Cope with a deficiency in OpenSSL 3.x's error reporting.

In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses
to provide a string for error codes representing system errno values
(e.g., "No such file or directory").  There is a poorly-documented way
to extract the errno from the SSL error code in this case, so do that
and apply strerror, rather than falling back to reporting the error
code's numeric value as we were previously doing.

Problem reported by David Zhang, although this is not his proposed
patch; it's instead based on a suggestion from Heikki Linnakangas.
Back-patch to all supported branches, since any of them are likely
to be used with recent OpenSSL.

Discussion: https://postgr.es/m/b6fb018b-f05c-4afd-abd3-318c649faf18@highgo.ca

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 4f1fd91ba4d6bb267133b31277347317d241328d..6f0ecf8bf7b67c3f4da08bbe5e0ce121219e1af8 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -1350,9 +1350,9 @@ initialize_ecdh(SSL_CTX *context, bool isServerStart)
  *
  * ERR_get_error() is used by caller to get errcode to pass here.
  *
- * Some caution is needed here since ERR_reason_error_string will
- * return NULL if it doesn't recognize the error code.  We don't
- * want to return NULL ever.
+ * Some caution is needed here since ERR_reason_error_string will return NULL
+ * if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
+ * represents a system errno value.  We don't want to return NULL ever.
  */
 static const char *
 SSLerrmessage(unsigned long ecode)
@@ -1365,6 +1365,19 @@ SSLerrmessage(unsigned long ecode)
    errreason = ERR_reason_error_string(ecode);
    if (errreason != NULL)
        return errreason;
+
+   /*
+    * In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
+    * map system errno values.  We can cover that shortcoming with this bit
+    * of code.  Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
+    * but that's okay because they don't have the shortcoming either.
+    */
+#ifdef ERR_SYSTEM_ERROR
+   if (ERR_SYSTEM_ERROR(ecode))
+       return strerror(ERR_GET_REASON(ecode));
+#endif
+
+   /* No choice but to report the numeric ecode */
    snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
    return errbuf;
 }

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index 82360b0e29b3c7c93497eff4b017ecad22fc4f65..c2858096b5dac1a9da8a23b86cbccb39abf50d72 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1675,10 +1675,11 @@ pgtls_close(PGconn *conn)
  * Obtain reason string for passed SSL errcode
  *
  * ERR_get_error() is used by caller to get errcode to pass here.
+ * The result must be freed after use, using SSLerrfree.
  *
- * Some caution is needed here since ERR_reason_error_string will
- * return NULL if it doesn't recognize the error code.  We don't
- * want to return NULL ever.
+ * Some caution is needed here since ERR_reason_error_string will return NULL
+ * if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
+ * represents a system errno value.  We don't want to return NULL ever.
  */
 static char ssl_nomem[] = "out of memory allocating error description";
 
@@ -1704,6 +1705,22 @@ SSLerrmessage(unsigned long ecode)
        strlcpy(errbuf, errreason, SSL_ERR_LEN);
        return errbuf;
    }
+
+   /*
+    * In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
+    * map system errno values.  We can cover that shortcoming with this bit
+    * of code.  Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
+    * but that's okay because they don't have the shortcoming either.
+    */
+#ifdef ERR_SYSTEM_ERROR
+   if (ERR_SYSTEM_ERROR(ecode))
+   {
+       strlcpy(errbuf, strerror(ERR_GET_REASON(ecode)), SSL_ERR_LEN);
+       return errbuf;
+   }
+#endif
+
+   /* No choice but to report the numeric ecode */
    snprintf(errbuf, SSL_ERR_LEN, libpq_gettext("SSL error code %lu"), ecode);
    return errbuf;
 }