From: Todd Short Date: Fri, 17 Jul 2026 21:34:11 +0000 (-0400) Subject: errors: fix stale string overrides in openssl.txt for renamed SSL error codes X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ba2f3b557a660cbe2a0fc0e99b1830cb930a090f;p=thirdparty%2Fopenssl.git errors: fix stale string overrides in openssl.txt for renamed SSL error codes Commit b3d26e438a ("merge feature/removesslv3", PR #29338) renamed SSL3 error codes to TLS equivalents and updated the string descriptions in crypto/ssl_err.c (e.g. from "ssl/tls alert bad certificate" to "tls alert bad certificate"), but did not update the corresponding strings in crypto/err/openssl.txt. This caused a latent divergence: running mkerr.pl -rebuild would regenerate ssl_err.c with the old openssl.txt strings, undoing the intentional name cleanup. Similarly, adding any new SSL error code triggers a full SSL regeneration that would revert the strings and reorder entries to their correct alphabetical positions, producing spurious changes unrelated to the new code. Update openssl.txt to match the strings already in ssl_err.c, which also happen to be the auto-generated strings derived from the reason code names. Regenerate ssl_err.c and sslerr.h with the correct alphabetical ordering so that future make update runs are idempotent: adding and removing a new SSL error code now produces only the expected changes to the generated files, with no side-effect reordering or string reversions. Fixes: b3d26e438a ("Rename SSL3 error codes to TLS equivalents") Signed-off-by: Todd Short Reviewed-by: Tim Hudson Reviewed-by: Paul Dale MergeDate: Tue Jul 21 14:28:22 2026 (Merged from https://github.com/openssl/openssl/pull/31993) --- diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt index 14658d76341..8b6c9129776 100644 --- a/crypto/err/openssl.txt +++ b/crypto/err/openssl.txt @@ -1645,25 +1645,24 @@ SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE:1113:\ SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE:1111:tlsv1 certificate unobtainable SSL_R_TLSV1_UNRECOGNIZED_NAME:1112:tlsv1 unrecognized name SSL_R_TLSV1_UNSUPPORTED_EXTENSION:1110:tlsv1 unsupported extension -SSL_R_TLS_ALERT_BAD_CERTIFICATE:1042:ssl/tls alert bad certificate -SSL_R_TLS_ALERT_BAD_RECORD_MAC:1020:ssl/tls alert bad record mac -SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED:1045:ssl/tls alert certificate expired -SSL_R_TLS_ALERT_CERTIFICATE_REVOKED:1044:ssl/tls alert certificate revoked -SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN:1046:ssl/tls alert certificate unknown -SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE:1030:ssl/tls alert decompression failure -SSL_R_TLS_ALERT_HANDSHAKE_FAILURE:1040:ssl/tls alert handshake failure -SSL_R_TLS_ALERT_ILLEGAL_PARAMETER:1047:ssl/tls alert illegal parameter -SSL_R_TLS_ALERT_NO_CERTIFICATE:1041:ssl/tls alert no certificate -SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE:1010:ssl/tls alert unexpected message -SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE:1043:\ - ssl/tls alert unsupported certificate +SSL_R_TLS_ALERT_BAD_CERTIFICATE:1042:tls alert bad certificate +SSL_R_TLS_ALERT_BAD_RECORD_MAC:1020:tls alert bad record mac +SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED:1045:tls alert certificate expired +SSL_R_TLS_ALERT_CERTIFICATE_REVOKED:1044:tls alert certificate revoked +SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN:1046:tls alert certificate unknown +SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE:1030:tls alert decompression failure +SSL_R_TLS_ALERT_HANDSHAKE_FAILURE:1040:tls alert handshake failure +SSL_R_TLS_ALERT_ILLEGAL_PARAMETER:1047:tls alert illegal parameter +SSL_R_TLS_ALERT_NO_CERTIFICATE:1041:tls alert no certificate +SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE:1010:tls alert unexpected message +SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE:1043:tls alert unsupported certificate SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH:232:\ - ssl3 ext invalid max fragment length -SSL_R_TLS_EXT_INVALID_SERVERNAME:319:ssl3 ext invalid servername -SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE:320:ssl3 ext invalid servername type + tls ext invalid max fragment length +SSL_R_TLS_EXT_INVALID_SERVERNAME:319:tls ext invalid servername +SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE:320:tls ext invalid servername type SSL_R_TLS_ILLEGAL_EXPORTER_LABEL:367:tls illegal exporter label SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST:157:tls invalid ecpointformat list -SSL_R_TLS_SESSION_ID_TOO_LONG:300:ssl3 session id too long +SSL_R_TLS_SESSION_ID_TOO_LONG:300:tls session id too long SSL_R_TOO_MANY_KEY_UPDATES:132:too many key updates SSL_R_TOO_MANY_WARN_ALERTS:409:too many warn alerts SSL_R_TOO_MUCH_EARLY_DATA:164:too much early data diff --git a/crypto/ssl_err.c b/crypto/ssl_err.c index 0dca54bb1db..9766b643146 100644 --- a/crypto/ssl_err.c +++ b/crypto/ssl_err.c @@ -426,36 +426,6 @@ static const ERR_STRING_DATA SSL_str_reasons[] = { "srtp protection profile list too long" }, { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE), "srtp unknown protection profile" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH), - "tls ext invalid max fragment length" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME), - "tls ext invalid servername" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE), - "tls ext invalid servername type" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_SESSION_ID_TOO_LONG), - "tls session id too long" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_CERTIFICATE), - "tls alert bad certificate" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_RECORD_MAC), - "tls alert bad record mac" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED), - "tls alert certificate expired" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_REVOKED), - "tls alert certificate revoked" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN), - "tls alert certificate unknown" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE), - "tls alert decompression failure" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_HANDSHAKE_FAILURE), - "tls alert handshake failure" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_ILLEGAL_PARAMETER), - "tls alert illegal parameter" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_NO_CERTIFICATE), - "tls alert no certificate" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE), - "tls alert unexpected message" }, - { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE), - "tls alert unsupported certificate" }, { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SSL_COMMAND_SECTION_EMPTY), "ssl command section empty" }, { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_SSL_COMMAND_SECTION_NOT_FOUND), @@ -534,10 +504,40 @@ static const ERR_STRING_DATA SSL_str_reasons[] = { "tlsv1 unrecognized name" }, { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLSV1_UNSUPPORTED_EXTENSION), "tlsv1 unsupported extension" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_CERTIFICATE), + "tls alert bad certificate" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_BAD_RECORD_MAC), + "tls alert bad record mac" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED), + "tls alert certificate expired" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_REVOKED), + "tls alert certificate revoked" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN), + "tls alert certificate unknown" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE), + "tls alert decompression failure" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_HANDSHAKE_FAILURE), + "tls alert handshake failure" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_ILLEGAL_PARAMETER), + "tls alert illegal parameter" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_NO_CERTIFICATE), + "tls alert no certificate" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE), + "tls alert unexpected message" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE), + "tls alert unsupported certificate" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH), + "tls ext invalid max fragment length" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME), + "tls ext invalid servername" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE), + "tls ext invalid servername type" }, { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL), "tls illegal exporter label" }, { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST), "tls invalid ecpointformat list" }, + { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TLS_SESSION_ID_TOO_LONG), + "tls session id too long" }, { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TOO_MANY_KEY_UPDATES), "too many key updates" }, { ERR_PACK(ERR_LIB_SSL, 0, SSL_R_TOO_MANY_WARN_ALERTS), diff --git a/crypto/sslerr.h b/crypto/sslerr.h index 968f27b00a6..f2936b7d999 100644 --- a/crypto/sslerr.h +++ b/crypto/sslerr.h @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy diff --git a/include/openssl/sslerr.h b/include/openssl/sslerr.h index 28e38861696..6ae701dba06 100644 --- a/include/openssl/sslerr.h +++ b/include/openssl/sslerr.h @@ -269,21 +269,6 @@ #define SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES 362 #define SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG 363 #define SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE 364 -#define SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH 232 -#define SSL_R_TLS_EXT_INVALID_SERVERNAME 319 -#define SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE 320 -#define SSL_R_TLS_SESSION_ID_TOO_LONG 300 -#define SSL_R_TLS_ALERT_BAD_CERTIFICATE 1042 -#define SSL_R_TLS_ALERT_BAD_RECORD_MAC 1020 -#define SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED 1045 -#define SSL_R_TLS_ALERT_CERTIFICATE_REVOKED 1044 -#define SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN 1046 -#define SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE 1030 -#define SSL_R_TLS_ALERT_HANDSHAKE_FAILURE 1040 -#define SSL_R_TLS_ALERT_ILLEGAL_PARAMETER 1047 -#define SSL_R_TLS_ALERT_NO_CERTIFICATE 1041 -#define SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE 1010 -#define SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE 1043 #define SSL_R_SSL_COMMAND_SECTION_EMPTY 117 #define SSL_R_SSL_COMMAND_SECTION_NOT_FOUND 125 #define SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION 228 @@ -326,8 +311,23 @@ #define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE 1111 #define SSL_R_TLSV1_UNRECOGNIZED_NAME 1112 #define SSL_R_TLSV1_UNSUPPORTED_EXTENSION 1110 +#define SSL_R_TLS_ALERT_BAD_CERTIFICATE 1042 +#define SSL_R_TLS_ALERT_BAD_RECORD_MAC 1020 +#define SSL_R_TLS_ALERT_CERTIFICATE_EXPIRED 1045 +#define SSL_R_TLS_ALERT_CERTIFICATE_REVOKED 1044 +#define SSL_R_TLS_ALERT_CERTIFICATE_UNKNOWN 1046 +#define SSL_R_TLS_ALERT_DECOMPRESSION_FAILURE 1030 +#define SSL_R_TLS_ALERT_HANDSHAKE_FAILURE 1040 +#define SSL_R_TLS_ALERT_ILLEGAL_PARAMETER 1047 +#define SSL_R_TLS_ALERT_NO_CERTIFICATE 1041 +#define SSL_R_TLS_ALERT_UNEXPECTED_MESSAGE 1010 +#define SSL_R_TLS_ALERT_UNSUPPORTED_CERTIFICATE 1043 +#define SSL_R_TLS_EXT_INVALID_MAX_FRAGMENT_LENGTH 232 +#define SSL_R_TLS_EXT_INVALID_SERVERNAME 319 +#define SSL_R_TLS_EXT_INVALID_SERVERNAME_TYPE 320 #define SSL_R_TLS_ILLEGAL_EXPORTER_LABEL 367 #define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST 157 +#define SSL_R_TLS_SESSION_ID_TOO_LONG 300 #define SSL_R_TOO_MANY_KEY_UPDATES 132 #define SSL_R_TOO_MANY_WARN_ALERTS 409 #define SSL_R_TOO_MUCH_EARLY_DATA 164