Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9fbe072

Browse files
committed
Cope with a deficiency in OpenSSL 3.x's error reporting.
In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refusesto provide a string for error codes representing system errno values(e.g., "No such file or directory"). There is a poorly-documented wayto extract the errno from the SSL error code in this case, so do thatand apply strerror, rather than falling back to reporting the errorcode's numeric value as we were previously doing.Problem reported by David Zhang, although this is not his proposedpatch; it's instead based on a suggestion from Heikki Linnakangas.Back-patch to all supported branches, since any of them are likelyto be used with recent OpenSSL.Discussion:https://postgr.es/m/b6fb018b-f05c-4afd-abd3-318c649faf18@highgo.ca
1 parent70a3162 commit9fbe072

File tree

2 files changed

+36
-6
lines changed

2 files changed

+36
-6
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1146,9 +1146,9 @@ initialize_ecdh(SSL_CTX *context, bool isServerStart)
11461146
*
11471147
* ERR_get_error() is used by caller to get errcode to pass here.
11481148
*
1149-
* Some caution is needed here since ERR_reason_error_string will
1150-
*return NULLif it doesn't recognize the error code. We don't
1151-
* want to return NULL ever.
1149+
* Some caution is needed here since ERR_reason_error_string will return NULL
1150+
* if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
1151+
*represents a system errno value. We don'twant to return NULL ever.
11521152
*/
11531153
staticconstchar*
11541154
SSLerrmessage(unsigned longecode)
@@ -1161,6 +1161,19 @@ SSLerrmessage(unsigned long ecode)
11611161
errreason=ERR_reason_error_string(ecode);
11621162
if (errreason!=NULL)
11631163
returnerrreason;
1164+
1165+
/*
1166+
* In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
1167+
* map system errno values. We can cover that shortcoming with this bit
1168+
* of code. Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
1169+
* but that's okay because they don't have the shortcoming either.
1170+
*/
1171+
#ifdefERR_SYSTEM_ERROR
1172+
if (ERR_SYSTEM_ERROR(ecode))
1173+
returnstrerror(ERR_GET_REASON(ecode));
1174+
#endif
1175+
1176+
/* No choice but to report the numeric ecode */
11641177
snprintf(errbuf,sizeof(errbuf),_("SSL error code %lu"),ecode);
11651178
returnerrbuf;
11661179
}

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1466,10 +1466,11 @@ pgtls_close(PGconn *conn)
14661466
* Obtain reason string for passed SSL errcode
14671467
*
14681468
* ERR_get_error() is used by caller to get errcode to pass here.
1469+
* The result must be freed after use, using SSLerrfree.
14691470
*
1470-
* Some caution is needed here since ERR_reason_error_string will
1471-
*return NULLif it doesn't recognize the error code. We don't
1472-
* want to return NULL ever.
1471+
* Some caution is needed here since ERR_reason_error_string will return NULL
1472+
* if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
1473+
*represents a system errno value. We don'twant to return NULL ever.
14731474
*/
14741475
staticcharssl_nomem[]="out of memory allocating error description";
14751476

@@ -1495,6 +1496,22 @@ SSLerrmessage(unsigned long ecode)
14951496
strlcpy(errbuf,errreason,SSL_ERR_LEN);
14961497
returnerrbuf;
14971498
}
1499+
1500+
/*
1501+
* In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
1502+
* map system errno values. We can cover that shortcoming with this bit
1503+
* of code. Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
1504+
* but that's okay because they don't have the shortcoming either.
1505+
*/
1506+
#ifdefERR_SYSTEM_ERROR
1507+
if (ERR_SYSTEM_ERROR(ecode))
1508+
{
1509+
strlcpy(errbuf,strerror(ERR_GET_REASON(ecode)),SSL_ERR_LEN);
1510+
returnerrbuf;
1511+
}
1512+
#endif
1513+
1514+
/* No choice but to report the numeric ecode */
14981515
snprintf(errbuf,SSL_ERR_LEN,libpq_gettext("SSL error code %lu"),ecode);
14991516
returnerrbuf;
15001517
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp