Add SSL error code updates from
@@ -902,7 +902,7 @@ find themselves unable to migrate their session cache functionality without
accessing fields of `mbedtls_ssl_session` should describe their use case
on the Mbed TLS mailing list.
-### Removal of some SSL error codes
+### Changes in the SSL error code space
This affects users manually checking for the following error codes:
@@ -929,9 +929,28 @@ Migration paths:
compare the size of their own certificate against the configured size of the output buffer to
understand if the error is due to an overly large certificate.
-- `MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN` and `MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE` have been replaced by `MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE`
+- `MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN` and `MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE` have been
+ replaced by `MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE`.
-- all codes of the form `MBEDTLS_ERR_SSL_BAD_HS_XXX` have been replaced by various alternatives.
+- All codes of the form `MBEDTLS_ERR_SSL_BAD_HS_XXX` have been replaced by various alternatives.
+
+ Users should check for the newly introduced generic error codes
+
+ * `MBEDTLS_ERR_SSL_DECODE_ERROR`
+ * `MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER`,
+ * `MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE`
+ * `MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION`
+ * `MBEDTLS_ERR_SSL_BAD_CERTIFICATE`
+ * `MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME`
+ * `MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION`
+ * `MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL`
+
+ and the pre-existing generic error codes
+
+ * `MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE`
+ * `MBEDTLS_ERR_SSL_INTERNAL_ERROR`
+
+ instead.
### Modified semantics of `mbedtls_ssl_{get,set}_session()`
