From 7c6ea67e407a1e118cfd9600cdc5cf1e1bd2274b Mon Sep 17 00:00:00 2001
From: SirHumza <204067870+SirHumza@users.noreply.github.com>
Date: Fri, 14 Aug 2026 08:48:38 +0200
Subject: [PATCH] fix(ws): send TLS SNI via SSL_ctrl (SSL_set_tlsext_host_name)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

libSceLibreSSL exports SSL_ctrl but not SSL_set_tls_host directly.
SNI is required for Discord's TLS termination to route the gateway
and token endpoints correctly; without it the handshake can be
rejected. Implemented via SSL_ctrl(s, SSL_CTRL_SET_TLSEXT_HOSTNAME=55,
TLSEXT_NAMETYPE_host_name=0, host) — stable across OpenSSL/LibreSSL.
---
 PS4RP/ws.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/PS4RP/ws.c b/PS4RP/ws.c
index 1a75d24..4d1b321 100644
--- a/PS4RP/ws.c
+++ b/PS4RP/ws.c
@@ -32,7 +32,7 @@ extern int      SSL_read(SSL *s, void *buf, int num);
 extern int      SSL_shutdown(SSL *s);
 extern int      SSL_get_error(SSL *s, int ret);
 extern const void *SSLv23_client_method(void);
-extern int      SSL_set_tls_host(SSL *s, const char *hostname); /* if exported */
+extern int      SSL_ctrl(SSL *s, int cmd, long larg, void *parg);
 
 /* net pool id (keep once) */
 static int s_net_ready = 0;
@@ -90,6 +90,9 @@ int ws_connect(ws_t *w, const char *host, int port, const char *resource, const
     SSL *ssl = SSL_new(ctx);
     if(!ssl){ log_msg("SSL_new fail"); SSL_CTX_free(ctx); goto fail; }
     if(SSL_set_fd(ssl, (int)fd) != 1){ log_msg("SSL_set_fd fail"); SSL_free(ssl); SSL_CTX_free(ctx); goto fail; }
+    /* SNI: SSL_set_tlsext_host_name = SSL_ctrl(s, SSL_CTRL_SET_TLSEXT_HOSTNAME(55),
+     *   TLSEXT_NAMETYPE_host_name(0), hostname). Discord TLS needs the host. */
+    if(SSL_ctrl(ssl, 55, 0, (void *)host) != 1){ log_msg("SNI warn"); }
     SSL_set_connect_state(ssl);
     if(SSL_connect(ssl) != 1){ log_msg("SSL_connect fail"); SSL_free(ssl); SSL_CTX_free(ctx); goto fail; }
     w->ssl_ctx = (int32_t)(intptr_t)ctx;   /* stash for teardown */