HsOpenSSL 0.11.4.20 → 0.11.5

raw patch · 3 files changed

+54/−9 lines, 3 filesdep ~basePVP ok

version bump matches the API change (PVP)

Dependency ranges changed: base

API changes (from Hackage documentation)

Files

• ChangeLog +9/−0
• HsOpenSSL.cabal +1/−1
• OpenSSL/Session.hsc +44/−8

@@ -1,3 +1,12 @@+2020-11-02  Vladimir Shabanov  <dev@vshabanov.com>++	* HsOpenSSL.cabal (Version): Bump version to 0.11.5+	(actually it is previous version that should be 0.11.5+	since it added new API but it was already released+	so we bumping version here).++	* Handling SSL_ERROR_SYSCALL with errno=0 which means unexpected EOF.+ 2020-10-08  Vladimir Shabanov  <dev@vshabanov.com>  	* HsOpenSSL.cabal (Version): Bump version to 0.11.4.20

@@ -10,7 +10,7 @@     systems and stable. You may also be interested in the @tls@ package,     <http://hackage.haskell.org/package/tls>, which is a pure Haskell     implementation of SSL.-Version:       0.11.4.20+Version:       0.11.5 License:       PublicDomain License-File:  COPYING Author:        Adam Langley, Mikhail Vorozhtsov, PHO, Taru Karttunen

@@ -452,16 +452,52 @@ foreign import ccall "SSL_connect" _ssl_connect :: Ptr SSL_ -> IO CInt foreign import ccall unsafe "SSL_get_error" _ssl_get_error :: Ptr SSL_ -> CInt -> IO CInt -throwSSLException :: String -> CInt -> IO a-throwSSLException loc ret+throwSSLException :: String -> CInt -> CInt -> IO a+throwSSLException loc sslErr ret     = do e <- getError          if e == 0 then              case ret of-               0 -> throwIO ConnectionAbruptlyTerminated-               _ -> throwErrno loc+               0 ->+                 throwIO ConnectionAbruptlyTerminated+                 -- empty error queue and ret==0 meant EOF in older versions+                 -- of OpenSSL+                 -- https://github.com/openssl/openssl/commit/beacb0f0c1ae7b0542fe053b95307f515b578eb7+               _ -> do+                 errno <- getErrno+                 if errno == eOK then+                   if sslErr == (#const SSL_ERROR_SYSCALL) then+                     -- newer OpenSSL versions have bug:+                     -- SSL_ERROR_SYSCALL with errno=0 means unexpected EOF+                     -- from the peer+                     throwIO ConnectionAbruptlyTerminated+                   else+                     throwIO $ ProtocolError $ loc <> ": "+                       <> sslErrorString sslErr+                 else+                   throwErrno loc            else              errorString e >>= throwIO . ProtocolError +sslErrorString :: CInt -> String+sslErrorString e = case e of+  (#const SSL_ERROR_NONE) -> "SSL_ERROR_NONE"+  (#const SSL_ERROR_ZERO_RETURN) -> "SSL_ERROR_ZERO_RETURN"+  (#const SSL_ERROR_WANT_READ) -> "SSL_ERROR_WANT_READ"+  (#const SSL_ERROR_WANT_WRITE) -> "SSL_ERROR_WANT_WRITE"+  (#const SSL_ERROR_WANT_CONNECT) -> "SSL_ERROR_WANT_CONNECT"+  (#const SSL_ERROR_WANT_ACCEPT) -> "SSL_ERROR_WANT_ACCEPT"+  (#const SSL_ERROR_WANT_X509_LOOKUP) -> "SSL_ERROR_WANT_X509_LOOKUP"+#if OPENSSL_VERSION_NUMBER >= 0x10100000L+  (#const SSL_ERROR_WANT_ASYNC) -> "SSL_ERROR_WANT_ASYNC"+  (#const SSL_ERROR_WANT_ASYNC_JOB) -> "SSL_ERROR_WANT_ASYNC_JOB"+#endif+#if OPENSSL_VERSION_NUMBER >= 0x10101000L+  (#const SSL_ERROR_WANT_CLIENT_HELLO_CB) -> "SSL_ERROR_WANT_CLIENT_HELLO_CB"+#endif+  (#const SSL_ERROR_SYSCALL) -> "SSL_ERROR_SYSCALL"+  (#const SSL_ERROR_SSL) -> "SSL_ERROR_SSL"+  _ -> "Unknown SSL error " <> show e+ -- | This is the type of an SSL IO operation. Errors are handled by -- exceptions while everything else is one of these. Note that reading -- from an SSL socket can result in WantWrite and vice versa.@@ -497,7 +533,7 @@                 case err of                   (#const SSL_ERROR_WANT_READ ) -> return WantRead                   (#const SSL_ERROR_WANT_WRITE) -> return WantWrite-                  _ -> throwSSLException loc n+                  _ -> throwSSLException loc err n  -- | Perform an SSL server handshake accept :: SSL -> IO ()@@ -547,7 +583,7 @@                   (#const SSL_ERROR_ZERO_RETURN) -> return $ SSLDone $ 0                   (#const SSL_ERROR_WANT_READ  ) -> return WantRead                   (#const SSL_ERROR_WANT_WRITE ) -> return WantWrite-                  _ -> throwSSLException loc n+                  _ -> throwSSLException loc err n  -- | Try to read the given number of bytes from an SSL connection. On EOF an --   empty ByteString is returned. If the connection dies without a graceful@@ -689,10 +725,10 @@                            (#const SSL_ERROR_SYSCALL)                                -> do sd <- _ssl_get_shutdown sslPtr                                      if sd .&. (#const SSL_RECEIVED_SHUTDOWN) == 0 then-                                         throwSSLException "SSL_shutdown" n+                                         throwSSLException "SSL_shutdown" err n                                        else                                          return $ SSLDone ()-                           _   -> throwSSLException "SSL_shutdown" n+                           _   -> throwSSLException "SSL_shutdown" err n  foreign import ccall "SSL_get_peer_certificate" _ssl_get_peer_cert :: Ptr SSL_ -> IO (Ptr X509_)