OpenSSL's read
bottoms out in a blocking `recv` that times out with `WSAETIMEDOUT`, which the
worker reads as "hand the connection back", so a `SSL_ERROR_SYSCALL` leaves
`WSAGetLastError` exactly as the underlying transport set it.

Constants

• AOWLSPT_TLS_H
• AOWL_SSL_ERROR_NONE
• AOWL_SSL_ERROR_SYSCALL
• AOWL_SSL_ERROR_WANT_READ
• AOWL_SSL_ERROR_WANT_WRITE
• AOWL_SSL_ERROR_ZERO_RETURN
• AOWL_SSL_FILETYPE_PEM
• AOWL_SSL_VERIFY_NONE
• AOWL_TLS_SYM

Functions

Signature	Line
void aowl_trace(const char* fmt, ...)	73
void aowl_tls_set_err(const char* s)	148
void aowl_tls_pop_err(const char* prefix)	156
char aowl_tls_error(void)	168
int aowl_tls_load(void)	178
int aowl_tls_server_init(const char* certPath, const char* keyPath)	227
void aowl_tls_accept_new(SOCKET s)	255
int aowl_tls_do_handshake(void* ssl)	269
int aowl_tls_read_once(void* ssl, void* buf, int len)	283
int aowl_tls_write_once(void* ssl, const void* buf, int len)	305
int aowl_tls_pending(void* ssl)	321
void aowl_tls_conn_free(void* ssl)	327
int aowl_tls_spawn(const char* cmdline)	337
int aowl_tls_gencert(const char* openssl, const char* cert, const char* key)	362