SSL_GET_ERROR(3) | Library Functions Manual | SSL_GET_ERROR(3) |
SSL_get_error
—
#include <openssl/ssl.h>
int
SSL_get_error
(const
SSL *ssl, int
ret);
SSL_get_error
() returns a result code (suitable for the
C “switch” statement) for a preceding call to
SSL_connect(3),
SSL_accept(3),
SSL_do_handshake(3),
SSL_read(3),
SSL_peek(3), or
SSL_write(3) on
ssl. The value returned by that TLS/SSL I/O function
must be passed to SSL_get_error
() in parameter
ret.
In addition to ssl and
ret, SSL_get_error
() inspects
the current thread's OpenSSL error queue. Thus,
SSL_get_error
() must be used in the same thread that
performed the TLS/SSL I/O operation, and no other OpenSSL function calls
should appear in between. The current thread's error queue must be empty
before the TLS/SSL I/O operation is attempted, or
SSL_get_error
() will not work reliably.
SSL_ERROR_NONE
SSL_ERROR_ZERO_RETURN
SSL_ERROR_ZERO_RETURN
does
not necessarily indicate that the underlying transport has been
closed.SSL_ERROR_WANT_READ
,
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_READ
) or allows writing data
(SSL_ERROR_WANT_WRITE
), then some TLS/SSL protocol
progress will take place, i.e., at least part of a TLS/SSL record will be
read or written. Note that the retry may again lead to a
SSL_ERROR_WANT_READ
or
SSL_ERROR_WANT_WRITE
condition. There is no fixed
upper limit for the number of iterations that may be necessary until
progress becomes visible at application protocol level.
For socket BIOs (e.g., when
SSL_set_fd
() was used),
select(2) or
poll(2) on the underlying socket can be
used to find out when the TLS/SSL I/O function should be retried.
Caveat: Any TLS/SSL I/O function can lead to either of
SSL_ERROR_WANT_READ
and
SSL_ERROR_WANT_WRITE
. In particular,
SSL_read(3) or
SSL_peek(3) may want to write data
and SSL_write(3) may want to read
data. This is mainly because TLS/SSL handshakes may occur at any time
during the protocol (initiated by either the client or the server);
SSL_read(3),
SSL_peek(3), and
SSL_write(3) will handle any
pending handshakes.
SSL_ERROR_WANT_CONNECT
,
SSL_ERROR_WANT_ACCEPT
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
ERR_get_error
() returns 0),
ret can be used to find out more about the error: If
ret == 0, an EOF
was
observed that violates the protocol. If ret ==
−1, the underlying BIO reported an I/O error
(for socket I/O on Unix systems, consult errno
for
details).SSL_ERROR_SSL
SSL_get_error
() first appeared in SSLeay 0.8.0 and have
been available since OpenBSD 2.4.April 29, 2018 | OpenBSD-current |