isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

If ERR_reason_error_string() returns NULL, fall back on strerror(errno).

Browse Source 
That way we get reasonable error messages for missing files, etc.
This commit is contained in:
Todd C. Miller
2022-05-17 09:18:03 -06:00
parent 3ba807b70f
commit d7df7abf87
6 changed files with 80 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
plugins/sudoers/log_client.c
View File

@@ -197,14 +197,16 @@ tls_init(struct client_closure *closure)
/* Create the ssl context and enforce TLS 1.2 or higher. */
if ((closure->ssl_ctx = SSL_CTX_new(TLS_method())) == NULL) {
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx(U_("Creation of new SSL_CTX object failed: %s"), errstr);
sudo_warnx(U_("Creation of new SSL_CTX object failed: %s"),
errstr ? errstr : strerror(errno));
goto bad;
}
#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
if (!SSL_CTX_set_min_proto_version(closure->ssl_ctx, TLS1_2_VERSION)) {
errstr = ERR_reason_error_string(ERR_get_error());
sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
"unable to restrict min. protocol version: %s", errstr);
"unable to restrict min. protocol version: %s",
errstr ? errstr : strerror(errno));
goto bad;
}
#else
@@ -219,7 +221,7 @@ tls_init(struct client_closure *closure)
closure->log_details->ca_bundle, NULL) <= 0) {
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx(U_("%s: %s"), closure->log_details->ca_bundle,
errstr);
errstr ? errstr : strerror(errno));
sudo_warnx(U_("unable to load certificate authority bundle %s"),
closure->log_details->ca_bundle);
goto bad;
@@ -227,7 +229,8 @@ tls_init(struct client_closure *closure)
} else {
if (!SSL_CTX_set_default_verify_paths(closure->ssl_ctx)) {
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx("SSL_CTX_set_default_verify_paths: %s", errstr);
sudo_warnx("SSL_CTX_set_default_verify_paths: %s",
errstr ? errstr : strerror(errno));
goto bad;
}
}
@@ -239,7 +242,8 @@ tls_init(struct client_closure *closure)
if (!SSL_CTX_use_certificate_chain_file(closure->ssl_ctx,
closure->log_details->cert_file)) {
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx(U_("%s: %s"), closure->log_details->cert_file, errstr);
sudo_warnx(U_("%s: %s"), closure->log_details->cert_file,
errstr ? errstr : strerror(errno));
sudo_warnx(U_("unable to load certificate %s"),
closure->log_details->cert_file);
goto bad;
@@ -252,7 +256,8 @@ tls_init(struct client_closure *closure)
closure->log_details->key_file, SSL_FILETYPE_PEM) ||
!SSL_CTX_check_private_key(closure->ssl_ctx)) {
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx(U_("%s: %s"), closure->log_details->key_file, errstr);
sudo_warnx(U_("%s: %s"), closure->log_details->key_file,
errstr ? errstr : strerror(errno));
sudo_warnx(U_("unable to load private key %s"),
closure->log_details->key_file);
goto bad;
@@ -262,13 +267,14 @@ tls_init(struct client_closure *closure)
/* Create the SSL object and attach the closure. */
if ((closure->ssl = SSL_new(closure->ssl_ctx)) == NULL) {
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx(U_("Unable to allocate ssl object: %s"), errstr);
sudo_warnx(U_("Unable to allocate ssl object: %s"),
errstr ? errstr : strerror(errno));
goto bad;
}
if (SSL_set_ex_data(closure->ssl, 1, closure) <= 0) {
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx(U_("Unable to attach user data to the ssl object: %s"),
errstr);
errstr ? errstr : strerror(errno));
goto bad;
}
@@ -356,7 +362,8 @@ tls_connect_cb(int sock, int what, void *v)
default:
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx(U_("TLS connection to %s:%s failed: %s"),
closure->host, closure->port, errstr);
closure->host, closure->port,
errstr ? errstr : strerror(errno));
goto bad;
}
}
@@ -1755,13 +1762,13 @@ server_msg_cb(int fd, int what, void *v)
#if !defined(HAVE_WOLFSSL)
if (closure->state == RECV_HELLO &&
ERR_GET_REASON(err) == SSL_R_TLSV1_ALERT_INTERNAL_ERROR) {
errstr = "host name does not match certificate";
errstr = U_("host name does not match certificate");
} else
#endif
{
errstr = ERR_reason_error_string(err);
}
sudo_warnx("%s", errstr);
sudo_warnx("%s", errstr ? errstr : strerror(errno));
goto bad;
case SSL_ERROR_SYSCALL:
if (nread == 0)
@@ -1771,7 +1778,7 @@ server_msg_cb(int fd, int what, void *v)
goto bad;
default:
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx("recv: %s", errstr);
sudo_warnx("recv: %s", errstr ? errstr : strerror(errno));
goto bad;
}
}
@@ -1899,14 +1906,14 @@ client_msg_cb(int fd, int what, void *v)
debug_return;
case SSL_ERROR_SSL:
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx("%s", errstr);
sudo_warnx("%s", errstr ? errstr : strerror(errno));
goto bad;
case SSL_ERROR_SYSCALL:
sudo_warn("send");
goto bad;
default:
errstr = ERR_reason_error_string(ERR_get_error());
sudo_warnx("send: %s", errstr);
sudo_warnx("send: %s", errstr ? errstr : strerror(errno));
goto bad;
}
}