From 57bdd8a488d544282dcc71e6a23987ded71ac64d Mon Sep 17 00:00:00 2001

From: Benjamin Fogle <benfogle@gmail.com>

Date: Thu, 17 Nov 2022 09:52:50 -0500

Subject: [PATCH] resolved: Fix OpenSSL error messages

(cherry picked from commit f4a49d1c58578cb8d759dc6266a23d1acabdc38f)

Related: #2138081

---

 src/resolve/resolved-dnstls-openssl.c | 65 +++++++++++----------------

 1 file changed, 26 insertions(+), 39 deletions(-)

diff --git a/src/resolve/resolved-dnstls-openssl.c b/src/resolve/resolved-dnstls-openssl.c

index 4d3a88c8da..4a0132ad3d 100644

--- a/src/resolve/resolved-dnstls-openssl.c

+++ b/src/resolve/resolved-dnstls-openssl.c

@@ -14,6 +14,19 @@

 #include "resolved-dnstls.h"

 #include "resolved-manager.h"

+static char *dnstls_error_string(int ssl_error, char *buf, size_t count) {

+        assert(buf || count == 0);

+        if (ssl_error == SSL_ERROR_SSL)

+                ERR_error_string_n(ERR_get_error(), buf, count);

+        else

+                snprintf(buf, count, "SSL_get_error()=%d", ssl_error);

+        return buf;

+}

+

+#define DNSTLS_ERROR_BUFSIZE 256

+#define DNSTLS_ERROR_STRING(error) \

+        dnstls_error_string((error), (char[DNSTLS_ERROR_BUFSIZE]){}, DNSTLS_ERROR_BUFSIZE)

+

 static int dnstls_flush_write_buffer(DnsStream *stream) {

         ssize_t ss;

@@ -97,26 +110,18 @@ int dnstls_stream_connect_tls(DnsStream *stream, DnsServer *server) {

         if (server->server_name) {

                 r = SSL_set_tlsext_host_name(s, server->server_name);

-                if (r <= 0) {

-                        char errbuf[256];

-

-                        error = ERR_get_error();

-                        ERR_error_string_n(error, errbuf, sizeof(errbuf));

-                        return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to set server name: %s", errbuf);

-                }

+                if (r <= 0)

+                        return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),

+                                               "Failed to set server name: %s", DNSTLS_ERROR_STRING(SSL_ERROR_SSL));

         }

         ERR_clear_error();

         stream->dnstls_data.handshake = SSL_do_handshake(s);

         if (stream->dnstls_data.handshake <= 0) {

                 error = SSL_get_error(s, stream->dnstls_data.handshake);

-                if (!IN_SET(error, SSL_ERROR_WANT_READ, SSL_ERROR_WANT_WRITE)) {

-                        char errbuf[256];

-

-                        ERR_error_string_n(error, errbuf, sizeof(errbuf));

+                if (!IN_SET(error, SSL_ERROR_WANT_READ, SSL_ERROR_WANT_WRITE))

                         return log_debug_errno(SYNTHETIC_ERRNO(ECONNREFUSED),

-                                               "Failed to invoke SSL_do_handshake: %s", errbuf);

-                }

+                                               "Failed to invoke SSL_do_handshake: %s", DNSTLS_ERROR_STRING(error));

         }

         stream->encrypted = true;

@@ -177,12 +182,8 @@ int dnstls_stream_on_io(DnsStream *stream, uint32_t revents) {

                         } else if (error == SSL_ERROR_SYSCALL) {

                                 if (errno > 0)

                                         log_debug_errno(errno, "Failed to invoke SSL_shutdown, ignoring: %m");

-                        } else {

-                                char errbuf[256];

-

-                                ERR_error_string_n(error, errbuf, sizeof(errbuf));

-                                log_debug("Failed to invoke SSL_shutdown, ignoring: %s", errbuf);

-                        }

+                        } else

+                                log_debug("Failed to invoke SSL_shutdown, ignoring: %s", DNSTLS_ERROR_STRING(error));

                 }

                 stream->dnstls_events = 0;

@@ -206,14 +207,10 @@ int dnstls_stream_on_io(DnsStream *stream, uint32_t revents) {

                                         return r;

                                 return -EAGAIN;

-                        } else {

-                                char errbuf[256];

-

-                                ERR_error_string_n(error, errbuf, sizeof(errbuf));

+                        } else

                                 return log_debug_errno(SYNTHETIC_ERRNO(ECONNREFUSED),

                                                        "Failed to invoke SSL_do_handshake: %s",

-                                                       errbuf);

-                        }

+                                                       DNSTLS_ERROR_STRING(error));

                 }

                 stream->dnstls_events = 0;

@@ -275,12 +272,8 @@ int dnstls_stream_shutdown(DnsStream *stream, int error) {

                         } else if (ssl_error == SSL_ERROR_SYSCALL) {

                                 if (errno > 0)

                                         log_debug_errno(errno, "Failed to invoke SSL_shutdown, ignoring: %m");

-                        } else {

-                                char errbuf[256];

-

-                                ERR_error_string_n(ssl_error, errbuf, sizeof(errbuf));

-                                log_debug("Failed to invoke SSL_shutdown, ignoring: %s", errbuf);

-                        }

+                        } else

+                                log_debug("Failed to invoke SSL_shutdown, ignoring: %s", DNSTLS_ERROR_STRING(ssl_error));

                 }

                 stream->dnstls_events = 0;

@@ -307,10 +300,7 @@ static ssize_t dnstls_stream_write(DnsStream *stream, const char *buf, size_t co

                         stream->dnstls_events = 0;

                         ss = 0;

                 } else {

-                        char errbuf[256];

-

-                        ERR_error_string_n(error, errbuf, sizeof(errbuf));

-                        log_debug("Failed to invoke SSL_write: %s", errbuf);

+                        log_debug("Failed to invoke SSL_write: %s", DNSTLS_ERROR_STRING(error));

                         stream->dnstls_events = 0;

                         ss = -EPIPE;

                 }

@@ -375,10 +365,7 @@ ssize_t dnstls_stream_read(DnsStream *stream, void *buf, size_t count) {

                         stream->dnstls_events = 0;

                         ss = 0;

                 } else {

-                        char errbuf[256];

-

-                        ERR_error_string_n(error, errbuf, sizeof(errbuf));

-                        log_debug("Failed to invoke SSL_read: %s", errbuf);

+                        log_debug("Failed to invoke SSL_read: %s", DNSTLS_ERROR_STRING(error));

                         stream->dnstls_events = 0;

                         ss = -EPIPE;

                 }