From a1cb1b47b138b9f654cd0bca5de6d08dbca61888 Mon Sep 17 00:00:00 2001 From: Arne Schwabe Date: Tue, 21 Nov 2023 11:39:30 +0100 Subject: [PATCH] Log SSL alerts more prominently When we receive an SSL alert from a server we currently only log a very cryptic OpenSSL error message: OpenSSL: error:0A00042E:SSL routines::tlsv1 alert protocol version:SSL alert number 70 This also enables logging the much more readable SSL error message: Received fatal SSL alert: protocol version which previously needed --verb 8 to be displayed (now verb 3). Also rework the message to be better readable. Change-Id: I6bdab3028c9bd679c31d4177a746a3ea505dcbbf Signed-off-by: Arne Schwabe Acked-by: Frank Lichtenheld Message-Id: <20231121103930.15175-1-frank@lichtenheld.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27523.html Signed-off-by: Gert Doering --- src/openvpn/ssl_openssl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index 23e762319eb..82872bf2633 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -196,8 +196,8 @@ info_callback(INFO_CALLBACK_SSL_CONST SSL *s, int where, int ret) } else if (where & SSL_CB_ALERT) { - dmsg(D_HANDSHAKE_VERBOSE, "SSL alert (%s): %s: %s", - where & SSL_CB_READ ? "read" : "write", + dmsg(D_TLS_DEBUG_LOW, "%s %s SSL alert: %s", + where & SSL_CB_READ ? "Received" : "Sent", SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret)); }