From 4ab01251a636fac40d8a39e8cc3ba506580aa79b Mon Sep 17 00:00:00 2001 From: tb <> Date: Thu, 16 Apr 2026 07:28:00 +0000 Subject: libtls: prefer x version of error setting If a check fails and errno is not necessarily set by the previous API call use tls_set_errorx() or tls_error_setx() since turning an unrelated errno into an error string is unhelpful. From Michael Forney ok bcook --- src/lib/libtls/tls.c | 4 ++-- src/lib/libtls/tls_client.c | 4 ++-- src/lib/libtls/tls_keypair.c | 6 +++--- src/lib/libtls/tls_ocsp.c | 10 +++++----- src/lib/libtls/tls_server.c | 10 +++++----- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c index 41bb06d857..02ff337b1e 100644 --- a/src/lib/libtls/tls.c +++ b/src/lib/libtls/tls.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls.c,v 1.104 2024/04/08 20:47:32 tb Exp $ */ +/* $OpenBSD: tls.c,v 1.105 2026/04/16 07:28:00 tb Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -686,7 +686,7 @@ tls_configure_ssl_verify(struct tls *ctx, SSL_CTX *ssl_ctx, int verify) if (xi->crl == NULL) continue; if (!X509_STORE_add_crl(store, xi->crl)) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "failed to add crl"); goto err; } diff --git a/src/lib/libtls/tls_client.c b/src/lib/libtls/tls_client.c index 97e1d40210..7de9927b94 100644 --- a/src/lib/libtls/tls_client.c +++ b/src/lib/libtls/tls_client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_client.c,v 1.51 2024/03/26 08:54:48 joshua Exp $ */ +/* $OpenBSD: tls_client.c,v 1.52 2026/04/16 07:28:00 tb Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -115,7 +115,7 @@ tls_connect_servername(struct tls *ctx, const char *host, const char *port, hints.ai_family = AF_UNSPEC; hints.ai_flags = AI_ADDRCONFIG; if ((s = getaddrinfo(h, p, &hints, &res0)) != 0) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "%s", gai_strerror(s)); goto err; } diff --git a/src/lib/libtls/tls_keypair.c b/src/lib/libtls/tls_keypair.c index 594b9af438..e10d0fdc76 100644 --- a/src/lib/libtls/tls_keypair.c +++ b/src/lib/libtls/tls_keypair.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_keypair.c,v 1.10 2026/04/16 05:16:48 tb Exp $ */ +/* $OpenBSD: tls_keypair.c,v 1.11 2026/04/16 07:28:00 tb Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -144,7 +144,7 @@ tls_keypair_load_cert(struct tls_keypair *keypair, struct tls_error *error, *cert = NULL; if (keypair->cert_mem == NULL) { - tls_error_set(error, TLS_ERROR_UNKNOWN, + tls_error_setx(error, TLS_ERROR_UNKNOWN, "keypair has no certificate"); goto err; } @@ -163,7 +163,7 @@ tls_keypair_load_cert(struct tls_keypair *keypair, struct tls_error *error, NULL)) == NULL) { if ((ssl_err = ERR_peek_error()) != 0) errstr = ERR_error_string(ssl_err, NULL); - tls_error_set(error, TLS_ERROR_UNKNOWN, + tls_error_setx(error, TLS_ERROR_UNKNOWN, "failed to load certificate: %s", errstr); goto err; } diff --git a/src/lib/libtls/tls_ocsp.c b/src/lib/libtls/tls_ocsp.c index c65911920a..784d911b7a 100644 --- a/src/lib/libtls/tls_ocsp.c +++ b/src/lib/libtls/tls_ocsp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_ocsp.c,v 1.27 2026/03/28 11:49:31 tb Exp $ */ +/* $OpenBSD: tls_ocsp.c,v 1.28 2026/04/16 07:28:00 tb Exp $ */ /* * Copyright (c) 2015 Marko Kreen * Copyright (c) 2016 Bob Beck @@ -102,19 +102,19 @@ tls_ocsp_fill_info(struct tls *ctx, int response_status, int cert_status, info->revocation_time = info->this_update = info->next_update = -1; if (revtime != NULL && tls_ocsp_asn1_parse_time(ctx, revtime, &info->revocation_time) != 0) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "unable to parse revocation time in OCSP reply"); goto err; } if (thisupd != NULL && tls_ocsp_asn1_parse_time(ctx, thisupd, &info->this_update) != 0) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "unable to parse this update time in OCSP reply"); goto err; } if (nextupd != NULL && tls_ocsp_asn1_parse_time(ctx, nextupd, &info->next_update) != 0) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "unable to parse next update time in OCSP reply"); goto err; } @@ -305,7 +305,7 @@ tls_ocsp_process_response_internal(struct tls *ctx, const unsigned char *respons if (resp == NULL) { tls_ocsp_free(ctx->ocsp); ctx->ocsp = NULL; - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "unable to parse OCSP response"); return -1; } diff --git a/src/lib/libtls/tls_server.c b/src/lib/libtls/tls_server.c index 42a697327a..570020d6a2 100644 --- a/src/lib/libtls/tls_server.c +++ b/src/lib/libtls/tls_server.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_server.c,v 1.52 2025/06/04 10:25:30 tb Exp $ */ +/* $OpenBSD: tls_server.c,v 1.53 2026/04/16 07:28:00 tb Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -242,12 +242,12 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx, if (SSL_CTX_set_tlsext_servername_callback(*ssl_ctx, tls_servername_cb) != 1) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "failed to set servername callback"); goto err; } if (SSL_CTX_set_tlsext_servername_arg(*ssl_ctx, ctx) != 1) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "failed to set servername callback arg"); goto err; } @@ -298,7 +298,7 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx, SSL_CTX_clear_options(*ssl_ctx, SSL_OP_NO_TICKET); if (!SSL_CTX_set_tlsext_ticket_key_cb(*ssl_ctx, tls_server_ticket_cb)) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "failed to set the TLS ticket callback"); goto err; } @@ -306,7 +306,7 @@ tls_configure_server_ssl(struct tls *ctx, SSL_CTX **ssl_ctx, if (SSL_CTX_set_session_id_context(*ssl_ctx, ctx->config->session_id, sizeof(ctx->config->session_id)) != 1) { - tls_set_error(ctx, TLS_ERROR_UNKNOWN, + tls_set_errorx(ctx, TLS_ERROR_UNKNOWN, "failed to set session id context"); goto err; } -- cgit v1.2.3-55-g6feb