8000 Fix errormessage for missing system CA in OpenSSL 3.1 · postgres/postgres@0b5d1fb · GitHub
[go: up one dir, main page]
Skip to content

Commit 0b5d1fb

Browse files
danielgustafssondanielgustafsson
committed
Fix errormessage for missing system CA in OpenSSL 3.1
The error message for a missing or invalid system CA when using sslrootcert=system differs based on the OpenSSL version used. In OpenSSL 1.0.1-3.0 it is reported as SSL Error, with varying degrees of helpfulness in the error message. With OpenSSL 3.1 it is reported as an SSL SYSCALL error with "Undefined error" as the error message. This fix pulls out the particular error in OpenSSL 3.1 as a certificate verify error in order to help the user better figure out what happened, and to keep the ssl test working. While there is no evidence that extracing the errors will clobber errno, this adds a guard against that regardless to also make the consistent with how we handle OpenSSL errors elsewhere. It also memorizes the output from OpenSSL 3.0 in the test in cases where the system CA isn't responding. Reported-by: Peter Eisentraut <peter.eisentraut@enterprisedb.com> Discussion: https://postgr.es/m/c39be3c5-c1a5-1e33-1024-16f527e251a4@enterprisedb.com
1 parent 77dedeb commit 0b5d1fb

File tree

2 files changed

+24
-4
lines changed

2 files changed

+24
-4
lines changed

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1489,10 +1489,12 @@ open_client_SSL(PGconn *conn)
14891489
{
14901490
int r;
14911491

1492+
SOCK_ERRNO_SET(0);
14921493
ERR_clear_error();
14931494
r = SSL_connect(conn->ssl);
14941495
if (r <= 0)
14951496
{
1497+
int save_errno = SOCK_ERRNO;
14961498
int err = SSL_get_error(conn->ssl, r);
14971499
unsigned long ecode;
14981500

@@ -1508,10 +1510,26 @@ open_client_SSL(PGconn *conn)
15081510
case SSL_ERROR_SYSCALL:
15091511
{
15101512
char sebuf[PG_STRERROR_R_BUFLEN];
1511-
1512-
if (r == -1)
1513+
unsigned long vcode;
1514+
1515+
vcode = SSL_get_verify_result(conn->ssl);
1516+
1517+
/*
1518+
* If we get an X509 error here for failing to load the
1519+
* local issuer cert, without an error in the socket layer
1520+
* it means that verification failed due to a missing
1521+
* system CA pool without it being a protocol error. We
1522+
* inspect the sslrootcert setting to ensure that the user
1523+
* was using the system CA pool. For other errors, log them
1524+
* using the normal SYSCALL logging.
1525+
*/
1526+
if (!save_errno && vcode == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY &&
1527+
strcmp(conn->sslrootcert, "system") == 0)
1528+
libpq_append_conn_error(conn, "SSL error: certificate verify failed: %s",
1529+
X509_verify_cert_error_string(vcode));
1530+
else if (r == -1)
15131531
libpq_append_conn_error(conn, "SSL SYSCALL error: %s",
1514-
SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf)));
1532+
SOCK_STRERROR(save_errno, sebuf, sizeof(sebuf)));
15151533
else
15161534
libpq_append_conn_error(conn, "SSL SYSCALL error: EOF detected");
15171535
pgtls_close(conn);

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -476,10 +476,12 @@ sub switch_server_cert
476476
"$default_ssl_connstr user=ssltestuser dbname=trustdb sslrootcert=system hostaddr=$SERVERHOSTADDR";
477477

478478
# By default our custom-CA-signed certificate should not be trusted.
479+
# OpenSSL 3.0 reports a missing/invalid system CA as "unregistered schema"
480+
# instead of a failed certificate verification.
479481
$node->connect_fails(
480482
"$common_connstr sslmode=verify-full host=common-name.pg-ssltest.test",
481483
"sslrootcert=system does not connect with private CA",
482-
expected_stderr => qr/SSL error: certificate verify failed/);
484+
expected_stderr => qr/SSL error: (certificate verify failed|unregistered scheme)/);
483485

484486
# Modes other than verify-full cannot be mixed with sslrootcert=system.
485487
$node->connect_fails(

0 commit comments

Comments
 (0)
0