From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Heikki Linnakangas <hlinnaka@iki.fi>, David Zhang <david.zhang@highgo.ca>,
        Pgsql Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: improve ssl error code, 2147483650
In-reply-to: <537905.1709833932@sss.pgh.pa.us>
References: <b6fb018b-f05c-4afd-abd3-318c649faf18@highgo.ca> <86932ed6-e4b3-44cd-abf2-7f0173dea782@iki.fi> <Zen46it50z9iXz2G@tamriel.snowman.net> <537905.1709833932@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Thu, 07 Mar 2024 12:52:12 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <563350.1709841511.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 07 Mar 2024 14:58:31 -0500
Message-ID: <563351.1709841511@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/563351.1709841511%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> Stephen Frost <sfrost@snowman.net> writes:
>> Agreed that it doesn't seem well documented.  I was trying to figure ou=
t
>> what the 'right' answer here was myself and not having much success.  I=
f
>> the above works, then +1 to that.

> My reaction as well --- I was just gearing up to test this idea,
> unless one of you are already on it?

I've confirmed that this:

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-=
secure-openssl.c
index e12b1cc9e3..47eee4b59d 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -1363,6 +1363,10 @@ SSLerrmessage(unsigned long ecode)
 	errreason =3D ERR_reason_error_string(ecode);
 	if (errreason !=3D NULL)
 		return errreason;
+#ifdef ERR_SYSTEM_ERROR
+	if (ERR_SYSTEM_ERROR(ecode))
+		return strerror(ERR_GET_REASON(ecode));
+#endif
 	snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
 	return errbuf;
 }

seems to be enough to fix the problem on OpenSSL 3.1.1.  The #ifdef
is needed to avoid compile failure against OpenSSL 1.1.1 --- but that
version doesn't have the problem, so we don't need to sweat.

This could probably do with a comment, and we need to propagate
the fix into libpq's copy of the function too.  Barring objections,
I'll take care of that and push it later today.

			regards, tom lane