Skip to content

Networking

Nexus applications use Synapse sockets, the Nexus OpenSSL integration, and NexusXMPP for XMPP client behavior.

XMPP ownership and limits

Applications add modules before Connect; the client owns them afterward. Typed message and discovery objects passed to callbacks are borrowed for the duration of the callback. A MAM query returns an INXXMPPMAMOperation owned by the caller and retained by the module until terminal IQ handling. MAM cancellation is local and does not claim server-side cancellation.

The default in-memory limits are: 128 capability entries with a one-hour TTL; 8 concurrent MAM operations, 100 results per page, 1000 accepted results, and 4 MiB forwarded XML per operation; 32 rooms, 512 occupants per room, and 100 history messages per room; 256 pending receipt correlations with a five-minute timeout; and 4096 Unicode characters of generated reply fallback. All are validated through TNXXMPPClientConfig; forwarding unwrap depth defaults to one. Capacity failure occurs before a new operation or replayable stanza is transmitted; NexusXMPP does not silently evict pending receipt or MAM work.

The implemented protocol baseline is XEP-0045 1.35.5, XEP-0059 1.0, XEP-0085 2.1, XEP-0115 1.6.0, XEP-0184 1.4.0, XEP-0199 2.0.1, XEP-0203 2.0, XEP-0280 1.0.1, XEP-0297 1.0, XEP-0313 1.1.3, XEP-0359 0.7.0, XEP-0410 1.1.0, XEP-0421 1.0.1, XEP-0428 0.2.1, XEP-0446 0.2.0, XEP-0447 0.3.1, XEP-0363 1.2.0, XEP-0066 1.6, XEP-0300 1.0.0, and XEP-0461 0.2.1. Feature availability remains subject to peer/server advertisement; the library does not infer support from server brand. The selected XEP-0359, XEP-0428, and XEP-0461 revisions are Experimental and their public shapes may need deliberate revision when those specifications change.

OpenSSL integration

This package owns the dynamic OpenSSL binding (src/openssl.pas), certificate and TLS object wrappers (src/fpopenssl.pas), shared cryptography helpers (src/obNXOpenSSLCrypto.pas), certificate definitions in src/tpNXOpenSSLTypes.pas and src/obNXOpenSSLCertificates.pas, and the Nexus-owned Synapse adapter (synapse/obNXSynapseOpenSSL.pas). Upstream origins, import evidence, authors, and separate native-library/binding license indicators are maintained in the central attribution record. Original notices remain in the inherited sources.

Add src to the compiler unit search path. Certificate data and generator classes are owned here; FCL Net is no longer required. OpenSSL.nxproject builds the wrappers and Nexus Synapse adapter with the configured native Nexus Pascal. Native OpenSSL libraries are loaded dynamically and are not bundled here. The runtime must be OpenSSL 3 and supply the required TLS and cryptography exports. Each candidate library pair is validated before loading is published; an incomplete load is released and can be retried. Historical declarations remain, but older OpenSSL and LibreSSL runtimes are rejected.

SNI routes copy their domain lists; keep the referenced TSSLContext objects alive while the routes are in use. Release OpenSSL contexts and sessions before explicitly unloading the native libraries. Nexus XMPP and BotHost use this binding for TLS and cryptography.

For Synapse integration, add this package's src and synapse folders and network/external/synapse to the unit search path. Include obNXSynapseOpenSSL to register TNXSynapseOpenSSL, which descends directly from TCustomSSL. Keep other TLS-provider registration units out of that application's uses graph. The adapter owns its context and session; Synapse owns the socket. LT_All negotiates TLS 1.2 or later; explicit LT_TLSv1_2 and LT_TLSv1_3 select just that version. Older protocols are rejected. Verification uses SNIHost as the reference identity, or the connected peer IP when no name is provided; SNI is sent for DNS names only. HTTP and XMPP callers already provide their service name.

ALPN is configured through Socket.SSL.ALPNProtocols, a comma-separated protocol list in preference order. The Nexus provider installs it before the client or server handshake. Read Socket.SSL.SelectedALPNProtocol afterward; it is empty when ALPN was not negotiated, before a successful handshake, or after shutdown. Assign copies the configured offer, never the negotiated session result. An empty configuration disables ALPN; an empty-token-only list or a protocol ID longer than 255 bytes fails TLS setup. The application offers only protocols it implements and decides whether an absent selection is acceptable.

XMPP direct TLS offers xmpp-client; STARTTLS clears the offer, including when reusing a transport that previously used direct TLS. HTTP consumers keep their existing empty default. Negotiating h2 does not itself implement HTTP/2.

Handshake retries share the socket's ConnectionTimeout deadline. Send retries share NonblockSendTimeout; read retries share the adapter's ReceiveTimeout (default -1, unbounded). Set that property to the caller's receive timeout, including when calling Synapse's timed receive APIs: their initial readiness wait alone cannot bound a partial TLS record. BotHost and XMPP do this explicitly. Each operation restores the previous socket mode, and hard shutdown accepts a sent close_notify without waiting for the peer. Failure to load/configure TLS fails the operation; the adapter never substitutes a plaintext provider.

TNXOpenSSLCrypto provides raw binary SHA-1/SHA-256, streaming SHA-256, HMAC-SHA-256, PBKDF2-HMAC-SHA-256, secure random bytes, and constant-time comparison of equal-length inputs. SHA-1 remains for the XEP-0115 protocol digest. Helpers use the shared binding and caller-owned output buffers; there is no second loader. Shared crypto errors use ESSL; protocol validation errors remain owned by XMPP.

Prebuilt native dependency

Native.nxproject is the shared, target-aware native OpenSSL dependency, registered as Projects.OpenSSLNative. The Pascal source project and Nexus2D engine require it. It publishes headers and library directories and has no compilation or source-fetch steps. OpenSSL is not built by Nexus.

Install the prebuilt developer files outside source, relative to the development root:

toolchain/openssl/<TargetCPU>-<TargetOS>/
    include/openssl/        matching target headers, including configuration.h
    lib/                   link libraries
    bin/                   shared runtime libraries, when supplied separately
    licenses/              original supplier and OpenSSL notices

For example, x86_64-win64, x86_64-linux, aarch64-android, and aarch64-ios select different installations automatically. Debug and Release use the same prebuilt dependency. All 13 compiler targets use this layout; publication does not download or install missing artifacts. Keep platform and CPU configuration headers with the libraries they describe.

On Windows, use the full OpenSSL 3 developer package from Shining Light Productions, not the Light runtime-only edition. Check its download against the supplier's published hashes. The x64 engine's LiveServer and libevent use the release static C runtime (/MT) in both system staging modes. Copy the matching lib/VC/x64/MT/libcrypto_static.lib and libssl_static.lib to the installation's lib/libcrypto.lib and lib/libssl.lib, retaining the engine's static link input names. The supplier's unsuffixed .lib files are DLL import libraries; keep those separately in lib/import if needed. Copy its headers unchanged, runtime DLLs into bin, and original license into licenses. The existing Windows dependency helper accepts -OpenSSLRoot and consumes these files without Perl, Configure or NMake.

On Linux, use the matching distribution's prebuilt developer/runtime packages. When preparing the installation above, merge its generic and target-specific openssl header directories (for example /usr/include/openssl and /usr/include/x86_64-linux-gnu/openssl), preserve library SONAMEs and linker symlinks, and retain the distribution copyright notice. Cross targets require their own prebuilt libraries; the host's libraries cannot satisfy them.

Shining Light supplies Windows binaries. Apple and Android installations need prebuilt packages for those platforms. Runtime staging must carry the selected shared libraries and any provider modules/configuration needed by the product; folder publication itself does not copy runtime files. See the attribution record for supplier provenance and terms.

Socket and resolver integration

Use Synapse's blcksock API with obNXSynapseOpenSSL from the Nexus OpenSSL adapter for TLS. The package project supplies the corresponding source paths. utNXSynapseResolver supports forward/reverse IPv4/IPv6 resolution, hosts files and named service-to-port lookup. Service ports are returned in host order. General network/protocol/service database enumeration is not a public API; optional libc declarations remain private in nxresolverlibc.inc.