Repository navigation
Conversation
With OpenSSL 3, a missing or unreadable CA file failed with "OpenSSL error: -2147483646 : Unknown SSL error", because ERR_reason_error_string() returns NULL for system errors and throwSSLError() had no fallback. I now fall back to ERR_error_string_n(), which formats the errno text, and prepareSSLContext() prefixes CA file and directory load failures with the path. The error queue is cleared before each CA load and after throwSSLError() reads it, so a stale entry cannot be reported as the reason of an unrelated failure. The comment above the disabled X509_check_ip() block no longer claims IP addresses go unverified, since OpenSSL 3.0 SSL_set1_host() checks IP literals.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With OpenSSL 3, a missing or unreadable CA file fails with
OpenSSL error: -2147483646 : Unknown SSL error.ERR_reason_error_string()returns NULL for system errors, andthrowSSLError()has no fallback.Fix:
throwSSLError()falls back toERR_error_string_n(), which includes the errno text.prepareSSLContext()prefixes CA file and directory load failures with the path, for exampleFailed to load CA file '/nonexistent': ... No such file or directory.throwSSLError()reads it, so a stale entry can't be reported as the cause of an unrelated failure.X509_check_ip()block no longer claims IP addresses go unverified: since OpenSSL 3.0,SSL_set1_host()checks IP literals.Test:
SSLContext.MissingCAFileErrorNamesFileAndReasonfails on master and passes here.