Add error code support to libtls

This adds tls_config_error_code() and tls_error_code(), which will become
public API at a later date.

Additional error codes will be added in follow-up commits.

ok jsing@ beck@

1 files changed, 34 insertions, 20 deletions

diff --git a/src/lib/libtls/tls_server.c b/src/lib/libtls/tls_server.c
index 5f93c7a035..a42985744b 100644
--- a/src/lib/libtls/tls_server.c
+++ b/src/lib/libtls/tls_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_server.c,v 1.49 2023/05/14 07:26:25 op Exp $ */
+/* $OpenBSD: tls_server.c,v 1.50 2024/03/26 06:24:52 joshua Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -181,7 +181,8 @@ tls_server_ticket_cb(SSL *ssl, unsigned char *keyname, unsigned char *iv,
                 /* create new session */
                 key = tls_server_ticket_key(tls_ctx->config, NULL);
                 if (key == NULL) {
-                        tls_set_errorx(tls_ctx, "no valid ticket key found");
+                        tls_set_errorx(tls_ctx, TLS_ERROR_UNKNOWN,
+                            "no valid ticket key found");
                         return (-1);
                 }
 
@@ -189,12 +190,14 @@ tls_server_ticket_cb(SSL *ssl, unsigned char *keyname, unsigned char *iv,
                 arc4random_buf(iv, EVP_MAX_IV_LENGTH);
                 if (!EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL,
                     key->aes_key, iv)) {
-                        tls_set_errorx(tls_ctx, "failed to init encrypt");
+                        tls_set_errorx(tls_ctx, TLS_ERROR_UNKNOWN,
+                            "failed to init encrypt");
                         return (-1);
                 }
                 if (!HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
                     EVP_sha256(), NULL)) {
-                        tls_set_errorx(tls_ctx, "failed to init hmac");
+                        tls_set_errorx(tls_ctx, TLS_ERROR_UNKNOWN,
+                            "failed to init hmac");
                         return (-1);
                 }
                 return (0);
@@ -206,12 +209,14 @@ tls_server_ticket_cb(SSL *ssl, unsigned char *keyname, unsigned char *iv,
 
                 if (!EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL,
                     key->aes_key, iv)) {
-                        tls_set_errorx(tls_ctx, "failed to init decrypt");
+                        tls_set_errorx(tls_ctx, TLS_ERROR_UNKNOWN,
+                            "failed to init decrypt");
                         return (-1);
                 }
                 if (!HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
                     EVP_sha256(), NULL)) {
-                        tls_set_errorx(tls_ctx, "failed to init hmac");
+                        tls_set_errorx(tls_ctx, TLS_ERROR_UNKNOWN,
+                            "failed to init hmac");
                         return (-1);
                 }
 
@@ -229,7 +234,7 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
         SSL_CTX_free(*ssl_ctx);
 
         if ((*ssl_ctx = SSL_CTX_new(SSLv23_server_method())) == NULL) {
-                tls_set_errorx(ctx, "ssl context failure");
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "ssl context failure");
                 goto err;
         }
 
@@ -237,11 +242,13 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
 
         if (SSL_CTX_set_tlsext_servername_callback(*ssl_ctx,
             tls_servername_cb) != 1) {
-                tls_set_error(ctx, "failed to set servername callback");
+                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                    "failed to set servername callback");
                 goto err;
         }
         if (SSL_CTX_set_tlsext_servername_arg(*ssl_ctx, ctx) != 1) {
-                tls_set_error(ctx, "failed to set servername callback arg");
+                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                    "failed to set servername callback arg");
                 goto err;
         }
 
@@ -270,7 +277,8 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
                 SSL_CTX_set_ecdh_auto(*ssl_ctx, 1);
                 if (SSL_CTX_set1_groups(*ssl_ctx, ctx->config->ecdhecurves,
                     ctx->config->ecdhecurves_len) != 1) {
-                        tls_set_errorx(ctx, "failed to set ecdhe curves");
+                        tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
+                            "failed to set ecdhe curves");
                         goto err;
                 }
         }
@@ -279,7 +287,8 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
                 SSL_CTX_set_options(*ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
 
         if (SSL_CTX_set_tlsext_status_cb(*ssl_ctx, tls_ocsp_stapling_cb) != 1) {
-                tls_set_errorx(ctx, "failed to add OCSP stapling callback");
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
+                    "failed to add OCSP stapling callback");
                 goto err;
         }
 
@@ -289,7 +298,7 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
                 SSL_CTX_clear_options(*ssl_ctx, SSL_OP_NO_TICKET);
                 if (!SSL_CTX_set_tlsext_ticket_key_cb(*ssl_ctx,
                     tls_server_ticket_cb)) {
-                        tls_set_error(ctx,
+                        tls_set_error(ctx, TLS_ERROR_UNKNOWN,
                             "failed to set the TLS ticket callback");
                         goto err;
                 }
@@ -297,7 +306,8 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
 
         if (SSL_CTX_set_session_id_context(*ssl_ctx, ctx->config->session_id,
             sizeof(ctx->config->session_id)) != 1) {
-                tls_set_error(ctx, "failed to set session id context");
+                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                    "failed to set session id context");
                 goto err;
         }
 
@@ -323,7 +333,7 @@ tls_configure_server_sni(struct tls *ctx)
         sni_ctx = &ctx->sni_ctx;
         for (kp = ctx->config->keypair->next; kp != NULL; kp = kp->next) {
                 if ((*sni_ctx = tls_sni_ctx_new()) == NULL) {
-                        tls_set_errorx(ctx, "out of memory");
+                        tls_set_errorx(ctx, TLS_ERROR_OUT_OF_MEMORY, "out of memory");
                         goto err;
                 }
                 (*sni_ctx)->keypair = kp;
@@ -362,22 +372,24 @@ tls_accept_common(struct tls *ctx)
         struct tls *conn_ctx = NULL;
 
         if ((ctx->flags & TLS_SERVER) == 0) {
-                tls_set_errorx(ctx, "not a server context");
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "not a server context");
                 goto err;
         }
 
         if ((conn_ctx = tls_server_conn(ctx)) == NULL) {
-                tls_set_errorx(ctx, "connection context failure");
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
+                    "connection context failure");
                 goto err;
         }
 
         if ((conn_ctx->ssl_conn = SSL_new(ctx->ssl_ctx)) == NULL) {
-                tls_set_errorx(ctx, "ssl failure");
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "ssl failure");
                 goto err;
         }
 
         if (SSL_set_app_data(conn_ctx->ssl_conn, conn_ctx) != 1) {
-                tls_set_errorx(ctx, "ssl application data failure");
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
+                    "ssl application data failure");
                 goto err;
         }
 
@@ -405,7 +417,8 @@ tls_accept_fds(struct tls *ctx, struct tls **cctx, int fd_read, int fd_write)
 
         if (SSL_set_rfd(conn_ctx->ssl_conn, fd_read) != 1 ||
             SSL_set_wfd(conn_ctx->ssl_conn, fd_write) != 1) {
-                tls_set_errorx(ctx, "ssl file descriptor failure");
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
+                    "ssl file descriptor failure");
                 goto err;
         }
 
@@ -448,7 +461,8 @@ tls_handshake_server(struct tls *ctx)
         int rv = -1;
 
         if ((ctx->flags & TLS_SERVER_CONN) == 0) {
-                tls_set_errorx(ctx, "not a server connection context");
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
+                    "not a server connection context");
                 goto err;
         }