blocks|key|1055149|text|SSL_get_error|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1055150|ssl+SSL_get_error()返回前面对SSL_connect()、SSL_accept()、SSL_do_handshake()、SSL_read()、SSL_peek()或SSL_write()的调用的结果代码(适用于C+"switch“语句)。必须在参数ret中将TLS/SSL+I/O函数返回的值传递给SSL_get_error()。|1055151|1055152|ERR_get_error|1055153|1055154|+ERR_get_error()从线程的错误队列中返回最早的错误代码，并删除该项。可以重复调用此函数，直到不再返回错误代码为止。|blockquote|1055155|1055156|1055157|因此，后者用于更一般的用途，它们不应该一起使用，因为：|1055158|1055159|在尝试TLS/SSL+I/O操作之前，当前线程的错误队列必须为空，否则SSL_get_error()将无法可靠地工作。|1055160|1055161|1055162|因此，您必须使用ERR_get_error读取所有错误并处理它们(或者像在使用ERR_clear_error的代码示例中那样通过删除来忽略它们)，然后执行IO操作。你的方法似乎是正确的，尽管我现在不能自己检查它的所有方面。|style|CODE|1055163|有关更多信息，请参阅this+answer和this+post。|1055164|编辑:根据this教程，BIO_例程可能会生成错误并影响错误队列：|1055165|1055166|第三个字段是生成错误的包的名称，例如"BIO+routines"或"bignum+routines“。|BOLD|1055167|1055168|entityMap|0|LINK|mutability|MUTABLE|url|https://www.openssl.org/docs/man1.1.0/ssl/SSL_get_error.html|1|https://www.openssl.org/docs/man1.1.0/crypto/ERR_get_error.html|2|https://stackoverflow.com/a/28056464/5922757|3|https://github.com/cesanta/mongoose/issues/168|4|https://www.oreilly.com/library/view/network-security-with/059600270X/ch04.html^0|0|D|0|0|0|0|0|D|1|0|0|0|0|0|0|0|0|0|0|13|F|0|A|B|2|M|9|3|0|5|4|4|0|0|I|E|0|0^^$0|@$1|2|3|4|5|6|7|1O|8|@]|9|@$A|1P|B|1Q|1|1R]]|C|$]]|$1|D|3|E|5|6|7|1S|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|1T|8|@]|9|@]|C|$]]|$1|G|3|H|5|6|7|1U|8|@]|9|@$A|1V|B|1W|1|1X]]|C|$]]|$1|I|3|-4|5|6|7|1Y|8|@]|9|@]|C|$]]|$1|J|3|K|5|L|7|1Z|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|20|8|@]|9|@]|C|$]]|$1|N|3|-4|5|6|7|21|8|@]|9|@]|C|$]]|$1|O|3|P|5|6|7|22|8|@]|9|@]|C|$]]|$1|Q|3|-4|5|6|7|23|8|@]|9|@]|C|$]]|$1|R|3|S|5|L|7|24|8|@]|9|@]|C|$]]|$1|T|3|-4|5|6|7|25|8|@]|9|@]|C|$]]|$1|U|3|-4|5|6|7|26|8|@]|9|@]|C|$]]|$1|V|3|W|5|6|7|27|8|@$A|28|B|29|X|Y]]|9|@]|C|$]]|$1|Z|3|10|5|6|7|2A|8|@]|9|@$A|2B|B|2C|1|2D]|$A|2E|B|2F|1|2G]]|C|$]]|$1|11|3|12|5|6|7|2H|8|@]|9|@$A|2I|B|2J|1|2K]]|C|$]]|$1|13|3|-4|5|6|7|2L|8|@]|9|@]|C|$]]|$1|14|3|15|5|L|7|2M|8|@$A|2N|B|2O|X|16]]|9|@]|C|$]]|$1|17|3|-4|5|6|7|2P|8|@]|9|@]|C|$]]|$1|18|3|-4|5|6|7|2Q|8|@]|9|@]|C|$]]]|19|$1A|$5|1B|1C|1D|C|$1E|1F]]|1G|$5|1B|1C|1D|C|$1E|1H]]|1I|$5|1B|1C|1D|C|$1E|1J]]|1K|$5|1B|1C|1D|C|$1E|1L]]|1M|$5|1B|1C|1D|C|$1E|1N]]]]

<a href="https://www.openssl.org/docs/man1.1.0/ssl/SSL_get_error.html" rel="nofollow noreferrer">SSL_get_error</a>:

<blockquote>
 SSL_get_error() returns a result code (suitable for the C "switch"
 statement) for a preceding call to SSL_connect(), SSL_accept(),
 SSL_do_handshake(), SSL_read(), SSL_peek(), or SSL_write() on ssl. The
 value returned by that TLS/SSL I/O function must be passed to
 SSL_get_error() in parameter ret.
</blockquote>

<a href="https://www.openssl.org/docs/man1.1.0/crypto/ERR_get_error.html" rel="nofollow noreferrer">ERR_get_error</a>:

<blockquote>
 ERR_get_error() returns the earliest error code from the thread's
 error queue and removes the entry. This function can be called
 repeatedly until there are no more error codes to return.
</blockquote>

So the latter is for more general use and those shouldn't be used together, because:

<blockquote>
 The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, or SSL_get_error() will not work reliably.
</blockquote>

So you have to read all of the errors using ERR_get_error and handle them (or ignore them by removal as you did in your code sample with <code>ERR_clear_error</code>) and then perform the IO operation. Your approach seems to be correct, although I can't check all aspects of it by myself at the moment.

Refer to <a href="https://stackoverflow.com/a/28056464/5922757">this answer</a> and <a href="https://github.com/cesanta/mongoose/issues/168" rel="nofollow noreferrer">this post</a> for more information.

EDIT: according to <a href="https://www.oreilly.com/library/view/network-security-with/059600270X/ch04.html" rel="nofollow noreferrer">this</a> tutorial, BIO_ routines may generate an error and affect error queue:

<blockquote>
 The third field is the name of the package that generated the error,
 such as "BIO routines" or "bignum routines".
</blockquote>

blocks|key|1055199|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1055200|和SSL_get_error和ERR_get_error的区别是什么？|blockquote|1055201|1055202|1055203|OpenSSL有两个逻辑部分。首先是SSL库，libssl.a+(和libssl.so)，它包含了与通信相关的东西。第二个是密码库libcrypto.a+(和libcrypto.so)，它包括大数、配置、输入/输出等。|offset|length|style|CODE|1055204|libssl.a依赖于libcrypto.a，这就是为什么link命令被定为-lssl+-lcrypto的原因。|1055205|您可以使用SSL_get_error从SSL部分库中检索大多数错误，并使用ERR_get_error来检索库的SSL部分之外的错误。|1055206|1055207|1055208|这是在OpenSSL中进行错误处理的正确方法吗？|1055209|1055210|1055211|您展示的代码更接近于“如何关闭SSL套接字”。最终，旋转控制了两种情况。首先是半开连接，当客户端关闭而没有发送关闭通知消息时。第二个是您的程序在发送关闭通知消息时的行为。|1055212|很难回答“它是否正确”，因为我们不知道您想要的行为。如果您不关心是否发送关闭通知，那么我相信您只需要调用SSL_shutdown一次，无论客户端做什么。|1055213|entityMap^0|0|0|0|0|N|8|Y|9|1T|B|27|C|0|0|8|B|B|12|E|0|5|D|11|D|0|0|0|0|0|0|0|1G|C|0^^$0|@$1|2|3|-4|4|5|6|11|7|@]|8|@]|9|$]]|$1|A|3|B|4|C|6|12|7|@]|8|@]|9|$]]|$1|D|3|-4|4|5|6|13|7|@]|8|@]|9|$]]|$1|E|3|-4|4|5|6|14|7|@]|8|@]|9|$]]|$1|F|3|G|4|5|6|15|7|@$H|16|I|17|J|K]|$H|18|I|19|J|K]|$H|1A|I|1B|J|K]|$H|1C|I|1D|J|K]]|8|@]|9|$]]|$1|L|3|M|4|5|6|1E|7|@$H|1F|I|1G|J|K]|$H|1H|I|1I|J|K]|$H|1J|I|1K|J|K]]|8|@]|9|$]]|$1|N|3|O|4|5|6|1L|7|@$H|1M|I|1N|J|K]|$H|1O|I|1P|J|K]]|8|@]|9|$]]|$1|P|3|-4|4|5|6|1Q|7|@]|8|@]|9|$]]|$1|Q|3|-4|4|5|6|1R|7|@]|8|@]|9|$]]|$1|R|3|S|4|C|6|1S|7|@]|8|@]|9|$]]|$1|T|3|-4|4|5|6|1T|7|@]|8|@]|9|$]]|$1|U|3|-4|4|5|6|1U|7|@]|8|@]|9|$]]|$1|V|3|W|4|5|6|1V|7|@]|8|@]|9|$]]|$1|X|3|Y|4|5|6|1W|7|@$H|1X|I|1Y|J|K]]|8|@]|9|$]]|$1|Z|3|-4|4|5|6|1Z|7|@]|8|@]|9|$]]]|10|$]]

<blockquote>
 And what is the difference between SSL_get_error and ERR_get_error? 
</blockquote>

There are two logical parts to OpenSSL. First is the SSL library, <code>libssl.a</code> (and <code>libssl.so</code>), and it includes the communication related stuff. Second is the cryptography library, <code>libcrypto.a</code> (and <code>libcrypto.so</code>), and it includes big numbers, configuration, input/output, etc.

<code>libssl.a</code> depends upon <code>libcrypto.a</code>, and its why the link command is ordered as <code>-lssl -lcrypto</code>.

You use <code>SSL_get_error</code> to retrieve most errors from the SSL portion library, and you use <code>ERR_get_error</code> to retrieve errors not in the SSL portion of the library.

<hr>

<blockquote>
 Is this the correct way to do error handling in OpenSSL?
</blockquote>

The code you showed is closer to "how do you shutdown a SSL socket". Ultimately, the gyrations control two cases. First is a half open connection, when the client shutdowns without sending the close notify message. The second is your program's behavior when sending the close notify message.

Its hard to answer "is it correct" because we don't know the behavior you want. If you don't care if the close notify is sent, then I believe you only need to call <code>SSL_shutdown</code> once, regardless of what the client does.

Is this the correct way to do error handling in OpenSSL?
And what is the difference between <code>SSL_get_error</code> and <code>ERR_get_error</code>?
The docs are quite vague in this regard.

<pre><code>int ssl_shutdown(SSL *ssl_connection)
{
 int rv, err;
 ERR_clear_error();
 rv = SSL_shutdown(ssl_connection);

 if (rv == 0)
 SSL_shutdown(ssl_connection);

 if (rv &lt; 0)
 {
 err = SSL_get_error(ssl_connection, rv);

 if (err == SSL_ERROR_SSL)
 fprintf(stderr, "%s\n", ERR_error_string(ERR_get_error(), NULL));

 fprintf(stderr, "%s\n", SSL_state_string(ssl_connection));

 return 1;
 }

 SSL_free(ssl_connection);
 return 0;
}
</code></pre>

OpenSSL error handling

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

这是在OpenSSL中进行错误处理的正确方法吗？SSL_get_error和ERR_get_error之间的区别是什么？在这方面，文档相当含糊。int ssl_shutdown(SSL *ssl_connection){    int rv, err;    ERR_clear_error();    rv = SSL...

问OpenSSL错误处理
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问OpenSSL错误处理EN