libtls: prefer x version of error setting

If a check fails and errno is not necessarily set by the previous API call
use tls_set_errorx() or tls_error_setx() since turning an unrelated errno
into an error string is unhelpful.

From Michael Forney

ok bcook

5 files changed, 17 insertions, 17 deletions

diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index 41bb06d857..02ff337b1e 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.104 2024/04/08 20:47:32 tb Exp $ */
+/* $OpenBSD: tls.c,v 1.105 2026/04/16 07:28:00 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -686,7 +686,7 @@ tls_configure_ssl_verify(struct tls *ctx, SSL_CTX *ssl_ctx, int verify)
                         if (xi->crl == NULL)
                                 continue;
                         if (!X509_STORE_add_crl(store, xi->crl)) {
-                                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                                     "failed to add crl");
                                 goto err;
                         }
diff --git a/src/lib/libtls/tls_client.c b/src/lib/libtls/tls_client.c
index 97e1d40210..7de9927b94 100644
--- a/src/lib/libtls/tls_client.c
+++ b/src/lib/libtls/tls_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_client.c,v 1.51 2024/03/26 08:54:48 joshua Exp $ */
+/* $OpenBSD: tls_client.c,v 1.52 2026/04/16 07:28:00 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -115,7 +115,7 @@ tls_connect_servername(struct tls *ctx, const char *host, const char *port,
                         hints.ai_family = AF_UNSPEC;
                         hints.ai_flags = AI_ADDRCONFIG;
                         if ((s = getaddrinfo(h, p, &hints, &res0)) != 0) {
-                                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                                     "%s", gai_strerror(s));
                                 goto err;
                         }
diff --git a/src/lib/libtls/tls_keypair.c b/src/lib/libtls/tls_keypair.c
index 594b9af438..e10d0fdc76 100644
--- a/src/lib/libtls/tls_keypair.c
+++ b/src/lib/libtls/tls_keypair.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_keypair.c,v 1.10 2026/04/16 05:16:48 tb Exp $ */
+/* $OpenBSD: tls_keypair.c,v 1.11 2026/04/16 07:28:00 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -144,7 +144,7 @@ tls_keypair_load_cert(struct tls_keypair *keypair, struct tls_error *error,
         *cert = NULL;
 
         if (keypair->cert_mem == NULL) {
-                tls_error_set(error, TLS_ERROR_UNKNOWN,
+                tls_error_setx(error, TLS_ERROR_UNKNOWN,
                     "keypair has no certificate");
                 goto err;
         }
@@ -163,7 +163,7 @@ tls_keypair_load_cert(struct tls_keypair *keypair, struct tls_error *error,
             NULL)) == NULL) {
                 if ((ssl_err = ERR_peek_error()) != 0)
                         errstr = ERR_error_string(ssl_err, NULL);
-                tls_error_set(error, TLS_ERROR_UNKNOWN,
+                tls_error_setx(error, TLS_ERROR_UNKNOWN,
                     "failed to load certificate: %s", errstr);
                 goto err;
         }
diff --git a/src/lib/libtls/tls_ocsp.c b/src/lib/libtls/tls_ocsp.c
index c65911920a..784d911b7a 100644
--- a/src/lib/libtls/tls_ocsp.c
+++ b/src/lib/libtls/tls_ocsp.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tls_ocsp.c,v 1.27 2026/03/28 11:49:31 tb Exp $ */
+/*      $OpenBSD: tls_ocsp.c,v 1.28 2026/04/16 07:28:00 tb Exp $ */
 /*
  * Copyright (c) 2015 Marko Kreen <markokr@gmail.com>
  * Copyright (c) 2016 Bob Beck <beck@openbsd.org>
@@ -102,19 +102,19 @@ tls_ocsp_fill_info(struct tls *ctx, int response_status, int cert_status,
         info->revocation_time = info->this_update = info->next_update = -1;
         if (revtime != NULL &&
             tls_ocsp_asn1_parse_time(ctx, revtime, &info->revocation_time) != 0) {
-                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                     "unable to parse revocation time in OCSP reply");
                 goto err;
         }
         if (thisupd != NULL &&
             tls_ocsp_asn1_parse_time(ctx, thisupd, &info->this_update) != 0) {
-                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                     "unable to parse this update time in OCSP reply");
                 goto err;
         }
         if (nextupd != NULL &&
             tls_ocsp_asn1_parse_time(ctx, nextupd, &info->next_update) != 0) {
-                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                     "unable to parse next update time in OCSP reply");
                 goto err;
         }
@@ -305,7 +305,7 @@ tls_ocsp_process_response_internal(struct tls *ctx, const unsigned char *respons
         if (resp == NULL) {
                 tls_ocsp_free(ctx->ocsp);
                 ctx->ocsp = NULL;
-                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                     "unable to parse OCSP response");
                 return -1;
         }
diff --git a/src/lib/libtls/tls_server.c b/src/lib/libtls/tls_server.c
index 42a697327a..570020d6a2 100644
--- a/src/lib/libtls/tls_server.c
+++ b/src/lib/libtls/tls_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_server.c,v 1.52 2025/06/04 10:25:30 tb Exp $ */
+/* $OpenBSD: tls_server.c,v 1.53 2026/04/16 07:28:00 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -242,12 +242,12 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
 
         if (SSL_CTX_set_tlsext_servername_callback(*ssl_ctx,
             tls_servername_cb) != 1) {
-                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                     "failed to set servername callback");
                 goto err;
         }
         if (SSL_CTX_set_tlsext_servername_arg(*ssl_ctx, ctx) != 1) {
-                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                     "failed to set servername callback arg");
                 goto err;
         }
@@ -298,7 +298,7 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
                 SSL_CTX_clear_options(*ssl_ctx, SSL_OP_NO_TICKET);
                 if (!SSL_CTX_set_tlsext_ticket_key_cb(*ssl_ctx,
                     tls_server_ticket_cb)) {
-                        tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                        tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                             "failed to set the TLS ticket callback");
                         goto err;
                 }
@@ -306,7 +306,7 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx,
 
         if (SSL_CTX_set_session_id_context(*ssl_ctx, ctx->config->session_id,
             sizeof(ctx->config->session_id)) != 1) {
-                tls_set_error(ctx, TLS_ERROR_UNKNOWN,
+                tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
                     "failed to set session id context");
                 goto err;
         }