funman300
84e81f2037
The redirector was the only host that spoke TLS, so its TLS lived inside
it. The roster host needs the same listener, and that made the choice
explicit: share this code or copy it.
Copying it is what already went wrong. On 2026-08-11 the Rust redirector
served one certificate while the container served another. ProtoSSL
caches the server certificate per backend, so the redirector -- the first
TLS connection of a session -- decided what the client expected, and
every later service failed its handshake. Silently: Python's socketserver
swallows ssl.SSLError as OSError. Three gates went to it. One place to
configure TLS is the structural fix, so it exists before the second host
does rather than after.
Split along the line the architecture already draws:
openfut-tls how to build an acceptor. Game-independent.
Knows nothing about which suites any client
offers.
adapter-fifa17::tls what FIFA 17 was OBSERVED to offer: the six
enabled suites, the two refused, the TLS 1.2
window, the EA SNI. Plain strings, so the
adapter keeps its lean dependencies -- reading
a card table should not build OpenSSL.
redirector-host joins the two. Chooses no cipher of its own.
Behaviour is unchanged, and shown to be:
* tests/fifa17_tls_profile.rs carries over every case from the deleted
module -- FIFA's eight suites negotiate AES256-GCM-SHA384, each enabled
suite works alone, RC4-only is refused, ECDHE-only is refused. Deleting
a module must not quietly delete its evidence.
* one test pins the composed values literally against the host as it was
when gates 1-14 passed. A "pure refactor" that cannot fail is not a
claim, it is an assumption.
* the rebuilt binary self-tests to the same TLSv1.2 / AES256-GCM-SHA384
the retail client negotiated at 17:09 today.
Two improvements fall out of having one place to look:
* the startup banner now prints cert_sha256. The mismatch above raised no
error at startup and broke the client much later with nothing logged;
it is now the first line of the log.
* tls_min/tls_max print as TLSv1.2 rather than SslVersion(771). This line
is gate evidence and gets read by people.
Nothing deployed and nothing restarted: FIFA is mid-session on the
running redirector, which is untouched.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
31 lines
1.3 KiB
TOML
31 lines
1.3 KiB
TOML
[package]
|
|
name = "openfut-redirector-host"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
license = "MIT"
|
|
description = "FIFA 17 Blaze redirector transport host (legacy TLS compatibility island)"
|
|
publish = false
|
|
|
|
[dependencies]
|
|
openfut-adapter-fifa17 = { path = "../openfut-adapter-fifa17" }
|
|
openfut-host-config = { path = "../openfut-host-config" }
|
|
# Shared legacy-TLS listener. See its manifest for why openssl and not rustls.
|
|
openfut-tls = { path = "../openfut-tls" }
|
|
|
|
# Direct openssl, NOT native-tls.
|
|
#
|
|
# This is deliberately the opposite of what native-tls is for. native-tls
|
|
# abstracts over whatever the platform provides; here the requirement is
|
|
# precise, evidenced behaviour for one legacy client that offers exactly eight
|
|
# static-RSA suites. That needs explicit control of the cipher list, protocol
|
|
# floor and ceiling, and security level — knobs the openssl crate exposes and
|
|
# native-tls deliberately hides.
|
|
#
|
|
# VENDORED, because this project's reproducibility work would be undone by a
|
|
# distro libssl update silently changing whether FIFA 17 can connect. The exact
|
|
# linked version is printed at startup and recorded in gate evidence.
|
|
#
|
|
# Scoped to THIS crate only: neither OpenFUT Core nor the generic protocol
|
|
# crates gain an OpenSSL dependency.
|
|
openssl = { version = "0.10", features = ["vendored"] }
|