diff mbox series

[Openvpn-devel,v3] Log SSL alerts more prominently

Message ID 20231121103930.15175-1-frank@lichtenheld.com
State Accepted
Headers show
Series [Openvpn-devel,v3] Log SSL alerts more prominently | expand

Commit Message

Frank Lichtenheld Nov. 21, 2023, 10:39 a.m. UTC 
From: Arne Schwabe <arne@rfc2549.org>

When we receive an SSL alert from a server we currently only log a
very cryptic OpenSSL error message:

   OpenSSL: error:0A00042E:SSL routines::tlsv1 alert protocol version:SSL alert number 70

This also enables logging the much more readable SSL error message:

   Received fatal SSL alert: protocol version

which previously needed --verb 8 to be displayed (now verb 3). Also rework the
message to be better readable.

Change-Id: I6bdab3028c9bd679c31d4177a746a3ea505dcbbf
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/448
This mail reflects revision 3 of this Change.
Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <frank@lichtenheld.com>

Comments

Gert Doering Nov. 21, 2023, 9:26 p.m. UTC | #1 
Better diagnostics is goood!

Your patch has been applied to the master and release/2.6 branch 
(very basic change, no code flow change, enhanced diagnostics good).

We might consider moving from dmsg() to msg() - this is neither 
very time consuming nor increasing binary size hugely.

commit a1cb1b47b138b9f654cd0bca5de6d08dbca61888 (master)
commit 94cd53c70e8e8fdd0beac79b17bdb1f912e03cb7 (release/2.6)
Author: Arne Schwabe
Date:   Tue Nov 21 11:39:30 2023 +0100

     Log SSL alerts more prominently

     Signed-off-by: Arne Schwabe <arne@rfc2549.org>
     Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
     Message-Id: <20231121103930.15175-1-frank@lichtenheld.com>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27523.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
index 23e7623..82872bf 100644
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -196,8 +196,8 @@ 
     }
     else if (where & SSL_CB_ALERT)
     {
-        dmsg(D_HANDSHAKE_VERBOSE, "SSL alert (%s): %s: %s",
-             where & SSL_CB_READ ? "read" : "write",
+        dmsg(D_TLS_DEBUG_LOW, "%s %s SSL alert: %s",
+             where & SSL_CB_READ ? "Received" : "Sent",
              SSL_alert_type_string_long(ret),
              SSL_alert_desc_string_long(ret));
     }