From patchwork Tue Nov 21 10:39:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Lichtenheld X-Patchwork-Id: 3465 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7300:53c1:b0:f2:62eb:61c1 with SMTP id u1csp269957dye; Tue, 21 Nov 2023 02:40:04 -0800 (PST) X-Google-Smtp-Source: AGHT+IGrfVYni8Q4tRPV0iN8PPSDzD5zKokGox59PWGMUJ5NEjIMZbtm8sEhG563IYsVYmVCCKUE X-Received: by 2002:a17:902:f688:b0:1c3:a4f2:7c99 with SMTP id l8-20020a170902f68800b001c3a4f27c99mr12906791plg.4.1700563204055; Tue, 21 Nov 2023 02:40:04 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1700563204; cv=none; d=google.com; s=arc-20160816; b=JQBDPzBzFcJr4Lv2CMLSLZj2qmdUeN2J5pL50RbARzq+3J2ntlvVrfsOWp9PT528Ad 1lA+43Oh0cmFBgVVzjmjDTexybtFS+jnXxTlMBwxYmz4n73zIzpqTgs4HosLiCeeKkYj wRBSqPyrkS4rFk0NHc61Cp4vVmohnI1kVpuERwGHRe1DnOCsqI3YJ323GkH+A856rHYy HKTUwJjYIvzIRD4rHMhyYEe79hI2BsGIP5/7H8zBiP13IPb4H3DHAnh27EkFg8kaDLv9 5y0VT4Kqu54EkX3DwxCDWcecKrxneQ2y2CiPm1nktoqcpwWUZkriruhHVuooB4qC/aP7 L1/Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=emG6N18J35EG0G+W9KbWmj+oRdY4FO/qDDkugFp47Pg=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=J5zDI5dB7KmqynNqurN/bMHqCxV0rhZa7ict/ApJL+K6cqrhe14btLT5TIxX4qlLer 0lj0DlGjOIP+rDa5ENR2uTQGKryqmqRtU5QYQcQkn8yMdaMxlbZ1hB7SshF7jrZ0YLU3 9eisAnTQptry17TwyWd18Z2JQDJIbrCauNrnoVvXuAt78UTesKZHIY97tgYJSMIdVIm8 hjOmf728ar+yt7sUcjUr4PjSMULWRmQ/5hsppqHqxMNmxUvv7ucQeph3Oe8h1ShvDfdu A34tc9yOne2MZBvyFqqaSRMJ4WAjgaa+W8DkgOTb1SylyBYha7D47Sowq2ia/tDPQdZM HF9A== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=mWyBQsFZ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Y6e9xtBE; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=T2rBwo4R; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id l19-20020a170902d35300b001cc40ca1731si9457092plk.475.2023.11.21.02.40.03 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Nov 2023 02:40:04 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=mWyBQsFZ; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=Y6e9xtBE; dkim=neutral (body hash did not verify) header.i=@lichtenheld.com header.s=MBO0001 header.b=T2rBwo4R; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1r5OAR-0004LS-PZ; Tue, 21 Nov 2023 10:39:44 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1r5OAQ-0004LB-4e for openvpn-devel@lists.sourceforge.net; Tue, 21 Nov 2023 10:39:42 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=VXXJEIke5FrbGovDUr4pdzBzC1pg5cccWzx50b6/cks=; b=mWyBQsFZTg+9w6KAGKT7jbh4/7 NMcU7TlN/Fzlnp7Ie+2Tp2TlapMJneAUfM9uLcPK3tS5taY4H4nTUpzwZI+DZaGP3cr94ZurmNBp+ Mks5wvmTG7YOJp2Q4+jZYrIq3tyMEibFn3O12qHtw0SBil9hL6oybavIO5qvfrX6zAKI=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=VXXJEIke5FrbGovDUr4pdzBzC1pg5cccWzx50b6/cks=; b=Y6e9xtBEYW8+ElHtc+AYoU5VK1 RnFvlCAGxbqlmlyRXfRP3zN5Qa04GPfEUszdb3Ux+mIO8hJqI1OKHYwY0aoymO3b0Y4M0ospgcdPo 1MT63eDXbK3hDNBjQ8TptKTEDSqGyalV/4poZvkq2tisw5tGk2H/EUBkMaC3ArzhJ/zQ=; Received: from mout-p-201.mailbox.org ([80.241.56.171]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1r5OAP-0001YL-7U for openvpn-devel@lists.sourceforge.net; Tue, 21 Nov 2023 10:39:42 +0000 Received: from smtp102.mailbox.org (smtp102.mailbox.org [10.196.197.102]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-201.mailbox.org (Postfix) with ESMTPS id 4SZLTv1zs6z9t0c; Tue, 21 Nov 2023 11:39:31 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lichtenheld.com; s=MBO0001; t=1700563171; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VXXJEIke5FrbGovDUr4pdzBzC1pg5cccWzx50b6/cks=; b=T2rBwo4Rsv1uxvF/RzzrGhq2OwunpdHUsiPm8kEpmwFf/SX5l2PO7mF8D7ZAtiPrXBSkYk zIIVZ3SFhAz4i0ArTwIqFKcj3JxkLX4YtklwJMDTj+twsvwoAgfMPIV+GADtZKRjl2rH0s 3ljxY0sgJdH9kBiS/gIVIGGYTpnu4789C3LiZbvHyLagF1uMOZL4nM7t46p3CJ+R4ZjmFv IrlBt6/c6bMODxiMb8udDVWkiNNe3SmtH9ADHQh+2QVy8M8hWxAHHI+sXstram4ac8wPis 4YFzu6Otg0P0LNSJuM7wHb4nWKQhVD67/r2iVUYTlHDQd0Ay1BaFSjWN2UjfHQ== From: Frank Lichtenheld To: openvpn-devel@lists.sourceforge.net Date: Tue, 21 Nov 2023 11:39:30 +0100 Message-Id: <20231121103930.15175-1-frank@lichtenheld.com> In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: -0.9 (/) X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe When we receive an SSL alert from a server we currently only log a very cryptic OpenSSL error message: OpenSSL: error:0A00042E:SSL routines::tlsv1 alert protocol version:SSL alert number 70 Content analysis details: (-0.9 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at https://www.dnswl.org/, low trust [80.241.56.171 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1r5OAP-0001YL-7U Subject: [Openvpn-devel] [PATCH v3] Log SSL alerts more prominently X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: =?utf-8?q?1783169762164304841?= X-GMAIL-MSGID: =?utf-8?q?1783169762164304841?= From: Arne Schwabe When we receive an SSL alert from a server we currently only log a very cryptic OpenSSL error message: OpenSSL: error:0A00042E:SSL routines::tlsv1 alert protocol version:SSL alert number 70 This also enables logging the much more readable SSL error message: Received fatal SSL alert: protocol version which previously needed --verb 8 to be displayed (now verb 3). Also rework the message to be better readable. Change-Id: I6bdab3028c9bd679c31d4177a746a3ea505dcbbf Signed-off-by: Arne Schwabe Acked-by: Frank Lichtenheld --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/448 This mail reflects revision 3 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 23e7623..82872bf 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -196,8 +196,8 @@ } else if (where & SSL_CB_ALERT) { - dmsg(D_HANDSHAKE_VERBOSE, "SSL alert (%s): %s: %s", - where & SSL_CB_READ ? "read" : "write", + dmsg(D_TLS_DEBUG_LOW, "%s %s SSL alert: %s", + where & SSL_CB_READ ? "Received" : "Sent", SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret)); }