[dart:io] Extract better error messages from boringssl.

runtime/bin/secure_socket_boringssl.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #if !defined(DART_IO_DISABLED) && !defined(DART_IO_SECURE_SOCKET_DISABLED)
 
 #include "platform/globals.h"
 #if defined(TARGET_OS_ANDROID) || defined(TARGET_OS_LINUX) ||                  \
     defined(TARGET_OS_WINDOWS) || defined(TARGET_OS_FUCHSIA)
 
 #include "bin/secure_socket.h"
 #include "bin/secure_socket_boringssl.h"
 
 #include <errno.h>
 #include <fcntl.h>
+#include <stdarg.h>
 #include <stdio.h>
 #include <string.h>
 #include <sys/stat.h>
 
 #include <openssl/bio.h>
 #include <openssl/err.h>
 #include <openssl/pkcs12.h>
 #include <openssl/safestack.h>
 #include <openssl/ssl.h>
 #include <openssl/tls1.h>
 #include <openssl/x509.h>
 
 #include "bin/builtin.h"
 #include "bin/dartutils.h"
 #include "bin/directory.h"
 #include "bin/file.h"
 #include "bin/lockers.h"
 #include "bin/log.h"
 #include "bin/socket.h"
 #include "bin/thread.h"
 #include "bin/utils.h"
+#include "platform/text_buffer.h"
 #include "platform/utils.h"
 
 #include "include/dart_api.h"
 
 // Return the error from the containing function if handle is an error handle.
 #define RETURN_IF_ERROR(handle)                                                \
   {                                                                            \
     Dart_Handle __handle = handle;                                             \
     if (Dart_IsError((__handle))) {                                            \
       return __handle;                                                         \
@@ skipping 24 matching lines @@
 static const int kX509NativeFieldIndex = 0;
 
 static const bool SSL_LOG_STATUS = false;
 static const bool SSL_LOG_DATA = false;
 
 static const int SSL_ERROR_MESSAGE_BUFFER_SIZE = 1000;
 
 const char* commandline_root_certs_file = NULL;
 const char* commandline_root_certs_cache = NULL;
 
-/* Get the error messages from BoringSSL, and put them in buffer as a
- * null-terminated string. */
-static void FetchErrorString(char* buffer, int length) {
-  buffer[0] = '\0';
-  int error = ERR_get_error();
-  while (error != 0) {
-    int used = strlen(buffer);
-    int free_length = length - used;
-    if (free_length > 16) {
-      // Enough room for error code at least.
-      if (used > 0) {
-        buffer[used] = '\n';
-        buffer[used + 1] = '\0';
-        used++;
-        free_length--;
-      }
-      ERR_error_string_n(error, buffer + used, free_length);
-      // ERR_error_string_n is guaranteed to leave a null-terminated string.
+// Get the error messages from BoringSSL, and put them in buffer as a
+// null-terminated string.
+static void FetchErrorString(const SSL* ssl, TextBuffer* text_buffer) {
+  uint32_t error = 0;
+  const char* path = NULL;
+  int line = -1;
+  const char* sep = File::PathSeparator();
+  do {
+    error = ERR_get_error_line(&path, &line);
+    const char* file = strrchr(path, sep[0]);
+    path = file ? file + 1 : path;
+    if (ssl &&

[rmacnak, 2017/02/06 22:57:37]

ssl != NULL

[zra, 2017/02/07 15:45:15]

Done.

+        error == ERR_PACK(ERR_R_SSL_LIB, SSL_R_CERTIFICATE_VERIFY_FAILED)) {
+      intptr_t result = SSL_get_verify_result(ssl);
+      text_buffer->Printf("\n\t%s: %s (%s:%d)", ERR_reason_error_string(error),
+                          X509_verify_cert_error_string(result), path, line);
+    } else if (error != 0) {
+      text_buffer->Printf("\n\t%s (%s:%d)", ERR_reason_error_string(error),
+                          path, line);
     }
-    error = ERR_get_error();
-  }
+  } while (error != 0);
 }
 
 
-/* Handle an error reported from the BoringSSL library. */
+// Handle an error reported from the BoringSSL library.
 static void ThrowIOException(int status,
                              const char* exception_type,
-                             const char* message) {
-  char error_string[SSL_ERROR_MESSAGE_BUFFER_SIZE];
-  FetchErrorString(error_string, SSL_ERROR_MESSAGE_BUFFER_SIZE);
+                             const char* message,
+                             const SSL* ssl) {
   Dart_Handle exception;
   {
-    OSError os_error_struct(status, error_string, OSError::kBoringSSL);
+    TextBuffer error_string(SSL_ERROR_MESSAGE_BUFFER_SIZE);
+    FetchErrorString(ssl, &error_string);
+    OSError os_error_struct(status, error_string.buf(), OSError::kBoringSSL);
     Dart_Handle os_error = DartUtils::NewDartOSError(&os_error_struct);
     exception =
         DartUtils::NewDartIOException(exception_type, message, os_error);
     ASSERT(!Dart_IsError(exception));
   }
   Dart_ThrowException(exception);
   UNREACHABLE();
 }
 
 
@@ skipping 317 matching lines @@
 
 
 int PasswordCallback(char* buf, int size, int rwflag, void* userdata) {
   char* password = static_cast<char*>(userdata);
   ASSERT(size == PEM_BUFSIZE);
   strncpy(buf, password, size);
   return strlen(password);
 }
 
 
-void CheckStatus(int status, const char* type, const char* message) {
+void CheckStatusSSL(int status,
+                    const char* type,
+                    const char* message,
+                    const SSL* ssl) {
   // TODO(24183): Take appropriate action on failed calls,
   // throw exception that includes all messages from the error stack.
   if (status == 1) {
     return;
   }
   if (SSL_LOG_STATUS) {
     int error = ERR_get_error();
     Log::PrintErr("Failed: %s status %d", message, status);
     char error_string[SSL_ERROR_MESSAGE_BUFFER_SIZE];
     ERR_error_string_n(error, error_string, SSL_ERROR_MESSAGE_BUFFER_SIZE);
     Log::PrintErr("ERROR: %d %s\n", error, error_string);
   }
-  ThrowIOException(status, type, message);
+  ThrowIOException(status, type, message, ssl);
 }
 
 
+void CheckStatus(int status, const char* type, const char* message) {
+  CheckStatusSSL(status, type, message, NULL);
+}
+
+
 // Where the argument to the constructor is the handle for an object
 // implementing List<int>, this class creates a scope in which a memory-backed
 // BIO is allocated. Leaving the scope cleans up the BIO and the buffer that
 // was used to create it.
 //
 // Do not make Dart_ API calls while in a ScopedMemBIO.
 // Do not call Dart_PropagateError while in a ScopedMemBIO.
 class ScopedMemBIO {
  public:
   explicit ScopedMemBIO(Dart_Handle object) {
@@ skipping 331 matching lines @@
   ASSERT((ERR_peek_error() == 0) || NoPEMStartLine());
   ERR_clear_error();
 }
 
 
 static void LoadRootCertFile(SSLContext* context, const char* file) {
   if (SSL_LOG_STATUS) {
     Log::Print("Looking for trusted roots in %s\n", file);
   }
   if (!File::Exists(file)) {
-    ThrowIOException(-1, "TlsException", "Failed to find root cert file");
+    ThrowIOException(-1, "TlsException", "Failed to find root cert file", NULL);
   }
   int status = SSL_CTX_load_verify_locations(context->context(), file, NULL);
   CheckStatus(status, "TlsException", "Failure trusting builtin roots");
   if (SSL_LOG_STATUS) {
     Log::Print("Trusting roots from: %s\n", file);
   }
 }
 
 
 static void LoadRootCertCache(SSLContext* context, const char* cache) {
   if (SSL_LOG_STATUS) {
     Log::Print("Looking for trusted roots in %s\n", cache);
   }
   if (Directory::Exists(cache) != Directory::EXISTS) {
-    ThrowIOException(-1, "TlsException", "Failed to find root cert cache");
+    ThrowIOException(-1, "TlsException", "Failed to find root cert cache",
+                     NULL);
   }
   int status = SSL_CTX_load_verify_locations(context->context(), NULL, cache);
   CheckStatus(status, "TlsException", "Failure trusting builtin roots");
   if (SSL_LOG_STATUS) {
     Log::Print("Trusting roots from: %s\n", cache);
   }
 }
 
 
 void FUNCTION_NAME(SecurityContext_TrustBuiltinRoots)(
@@ skipping 341 matching lines @@
   if (filter->ProcessAllBuffers(starts, ends, in_handshake)) {
     CObjectArray* result =
         new CObjectArray(CObject::NewArray(SSLFilter::kNumBuffers * 2));
     for (int i = 0; i < SSLFilter::kNumBuffers; ++i) {
       result->SetAt(2 * i, new CObjectInt32(CObject::NewInt32(starts[i])));
       result->SetAt(2 * i + 1, new CObjectInt32(CObject::NewInt32(ends[i])));
     }
     return result;
   } else {
     int32_t error_code = static_cast<int32_t>(ERR_peek_error());
-    char error_string[SSL_ERROR_MESSAGE_BUFFER_SIZE];
-    FetchErrorString(error_string, SSL_ERROR_MESSAGE_BUFFER_SIZE);
+    TextBuffer error_string(SSL_ERROR_MESSAGE_BUFFER_SIZE);
+    FetchErrorString(filter->ssl_, &error_string);
     CObjectArray* result = new CObjectArray(CObject::NewArray(2));
     result->SetAt(0, new CObjectInt32(CObject::NewInt32(error_code)));
-    result->SetAt(1, new CObjectString(CObject::NewString(error_string)));
+    result->SetAt(1, new CObjectString(CObject::NewString(error_string.buf())));
     return result;
   }
 }
 
 
 bool SSLFilter::ProcessAllBuffers(int starts[kNumBuffers],
                                   int ends[kNumBuffers],
                                   bool in_handshake) {
   for (int i = 0; i < kNumBuffers; ++i) {
     if (in_handshake && (i == kReadPlaintext || i == kWritePlaintext)) continue;
@@ skipping 296 matching lines @@
   is_server_ = is_server;
   if (in_handshake_) {
     FATAL("Connect called twice on the same _SecureFilter.");
   }
 
   int status;
   int error;
   BIO* ssl_side;
   status = BIO_new_bio_pair(&ssl_side, kInternalBIOSize, &socket_side_,
                             kInternalBIOSize);
-  CheckStatus(status, "TlsException", "BIO_new_bio_pair");
+  CheckStatusSSL(status, "TlsException", "BIO_new_bio_pair", ssl_);
 
   assert(context != NULL);
   ssl_ = SSL_new(context);
   SSL_set_bio(ssl_, ssl_side, ssl_side);
   SSL_set_mode(ssl_, SSL_MODE_AUTO_RETRY);  // TODO(whesse): Is this right?
   SSL_set_ex_data(ssl_, filter_ssl_index, this);
 
   if (is_server_) {
     int certificate_mode =
         request_client_certificate ? SSL_VERIFY_PEER : SSL_VERIFY_NONE;
     if (require_client_certificate) {
       certificate_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
     }
     SSL_set_verify(ssl_, certificate_mode, NULL);
   } else {
     SetAlpnProtocolList(protocols_handle, ssl_, NULL, false);
     status = SSL_set_tlsext_host_name(ssl_, hostname);
-    CheckStatus(status, "TlsException", "Set SNI host name");
+    CheckStatusSSL(status, "TlsException", "Set SNI host name", ssl_);
     // Sets the hostname in the certificate-checking object, so it is checked
     // against the certificate presented by the server.
     X509_VERIFY_PARAM* certificate_checking_parameters = SSL_get0_param(ssl_);
     hostname_ = strdup(hostname);
     X509_VERIFY_PARAM_set_flags(
         certificate_checking_parameters,
         X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_TRUSTED_FIRST);
     X509_VERIFY_PARAM_set_hostflags(certificate_checking_parameters, 0);
     status = X509_VERIFY_PARAM_set1_host(certificate_checking_parameters,
                                          hostname_, strlen(hostname_));
-    CheckStatus(status, "TlsException",
-                "Set hostname for certificate checking");
+    CheckStatusSSL(status, "TlsException",
+                   "Set hostname for certificate checking", ssl_);
   }
   // Make the connection:
   if (is_server_) {
     status = SSL_accept(ssl_);
     if (SSL_LOG_STATUS) {
       Log::Print("SSL_accept status: %d\n", status);
     }
     if (status != 1) {
       // TODO(whesse): expect a needs-data error here.  Handle other errors.
       error = SSL_get_error(ssl_, status);
@@ skipping 32 matching lines @@
     // The SSL_do_handshake will try performing a handshake and might call
     // a CertificateCallback. If the certificate validation
     // failed the 'callback_error" will be set by the certificateCallback
     // logic and we propagate the error"
     Dart_PropagateError(callback_error);
   }
   if (SSL_want_write(ssl_) || SSL_want_read(ssl_)) {
     in_handshake_ = true;
     return;
   }
-  CheckStatus(status, "HandshakeException", is_server_
-                                                ? "Handshake error in server"
-                                                : "Handshake error in client");
+  CheckStatusSSL(
+      status, "HandshakeException",
+      is_server_ ? "Handshake error in server" : "Handshake error in client",
+      ssl_);
   // Handshake succeeded.
   if (in_handshake_) {
     // TODO(24071): Check return value of SSL_get_verify_result, this
     //    should give us the hostname check.
     int result = SSL_get_verify_result(ssl_);
     if (SSL_LOG_STATUS) {
       Log::Print("Handshake verification status: %d\n", result);
       X509* peer_certificate = SSL_get_peer_certificate(ssl_);
       if (peer_certificate == NULL) {
         Log::Print("No peer certificate received\n");
@@ skipping 160 matching lines @@
   return bytes_processed;
 }
 
 }  // namespace bin
 }  // namespace dart
 
 #endif  // defined(TARGET_OS_LINUX)
 
 #endif  // !defined(DART_IO_DISABLED) &&
         // !defined(DART_IO_SECURE_SOCKET_DISABLED)