upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-01-04 13:59:35 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- squelch DNS over TLS errors 'ssl handshake failed crypto error'

Browse source 
on low verbosity, they show on verbosity 3 (query details), because
  there is a high volume and the operator cannot do anything for the
  remote failure.  Specifically filters the high volume errors.
This commit is contained in:
W.C.A. Wijngaards 2019-09-03 09:47:27 +02:00
parent 366296ec14
commit 1089fd6dc1
4 changed files with 52 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
doc/Changelog
View file

@ -1,3 +1,9 @@
3 September 2019: Wouter
- squelch DNS over TLS errors 'ssl handshake failed crypto error'
on low verbosity, they show on verbosity 3 (query details), because
there is a high volume and the operator cannot do anything for the
remote failure. Specifically filters the high volume errors.
2 September 2019: Wouter
- ipset module #28: log that an address is added, when verbosity high.
- ipset: refactor long routine into three smaller ones.

12
util/net_help.c
View file

@ -697,11 +697,20 @@ void sock_list_merge(struct sock_list** list, struct regional* region,
void
log_crypto_err(const char* str)
{
#ifdef HAVE_SSL
log_crypto_err_code(str, ERR_get_error());
#else
(void)str;
#endif /* HAVE_SSL */
}
void log_crypto_err_code(const char* str, unsigned long err)
{
#ifdef HAVE_SSL
/* error:[error code]:[library name]:[function name]:[reason string] */
char buf[128];
unsigned long e;
ERR_error_string_n(ERR_get_error(), buf, sizeof(buf));
ERR_error_string_n(err, buf, sizeof(buf));
log_err("%s crypto %s", str, buf);
while( (e=ERR_get_error()) ) {
ERR_error_string_n(e, buf, sizeof(buf));
@ -709,6 +718,7 @@ log_crypto_err(const char* str)
}
#else
(void)str;
(void)err;
#endif /* HAVE_SSL */
}

7
util/net_help.h
View file

@ -378,6 +378,13 @@ void sock_list_merge(struct sock_list** list, struct regional* region,
*/
void log_crypto_err(const char* str);
/**
* Log libcrypto error from errcode with descriptive string, calls log_err.
* @param str: what failed.
* @param err: error code from ERR_get_error.
*/
void log_crypto_err_code(const char* str, unsigned long err);
/**
* Set SSL_OP_NOxxx options on SSL context to disable bad crypto
* @param ctxt: SSL_CTX*

31
util/netevent.c
View file

@ -1052,6 +1052,28 @@ log_cert(unsigned level, const char* str, X509* cert)
}
#endif /* HAVE_SSL */
#ifdef HAVE_SSL
/** true if the ssl handshake error has to be squelched from the logs */
static int
squelch_err_ssl_handshake(unsigned long err)
{
if(verbosity >= VERB_QUERY)
return 0; /* only squelch on low verbosity */
/* this is very specific, we could filter on ERR_GET_REASON()
* (the third element in ERR_PACK) */
if(err == ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_GET_RECORD, SSL_R_HTTPS_PROXY_REQUEST) ||
err == ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_GET_RECORD, SSL_R_HTTP_REQUEST) ||
err == ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER) ||
err == ERR_PACK(ERR_LIB_SSL, SSL_F_SSL3_READ_BYTES, SSL_R_SSLV3_ALERT_BAD_CERTIFICATE) ||
err == ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, SSL_R_NO_SHARED_CIPHER) ||
err == ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL) ||
err == ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL) ||
err == ERR_PACK(ERR_LIB_SSL, SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO, SSL_R_VERSION_TOO_LOW))
return 1;
return 0;
}
#endif /* HAVE_SSL */
/** continue ssl handshake */
#ifdef HAVE_SSL
static int
@ -1096,9 +1118,12 @@ ssl_handshake(struct comm_point* c)
strerror(errno));
return 0;
} else {
log_crypto_err("ssl handshake failed");
log_addr(1, "ssl handshake failed", &c->repinfo.addr,
c->repinfo.addrlen);
unsigned long err = ERR_get_error();
if(!squelch_err_ssl_handshake(err)) {
log_crypto_err_code("ssl handshake failed", err);
log_addr(1, "ssl handshake failed", &c->repinfo.addr,
c->repinfo.addrlen);
}
return 0;
}
}