Preserve server TLS request flags when TLS is disabled (prevent fail-open)

[rgerhards]

Motivation

• Fix a fail-open downgrade where calling the newer TLS-enable APIs could return RELP_RET_ERR_NO_TLS but not record that TLS was requested, allowing relpSrvRun() to skip TLS setup and start a plaintext listener when librelp is built without TLS.

Description

• Update relpSrvEnableTLS2 and relpSrvEnableTLSZip2 to set pThis->bEnableTLS / pThis->bEnableTLSZip unconditionally and still return RELP_RET_ERR_NO_TLS in builds without TLS using a #if !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL)) guard for the error path.

Testing

• Ran git diff --check which reported no whitespace or diff errors; this succeeded.
• Ran autoreconf -fvi which failed in the current environment because aclocal is not available, so full autotools regeneration could not be executed here.

---

Codex Task

---

Summary by cubic

Prevents a fail-open downgrade when enabling server TLS on builds without TLS. Previously relpSrvEnableTLS2/relpSrvEnableTLSZip2 returned RELP_RET_ERR_NO_TLS but did not record the TLS request, so relpSrvRun() started a plaintext listener; now the enable calls always set the request flags and relpSrvRun() returns RELP_RET_ERR_NO_TLS without starting a listener.

• Always set bEnableTLS/bEnableTLSZip in relpSrvEnableTLS2/relpSrvEnableTLSZip2; still return RELP_RET_ERR_NO_TLS when TLS is unsupported; add RELPOBJ_assert(pThis, Srv) to validate input.
• No behavior change in TLS-enabled builds. In non-TLS builds callers still receive RELP_RET_ERR_NO_TLS and must not start a listener.
• Adds regression test tls-request-no-tls (built and run only when !ENABLE_TLS_GENERIC) to verify flags are set and no TCP listener is created.

^{Written for commit 1ca58dc. Summary will update on new commits.}

[Copilot]

Pull request overview

Prevents a TLS “fail-open” downgrade in non-TLS builds by recording that TLS (and TLS+ZIP) was requested even when the TLS enable APIs return RELP_RET_ERR_NO_TLS, so relpSrvRun() won’t silently start a plaintext listener.

Changes:

• Set relpSrv_t::bEnableTLS unconditionally in relpSrvEnableTLS2(), while still returning RELP_RET_ERR_NO_TLS in non-TLS builds.
• Set relpSrv_t::bEnableTLSZip unconditionally in relpSrvEnableTLSZip2(), while still returning RELP_RET_ERR_NO_TLS in non-TLS builds.

Suppressed comments (1)

src/relpsrv.c:369

• relpSrvEnableTLSZip2() now dereferences pThis unconditionally (even in non-TLS builds), but it doesn’t validate the server handle (contrast with most other relpSrv* setters which use RELPOBJ_assert(pThis, Srv)). Adding the assertion keeps the API consistent and catches invalid handles in debug builds. Also update the #endif comment to match the new #if !(...) guard.

	ENTER_RELPFUNC;
	pThis->bEnableTLSZip = 1;
#if !(defined(ENABLE_TLS) || defined(ENABLE_TLS_OPENSSL))
	iRet = RELP_RET_ERR_NO_TLS;
#endif /* #ifdef ENABLE_TLS | ENABLE_TLS_OPENSSL */

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.