Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit473babd

Browse files
committed
Cope with a deficiency in OpenSSL 3.x's error reporting.
In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refusesto provide a string for error codes representing system errno values(e.g., "No such file or directory"). There is a poorly-documented wayto extract the errno from the SSL error code in this case, so do thatand apply strerror, rather than falling back to reporting the errorcode's numeric value as we were previously doing.Problem reported by David Zhang, although this is not his proposedpatch; it's instead based on a suggestion from Heikki Linnakangas.Back-patch to all supported branches, since any of them are likelyto be used with recent OpenSSL.Discussion:https://postgr.es/m/b6fb018b-f05c-4afd-abd3-318c649faf18@highgo.ca
1 parent49b9712 commit473babd

File tree

2 files changed

+36
-6
lines changed

2 files changed

+36
-6
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1225,9 +1225,9 @@ initialize_ecdh(SSL_CTX *context, bool isServerStart)
12251225
*
12261226
* ERR_get_error() is used by caller to get errcode to pass here.
12271227
*
1228-
* Some caution is needed here since ERR_reason_error_string will
1229-
*return NULLif it doesn't recognize the error code. We don't
1230-
* want to return NULL ever.
1228+
* Some caution is needed here since ERR_reason_error_string will return NULL
1229+
* if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
1230+
*represents a system errno value. We don'twant to return NULL ever.
12311231
*/
12321232
staticconstchar*
12331233
SSLerrmessage(unsigned longecode)
@@ -1240,6 +1240,19 @@ SSLerrmessage(unsigned long ecode)
12401240
errreason=ERR_reason_error_string(ecode);
12411241
if (errreason!=NULL)
12421242
returnerrreason;
1243+
1244+
/*
1245+
* In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
1246+
* map system errno values. We can cover that shortcoming with this bit
1247+
* of code. Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
1248+
* but that's okay because they don't have the shortcoming either.
1249+
*/
1250+
#ifdefERR_SYSTEM_ERROR
1251+
if (ERR_SYSTEM_ERROR(ecode))
1252+
returnstrerror(ERR_GET_REASON(ecode));
1253+
#endif
1254+
1255+
/* No choice but to report the numeric ecode */
12431256
snprintf(errbuf,sizeof(errbuf),_("SSL error code %lu"),ecode);
12441257
returnerrbuf;
12451258
}

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1525,10 +1525,11 @@ pgtls_close(PGconn *conn)
15251525
* Obtain reason string for passed SSL errcode
15261526
*
15271527
* ERR_get_error() is used by caller to get errcode to pass here.
1528+
* The result must be freed after use, using SSLerrfree.
15281529
*
1529-
* Some caution is needed here since ERR_reason_error_string will
1530-
*return NULLif it doesn't recognize the error code. We don't
1531-
* want to return NULL ever.
1530+
* Some caution is needed here since ERR_reason_error_string will return NULL
1531+
* if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
1532+
*represents a system errno value. We don'twant to return NULL ever.
15321533
*/
15331534
staticcharssl_nomem[]="out of memory allocating error description";
15341535

@@ -1554,6 +1555,22 @@ SSLerrmessage(unsigned long ecode)
15541555
strlcpy(errbuf,errreason,SSL_ERR_LEN);
15551556
returnerrbuf;
15561557
}
1558+
1559+
/*
1560+
* In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
1561+
* map system errno values. We can cover that shortcoming with this bit
1562+
* of code. Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
1563+
* but that's okay because they don't have the shortcoming either.
1564+
*/
1565+
#ifdefERR_SYSTEM_ERROR
1566+
if (ERR_SYSTEM_ERROR(ecode))
1567+
{
1568+
strlcpy(errbuf,strerror(ERR_GET_REASON(ecode)),SSL_ERR_LEN);
1569+
returnerrbuf;
1570+
}
1571+
#endif
1572+
1573+
/* No choice but to report the numeric ecode */
15571574
snprintf(errbuf,SSL_ERR_LEN,libpq_gettext("SSL error code %lu"),ecode);
15581575
returnerrbuf;
15591576
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp