From db302550d32c0a450a47ab17990dd1b66551186a Mon Sep 17 00:00:00 2001 From: "Dr. David von Oheimb" Date: Tue, 28 Jun 2022 12:10:49 +0200 Subject: [PATCH] app_http_tls_cb() and tls_error_hint(): code cleanup Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/18675) --- apps/lib/apps.c | 46 ++++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/apps/lib/apps.c b/apps/lib/apps.c index 55fd0d3cbcc..0721120ab22 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -2436,7 +2436,7 @@ static const char *tls_error_hint(void) if (ERR_GET_LIB(err) != ERR_LIB_SSL) err = ERR_peek_last_error(); if (ERR_GET_LIB(err) != ERR_LIB_SSL) - return NULL; + return NULL; /* likely no TLS error */ switch (ERR_GET_REASON(err)) { case SSL_R_WRONG_VERSION_NUMBER: @@ -2449,9 +2449,27 @@ static const char *tls_error_hint(void) return "Server did not accept our TLS certificate, likely due to mismatch with server's trust anchor or missing revocation status"; case SSL_AD_REASON_OFFSET + SSL3_AD_HANDSHAKE_FAILURE: return "TLS handshake failure. Possibly the server requires our TLS certificate but did not receive it"; - default: /* no error or no hint available for error */ - return NULL; + default: + return NULL; /* no hint available for TLS error */ + } +} + +static BIO *http_tls_shutdown(BIO *bio) +{ + if (bio != NULL) { + BIO *cbio; + const char *hint = tls_error_hint(); + + if (hint != NULL) + BIO_printf(bio_err, "%s\n", hint); + (void)ERR_set_mark(); + BIO_ssl_shutdown(bio); + cbio = BIO_pop(bio); /* connect+HTTP BIO */ + BIO_free(bio); /* SSL BIO */ + (void)ERR_pop_to_mark(); /* hide SSL_R_READ_BIO_NOT_SET etc. */ + bio = cbio; } + return bio; } /* HTTP callback function that supports TLS connection also via HTTPS proxy */ @@ -2474,7 +2492,7 @@ BIO *app_http_tls_cb(BIO *bio, void *arg, int connect, int detail) || (sbio = BIO_new(BIO_f_ssl())) == NULL) { return NULL; } - if (ssl_ctx == NULL || (ssl = SSL_new(ssl_ctx)) == NULL) { + if ((ssl = SSL_new(ssl_ctx)) == NULL) { BIO_free(sbio); return NULL; } @@ -2486,24 +2504,8 @@ BIO *app_http_tls_cb(BIO *bio, void *arg, int connect, int detail) BIO_set_ssl(sbio, ssl, BIO_CLOSE); bio = BIO_push(sbio, bio); - } - if (!connect) { - const char *hint; - BIO *cbio; - - if (!detail) { /* disconnecting after error */ - hint = tls_error_hint(); - if (hint != NULL) - ERR_add_error_data(2, " : ", hint); - } - if (ssl_ctx != NULL) { - (void)ERR_set_mark(); - BIO_ssl_shutdown(bio); - cbio = BIO_pop(bio); /* connect+HTTP BIO */ - BIO_free(bio); /* SSL BIO */ - (void)ERR_pop_to_mark(); /* hide SSL_R_READ_BIO_NOT_SET etc. */ - bio = cbio; - } + } else { /* disconnect from TLS */ + bio = http_tls_shutdown(bio); } return bio; } -- 2.47.2