* Attempt to negotiate SSL connection. */
| 1345 | * Attempt to negotiate SSL connection. |
| 1346 | */ |
| 1347 | static PostgresPollingStatusType |
| 1348 | open_client_SSL(PGconn *conn) |
| 1349 | { |
| 1350 | int r; |
| 1351 | |
| 1352 | ERR_clear_error(); |
| 1353 | r = SSL_connect(conn->ssl); |
| 1354 | if (r <= 0) |
| 1355 | { |
| 1356 | int err = SSL_get_error(conn->ssl, r); |
| 1357 | unsigned long ecode; |
| 1358 | |
| 1359 | ecode = ERR_get_error(); |
| 1360 | switch (err) |
| 1361 | { |
| 1362 | case SSL_ERROR_WANT_READ: |
| 1363 | return PGRES_POLLING_READING; |
| 1364 | |
| 1365 | case SSL_ERROR_WANT_WRITE: |
| 1366 | return PGRES_POLLING_WRITING; |
| 1367 | |
| 1368 | case SSL_ERROR_SYSCALL: |
| 1369 | { |
| 1370 | char sebuf[PG_STRERROR_R_BUFLEN]; |
| 1371 | |
| 1372 | if (r == -1) |
| 1373 | appendPQExpBuffer(&conn->errorMessage, |
| 1374 | libpq_gettext("SSL SYSCALL error: %s\n"), |
| 1375 | SOCK_STRERROR(SOCK_ERRNO, sebuf, sizeof(sebuf))); |
| 1376 | else |
| 1377 | appendPQExpBufferStr(&conn->errorMessage, |
| 1378 | libpq_gettext("SSL SYSCALL error: EOF detected\n")); |
| 1379 | pgtls_close(conn); |
| 1380 | return PGRES_POLLING_FAILED; |
| 1381 | } |
| 1382 | case SSL_ERROR_SSL: |
| 1383 | { |
| 1384 | char *err = SSLerrmessage(ecode); |
| 1385 | |
| 1386 | appendPQExpBuffer(&conn->errorMessage, |
| 1387 | libpq_gettext("SSL error: %s\n"), |
| 1388 | err); |
| 1389 | SSLerrfree(err); |
| 1390 | switch (ERR_GET_REASON(ecode)) |
| 1391 | { |
| 1392 | /* |
| 1393 | * UNSUPPORTED_PROTOCOL, WRONG_VERSION_NUMBER, and |
| 1394 | * TLSV1_ALERT_PROTOCOL_VERSION have been observed |
| 1395 | * when trying to communicate with an old OpenSSL |
| 1396 | * library, or when the client and server specify |
| 1397 | * disjoint protocol ranges. |
| 1398 | * NO_PROTOCOLS_AVAILABLE occurs if there's a |
| 1399 | * local misconfiguration (which can happen |
| 1400 | * despite our checks, if openssl.cnf injects a |
| 1401 | * limit we didn't account for). It's not very |
| 1402 | * clear what would make OpenSSL return the other |
| 1403 | * codes listed here, but a hint about protocol |
| 1404 | * versions seems like it's appropriate for all. |
no test coverage detected