If the TLSv1.3 code has not recorded an error and something already exists

on the error stack, refrain from pushing an 'unknown' error on the stack.
This should allow libcrypto errors (including bio) to be visible, where we
have nothing better to offer.

ok tb@

1 files changed, 5 insertions, 1 deletions

diff --git a/src/lib/libssl/tls13_lib.c b/src/lib/libssl/tls13_lib.c
index 2a13e8f773..3a90c0d6df 100644
--- a/src/lib/libssl/tls13_lib.c
+++ b/src/lib/libssl/tls13_lib.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls13_lib.c,v 1.31 2020/01/26 02:45:27 beck Exp $ */
+/*      $OpenBSD: tls13_lib.c,v 1.32 2020/01/29 17:03:58 jsing Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2019 Bob Beck <beck@openbsd.org>
@@ -408,6 +408,10 @@ tls13_legacy_error(SSL *ssl)
                 break;
         }
 
+        /* Something (probably libcrypto) already pushed an error on the stack. */
+        if (reason == SSL_R_UNKNOWN && ERR_peek_error() != 0)
+                return;
+
         ERR_put_error(ERR_LIB_SSL, (0xfff), reason, ctx->error.file,
             ctx->error.line);
 }