summaryrefslogtreecommitdiffstats
path: root/src/backend/libpq/be-secure-openssl.c
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-05-21 05:05:26 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-05-21 05:05:26 +0000
commite75d99818dd3940be997520e64db8c9e3b207e39 (patch)
tree0003ca0de74fcc8d18433e34ea68d2e7aaf06b7c /src/backend/libpq/be-secure-openssl.c
parentReleasing progress-linux version 15.6-0+deb12u1~progress6.99u1. (diff)
downloadpostgresql-15-e75d99818dd3940be997520e64db8c9e3b207e39.tar.xz
postgresql-15-e75d99818dd3940be997520e64db8c9e3b207e39.zip
Merging upstream version 15.7.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'src/backend/libpq/be-secure-openssl.c')
-rw-r--r--src/backend/libpq/be-secure-openssl.c19
1 files changed, 16 insertions, 3 deletions
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index ed13e8b..4c7e16c 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -1241,9 +1241,9 @@ initialize_ecdh(SSL_CTX *context, bool isServerStart)
*
* ERR_get_error() is used by caller to get errcode to pass here.
*
- * Some caution is needed here since ERR_reason_error_string will
- * return NULL if it doesn't recognize the error code. We don't
- * want to return NULL ever.
+ * Some caution is needed here since ERR_reason_error_string will return NULL
+ * if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
+ * represents a system errno value. We don't want to return NULL ever.
*/
static const char *
SSLerrmessage(unsigned long ecode)
@@ -1256,6 +1256,19 @@ SSLerrmessage(unsigned long ecode)
errreason = ERR_reason_error_string(ecode);
if (errreason != NULL)
return errreason;
+
+ /*
+ * In OpenSSL 3.0.0 and later, ERR_reason_error_string randomly refuses to
+ * map system errno values. We can cover that shortcoming with this bit
+ * of code. Older OpenSSL versions don't have the ERR_SYSTEM_ERROR macro,
+ * but that's okay because they don't have the shortcoming either.
+ */
+#ifdef ERR_SYSTEM_ERROR
+ if (ERR_SYSTEM_ERROR(ecode))
+ return strerror(ERR_GET_REASON(ecode));
+#endif
+
+ /* No choice but to report the numeric ecode */
snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
return errbuf;
}