openbsd/src/lib/libtls/tls_client.c, branch OPENBSD_7_9_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_9_BASE2026-04-16T07:28:00+00:00libtls: prefer x version of error setting2026-04-16T07:28:00+00:00tb2026-04-16T07:28:00+00:00urn:sha1:4ab01251a636fac40d8a39e8cc3ba506580aa79b
If a check fails and errno is not necessarily set by the previous API call
use tls_set_errorx() or tls_error_setx() since turning an unrelated errno
into an error string is unhelpful.
From Michael Forney
ok bcook
Add TLS_ERROR_INVALID_CONTEXT error code to libtls2024-03-26T08:54:48+00:00joshua2024-03-26T08:54:48+00:00urn:sha1:770136de1e8bfda122badbcfdd67920088e8d5fc
ok jsing@ beck@
Add error code support to libtls2024-03-26T06:24:52+00:00joshua2024-03-26T06:24:52+00:00urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311
This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.
Additional error codes will be added in follow-up commits.
ok jsing@ beck@
add missing #include <string.h>; ok tb@2023-05-14T07:26:25+00:00op2023-05-14T07:26:25+00:00urn:sha1:751c792967481bc8add0d09d060248a9d59cfadfEliminate a dead assignment and a weird cast. Adjust a comment to2021-10-21T08:38:11+00:00tb2021-10-21T08:38:11+00:00urn:sha1:a37220e6e025f0827a32fa95462274087fcfe4ae
reality while there.
ok jsing
Update RFC reference. RFC 4366 was obsoleted by RFC 6066.2021-06-01T20:26:11+00:00tb2021-06-01T20:26:11+00:00urn:sha1:9b140ddf9f41beb19ba130cb2c39347030e0f6c9Avoid sending a trailing dot in SNI as a client2021-06-01T20:14:17+00:00tb2021-06-01T20:14:17+00:00urn:sha1:c71e98774db737758f9fd959db92ae9a73f610db
While an FQDN includes a trailing dot for the zero-length label of
the root, SNI explicitly does not contain it. Contrary to other TLS
implementations, our tlsext_sni_is_valid_hostname() rejects a trailing
dot. The result is that LibreSSL TLS servers encountering an SNI with
trailing dot abort the connection with an illegal_parameter alert.
This fixes an issue reported by danj in nc(1) and by sthen in ftp(1).
DNS cluebat from florian.
ok jsing
Automatically handle library initialisation for libtls.2018-03-19T16:34:47+00:00jsing2018-03-19T16:34:47+00:00urn:sha1:5fd38b4657cfd0f2e0b0b92fd650c6710e8fbc8b
Now that we have tls_init() under pthread_once(), automatically initialise
libtls from the entry point functions (tls_config(), tls_client() and
tls_server()) - this makes an explicit tls_init() call no longer a
requirement.
ok bcook@ beck@ inoguchi@
Add support to libtls for client-side TLS session resumption.2018-02-10T04:41:24+00:00jsing2018-02-10T04:41:24+00:00urn:sha1:7f2c0ca878baa76136bb91e6e42ba28feb243a6b
A libtls client can specify a session file descriptor (a regular file
with appropriate ownership and permissions) and libtls will manage reading
and writing of session data across TLS handshakes.
Discussed at length with deraadt@ and tedu@.
Rides previous minor bump.
ok beck@
Add a tls_config_set_ecdhecurves() function to libtls, which allows the2017-08-10T18:18:30+00:00jsing2017-08-10T18:18:30+00:00urn:sha1:52c5bafe628bfaf1072a7e4cd721523f818d1bcf
names of the elliptic curves that may be used during client and server
key exchange to be specified.
This deprecates tls_config_set_ecdhecurve(), which could only be used to
specify a single supported curve.
ok beck@