Fix NX, add constant time compare

.gitea/workflows/tag.yaml

@@ -11,12 +11,11 @@ env:
 jobs:
   build-ppc:
     name: "🔨 Build for PowerPC"
-    runs-on: asrock
+    runs-on: msi-walmart
     container: 
       image: git.tesses.org/tesses50/linux-ppc:latest
     steps:
       - uses: actions/checkout@v4
-        url: https://git.tesses.org/tesses50/tessesframework.git
       - run: bash build-for-ppc.sh
       - uses: akkuman/gitea-release-action@v1
         env:
@@ -27,7 +26,7 @@ jobs:
             artifacts/** 
   update-tap-and-build-win32:
     name: "🔨 Build win32 and update the tap 🍺"
-    runs-on: msi-walmart
+    runs-on: asrock
     container: git.tesses.org/tesses50/global-containers-mingw:latest
     steps:
       - uses: actions/checkout@v4
@@ -73,11 +72,11 @@ jobs:
             nfpmName: "386"
             debianName: "i386-linux-gnu"
           - container: "git.tesses.org/tesses50/linux-arm:latest"
-            puter: "fw13-ubuntu-latest"
+            puter: "msi-walmart"
             nfpmName: "arm7"
             debianName: "arm-linux-gnueabihf"
           - container: "git.tesses.org/tesses50/linux-arm64:latest"
-            puter: "msi-walmart"
+            puter: "asrock"
             nfpmName: "arm64"
             debianName: "aarch64-linux-gnu"
           - container: "git.tesses.org/tesses50/linux-riscv64:latest"

README.md

@@ -30,6 +30,7 @@ Tesses Framework
 - MacOS
 - FreeBSD (including GhostBSD)
 - NetBSD
+- Haiku (only static builds work as of right now)
 - Wii (using libogc2, may be broken)
 - Switch (using libnx, may be broken)
 - Android (kinda, uses legacy and hardcoded /sdcard api unless you use TF_AllowPortable(std::string))

changelog.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 0.0.10
+Fix NX, add constant time compare
+
 ## 0.0.9
 Make html parser use case insensitive unordered_map for attributes
 

cmake/findmbed.cmake

@@ -11,7 +11,7 @@ endif()
 
 FetchContent_Declare(
     mbedtls
-    URL https://downloads.tesses.net/cache/libraries/source/mbedtls-3.6.4.tar.bz2
+    URL https://downloads.tesses.net/cache/libraries/source/mbedtls-3.6.7.tar.bz2
 
 )
 if(NOT mbedtls_POPULATED)

cmake/version.cmake

@@ -1,3 +1,3 @@
 set(TESSESFRAMEWORK_MAJOR_VERSION 0)
 set(TESSESFRAMEWORK_MINOR_VERSION 0)
-set(TESSESFRAMEWORK_PATCH_VERSION 9)
+set(TESSESFRAMEWORK_PATCH_VERSION 10)

include/TessesFramework/Common.hpp

@@ -36,8 +36,11 @@
 #include <string>
 #include <vector>
 
+
+
 namespace Tesses::Framework {
 
+
 class TF_Timer_Handle;
 // Used for internal purposes, don't use unless you want to run timer events on
 // another thread

include/TessesFramework/Crypto/Crypto.hpp

@@ -316,6 +316,9 @@ typedef enum {
  */
 bool PBKDF2(std::vector<uint8_t> &output, std::string pass,
             std::vector<uint8_t> &salt, long itterations, ShaVersion version);
+
+bool ConstantEquals(const std::vector<uint8_t>& left, const std::vector<uint8_t>& right);
+
 /**
  * @brief Get secure random bytes
  *

include/TessesFramework/Streams/NetworkStream.hpp

@@ -80,6 +80,7 @@ class NetworkStream : public Stream {
     size_t ReadFrom(uint8_t *buff, size_t sz, std::string &ip, uint16_t &port);
     size_t WriteTo(const uint8_t *buff, size_t sz, std::string ip,
                    uint16_t port);
+    
     static std::vector<std::pair<std::string, std::string>>
     GetIPs(bool ipV6 = false);
 

include/TessesFramework/Streams/Stream.hpp

@@ -35,6 +35,7 @@ class Stream {
     virtual size_t Write(const uint8_t *buff, size_t sz);
     size_t ReadBlock(uint8_t *buff, size_t sz);
     void WriteBlock(const uint8_t *buff, size_t sz);
+    
     virtual bool CanRead();
     virtual bool CanWrite();
     virtual bool CanSeek();

src/Crypto/MbedTLS/ClientTLSStream.cpp

@@ -35,6 +35,7 @@ using StreamReader = Tesses::Framework::TextStreams::StreamReader;
 #include <mbedtls/net_sockets.h>
 #include <mbedtls/ssl.h>
 #include <mbedtls/x509.h>
+#include <mbedtls/version.h>
 #endif
 #include <cstring>
 using namespace Tesses::Framework::Streams;
@@ -56,7 +57,6 @@ class ClientTLSPrivateData {
     mbedtls_pk_context client_key;
 
     ~ClientTLSPrivateData() {
-        strm->SetSendTimeout((uint64_t)7);
         mbedtls_ssl_close_notify(&ssl);
         if (mTLS) {
             mbedtls_x509_crt_free(&client_cert);
@@ -127,15 +127,23 @@ ClientTLSStream::ClientTLSStream(
     if ((ret = mbedtls_ctr_drbg_seed(
              &data->ctr_drbg, mbedtls_entropy_func, &data->entropy,
              (const unsigned char *)pers, strlen(pers))) != 0) {
-        printf("FAILED mbedtls_ctr_drbg_seed\n");
+        
-        return;
+        char buffer[100];
+        mbedtls_strerror(ret, buffer, sizeof(buffer));
+        std::string msg = "mbedtls_ctr_drbg_seed failed: " + std::string(buffer);
+         delete data;
+        throw std::runtime_error(msg);
     }
 
     ret = mbedtls_x509_crt_parse(
         &data->cachain, (const unsigned char *)cert.c_str(), cert.size() + 1);
     if (ret != 0) {
-        printf("FAILED mbedtls_x509_crt_parse cert %i\n", ret);
+         char buffer[100];
-        return;
+        mbedtls_strerror(ret, buffer, sizeof(buffer));
+        std::string msg = "mbedtls_x509_crt_parse failed: " + std::string(buffer);
+         delete data;
+        throw std::runtime_error(msg);
+            
     }
 
     if ((ret = mbedtls_ssl_config_defaults(&data->conf, MBEDTLS_SSL_IS_CLIENT,
@@ -143,8 +151,9 @@ ClientTLSStream::ClientTLSStream(
                                            MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
         char buffer[100];
         mbedtls_strerror(ret, buffer, sizeof(buffer));
-        printf("FAILED mbedtls_ssl_conf_defaults %s\n", buffer);
+        std::string msg = "mbedtls_ssl_conf_defaults failed: " + std::string(buffer);
-        return;
+         delete data;
+        throw std::runtime_error(msg);
     }
 
     mbedtls_ssl_conf_rng(&data->conf, mbedtls_ctr_drbg_random, &data->ctr_drbg);
@@ -161,18 +170,25 @@ ClientTLSStream::ClientTLSStream(
     mbedtls_ssl_set_bio(&data->ssl, static_cast<void *>(data), strm_send,
                         strm_recv, NULL);
     if ((ret = mbedtls_ssl_setup(&data->ssl, &data->conf) != 0)) {
-        printf("FAILED mbedtls_ssl_setup %i\n", ret);
+        char errbuf[100];
-        return;
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
+        std::string msg = "SSL setup failed: " + std::string(errbuf);
+         delete data;
+        throw std::runtime_error(msg);
     }
     if ((ret = mbedtls_ssl_set_hostname(&data->ssl, domain.c_str()) != 0)) {
-        printf("FAILED mbedtls_ssl_set_hostname %i\n", ret);
+        char errbuf[100];
-        return;
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
+         delete data;
+        throw std::runtime_error("mbedtls_ssl_set_hostname failed: " + std::string(errbuf));
     }
     if ((ret = mbedtls_ssl_handshake(&data->ssl)) != 0) {
-        char buffer[100];
+       
-        mbedtls_strerror(ret, buffer, sizeof(buffer));
+         char errbuf[100];
-        printf("FAILED mbedtls_ssl_handshake %s\n", buffer);
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
-        return;
+         delete data;
+        throw std::runtime_error("mbedtls_ssl_handshake failed: " + std::string(errbuf));
+    
     }
     uint32_t flags;
     if ((flags = mbedtls_ssl_get_verify_result(&data->ssl)) != 0) {
@@ -224,16 +240,20 @@ ClientTLSStream::ClientTLSStream(
     if ((ret = mbedtls_ctr_drbg_seed(
              &data->ctr_drbg, mbedtls_entropy_func, &data->entropy,
              (const unsigned char *)pers, strlen(pers))) != 0) {
-        printf("FAILED mbedtls_ctr_drbg_seed\n");
+        char errbuf[100];
-        return;
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
+         delete data;
+        throw std::runtime_error("mbedtls_ctr_drbg_seed failed: " + std::string(errbuf));
     }
 
     ret = mbedtls_x509_crt_parse(
         &data->cachain, (const unsigned char *)cert.c_str(), cert.size() + 1);
 
     if (ret != 0) {
-        printf("FAILED mbedtls_x509_crt_parse chain %i\n", ret);
+        char errbuf[100];
-        return;
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
+         delete data;
+        throw std::runtime_error("mbedtls_x509_crt_parse chain failed: " + std::string(errbuf));
     }
 
     ret = mbedtls_x509_crt_parse(
@@ -241,30 +261,44 @@ ClientTLSStream::ClientTLSStream(
         keyStore.certificate.size() + 1);
 
     if (ret != 0) {
-        printf("FAILED mbedtls_x509_crt_parse client_certificate %i\n", ret);
+
-        return;
+        char errbuf[100];
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
+         delete data;
+        throw std::runtime_error("mbedtls_x509_crt_parse client_certificate failed: " + std::string(errbuf));
+    
     }
 
     ret = mbedtls_pk_parse_key(
-        &data->client_key, (const unsigned char *)keyStore.certificate.c_str(),
+        &data->client_key, (const unsigned char *)keyStore.key.c_str(),
-        keyStore.certificate.size() + 1,
+        keyStore.key.size() + 1,
         keyStore.password.empty()
             ? NULL
             : (const unsigned char *)keyStore.password.c_str(),
-        keyStore.password.size(), mbedtls_entropy_func, &data->entropy);
+        keyStore.password.size() + 1
+        #if MBEDTLS_VERSION_MAJOR == 3
+        , mbedtls_entropy_func, &data->entropy
+        #endif
+    );
 
     if (ret != 0) {
-        printf("FAILED mbedtls_x509_crt_parse client_certificate %i\n", ret);
+                char errbuf[100];
-        return;
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
+        delete data;
+        throw std::runtime_error("mbedtls_pk_parse_key failed: " + std::string(errbuf));
+    
+
     }
 
     if ((ret = mbedtls_ssl_config_defaults(&data->conf, MBEDTLS_SSL_IS_CLIENT,
                                            MBEDTLS_SSL_TRANSPORT_STREAM,
                                            MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
-        char buffer[100];
+        
-        mbedtls_strerror(ret, buffer, sizeof(buffer));
+        char errbuf[100];
-        printf("FAILED mbedtls_ssl_conf_defaults %s\n", buffer);
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
-        return;
+        delete data;
+        throw std::runtime_error("mbedtls_ssl_conf_defaults failed: " + std::string(errbuf));
+    
     }
 
     mbedtls_ssl_conf_rng(&data->conf, mbedtls_ctr_drbg_random, &data->ctr_drbg);
@@ -284,18 +318,26 @@ ClientTLSStream::ClientTLSStream(
     mbedtls_ssl_set_bio(&data->ssl, static_cast<void *>(data), strm_send,
                         strm_recv, NULL);
     if ((ret = mbedtls_ssl_setup(&data->ssl, &data->conf) != 0)) {
-        printf("FAILED mbedtls_ssl_setup %i\n", ret);
+    
-        return;
+         char errbuf[100];
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
+        delete data;
+        throw std::runtime_error("mbedtls_ssl_setup failed: " + std::string(errbuf));
+    
     }
     if ((ret = mbedtls_ssl_set_hostname(&data->ssl, domain.c_str()) != 0)) {
-        printf("FAILED mbedtls_ssl_set_hostname %i\n", ret);
+        char errbuf[100];
-        return;
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
+        delete data;
+        throw std::runtime_error("mbedtls_ssl_set_hostname failed: " + std::string(errbuf));
     }
     if ((ret = mbedtls_ssl_handshake(&data->ssl)) != 0) {
-        char buffer[100];
+        
-        mbedtls_strerror(ret, buffer, sizeof(buffer));
+         char errbuf[100];
-        printf("FAILED mbedtls_ssl_handshake %s\n", buffer);
+        mbedtls_strerror(ret, errbuf, sizeof(errbuf));
-        return;
+        delete data;
+        throw std::runtime_error("mbedtls_ssl_handshake failed: " + std::string(errbuf));
+    
     }
     uint32_t flags;
     if ((flags = mbedtls_ssl_get_verify_result(&data->ssl)) != 0) {
@@ -327,10 +369,16 @@ size_t ClientTLSStream::Read(uint8_t *buffer, size_t len) {
         return 0;
     int r = mbedtls_ssl_read(&priv->ssl, buffer, len);
 
-    if (r == -30848) {
+    if (r == 0) {
         priv->eos = true;
         return 0;
     }
+    if (r < 0) {
+        char errbuf[100];
+        mbedtls_strerror(r, errbuf, sizeof(errbuf));
+        std::string msg = "Read failed: " + std::string(errbuf);
+        throw std::runtime_error(msg);
+    }
     return (size_t)r;
 #else
     return (size_t)0;
@@ -342,6 +390,16 @@ size_t ClientTLSStream::Write(const uint8_t *buffer, size_t len) {
     if (!priv->success)
         return 0;
     int r = mbedtls_ssl_write(&priv->ssl, buffer, len);
+    if (r == 0) {
+        priv->eos = true;
+        return 0;
+    }
+    if (r < 0) {
+        char errbuf[100];
+        mbedtls_strerror(r, errbuf, sizeof(errbuf));
+        std::string msg = "Write failed: " + std::string(errbuf);
+        throw std::runtime_error(msg);
+    }
     return (size_t)r;
 #else
     return (size_t)0;

src/Crypto/MbedTLS/Crypto.cpp

@@ -377,4 +377,20 @@ bool RandomBytes(std::vector<uint8_t> &output, std::string personal_str) {
 #endif
     return false;
 }
+bool ConstantEquals(const std::vector<uint8_t>& left, const std::vector<uint8_t>& right)
+{
+    if (left.size() != right.size()) return false;
+    if (left.empty()) return true;
+
+    const auto* pa = left.data();
+    const auto* pb = right.data();
+    const auto n   = left.size();
+
+    uint8_t diff = 0;
+    for (size_t i = 0; i < n; i++)
+        diff |= pa[i] ^ pb[i];
+
+    return diff == 0;
+}
+
 } // namespace Tesses::Framework::Crypto

src/Filesystem/LocalFS.cpp

@@ -282,13 +282,23 @@ FIFOCreationResult LocalFilesystem::CreateFIFO(VFSPath path, uint32_t mod) {
 void LocalFilesystem::Lock(VFSPath path) {
     auto p2 = VFSPathToSystem(path);
     const char *fopenPath = p2.c_str();
-    while (true) {
+    for (int i = 0; i < 10; i++) {
         FILE *fp = fopen(fopenPath, "wx");
         if (fp) {
             fclose(fp);
-            break;
+            return;
         }
+
+        if (errno != EEXIST) {
+            std::string error_msg("Failed to acquire lock on ");
+            error_msg += p2;
+            error_msg += ": ";
+            error_msg += strerror(errno);
+            throw std::runtime_error(error_msg);
+        }
+        TF_Sleep(100);
     }
+    throw std::runtime_error("Lock acquisition timed out for " + p2);
 }
 void LocalFilesystem::Unlock(VFSPath path) {
     std::error_code error;

src/Platform/Environment.cpp

@@ -332,14 +332,18 @@ std::string GetPlatform() {
 #if TARGET_OS_WATCH
     return "Apple Watch";
 #endif
-
-#if __EMSCRIPTEN__
-    return "WebAssembly";
-#endif
-
     return "Unknown Apple Device";
 #endif
+#if defined(__EMSCRIPTEN__)
+	return "WebAssembly";
+#endif
+#if defined(__HAIKU__)
+	return "Haiku";
+#endif
+#if defined(__TessesOS__)
+	return "TessesOS";
+#endif
 
     return "Unknown";
 }
-} // namespace Tesses::Framework::Platform::Environment
+} // namespace Tesses::Framework::Platform::Environment