CA-404460: Expose Stunnel_verify_error for mismatched or corrupted certificate, and expose ssl_verify_error during update syncing

[gangj]

Pls refer to commit msg for details

[lindig]

I don't like the overall (existing) look of check_verify_error as it looks fragile and likely to fail when Stunnel changes. Would extracting the desired information with a regex be simpler?

[lindig]

Why is the string empty and not providing details? Could at least use __LOC__.

[gangj]

I think this is to expose the error with reason found in the stunnel log. Raise the empty reason when no error can be found in the log.

[lindig]

For documentation, could you add in a comment an example for an actual error that we would like to parse? Otherwise it is difficult to assess how the current code works. I would suggest we define a single regular expression (it may contain alternatives (...|...|...) that catches the error and that is easier to maintain than a sequence of matches.

[gangj]

Added comment for the mismatched certificate case, but it only looks for log line containing "certificate verify failed", and after "certificate verify failed" is found in the line, it tries to look for detailed error.

[lindig]

I still maintain that using Re would be simple; the code below matches the string at the end and extracts the error code.

  4 let rx =
  3   Re.Posix.re {|error:([^:]*).*certificate verify failed|} |> Re.compile
  2 
  1 let str = "SSL_connect: ssl/statem/statem_clnt.c:1889: error:0A000086:SSL routines::certificate verify failed";;
  0                                                                               
  1 let m = Re.exec rx str in Re.Group.get m 1 |> print_endline
  2 

[gangj]

I don't like the overall (existing) look of check_verify_error as it looks fragile and likely to fail when Stunnel changes. Would extracting the desired information with a regex be simpler?

Yeah, I agree it is very fragile.
But after upgrading stunnel or openssl, the log might change significantly, as we can see here: the original log "VERIFY ERROR" is not printed by stunnel now. So I am afraid a regex might not made the situation better, maybe we can add XenRT test cases for these scenarios to make sure it works.