Yay for EINTR, but you're still handling EAGAIN; it's just called TLS_POLLIN/TLS_POLLOUT now. (Not that this is a bad thing: this is exactly what I'd expect from such an API, as it needs to integrate with the local event loop.)
The "What's wrong with the OpenSSL API" is excellent: a coworker ran into this just recently. A client was failing to connect, and had SSL23_XXX in the stack trace, and he wondered why it was using an outdated version of SSL; since we've long since disabled support for SSLv3 server-side, he figured — reasonably — that the client was failing to connect for that reason.
For those wondering, from the Python docs, which have the best explanation I know of:
ssl.PROTOCOL_SSLv23
Selects the highest protocol version that both the client and server support. Despite the name, this option can select “TLS” protocols as well as “SSL”.
Comments
Not to miss:
Less code http://www.openbsd.org/papers/libtls-fsec-2015/mgp00004.html
What's wrong with the OpenSSL API http://www.openbsd.org/papers/libtls-fsec-2015/mgp00007.html
TLS small set of functions http://www.openbsd.org/papers/libtls-fsec-2015/mgp00009.html
read() and write() semantics http://www.openbsd.org/papers/libtls-fsec-2015/mgp00011.html
No need for handling errno EAGAIN/EINTR yay! http://www.openbsd.org/papers/libtls-fsec-2015/mgp00016.html
There's more stuff like event/poll, but I don't want to link more. The presentation is very interesting.
Yay for EINTR, but you're still handling EAGAIN; it's just called TLS_POLLIN/TLS_POLLOUT now. (Not that this is a bad thing: this is exactly what I'd expect from such an API, as it needs to integrate with the local event loop.)
The "What's wrong with the OpenSSL API" is excellent: a coworker ran into this just recently. A client was failing to connect, and had SSL23_XXX in the stack trace, and he wondered why it was using an outdated version of SSL; since we've long since disabled support for SSLv3 server-side, he figured — reasonably — that the client was failing to connect for that reason.
For those wondering, from the Python docs, which have the best explanation I know of:
I think their point is that you just have to check the return value to know how to proceed, you don't have to check the return value and errno.
One nice side benefit of their usage of MagicPoint; it's easy to link directly into a specific slide.