Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.4\))
Subject: Re: improve ssl error code, 2147483650
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <563351.1709841511@sss.pgh.pa.us>
Date: Thu, 7 Mar 2024 21:08:56 +0100
Cc: Stephen Frost <sfrost@snowman.net>,
 Heikki Linnakangas <hlinnaka@iki.fi>,
 David Zhang <david.zhang@highgo.ca>,
 Pgsql Hackers <pgsql-hackers@lists.postgresql.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <61B1CFBD-14F8-4ECE-816E-6618FD68781C@yesql.se>
References: <b6fb018b-f05c-4afd-abd3-318c649faf18@highgo.ca>
 <86932ed6-e4b3-44cd-abf2-7f0173dea782@iki.fi>
 <Zen46it50z9iXz2G@tamriel.snowman.net> <537905.1709833932@sss.pgh.pa.us>
 <563351.1709841511@sss.pgh.pa.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/61B1CFBD-14F8-4ECE-816E-6618FD68781C%40yesql.se>
Precedence: bulk

> On 7 Mar 2024, at 20:58, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>=20
> I wrote:
>> Stephen Frost <sfrost@snowman.net> writes:
>>> Agreed that it doesn't seem well documented.  I was trying to figure =
out
>>> what the 'right' answer here was myself and not having much success. =
 If
>>> the above works, then +1 to that.
>=20
>> My reaction as well --- I was just gearing up to test this idea,
>> unless one of you are already on it?
>=20
> I've confirmed that this:
>=20
> diff --git a/src/backend/libpq/be-secure-openssl.c =
b/src/backend/libpq/be-secure-openssl.c
> index e12b1cc9e3..47eee4b59d 100644
> --- a/src/backend/libpq/be-secure-openssl.c
> +++ b/src/backend/libpq/be-secure-openssl.c
> @@ -1363,6 +1363,10 @@ SSLerrmessage(unsigned long ecode)
> 	errreason =3D ERR_reason_error_string(ecode);
> 	if (errreason !=3D NULL)
> 		return errreason;
> +#ifdef ERR_SYSTEM_ERROR
> +	if (ERR_SYSTEM_ERROR(ecode))
> +		return strerror(ERR_GET_REASON(ecode));
> +#endif
> 	snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), =
ecode);
> 	return errbuf;
> }
>=20
> seems to be enough to fix the problem on OpenSSL 3.1.1.  The #ifdef
> is needed to avoid compile failure against OpenSSL 1.1.1 --- but that
> version doesn't have the problem, so we don't need to sweat.

This was introduced in OpenSSL 3.0.0 so that makes sense.  Pre-3.0.0 =
versions
truncates system errorcodes that was outside of the range 1..127 =
reserving the
rest for OpenSSL specific errors.  To capture the full range possible of =
system
errors the code is no longer truncated and the ERR_SYSTEM_FLAG flag is =
set,
which can be tested for with the macro used here.

> This could probably do with a comment, and we need to propagate
> the fix into libpq's copy of the function too.  Barring objections,
> I'll take care of that and push it later today.

LGTM.

--
Daniel Gustafsson