TLS_ACCEPT_SOCKET(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💅 tls_accept_socket(3) — the libtls era begins

okay so bestie, this one is from the Library Functions Manual for libtls (and it links against libssl and libcrypto, iykyk) — and it's literally the "let the client in" page for a TLS server. 🎀

The stars of the show are tls_accept_socket, tls_accept_fds, and tls_accept_cbs, and they all do one iconic thing: accept an incoming client connection in a TLS server. Periodt.

✨ NAME ✨

tls_accept_socket, tls_accept_fds, tls_accept_cbs — accept an incoming client connection in a TLS server 🌸

✨ SYNOPSIS ✨

library “libtls” libssl libcrypto

#include <tls.h>

int
tls_accept_socket(struct tls *tls, struct tls **cctx, int socket);

int
tls_accept_fds(struct tls *tls, struct tls **cctx, int fd_read,
    int fd_write);

int
tls_accept_cbs(struct tls *tls, struct tls **cctx,
    ssize_t (*tls_read_cb)(struct tls *ctx, void *buf, size_t buflen, void *cb_arg),
    ssize_t (*tls_write_cb)(struct tls *ctx, const void *buf, size_t buflen, void *cb_arg),
    void *cb_arg);

like, look at that third one. it's giving callback main character energy. 💅

✨ DESCRIPTION ✨

so first things first, bestie: you don't just roll up on tls_accept_socket() with nothing. 🫶

You make a TLS server context tls with tls_server(3) and you configure it with tls_configure(3). Then, once you have an already established socket connection, the server accepts a new client connection by calling tls_accept_socket() on it. easy. slay.

Alternatively — yes there's an alternative, we love options — a new client connection can be accepted over a pair of existing file descriptors by calling tls_accept_fds(). two fds, one vibe. 🦋

And then there's calling tls_accept_cbs(), which lets read and write callback functions handle data transfers. the specified cb_arg parameter gets passed back to the functions, and it can contain a pointer to any caller-specified data. so it's like, your little bag of stuff that travels with the callbacks. 🎀

All these functions create a new context suitable for reading and writing and return it in *cctx. that's the whole point, that's the payoff, that *cctx is your new bestie. 👑

✨ RETURN VALUES ✨

keep it simple, keep it cute:

  • 0 — success 💖
  • -1 — error 😭

that's it. that's the return value lore. no cap.

✨ SEE ALSO ✨

go read these next, i'm obsessed with them for you:

✨ HISTORY ✨

storytime, gather round 🧚

tls_accept_socket() appeared in OpenBSD 5.6 and got its final name in OpenBSD 5.7. glow-up era, fr.

tls_accept_fds() appeared in OpenBSD 5.8 and tls_accept_cbs() in OpenBSD 6.1. the family kept growing, we love to see it. 🌈

✨ AUTHORS ✨

  • Joel Sing <jsing@openbsd.org> 👑
  • tls_accept_cbs() was written by Tobias Pape <tobias@netshed.de> ✨
bestie reminder: none of this works until your context is set up properly, and the callbacks version is only as good as the callbacks you hand it. 💀

okay that's the whole page!! 💜 this came from the Debian build, dated July 7, 2025, and we're closing out on TLS_ACCEPT_SOCKET(3) — mwah, go accept some connections, you've got this 🎀✨🫶

📦 where this page comes from