Fix allow_tls_v1, allow_tls_v1_1 and allow_tls_v1_2 on 32-bit platforms

`SSL_CTX_set_options` and `SSL_CTX_clear_options` were declared with a `ULong`
option mask. `ULong` is Pony's C `long`: 64 bits on 64-bit Unix, 32 bits
everywhere else. OpenSSL 3.x declares both as taking a `uint64_t`. On arm32 a
64-bit argument starts on an even-numbered register, so the 32 bits the emitted
call puts in r1 are never read, and the function ORs whatever sits in r2:r3
into the mask. `allow_tls_v1_2(false)` cannot disable TLS 1.2, its `(true)` form
cannot re-enable it, and unrelated options get set from whatever was in those
registers. I have not run this on 32-bit hardware. The emitted call and the
calling convention are what say so.

The mask is `U64` from the `_SslOpNo*` constants through to the call rather than
only at the FFI boundary. OpenSSL 3.x has option flags at bits 32 through 36,
and a `ULong` carrier would truncate every one of them to zero on 32-bit before
the call.

The other fourteen declarations corrected here are harmless on every platform
ponyc builds. Four name a pointer whose element type never reaches the ABI.
Seven name the wrong sign for a C `int` or `long`, which is the same width
either way. Three are the wrong width somewhere nobody calls them, or somewhere
the callee reads only the bits that arrive. They are corrected because a wrong
declaration is what the next one gets copied from.

`_alpn_select_cb` wrote the selected protocol's length by copying the first byte
of a `USize`, which is the low byte on little-endian and the high byte on
big-endian. ponyc builds no big-endian target, so nothing was broken. It writes
the byte through a `U8` now, and takes the pointer width from `USize(0)` rather
than from the length variable's type, which had coupled the two.

`Digest.sha224()`'s docstring named SHA-256. It calls `EVP_sha224` and returns
28 bytes.

Closes #78

Author: SeanTAllen

.release-notes/fix-allow-tls-methods-on-32-bit-platforms.md

@@ -0,0 +1,7 @@
+## Fix allow_tls_v1, allow_tls_v1_1 and allow_tls_v1_2 on 32-bit platforms
+
+`SSLContext.allow_tls_v1`, `SSLContext.allow_tls_v1_1` and `SSLContext.allow_tls_v1_2` did not change the protocol version they name, and left the context with TLS options nobody asked for. A call meant to forbid a version left it allowed, a call meant to allow one left it forbidden, and unrelated TLS features were switched on either way.
+
+This affected 32-bit builds using OpenSSL 3.x or 4.x. 64-bit builds, LibreSSL builds, and OpenSSL 1.1.x builds were never affected.
+
+These methods now change only the protocol version they name.

AGENTS.md

@@ -80,8 +80,39 @@ else
 end
 ```
 
+**One symbol whose C signature changes by version** needs two `use` statements, and the second guard must exclude the first. ponyc resolves an FFI call by enumerating every combination of the defines named in the guards, not just the one the build passes, and nothing tells it the `ssl=` defines are mutually exclusive. Overlapping guards give "Multiple possible declarations for FFI call":
+```pony
+use @SSL_CTX_set_options[U64](ctx: Pointer[_SSLContext] tag, opts: U64) if "openssl_3.0.x" or "openssl_4.0.x"
+use @SSL_CTX_set_options[ULong](ctx: Pointer[_SSLContext] tag, opts: ULong) if "openssl_1.1.x" and not ("openssl_3.0.x" or "openssl_4.0.x")
+```
+`libressl` appears in neither guard because LibreSSL reaches these options through `SSL_CTX_ctrl` instead — see LibreSSL API Divergences above.
+
+The call site needs an `ifdef` split too. Pony has no implicit numeric conversion, so one call expression cannot satisfy both parameter types.
+
+Adding a new SSL define means adding it to the exclusion list. Forgetting is safe: the enumeration finds the overlap and fails the build on every backend, not just the new one.
+
 Every ifdef chain must end with `compile_error` to catch missing defines at compile time.
 
+## FFI Type Conventions
+
+Declare the Pony type that corresponds to the C type in the header, not one that happens to be the same width on the platforms CI builds:
+
+| C type | Pony type |
+|---|---|
+| `int` / `unsigned int` | `I32` / `U32` |
+| `long` / `unsigned long` | `ILong` / `ULong` |
+| `size_t` | `USize` |
+| `uint64_t` | `U64` |
+| pointer to an opaque C struct | `Pointer[_Name]`, declaring a phantom primitive for it |
+| `void *`, or a pointer only ever passed as null | `Pointer[None]` |
+| pointer to bytes | `Pointer[U8]` |
+
+`ILong`/`ULong` track C's `long`: 32 bits on Windows and on 32-bit targets such as `arm32`, 64 bits on 64-bit Unix-like targets. `USize` tracks `size_t`, which is pointer-width. Neither is a stand-in for `uint64_t`. Reaching for `ULong` because it is 64 bits on the platform in front of you turns a correct call into a wrong one everywhere else — `SSL_CTX_set_options` takes a `uint64_t` in OpenSSL 3.x, and a `ULong` declaration passes 32 bits on every 32-bit build.
+
+A `Pointer[X]`'s element type never reaches the ABI, so `Pointer[USize]` where C says `unsigned int *` cannot break a call that passes null. It breaks the caller who later passes `addressof` a real `USize`: C writes four of the eight bytes and the rest keep whatever was in the slot, so the caller reads a garbage value.
+
+Public Pony signatures do not have to match the C types. Convert at the FFI call instead — `SSLContext.set_verify_depth` takes a `U32` and passes `depth.i32()`. Where the public type admits values the C type cannot hold, converting silently wraps: a depth above `2^31` arrives as a negative `int`. Validate at the public boundary or say so in the docstring; do not let the conversion be the whole answer.
+
 ## Key Files
 
 | File | Role |

ssl/crypto/digest.pony

@@ -4,9 +4,9 @@ use "lib:crypto"
 use "lib:bcrypt" if windows
 
 use @EVP_MD_CTX_new[Pointer[_EVPCTX]]() if "openssl_1.1.x" or "openssl_3.0.x" or "openssl_4.0.x" or "libressl"
-use @EVP_DigestInit_ex[I32](ctx: Pointer[_EVPCTX] tag, t: Pointer[_EVPMD], impl: USize)
+use @EVP_DigestInit_ex[I32](ctx: Pointer[_EVPCTX] tag, t: Pointer[_EVPMD], impl: Pointer[None])
 use @EVP_DigestUpdate[I32](ctx: Pointer[_EVPCTX] tag, d: Pointer[U8] tag, cnt: USize)
-use @EVP_DigestFinal_ex[I32](ctx: Pointer[_EVPCTX] tag, md: Pointer[U8] tag, s: Pointer[USize])
+use @EVP_DigestFinal_ex[I32](ctx: Pointer[_EVPCTX] tag, md: Pointer[U8] tag, s: Pointer[U32])
 use @EVP_DigestFinalXOF[I32](ctx: Pointer[_EVPCTX] tag, md: Pointer[U8] tag, len: USize) if "openssl_3.0.x" or "openssl_4.0.x"
 use @EVP_MD_CTX_free[None](ctx: Pointer[_EVPCTX]) if "openssl_1.1.x" or "openssl_3.0.x" or "openssl_4.0.x" or "libressl"
 
@@ -44,7 +44,7 @@ class Digest
     else
       compile_error "You must select an SSL version to use."
     end
-    @EVP_DigestInit_ex(_ctx, @EVP_md5(), USize(0))
+    @EVP_DigestInit_ex(_ctx, @EVP_md5(), Pointer[None])
 
   new ripemd160() =>
     """
@@ -57,7 +57,7 @@ class Digest
     else
       compile_error "You must select an SSL version to use."
     end
-    @EVP_DigestInit_ex(_ctx, @EVP_ripemd160(), USize(0))
+    @EVP_DigestInit_ex(_ctx, @EVP_ripemd160(), Pointer[None])
 
   new sha1() =>
     """
@@ -70,11 +70,11 @@ class Digest
     else
       compile_error "You must select an SSL version to use."
     end
-    @EVP_DigestInit_ex(_ctx, @EVP_sha1(), USize(0))
+    @EVP_DigestInit_ex(_ctx, @EVP_sha1(), Pointer[None])
 
   new sha224() =>
     """
-    Use the SHA256 algorithm to calculate the hash.
+    Use the SHA224 algorithm to calculate the hash.
     """
     _variable_length = false
     _digest_size = 28
@@ -83,7 +83,7 @@ class Digest
     else
       compile_error "You must select an SSL version to use."
     end
-    @EVP_DigestInit_ex(_ctx, @EVP_sha224(), USize(0))
+    @EVP_DigestInit_ex(_ctx, @EVP_sha224(), Pointer[None])
 
   new sha256() =>
     """
@@ -96,7 +96,7 @@ class Digest
     else
       compile_error "You must select an SSL version to use."
     end
-    @EVP_DigestInit_ex(_ctx, @EVP_sha256(), USize(0))
+    @EVP_DigestInit_ex(_ctx, @EVP_sha256(), Pointer[None])
 
   new sha384() =>
     """
@@ -109,7 +109,7 @@ class Digest
     else
       compile_error "You must select an SSL version to use."
     end
-    @EVP_DigestInit_ex(_ctx, @EVP_sha384(), USize(0))
+    @EVP_DigestInit_ex(_ctx, @EVP_sha384(), Pointer[None])
 
   new sha512() =>
     """
@@ -122,7 +122,7 @@ class Digest
     else
       compile_error "You must select an SSL version to use."
     end
-    @EVP_DigestInit_ex(_ctx, @EVP_sha512(), USize(0))
+    @EVP_DigestInit_ex(_ctx, @EVP_sha512(), Pointer[None])
 
   new shake128(size': USize = 16) =>
     """
@@ -142,7 +142,7 @@ class Digest
         _digest_size = 16
       end
       _ctx = @EVP_MD_CTX_new()
-      @EVP_DigestInit_ex(_ctx, @EVP_shake128(), USize(0))
+      @EVP_DigestInit_ex(_ctx, @EVP_shake128(), Pointer[None])
     else
       compile_error "shake128 is only supported with OpenSSL 1.1.x, 3.0.x, or 4.0.x"
     end
@@ -165,7 +165,7 @@ class Digest
         _digest_size = 32
       end
       _ctx = @EVP_MD_CTX_new()
-      @EVP_DigestInit_ex(_ctx, @EVP_shake256(), USize(0))
+      @EVP_DigestInit_ex(_ctx, @EVP_shake256(), Pointer[None])
     else
       compile_error "shake256 is only supported with OpenSSL 1.1.x, 3.0.x, or 4.0.x"
     end
@@ -194,10 +194,10 @@ class Digest
         if _variable_length then
           @EVP_DigestFinalXOF(_ctx, digest.cpointer(), size)
         else
-          @EVP_DigestFinal_ex(_ctx, digest.cpointer(), Pointer[USize])
+          @EVP_DigestFinal_ex(_ctx, digest.cpointer(), Pointer[U32])
         end
       elseif "openssl_1.1.x" or "libressl" then
-        @EVP_DigestFinal_ex(_ctx, digest.cpointer(), Pointer[USize])
+        @EVP_DigestFinal_ex(_ctx, digest.cpointer(), Pointer[U32])
       else
         compile_error "You must select an SSL version to use."
       end

ssl/net/_test.pony

@@ -35,6 +35,7 @@ actor \nodoc\ Main is TestList
     test(_TestSSLContextSetCiphersAfterDispose)
     test(_TestSSLContextSetVerifyDepthAfterDispose)
     test(_TestSSLContextAllowTlsAfterDispose)
+    test(_TestSSLContextAllowTlsV1u2)
     test(_TestSSLContextClientAfterDispose)
     test(_TestSSLContextServerAfterDispose)
     test(_TestTCPSSLWritev)
@@ -1793,13 +1794,16 @@ class \nodoc\ iso _TestSSLContextSetVerifyDepthAfterDispose is UnitTest
   dereferences the null context on every backend.
 
   There is nothing to observe beyond the call returning, so the context is
-  checked for inertness afterwards.
+  checked for inertness afterwards. The call before the dispose is the only one
+  in the suite that carries a depth into `SSL_CTX_set_verify_depth`.
   """
   fun name(): String => "net/ssl/SSLContext.set_verify_depth/after_dispose"
 
   fun apply(h: TestHelper) =>
     let ctx = SSLContext
 
+    ctx.set_verify_depth(4)
+
     ctx.dispose()
     ctx.set_verify_depth(4)
 
@@ -1842,6 +1846,112 @@ class \nodoc\ iso _TestSSLContextAllowTlsAfterDispose is UnitTest
       ctx.alpn_set_client_protocols(["h2"]),
       "the context should still be disposed")
 
+class \nodoc\ iso _TestSSLContextAllowTlsV1u2 is UnitTest
+  """
+  `allow_tls_v1_2` takes effect on a live context.
+
+  The context permits TLS 1.2 and nothing else, so disabling TLS 1.2 leaves the
+  handshake no version to negotiate. Re-enabling it clears the option and the
+  handshake completes again.
+
+  The first assertion is the control. Without it, a handshake that failed for
+  an unrelated reason would look like the option taking effect.
+
+  The context is live, so `SSLContext._set_options` and `_clear_options` reach
+  the SSL library rather than returning at the disposed check.
+  """
+  fun name(): String => "net/ssl/SSLContext.allow_tls_v1_2"
+
+  fun apply(h: TestHelper) =>
+    h.assert_true(
+      _handshakes(h, false, false),
+      "a context pinned to TLS 1.2 should complete a handshake")
+
+    h.assert_false(
+      _handshakes(h, true, false),
+      "disabling TLS 1.2 should leave no version to negotiate")
+
+    h.assert_true(
+      _handshakes(h, true, true),
+      "re-enabling TLS 1.2 should let the handshake complete again")
+
+  fun _handshakes(h: TestHelper, disable: Bool, reenable: Bool): Bool =>
+    """
+    Whether a client and a server session from a TLS 1.2 only context complete
+    a handshake, having disabled and then re-enabled TLS 1.2 as asked.
+    """
+    let auth = FileAuth(h.env.root)
+    let sslctx =
+      try
+        recover val
+          let ctx = SSLContext
+            .> set_authority(FilePath(auth, "assets/cert.pem"))?
+            .> set_cert(
+                FilePath(auth, "assets/cert.pem"),
+                FilePath(auth, "assets/key.pem"))?
+            .> set_client_verify(false)
+            .> set_server_verify(false)
+            .> set_min_proto_version(Tls1u2Version())?
+            .> set_max_proto_version(Tls1u2Version())?
+          if disable then ctx.allow_tls_v1_2(false) end
+          if reenable then ctx.allow_tls_v1_2(true) end
+          ctx
+        end
+      else
+        h.fail("ssl context setup failed")
+        return false
+      end
+
+    let client: SSL =
+      try
+        sslctx.client()?
+      else
+        h.fail("failed getting ssl client session")
+        return false
+      end
+
+    let server: SSL =
+      try
+        sslctx.server()?
+      else
+        client.dispose()
+        h.fail("failed getting ssl server session")
+        return false
+      end
+
+    let ready = _drive(client, server)
+    client.dispose()
+    server.dispose()
+    ready
+
+  fun _drive(client: SSL, server: SSL): Bool =>
+    """
+    Whether both sides reach `SSLReady` when each side's outgoing bytes are
+    handed straight to the other.
+
+    A handshake with no protocol version left to negotiate fails rather than
+    stalls, so the loop ends on its own. The round cap is a backstop against a
+    session that never settles, not the expected way out.
+    """
+    let max_rounds: USize = 20
+    var rounds: USize = 0
+
+    while
+      (client.state() is SSLHandshake) or (server.state() is SSLHandshake)
+    do
+      if rounds == max_rounds then return false end
+      rounds = rounds + 1
+
+      try
+        _TestSSLTransfer(client, server)?
+        _TestSSLTransfer(server, client)?
+      else
+        return false
+      end
+    end
+
+    (client.state() is SSLReady) and (server.state() is SSLReady)
+
 class \nodoc\ iso _TestSSLContextClientAfterDispose is UnitTest
   """
   `client` on a disposed context raises an error rather than handing a null

ssl/net/ssl.pony

@@ -7,7 +7,7 @@ use @SSL_ctrl[ILong](
   parg: Pointer[None])
 use @SSL_new[Pointer[_SSL]](ctx: Pointer[_SSLContext] tag)
 use @SSL_free[None](ssl: Pointer[_SSL] tag)
-use @SSL_set_verify[None](ssl: Pointer[_SSL], mode: I32, cb: Pointer[U8])
+use @SSL_set_verify[None](ssl: Pointer[_SSL], mode: I32, cb: Pointer[None])
 use @BIO_s_mem[Pointer[U8]]()
 use @BIO_new[Pointer[_BIO]](typ: Pointer[U8])
 use @BIO_free[I32](bio: Pointer[_BIO] tag)
@@ -18,10 +18,10 @@ use @SSL_do_handshake[I32](ssl: Pointer[_SSL])
 use @SSL_get0_alpn_selected[None](ssl: Pointer[_SSL] tag, data: Pointer[Pointer[U8] iso],
   len: Pointer[U32]) if "openssl_1.1.x" or "openssl_3.0.x" or "openssl_4.0.x" or "libressl"
 use @SSL_pending[I32](ssl: Pointer[_SSL])
-use @SSL_read[I32](ssl: Pointer[_SSL], buf: Pointer[U8] tag, len: U32)
-use @SSL_write[I32](ssl: Pointer[_SSL], buf: Pointer[U8] tag, len: U32)
-use @BIO_read[I32](bio: Pointer[_BIO] tag, buf: Pointer[U8] tag, len: U32)
-use @BIO_write[I32](bio: Pointer[_BIO] tag, buf: Pointer[U8] tag, len: U32)
+use @SSL_read[I32](ssl: Pointer[_SSL], buf: Pointer[U8] tag, len: I32)
+use @SSL_write[I32](ssl: Pointer[_SSL], buf: Pointer[U8] tag, len: I32)
+use @BIO_read[I32](bio: Pointer[_BIO] tag, buf: Pointer[U8] tag, len: I32)
+use @BIO_write[I32](bio: Pointer[_BIO] tag, buf: Pointer[U8] tag, len: I32)
 use @SSL_get_error[I32](ssl: Pointer[_SSL], ret: I32)
 use @BIO_ctrl_pending[USize](bio: Pointer[_BIO] tag)
 use @SSL_has_pending[I32](ssl: Pointer[_SSL]) if "openssl_1.1.x" or "openssl_3.0.x" or "openssl_4.0.x"
@@ -98,7 +98,7 @@ class SSL
     if _ssl.is_null() then error end
 
     let mode = if verify then I32(3) else I32(0) end
-    @SSL_set_verify(_ssl, mode, Pointer[U8])
+    @SSL_set_verify(_ssl, mode, Pointer[None])
 
     _input = @BIO_new(@BIO_s_mem())
     if _input.is_null() then error end
@@ -188,11 +188,11 @@ class SSL
       end
 
       _read_buf.undefined(offset + len)
-      @SSL_read(_ssl, _read_buf.cpointer(offset), len.u32())
+      @SSL_read(_ssl, _read_buf.cpointer(offset), len.i32())
     else
       _read_buf.undefined(offset + len)
       let r =
-        @SSL_read(_ssl, _read_buf.cpointer(offset), len.u32())
+        @SSL_read(_ssl, _read_buf.cpointer(offset), len.i32())
 
       if r <= 0 then
         match @SSL_get_error(_ssl, r)
@@ -249,7 +249,7 @@ class SSL
     if _state isnt SSLReady then error end
 
     if data.size() > 0 then
-      @SSL_write(_ssl, data.cpointer(), data.size().u32())
+      @SSL_write(_ssl, data.cpointer(), data.size().i32())
     end
 
   fun ref receive(data: ByteSeq) =>
@@ -259,7 +259,7 @@ class SSL
     """
     if _ssl.is_null() then return end
 
-    @BIO_write(_input, data.cpointer(), data.size().u32())
+    @BIO_write(_input, data.cpointer(), data.size().i32())
 
     if _state is SSLHandshake then
       let r = @SSL_do_handshake(_ssl)
@@ -294,7 +294,7 @@ class SSL
     if len == 0 then error end
 
     let buf = recover Array[U8] .> undefined(len) end
-    @BIO_read(_output, buf.cpointer(), buf.size().u32())
+    @BIO_read(_output, buf.cpointer(), buf.size().i32())
     buf
 
   fun ref dispose() =>