From ed6d3d88c112c5129a6a6d35306b0d112b244df7 Mon Sep 17 00:00:00 2001
From: Adrien Destugues <pulkomandy@pulkomandy.tk>
Date: Mon, 31 Oct 2016 22:12:50 +0100
Subject: [PATCH] SecureSocket: add code to trace SSL events.

Under a #define TRACE_SSL, should you need it.

Also load error strings when initializing the SSL context, so we get
human readable errors from SSL (also in the ser reported ones).
---
 src/kits/network/libnetapi/SecureSocket.cpp | 47 +++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/src/kits/network/libnetapi/SecureSocket.cpp b/src/kits/network/libnetapi/SecureSocket.cpp
index 9ca4f66717..7b3cfeb0e2 100644
--- a/src/kits/network/libnetapi/SecureSocket.cpp
+++ b/src/kits/network/libnetapi/SecureSocket.cpp
@@ -179,11 +179,58 @@ BSecureSocket::Private::VerifyCallback(int ok, X509_STORE_CTX* ctx)
 }
 
 
+#if TRACE_SSL
+static void apps_ssl_info_callback(const SSL *s, int where, int ret)
+{
+	const char *str;
+	int w;
+
+	w=where& ~SSL_ST_MASK;
+
+	if (w & SSL_ST_CONNECT) str="SSL_connect";
+	else if (w & SSL_ST_ACCEPT) str="SSL_accept";
+	else str="undefined";
+
+	if (where & SSL_CB_LOOP)
+	{
+		fprintf(stderr,"%s:%s\n",str,SSL_state_string_long(s));
+	}
+	else if (where & SSL_CB_ALERT)
+	{
+		str=(where & SSL_CB_READ)?"read":"write";
+		fprintf(stderr,"SSL3 alert %s:%s:%s\n",
+				str,
+				SSL_alert_type_string_long(ret),
+				SSL_alert_desc_string_long(ret));
+	}
+	else if (where & SSL_CB_EXIT)
+	{
+		if (ret == 0)
+			fprintf(stderr,"%s:failed in %s\n",
+					str,SSL_state_string_long(s));
+		else if (ret < 0)
+		{
+			fprintf(stderr,"%s:error in %s\n",
+					str,SSL_state_string_long(s));
+		}
+	}
+}
+#endif
+
+
 /* static */ void
 BSecureSocket::Private::_CreateContext()
 {
+	// We want SSL to report errors in human readable format.
+	SSL_load_error_strings();
+
 	sContext = SSL_CTX_new(SSLv23_method());
 
+#if TRACE_SSL
+	// For debugging purposes: get all SSL messages to the standard error.
+	SSL_CTX_set_info_callback(sContext, apps_ssl_info_callback);
+#endif
+
 	// Disable legacy protocols. They have known vulnerabilities.
 	SSL_CTX_set_options(sContext, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);