|
 |
205029 |
From 6baa5762ea5edb192ec003333d62b1d0e56509bf Mon Sep 17 00:00:00 2001
|
|
|
205029 |
From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
|
|
|
205029 |
Date: Sun, 11 Sep 2022 23:52:18 +0200
|
|
|
205029 |
Subject: [PATCH] stunnel-5.66
|
|
|
205029 |
|
|
|
205029 |
---
|
|
|
205029 |
src/common.h | 6 +++++-
|
|
|
205029 |
src/ctx.c | 58 +++++++++++++++++++++++++++++++++++++++++++---------
|
|
|
205029 |
2 files changed, 53 insertions(+), 11 deletions(-)
|
|
|
205029 |
|
|
|
205029 |
diff --git a/src/common.h b/src/common.h
|
|
|
205029 |
index bc37eb5..997e66e 100644
|
|
|
205029 |
--- a/src/common.h
|
|
|
205029 |
+++ b/src/common.h
|
|
|
205029 |
@@ -491,7 +491,7 @@ extern char *sys_errlist[];
|
|
|
205029 |
#include <openssl/dh.h>
|
|
|
205029 |
#if OPENSSL_VERSION_NUMBER<0x10100000L
|
|
|
205029 |
int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g);
|
|
|
205029 |
-#endif /* OpenSSL older than 1.1.0 */
|
|
|
205029 |
+#endif /* OPENSSL_VERSION_NUMBER<0x10100000L */
|
|
|
205029 |
#endif /* !defined(OPENSSL_NO_DH) */
|
|
|
205029 |
#ifndef OPENSSL_NO_ENGINE
|
|
|
205029 |
#include <openssl/engine.h>
|
|
|
205029 |
@@ -503,8 +503,12 @@ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g);
|
|
|
205029 |
/* not defined in public headers before OpenSSL 0.9.8 */
|
|
|
205029 |
STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
|
|
|
205029 |
#endif /* !defined(OPENSSL_NO_COMP) */
|
|
|
205029 |
+#if OPENSSL_VERSION_NUMBER>=0x10101000L
|
|
|
205029 |
+#include <openssl/storeerr.h>
|
|
|
205029 |
+#endif /* OPENSSL_VERSION_NUMBER>=0x10101000L */
|
|
|
205029 |
#if OPENSSL_VERSION_NUMBER>=0x30000000L
|
|
|
205029 |
#include <openssl/provider.h>
|
|
|
205029 |
+#include <openssl/proverr.h>
|
|
|
205029 |
#endif /* OPENSSL_VERSION_NUMBER>=0x30000000L */
|
|
|
205029 |
|
|
|
205029 |
#ifndef OPENSSL_VERSION
|
|
|
205029 |
diff --git a/src/ctx.c b/src/ctx.c
|
|
|
205029 |
index a2202b7..cc0806c 100644
|
|
|
205029 |
--- a/src/ctx.c
|
|
|
205029 |
+++ b/src/ctx.c
|
|
|
205029 |
@@ -1001,30 +1001,41 @@ NOEXPORT int ui_retry() {
|
|
|
205029 |
unsigned long err=ERR_peek_error();
|
|
|
205029 |
|
|
|
205029 |
switch(ERR_GET_LIB(err)) {
|
|
|
205029 |
- case ERR_LIB_ASN1:
|
|
|
205029 |
- return 1;
|
|
|
205029 |
- case ERR_LIB_PKCS12:
|
|
|
205029 |
+ case ERR_LIB_EVP: /* 6 */
|
|
|
205029 |
switch(ERR_GET_REASON(err)) {
|
|
|
205029 |
- case PKCS12_R_MAC_VERIFY_FAILURE:
|
|
|
205029 |
+ case EVP_R_BAD_DECRYPT:
|
|
|
205029 |
return 1;
|
|
|
205029 |
default:
|
|
|
205029 |
+ s_log(LOG_ERR, "Unhandled ERR_LIB_EVP error reason: %d",
|
|
|
205029 |
+ ERR_GET_REASON(err));
|
|
|
205029 |
return 0;
|
|
|
205029 |
}
|
|
|
205029 |
- case ERR_LIB_EVP:
|
|
|
205029 |
+ case ERR_LIB_PEM: /* 9 */
|
|
|
205029 |
switch(ERR_GET_REASON(err)) {
|
|
|
205029 |
- case EVP_R_BAD_DECRYPT:
|
|
|
205029 |
+ case PEM_R_BAD_PASSWORD_READ:
|
|
|
205029 |
+ case PEM_R_BAD_DECRYPT:
|
|
|
205029 |
return 1;
|
|
|
205029 |
default:
|
|
|
205029 |
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PEM error reason: %d",
|
|
|
205029 |
+ ERR_GET_REASON(err));
|
|
|
205029 |
return 0;
|
|
|
205029 |
}
|
|
|
205029 |
- case ERR_LIB_PEM:
|
|
|
205029 |
+ case ERR_LIB_ASN1: /* 13 */
|
|
|
205029 |
+ return 1;
|
|
|
205029 |
+ case ERR_LIB_PKCS12: /* 35 */
|
|
|
205029 |
switch(ERR_GET_REASON(err)) {
|
|
|
205029 |
- case PEM_R_BAD_PASSWORD_READ:
|
|
|
205029 |
+ case PKCS12_R_MAC_VERIFY_FAILURE:
|
|
|
205029 |
return 1;
|
|
|
205029 |
default:
|
|
|
205029 |
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PKCS12 error reason: %d",
|
|
|
205029 |
+ ERR_GET_REASON(err));
|
|
|
205029 |
return 0;
|
|
|
205029 |
}
|
|
|
205029 |
- case ERR_LIB_UI:
|
|
|
205029 |
+#ifdef ERR_LIB_DSO /* 37 */
|
|
|
205029 |
+ case ERR_LIB_DSO:
|
|
|
205029 |
+ return 1;
|
|
|
205029 |
+#endif
|
|
|
205029 |
+ case ERR_LIB_UI: /* 40 */
|
|
|
205029 |
switch(ERR_GET_REASON(err)) {
|
|
|
205029 |
case UI_R_RESULT_TOO_LARGE:
|
|
|
205029 |
case UI_R_RESULT_TOO_SMALL:
|
|
|
205029 |
@@ -1033,17 +1044,44 @@ NOEXPORT int ui_retry() {
|
|
|
205029 |
#endif
|
|
|
205029 |
return 1;
|
|
|
205029 |
default:
|
|
|
205029 |
+ s_log(LOG_ERR, "Unhandled ERR_LIB_UI error reason: %d",
|
|
|
205029 |
+ ERR_GET_REASON(err));
|
|
|
205029 |
+ return 0;
|
|
|
205029 |
+ }
|
|
|
205029 |
+#ifdef ERR_LIB_OSSL_STORE
|
|
|
205029 |
+ case ERR_LIB_OSSL_STORE: /* 44 - added in OpenSSL 1.1.1 */
|
|
|
205029 |
+ switch(ERR_GET_REASON(err)) {
|
|
|
205029 |
+ case OSSL_STORE_R_BAD_PASSWORD_READ:
|
|
|
205029 |
+ return 1;
|
|
|
205029 |
+ default:
|
|
|
205029 |
+ s_log(LOG_ERR, "Unhandled ERR_LIB_OSSL_STORE error reason: %d",
|
|
|
205029 |
+ ERR_GET_REASON(err));
|
|
|
205029 |
+ return 0;
|
|
|
205029 |
+ }
|
|
|
205029 |
+#endif
|
|
|
205029 |
+#ifdef ERR_LIB_PROV
|
|
|
205029 |
+ case ERR_LIB_PROV: /* 57 - added in OpenSSL 3.0 */
|
|
|
205029 |
+ switch(ERR_GET_REASON(err)) {
|
|
|
205029 |
+ case PROV_R_BAD_DECRYPT:
|
|
|
205029 |
+ return 1;
|
|
|
205029 |
+ default:
|
|
|
205029 |
+ s_log(LOG_ERR, "Unhandled ERR_LIB_PROV error reason: %d",
|
|
|
205029 |
+ ERR_GET_REASON(err));
|
|
|
205029 |
return 0;
|
|
|
205029 |
}
|
|
|
205029 |
- case ERR_LIB_USER: /* PKCS#11 hacks */
|
|
|
205029 |
+#endif
|
|
|
205029 |
+ case ERR_LIB_USER: /* 128 - PKCS#11 hacks */
|
|
|
205029 |
switch(ERR_GET_REASON(err)) {
|
|
|
205029 |
case 7UL: /* CKR_ARGUMENTS_BAD */
|
|
|
205029 |
case 0xa0UL: /* CKR_PIN_INCORRECT */
|
|
|
205029 |
return 1;
|
|
|
205029 |
default:
|
|
|
205029 |
+ s_log(LOG_ERR, "Unhandled ERR_LIB_USER error reason: %d",
|
|
|
205029 |
+ ERR_GET_REASON(err));
|
|
|
205029 |
return 0;
|
|
|
205029 |
}
|
|
|
205029 |
default:
|
|
|
205029 |
+ s_log(LOG_ERR, "Unhandled error library: %d", ERR_GET_LIB(err));
|
|
|
205029 |
return 0;
|
|
|
205029 |
}
|
|
|
205029 |
}
|
|
|
205029 |
--
|
|
|
205029 |
2.38.1
|
|
|
205029 |
|