Date: Thu, 7 Mar 2024 12:27:06 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: David Zhang <david.zhang@highgo.ca>,
	Pgsql Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: improve ssl error code, 2147483650
Message-ID: <Zen46it50z9iXz2G@tamriel.snowman.net>
References: <b6fb018b-f05c-4afd-abd3-318c649faf18@highgo.ca>
 <86932ed6-e4b3-44cd-abf2-7f0173dea782@iki.fi>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="ziJvP/BYUGzwRdQ0"
Content-Disposition: inline
In-Reply-To: <86932ed6-e4b3-44cd-abf2-7f0173dea782@iki.fi>
User-Agent: Mutt/2.1.4 (2021-12-11)
Archived-At: <https://www.postgresql.org/message-id/Zen46it50z9iXz2G%40tamriel.snowman.net>
Precedence: bulk


--ziJvP/BYUGzwRdQ0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Heikki Linnakangas (hlinnaka@iki.fi) wrote:
> On 07/03/2024 02:12, David Zhang wrote:
> > The SSL_CTX_load_verify_locations function in OpenSSL will return NULL
> > if there is a system error, such as "No such file or directory" in this
> > case:
> >=20
> > const char *ERR_reason_error_string(unsigned long e)
> > {
> >   =A0=A0=A0 ERR_STRING_DATA d, *p =3D NULL;
> >   =A0=A0=A0 unsigned long l, r;
> >=20
> >   =A0=A0=A0 if (!RUN_ONCE(&err_string_init, do_err_strings_init)) {
> >   =A0=A0=A0=A0=A0=A0=A0 return NULL;
> >   =A0=A0=A0 }
> >=20
> >   =A0=A0=A0 /*
> >   =A0=A0=A0=A0 * ERR_reason_error_string() can't safely return system e=
rror strings,
> >   =A0=A0=A0=A0 * since openssl_strerror_r() needs a buffer for thread s=
afety, and we
> >   =A0=A0=A0=A0 * haven't got one that would serve any sensible purpose.
> >   =A0=A0=A0=A0 */
> >   =A0=A0=A0 if (ERR_SYSTEM_ERROR(e))
> >   =A0=A0=A0=A0=A0=A0=A0 return NULL;
>=20
> That's pretty unfortunate. As typical with OpenSSL, this stuff is not very
> well documented, but I think we could do something like this in
> SSLerrmessage():
>=20
> if (ERR_SYSTEM_ERROR(e))
>     errreason =3D strerror(ERR_GET_REASON(e));
>=20
> ERR_SYSTEM_ERROR only exists in OpenSSL 3.0 and above, and the only
> documentation I could find was in this one obscure place in the man pages=
: https://www.openssl.org/docs/man3.2/man3/BIO_dgram_get_local_addr_enable.=
html.
> But as a best-effort thing, it would still be better than "SSL error code
> 2147483650".

Agreed that it doesn't seem well documented.  I was trying to figure out
what the 'right' answer here was myself and not having much success.  If
the above works, then +1 to that.

> > It would be better to perform a simple SSL file check before passing the
> > SSL file to OpenSSL APIs so that the system error can be captured and a
> > meaningful message provided to the end user.
>=20
> That feels pretty ugly. I agree it would catch most of the common mistakes
> in practice, so maybe we should just hold our noses and do it anyway, if =
the
> above ERR_SYSTEM_ERROR() method doesn't work.

Yeah, seems better to try and handle this the OpenSSL way ... if that's
possible to do.

> It's sad that we cannot pass a file descriptor or in-memory copy of the f=
ile
> contents to those functions.

Agreed.

Thanks!

Stephen

--ziJvP/BYUGzwRdQ0
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEwf6gbxKhD863zrx/7WyKOINHZFUFAmXp+OcACgkQ7WyKOINH
ZFX0qQ//QgKc7jLsisl4fOJz3W6FlfhG2Kud4LN9R9U5FY37uCKek/85wc7FYWCx
AT0TwiUrriImAz/U+liSQHbE8STT4y+4ZSA0JEGj/IyCrkCoSFjyOWqv4P1wPDat
PzWIXQBfWDF9KTH6pijDJK8LZvtDG2EIRc8l4MwMU1ofgDbUNeDD6cdxzT4Lt0rK
pceqNABN/5DnCpcttVcru3jXlX8xHDpPmZF4z63VlE9WCP6tFHNNFJU99BuFMd5p
2+6Q9L5LP15yT81OZkL27zlE3a3fBP0ku43N7b51ddqol/tUavGGE+7vX/O3bca/
f4T7qVUgb/4XmjRlUhhP13wgIhRVFklULzwifH4ZRzh8VAqwv/ta99DSepQiucnO
jSnZi/eDWiKtfmHTW7Mg71PaYftnxkTQ0s48h3wXoXudbQQEDtL+2eA2LrOZqHvu
A4BkXnERYawytH+fvfgOfwnjWr3JPljmmHitFiKjcv89x9d8I1yWORxrkSf5JqiT
NUAd2QJy+NgVwb0+b8Gl7ewtbwp30LLzqaiUG3VxI6ZmcjpfUj+7X1Jc6Darsc2c
aM5m5caU5i3U1bhc9KC9a1GhMb3eLIB/UsNSks6OB7RLNK5wgScdDRWF30IbIJjW
48Jf+ChV7E+JxZc+dyrGkfxErJCp0M1T1sf8sd4JMkhvmhWFxFw=
=hvJT
-----END PGP SIGNATURE-----

--ziJvP/BYUGzwRdQ0--