openbsd/src/lib/libtls/tls_server.c, branch OPENBSD_7_9A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_7_92026-04-16T07:28:00+00:00libtls: prefer x version of error setting2026-04-16T07:28:00+00:00tb2026-04-16T07:28:00+00:00urn:sha1:4ab01251a636fac40d8a39e8cc3ba506580aa79b
If a check fails and errno is not necessarily set by the previous API call
use tls_set_errorx() or tls_error_setx() since turning an unrelated errno
into an error string is unhelpful.
From Michael Forney
ok bcook
libtls: abort handshake on no ALPN protcol overlap2025-06-04T10:25:30+00:00tb2025-06-04T10:25:30+00:00urn:sha1:4af06736be7bcd30d213be74f1456a917b18a581
RFC 7301, section 3.2: In the event that the server supports no
protocols that the client advertises, then the server SHALL respond
with a fatal "no_application_protocol" alert.
This change makes tlsext_alpn_server_process() send the alert
rather than pretending no callback was present.
ok jsing
Add TLS_ERROR_INVALID_CONTEXT error code to libtls2024-03-26T08:54:48+00:00joshua2024-03-26T08:54:48+00:00urn:sha1:770136de1e8bfda122badbcfdd67920088e8d5fc
ok jsing@ beck@
Add error code support to libtls2024-03-26T06:24:52+00:00joshua2024-03-26T06:24:52+00:00urn:sha1:bd68c6e1694d8d4eb801f32889da4cdde0b3c311
This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.
Additional error codes will be added in follow-up commits.
ok jsing@ beck@
add missing #include <string.h>; ok tb@2023-05-14T07:26:25+00:00op2023-05-14T07:26:25+00:00urn:sha1:751c792967481bc8add0d09d060248a9d59cfadfCheck function return value in libtls2022-01-19T11:10:55+00:00inoguchi2022-01-19T11:10:55+00:00urn:sha1:a0f676076e1dde29f618a1e8ac62b1dd15e406d2
EVP_EncryptInit_ex, EVP_DecryptInit_ex and HMAC_Init_ex are possible to
fail and return error.
Error from these functions will be fatal for the callback, and I choose to
return -1.
SSL_CTX_set_tlsext_ticket_key_cb.3 explains the return value of callback.
This also could fix Coverity CID 345319.
ok jsing@ tb@
Use SSL_AD_INTERNAL_ERROR2021-06-14T03:53:59+00:00tb2021-06-14T03:53:59+00:00urn:sha1:31cc980921fb2043cc7798cb3d036980f86800d5
One instance of TLS1_AD_* was missed and broke the tree in the recent
switch to using only one version of alert defines internally.
Remove unnecessary cast in free.2021-06-01T19:49:17+00:00tb2021-06-01T19:49:17+00:00urn:sha1:ee817e88df52a4debdacfb18945e17697591ba82
ok jsing
Acquire mutex before incrementing the refcount. Fixes COV-1861442019-05-13T22:36:01+00:00bcook2019-05-13T22:36:01+00:00urn:sha1:c9ed4a76707f17c97f0f1c670382b32d6045c638
ok tb@
Automatically handle library initialisation for libtls.2018-03-19T16:34:47+00:00jsing2018-03-19T16:34:47+00:00urn:sha1:5fd38b4657cfd0f2e0b0b92fd650c6710e8fbc8b
Now that we have tls_init() under pthread_once(), automatically initialise
libtls from the entry point functions (tls_config(), tls_client() and
tls_server()) - this makes an explicit tls_init() call no longer a
requirement.
ok bcook@ beck@ inoguchi@