Add a TLS13_IO_ALERT return value so that we can explicitly signal when

we sent or received a fatal alert.

Pull the fatal_alert check up into tls13_legacy_error(). Also, if sending
an alert resulted in EOF, do not propagate this back since we do not want
to signal EOF to the caller (rather we want to indicate failure).

ok beck@ tb@

1 files changed, 5 insertions, 4 deletions

diff --git a/src/lib/libssl/tls13_internal.h b/src/lib/libssl/tls13_internal.h
index d8a74ef67a..4d6d626433 100644
--- a/src/lib/libssl/tls13_internal.h
+++ b/src/lib/libssl/tls13_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_internal.h,v 1.46 2020/01/23 02:24:38 jsing Exp $ */
+/* $OpenBSD: tls13_internal.h,v 1.47 2020/01/23 02:49:38 jsing Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  * Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
@@ -33,9 +33,10 @@ __BEGIN_HIDDEN_DECLS
 #define TLS13_IO_SUCCESS         1
 #define TLS13_IO_EOF             0
 #define TLS13_IO_FAILURE        -1
-#define TLS13_IO_WANT_POLLIN    -2
-#define TLS13_IO_WANT_POLLOUT   -3
-#define TLS13_IO_USE_LEGACY     -4
+#define TLS13_IO_ALERT          -2
+#define TLS13_IO_WANT_POLLIN    -3
+#define TLS13_IO_WANT_POLLOUT   -4
+#define TLS13_IO_USE_LEGACY     -5
 
 #define TLS13_ERR_VERIFY_FAILED 16
 #define TLS13_ERR_HRR_FAILED    17