openbsd/src/lib/libtls/tls.c, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2026-04-16T07:28:00+00:00libtls: prefer x version of error setting2026-04-16T07:28:00+00:00tb2026-04-16T07:28:00+00:00urn:sha1:4ab01251a636fac40d8a39e8cc3ba506580aa79b
If a check fails and errno is not necessarily set by the previous API call
use tls_set_errorx() or tls_error_setx() since turning an unrelated errno
into an error string is unhelpful.
From Michael Forney
ok bcook
Remove spaces before tabs2024-04-08T20:47:32+00:00tb2024-04-08T20:47:32+00:00urn:sha1:d52332356c8ba6fc11d87f6d466baff39351a3eeAdd TLS_ERROR_INVALID_ARGUMENT error code to libtls2024-03-27T07:35:30+00:00joshua2024-03-27T07:35:30+00:00urn:sha1:2f91b3106eca7de0d2c1cd49842ac4b5e027fc63
This is an initial pass, defining the error code and using it for
"too long"/length-related errors.
ok beck jsing
Add TLS_ERROR_INVALID_CONTEXT error code to libtls2024-03-26T08:54:48+00:00joshua2024-03-26T08:54:48+00:00urn:sha1:770136de1e8bfda122badbcfdd67920088e8d5fc
ok jsing@ beck@
Add error code support to libtls2024-03-26T06:24:52+00:00joshua2024-03-26T06:24:52+00:00urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311
This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.
Additional error codes will be added in follow-up commits.
ok jsing@ beck@
Use errno_value instead of num for readability2024-03-26T01:15:57+00:00joshua2024-03-26T01:15:57+00:00urn:sha1:ee7e62cdf4d4e04bf4fda6d714413ae19ff1f2ae
ok jsing@
Use errno_value instead of num for readability2024-03-26T00:50:22+00:00joshua2024-03-26T00:50:22+00:00urn:sha1:ebb5d184382e45fee186dab409ffc48de54983b6
ok beck@ jsing@
Remove the ability to do tls 1.0 and 1.1 from libtls.2023-07-02T06:37:27+00:00beck2023-07-02T06:37:27+00:00urn:sha1:908a2337ae4c28163a92b9fda969dbdd36bc634b
With this change any requests from configurations to request
versions of tls before tls 1.2 will use tls 1.2. This prepares
us to deprecate tls 1.0 and tls 1.1 support from libssl.
ok tb@
libtls: switch ECDSA_METHOD usage to EC_KEY_METHOD2023-06-18T11:43:03+00:00op2023-06-18T11:43:03+00:00urn:sha1:d4df7cddd1d4ded9778f0ab6b2c234b2d54515c3
smtpd and the bits it needs in libtls are the only consumer left of
ECDSA_METHOD, which is long deprecated. This paves the way for the
removal in libcrypto.
The diff is from gilles' work on OpenSMTPD-portable, libretls had a
similar diff.
ok tb@, jsing@
Forcibly update the EVP_PKEY's internal key2023-05-25T07:46:21+00:00op2023-05-25T07:46:21+00:00urn:sha1:38d31da6097a882f2d9c61b4831257122ba27fc1
To aid privilege separation, libtls maintains application-specific data
on the key inside the EVP_PKEY abstraction because the EVP API doesn't
provide a way to do that on the EVP_PKEY itself.
OpenSSL 3 changed behavior of EVP_PKEY_get1_RSA() and related functions.
These now return a struct from some cache. Thus, modifying the RSA will
no longer modify the EVP_PKEY like it did previously, which was clearly
implied to be the case in the older documentation.
This is a subtle breaking change that affects several applications.
While this is documented, no real solution is provided. The transition
plan from one OpenSSL major version to the next one tends to involve
many #ifdef in the ecosystem, and the only suggestion provided by the
new documentation is to switch to a completely unrelated, new API.
Instead, forcibly reset the internal key on EVP_PKEY after modification,
this way the change is picked up also by OpenSSL 3.
Fixes issue 1171 in OpenSMTPD-portable
ok tb@, jsing@