Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc42e5fd

Browse files
committed
Cope with a deficiency in OpenSSL 3.x's error reporting.
In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refusesto provide a string for error codes representing system errno values(e.g., "No such file or directory"). There is a poorly-documented wayto extract the errno from the SSL error code in this case, so do thatand apply strerror, rather than falling back to reporting the errorcode's numeric value as we were previously doing.Problem reported by David Zhang, although this is not his proposedpatch; it's instead based on a suggestion from Heikki Linnakangas.Back-patch to all supported branches, since any of them are likelyto be used with recent OpenSSL.Discussion:https://postgr.es/m/b6fb018b-f05c-4afd-abd3-318c649faf18@highgo.ca
1 parent69e8f9d commitc42e5fd

File tree

2 files changed

+36
-6
lines changed

2 files changed

+36
-6
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1096,9 +1096,9 @@ initialize_ecdh(SSL_CTX *context, bool isServerStart)
10961096
*
10971097
* ERR_get_error() is used by caller to get errcode to pass here.
10981098
*
1099-
* Some caution is needed here since ERR_reason_error_string will
1100-
*return NULLif it doesn't recognize the error code. We don't
1101-
* want to return NULL ever.
1099+
* Some caution is needed here since ERR_reason_error_string will return NULL
1100+
* if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
1101+
*represents a system errno value. We don'twant to return NULL ever.
11021102
*/
11031103
staticconstchar*
11041104
SSLerrmessage(unsigned longecode)
@@ -1111,6 +1111,19 @@ SSLerrmessage(unsigned long ecode)
11111111
errreason=ERR_reason_error_string(ecode);
11121112
if (errreason!=NULL)
11131113
returnerrreason;
1114+
1115+
/*
1116+
* In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
1117+
* map system errno values. We can cover that shortcoming with this bit
1118+
* of code. Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
1119+
* but that's okay because they don't have the shortcoming either.
1120+
*/
1121+
#ifdefERR_SYSTEM_ERROR
1122+
if (ERR_SYSTEM_ERROR(ecode))
1123+
returnstrerror(ERR_GET_REASON(ecode));
1124+
#endif
1125+
1126+
/* No choice but to report the numeric ecode */
11141127
snprintf(errbuf,sizeof(errbuf),_("SSL error code %lu"),ecode);
11151128
returnerrbuf;
11161129
}

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1355,10 +1355,11 @@ pgtls_close(PGconn *conn)
13551355
* Obtain reason string for passed SSL errcode
13561356
*
13571357
* ERR_get_error() is used by caller to get errcode to pass here.
1358+
* The result must be freed after use, using SSLerrfree.
13581359
*
1359-
* Some caution is needed here since ERR_reason_error_string will
1360-
*return NULLif it doesn't recognize the error code. We don't
1361-
* want to return NULL ever.
1360+
* Some caution is needed here since ERR_reason_error_string will return NULL
1361+
* if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
1362+
*represents a system errno value. We don'twant to return NULL ever.
13621363
*/
13631364
staticcharssl_nomem[]="out of memory allocating error description";
13641365

@@ -1384,6 +1385,22 @@ SSLerrmessage(unsigned long ecode)
13841385
strlcpy(errbuf,errreason,SSL_ERR_LEN);
13851386
returnerrbuf;
13861387
}
1388+
1389+
/*
1390+
* In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
1391+
* map system errno values. We can cover that shortcoming with this bit
1392+
* of code. Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
1393+
* but that's okay because they don't have the shortcoming either.
1394+
*/
1395+
#ifdefERR_SYSTEM_ERROR
1396+
if (ERR_SYSTEM_ERROR(ecode))
1397+
{
1398+
strlcpy(errbuf,strerror(ERR_GET_REASON(ecode)),SSL_ERR_LEN);
1399+
returnerrbuf;
1400+
}
1401+
#endif
1402+
1403+
/* No choice but to report the numeric ecode */
13871404
snprintf(errbuf,SSL_ERR_LEN,libpq_gettext("SSL error code %lu"),ecode);
13881405
returnerrbuf;
13891406
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp