OpenSSL error handling

Question

Is this the correct way to do error handling in OpenSSL? And what is the difference between SSL_get_error and ERR_get_error? The docs are quite vague in this regard.

int ssl_shutdown(SSL *ssl_connection)
{
    int rv, err;
    ERR_clear_error();
    rv = SSL_shutdown(ssl_connection);

    if (rv == 0)
        SSL_shutdown(ssl_connection);

    if (rv < 0)
    {
        err = SSL_get_error(ssl_connection, rv);

        if (err == SSL_ERROR_SSL)
            fprintf(stderr, "%s\n", ERR_error_string(ERR_get_error(), NULL));

        fprintf(stderr, "%s\n", SSL_state_string(ssl_connection));

        return 1;
    }

    SSL_free(ssl_connection);
    return 0;
}

Answer 1

SSL_get_error:

SSL_get_error() returns a result code (suitable for the C "switch" statement) for a preceding call to SSL_connect(), SSL_accept(), SSL_do_handshake(), SSL_read(), SSL_peek(), or SSL_write() on ssl. The value returned by that TLS/SSL I/O function must be passed to SSL_get_error() in parameter ret.

ERR_get_error:

ERR_get_error() returns the earliest error code from the thread's error queue and removes the entry. This function can be called repeatedly until there are no more error codes to return.

So the latter is for more general use and those shouldn't be used together, because:

The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, or SSL_get_error() will not work reliably.

So you have to read all of the errors using ERR_get_error and handle them (or ignore them by removal as you did in your code sample with ERR_clear_error) and then perform the IO operation. Your approach seems to be correct, although I can't check all aspects of it by myself at the moment.

Refer to this answer and this post for more information.

EDIT: according to this tutorial, BIO_ routines may generate an error and affect error queue:

The third field is the name of the package that generated the error, such as "BIO routines" or "bignum routines".