@@ -949,9 +949,9 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
949949 OPENSSL_free (inner_sni );
950950 OPENSSL_free (outer_sni );
951951 /* OpenSSL also applies outer ALPN to ordinary and GREASE handshakes. */
952- if ((status == SSL_ECH_STATUS_NOT_CONFIGURED ||
953- status == SSL_ECH_STATUS_GREASE ) &&
954- SSL_ech_set1_outer_alpn_protos (self -> ssl , NULL , 0 ) != 1 ) {
952+ if ((status == SSL_ECH_STATUS_NOT_CONFIGURED
953+ || status == SSL_ECH_STATUS_GREASE )
954+ && SSL_ech_set1_outer_alpn_protos (self -> ssl , NULL , 0 ) != 1 ) {
955955 _setSSLError (get_state_ctx (sslctx ), NULL , 0 , __FILE__ , __LINE__ );
956956 Py_DECREF (self );
957957 return NULL ;
@@ -4069,8 +4069,8 @@ _ssl__SSLContext__set_outer_alpn_protocols_impl(PySSLContext *self,
40694069 return NULL ;
40704070 }
40714071 if (SSL_CTX_ech_set1_outer_alpn_protos (self -> ctx ,
4072- protos -> len ? protos -> buf : NULL ,
4073- protos -> len ) != 1 ) {
4072+ protos -> len ? protos -> buf : NULL ,
4073+ protos -> len ) != 1 ) {
40744074 _setSSLError (get_state_ctx (self ), NULL , 0 , __FILE__ , __LINE__ );
40754075 return NULL ;
40764076 }
@@ -5260,24 +5260,23 @@ _ssl__SSLContext_set_ech_config_impl(PySSLContext *self,
52605260 unsigned char length [2 ] = {
52615261 (unsigned char )(entry_len >> 8 ), (unsigned char )entry_len
52625262 };
5263- if (BIO_reset (config_bio ) != 1 ||
5264- BIO_write (config_bio , length , sizeof (length )) != sizeof (length ) ||
5265- BIO_write (config_bio , config , entry_len ) != entry_len ) {
5263+ if (BIO_reset (config_bio ) != 1
5264+ || BIO_write (config_bio , length , sizeof (length )) != sizeof (length )
5265+ || BIO_write (config_bio , config , entry_len ) != entry_len ) {
52665266 goto fail ;
52675267 }
52685268 ERR_clear_error ();
52695269 if (OSSL_ECHSTORE_read_echconfiglist (store , config_bio ) != 1 ) {
52705270 unsigned long err = ERR_peek_error ();
52715271 /* Unsupported HPKE suites may first raise provider errors. */
5272- while (ERR_GET_LIB (err ) == ERR_LIB_PROV &&
5273- !ERR_FATAL_ERROR (err )) {
5272+ while (ERR_GET_LIB (err ) == ERR_LIB_PROV && !ERR_FATAL_ERROR (err )) {
52745273 ERR_get_error ();
52755274 err = ERR_peek_error ();
52765275 }
52775276 /* Ignore unsupported suites and mandatory extensions,
52785277 * preserving malformed input and fatal errors. */
5279- if (ERR_GET_LIB (err ) != ERR_LIB_SSL ||
5280- ERR_GET_REASON (err ) != ERR_R_PASSED_INVALID_ARGUMENT ) {
5278+ if (ERR_GET_LIB (err ) != ERR_LIB_SSL
5279+ || ERR_GET_REASON (err ) != ERR_R_PASSED_INVALID_ARGUMENT ) {
52815280 goto fail ;
52825281 }
52835282 }
@@ -5291,8 +5290,8 @@ _ssl__SSLContext_set_ech_config_impl(PySSLContext *self,
52915290 goto fail ;
52925291 }
52935292 }
5294- else if (BIO_write (config_bio , config , config_len ) != config_len ||
5295- OSSL_ECHSTORE_read_echconfiglist (store , config_bio ) != 1 ) {
5293+ else if (BIO_write (config_bio , config , config_len ) != config_len
5294+ || OSSL_ECHSTORE_read_echconfiglist (store , config_bio ) != 1 ) {
52965295 goto fail ;
52975296 }
52985297 int num_entries ;
@@ -5334,7 +5333,7 @@ load_ech_keys(SSL_CTX *ctx, BIO *bio, int for_retry)
53345333 int old_keys , new_keys ;
53355334 OSSL_ECHSTORE * store = NULL ;
53365335 EVP_PKEY * key = PEM_read_bio_PrivateKey (bio , NULL ,
5337- ech_password_callback , NULL );
5336+ ech_password_callback , NULL );
53385337 if (key == NULL ) {
53395338 goto end ;
53405339 }
@@ -5348,12 +5347,12 @@ load_ech_keys(SSL_CTX *ctx, BIO *bio, int for_retry)
53485347 goto end ;
53495348 }
53505349 }
5351- if (OSSL_ECHSTORE_num_keys (store , & old_keys ) != 1 ||
5352- OSSL_ECHSTORE_set1_key_and_read_pem (store , key , bio , for_retry ) != 1 ||
5353- OSSL_ECHSTORE_num_keys (store , & new_keys ) != 1 ) {
5350+ if (OSSL_ECHSTORE_num_keys (store , & old_keys ) != 1
5351+ || OSSL_ECHSTORE_set1_key_and_read_pem (store , key , bio , for_retry ) != 1
5352+ || OSSL_ECHSTORE_num_keys (store , & new_keys ) != 1 ) {
53545353 goto end ;
53555354 }
5356- /* OpenSSL may match a key already in the store. Require a new match. */
5355+ // OpenSSL may match a key already in the store. Require a new match.
53575356 if (new_keys <= old_keys ) {
53585357 ERR_raise (ERR_LIB_SSL , SSL_R_PRIVATE_KEY_MISMATCH );
53595358 goto end ;
0 commit comments