Update POCO library.

vendor/POCO/NetSSL_OpenSSL/src/CertificateHandlerFactoryMgr.cpp

@@ -42,14 +42,14 @@ void CertificateHandlerFactoryMgr::setFactory(const std::string& name, Certifica
 		delete pFactory;
 	poco_assert(success);
 }
-		
+
 
 bool CertificateHandlerFactoryMgr::hasFactory(const std::string& name) const
 {
 	return _factories.find(name) != _factories.end();
 }
-		
-	
+
+
 const CertificateHandlerFactory* CertificateHandlerFactoryMgr::getFactory(const std::string& name) const
 {
 	FactoriesMap::const_iterator it = _factories.find(name);

vendor/POCO/NetSSL_OpenSSL/src/Context.cpp

@@ -20,10 +20,19 @@
 #include "Poco/File.h"
 #include "Poco/Path.h"
 #include "Poco/Timestamp.h"
+#include "Poco/Format.h"
+#include "Poco/Error.h"
 #include <openssl/bio.h>
+#include <openssl/bn.h>
+#include <openssl/dh.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <openssl/x509v3.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+#include <openssl/decoder.h>
+#endif // OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <iostream>
 
 
 namespace Poco {
@@ -36,7 +45,8 @@ Context::Params::Params():
 	loadDefaultCAs(false),
 	ocspStaplingVerification(false),
 	cipherList("ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH"),
-	dhUse2048Bits(false)
+	dhUse2048Bits(false),
+	securityLevel(SECURITY_LEVEL_NONE)
 {
 }
 
@@ -125,6 +135,9 @@ void Context::init(const Params& params)
 	try
 	{
 		int errCode = 0;
+
+		setSecurityLevel(params.securityLevel);
+
 		if (!params.caLocation.empty())
 		{
 			Poco::File aFile(params.caLocation);
@@ -204,6 +217,14 @@ void Context::init(const Params& params)
 }
 
 
+void Context::setSecurityLevel(SecurityLevel level)
+{
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+	SSL_CTX_set_security_level(_pSSLContext, static_cast<int>(level));
+#endif
+}
+
+
 void Context::useCertificate(const Poco::Crypto::X509Certificate& certificate)
 {
 	int errCode = SSL_CTX_use_certificate(_pSSLContext, const_cast<X509*>(certificate.certificate()));
@@ -715,6 +736,110 @@ void Context::initDH(bool use2048Bits, const std::string& dhParamsFile)
 		0x6C,0xC4,0x16,0x59,
 	};
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+	EVP_PKEY_CTX* pKeyCtx = NULL;
+	OSSL_DECODER_CTX* pOSSLDecodeCtx = NULL;
+	EVP_PKEY* pKey = NULL;
+	bool freeEVPPKey = true;
+	if (!dhParamsFile.empty())
+	{
+		freeEVPPKey = false;
+		pOSSLDecodeCtx = OSSL_DECODER_CTX_new_for_pkey(&pKey, NULL, NULL, "DH",
+				OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS, NULL, NULL);
+
+		if (!pOSSLDecodeCtx)
+		{
+			std::string err = Poco::format(
+					"Context::initDH(%s):OSSL_DECODER_CTX_new_for_pkey():OSSL_DECODER_CTX*\n", dhParamsFile);
+			throw Poco::NullPointerException(Poco::Crypto::getError(err));
+		}
+
+		if (!OSSL_DECODER_CTX_get_num_decoders(pOSSLDecodeCtx))
+		{
+			OSSL_DECODER_CTX_free(pOSSLDecodeCtx);
+			throw Poco::Crypto::OpenSSLException(
+				Poco::format("Context::initDH(%s):OSSL_DECODER_CTX_get_num_decoders()=0",
+					dhParamsFile));
+		}
+
+		FILE* pFile = fopen(dhParamsFile.c_str(), "r");
+		if (!pFile)
+		{
+			OSSL_DECODER_CTX_free(pOSSLDecodeCtx);
+			throw Poco::NullPointerException(
+				Poco::format("Context::initDH(%s):fopen()\n%s",
+					dhParamsFile, Poco::Error::getMessage(Poco::Error::last())));
+		}
+
+		if (!OSSL_DECODER_from_fp(pOSSLDecodeCtx, pFile))
+		{
+			fclose(pFile);
+			OSSL_DECODER_CTX_free(pOSSLDecodeCtx);
+			std::string err = Poco::format(
+					"Context::initDH(%s):OSSL_DECODER_from_fp()\n%s", dhParamsFile);
+			throw Poco::Crypto::OpenSSLException(Poco::Crypto::getError(err));
+		}
+		fclose(pFile);
+		OSSL_DECODER_CTX_free(pOSSLDecodeCtx);
+
+		if (!pKey)
+		{
+			std::string err = Poco::format(
+					"Context::initDH(%s):OSSL_DECODER_CTX_new_for_pkey():EVP_PKEY*\n", dhParamsFile);
+			throw Poco::NullPointerException(Poco::Crypto::getError(err));
+		}
+	}
+	else
+	{
+		pKeyCtx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);
+		if (!pKeyCtx)
+		{
+			std::string err = "Context::initDH():EVP_PKEY_CTX_new_from_name()\n";
+			throw Poco::NullPointerException(Poco::Crypto::getError(err));
+		}
+
+		size_t keyLength = use2048Bits ? 256 : 160;
+		unsigned char* pDH_p = const_cast<unsigned char*>(use2048Bits ? dh2048_p : dh1024_p);
+		std::size_t sz_p = use2048Bits ? sizeof(dh2048_p) : sizeof(dh1024_p);
+		unsigned char* pDH_g = const_cast<unsigned char*>(use2048Bits ? dh2048_g : dh1024_g);
+		std::size_t sz_g = use2048Bits ? sizeof(dh2048_g) : sizeof(dh1024_g);
+		OSSL_PARAM params[]
+		{
+			OSSL_PARAM_size_t(OSSL_PKEY_PARAM_FFC_PBITS, &keyLength),
+			OSSL_PARAM_BN(OSSL_PKEY_PARAM_FFC_P, pDH_p, sz_p),
+			OSSL_PARAM_BN(OSSL_PKEY_PARAM_FFC_G, pDH_g, sz_g),
+			OSSL_PARAM_END
+		};
+
+		if (1 != EVP_PKEY_fromdata_init(pKeyCtx))
+		{
+			EVP_PKEY_CTX_free(pKeyCtx);
+			std::string err = "Context::initDH():EVP_PKEY_fromdata_init()\n";
+			throw SSLContextException(Poco::Crypto::getError(err));
+		}
+
+		if (1 != EVP_PKEY_fromdata(pKeyCtx, &pKey, EVP_PKEY_KEYPAIR, params))
+		{
+			EVP_PKEY_CTX_free(pKeyCtx);
+			std::string err = "Context::initDH():EVP_PKEY_fromdata()\n";
+			throw SSLContextException(Poco::Crypto::getError(err));
+		}
+		EVP_PKEY_CTX_free(pKeyCtx);
+	}
+
+	if (!pKey)
+	{
+		throw SSLContextException(Poco::format("Context::initDH(%s):EVP_PKEY*", dhParamsFile));
+	}
+
+	SSL_CTX_set0_tmp_dh_pkey(_pSSLContext, pKey);
+	SSL_CTX_set_options(_pSSLContext, SSL_OP_SINGLE_DH_USE);
+
+	if (freeEVPPKey) EVP_PKEY_free(pKey);
+
+#else // OPENSSL_VERSION_NUMBER >= 0x30000000L
+
 	DH* dh = 0;
 	if (!dhParamsFile.empty())
 	{
@@ -740,7 +865,9 @@ void Context::initDH(bool use2048Bits, const std::string& dhParamsFile)
 			std::string msg = Utility::getLastError();
 			throw SSLContextException("Error creating Diffie-Hellman parameters", msg);
 		}
+
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+
 		BIGNUM* p = nullptr;
 		BIGNUM* g = nullptr;
 		if (use2048Bits)
@@ -762,7 +889,9 @@ void Context::initDH(bool use2048Bits, const std::string& dhParamsFile)
 			DH_free(dh);
 			throw SSLContextException("Error creating Diffie-Hellman parameters");
 		}
-#else
+
+#else // OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+
 		if (use2048Bits)
 		{
 			dh->p = BN_bin2bn(dh2048_p, sizeof(dh2048_p), 0);
@@ -780,15 +909,23 @@ void Context::initDH(bool use2048Bits, const std::string& dhParamsFile)
 			DH_free(dh);
 			throw SSLContextException("Error creating Diffie-Hellman parameters");
 		}
-#endif
+
+#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+
 	}
 	SSL_CTX_set_tmp_dh(_pSSLContext, dh);
 	SSL_CTX_set_options(_pSSLContext, SSL_OP_SINGLE_DH_USE);
 	DH_free(dh);
-#else
+
+#endif // OPENSSL_VERSION_NUMBER >= 0x30000000L
+
+#else // OPENSSL_NO_DH
+
 	if (!dhParamsFile.empty())
-		throw SSLContextException("OpenSSL does not support DH");
-#endif
+		throw SSLContextException("Implementation does not support DH");
+
+#endif // OPENSSL_NO_DH
+
 }
 
 
@@ -812,7 +949,7 @@ void Context::initECDH(const std::string& curve)
  		throw SSLContextException("Cannot set ECDH groups", groups);
  	}
  	SSL_CTX_set_options(_pSSLContext, SSL_OP_SINGLE_ECDH_USE);
- #elif OPENSSL_VERSION_NUMBER >= 0x0090800fL
+ #else
 	int nid = 0;
 	if (!curve.empty())
 	{

vendor/POCO/NetSSL_OpenSSL/src/FTPSClientSession.cpp

@@ -127,6 +127,14 @@ StreamSocket FTPSClientSession::establishDataConnection(const std::string& comma
 		{
 			Poco::Net::SecureStreamSocket sss(Poco::Net::SecureStreamSocket::attach(ss, pSecure->context(), pSecure->currentSession()));
 			ss = sss;
+			if (_forceSessionReuse)
+			{
+				sss.setLazyHandshake(false);
+				if (sss.completeHandshake() != 1)
+					throw Poco::Net::FTPException("SSL Session HANDSHAKE error");
+				if (!sss.sessionWasReused())
+					throw Poco::Net::FTPException("SSL Session for data connection was not reused");
+			}
 		}
 	}
 	return ss;

vendor/POCO/NetSSL_OpenSSL/src/HTTPSStreamFactory.cpp

@@ -80,7 +80,7 @@ std::istream* HTTPSStreamFactory::open(const URI& uri)
 		int redirects = 0;
 		std::string username;
 		std::string password;
-		
+
 		do
 		{
 			if (!pSession)
@@ -110,7 +110,7 @@ std::istream* HTTPSStreamFactory::open(const URI& uri)
 			std::string path = resolvedURI.getPathAndQuery();
 			if (path.empty()) path = "/";
 			HTTPRequest req(HTTPRequest::HTTP_GET, path, HTTPMessage::HTTP_1_1);
-			
+
 			if (authorize)
 			{
 				HTTPCredentials::extractCredentials(uri, username, password);
@@ -118,7 +118,7 @@ std::istream* HTTPSStreamFactory::open(const URI& uri)
 				cred.authenticate(req, res);
 			}
 
-			req.set("User-Agent", Poco::format("poco/%d.%d.%d", 
+			req.set("User-Agent", Poco::format("poco/%d.%d.%d",
 				(POCO_VERSION >> 24) & 0xFF,
 				(POCO_VERSION >> 16) & 0xFF,
 				(POCO_VERSION >> 8) & 0xFF));
@@ -126,8 +126,8 @@ std::istream* HTTPSStreamFactory::open(const URI& uri)
 
 			pSession->sendRequest(req);
 			std::istream& rs = pSession->receiveResponse(res);
-			bool moved = (res.getStatus() == HTTPResponse::HTTP_MOVED_PERMANENTLY || 
-			              res.getStatus() == HTTPResponse::HTTP_FOUND || 
+			bool moved = (res.getStatus() == HTTPResponse::HTTP_MOVED_PERMANENTLY ||
+			              res.getStatus() == HTTPResponse::HTTP_FOUND ||
 			              res.getStatus() == HTTPResponse::HTTP_SEE_OTHER ||
 						  res.getStatus() == HTTPResponse::HTTP_TEMPORARY_REDIRECT);
 			if (moved)
@@ -138,7 +138,7 @@ std::istream* HTTPSStreamFactory::open(const URI& uri)
 					resolvedURI.setUserInfo(username + ":" + password);
 					authorize = false;
 				}
-				delete pSession; 
+				delete pSession;
 				pSession = 0;
 				++redirects;
 				retry = true;
@@ -149,13 +149,13 @@ std::istream* HTTPSStreamFactory::open(const URI& uri)
 			}
 			else if (res.getStatus() == HTTPResponse::HTTP_USEPROXY && !retry)
 			{
-				// The requested resource MUST be accessed through the proxy 
-				// given by the Location field. The Location field gives the 
-				// URI of the proxy. The recipient is expected to repeat this 
+				// The requested resource MUST be accessed through the proxy
+				// given by the Location field. The Location field gives the
+				// URI of the proxy. The recipient is expected to repeat this
 				// single request via the proxy. 305 responses MUST only be generated by origin servers.
 				// only use for one single request!
 				proxyUri.resolve(res.get("Location"));
-				delete pSession; 
+				delete pSession;
 				pSession = 0;
 				retry = true; // only allow useproxy once
 			}

vendor/POCO/NetSSL_OpenSSL/src/KeyFileHandler.cpp

@@ -45,7 +45,7 @@ void KeyFileHandler::onPrivateKeyRequested(const void* pSender, std::string& pri
 		std::string prefix = serverSide() ? SSLManager::CFG_SERVER_PREFIX : SSLManager::CFG_CLIENT_PREFIX;
 		if (!config.hasProperty(prefix + CFG_PRIV_KEY_FILE))
 			throw Poco::Util::EmptyOptionException(std::string("Missing Configuration Entry: ") + prefix + CFG_PRIV_KEY_FILE);
-		
+
 		privateKey = config.getString(prefix + CFG_PRIV_KEY_FILE);
 	}
 	catch (Poco::NullPointerException&)

vendor/POCO/NetSSL_OpenSSL/src/PrivateKeyFactoryMgr.cpp

@@ -40,14 +40,14 @@ void PrivateKeyFactoryMgr::setFactory(const std::string& name, PrivateKeyFactory
 		delete pFactory;
 	poco_assert(success);
 }
-		
+
 
 bool PrivateKeyFactoryMgr::hasFactory(const std::string& name) const
 {
 	return _factories.find(name) != _factories.end();
 }
-		
-	
+
+
 const PrivateKeyFactory* PrivateKeyFactoryMgr::getFactory(const std::string& name) const
 {
 	FactoriesMap::const_iterator it = _factories.find(name);

vendor/POCO/NetSSL_OpenSSL/src/SSLManager.cpp

@@ -119,6 +119,7 @@ SSLManager& SSLManager::instance()
 
 void SSLManager::initializeServer(PrivateKeyPassphraseHandlerPtr ptrPassphraseHandler, InvalidCertificateHandlerPtr ptrHandler, Context::Ptr ptrContext)
 {
+	Poco::FastMutex::ScopedLock lock(_mutex);
 	_ptrServerPassphraseHandler  = ptrPassphraseHandler;
 	_ptrServerCertificateHandler = ptrHandler;
 	_ptrDefaultServerContext     = ptrContext;
@@ -127,6 +128,7 @@ void SSLManager::initializeServer(PrivateKeyPassphraseHandlerPtr ptrPassphraseHa
 
 void SSLManager::initializeClient(PrivateKeyPassphraseHandlerPtr ptrPassphraseHandler, InvalidCertificateHandlerPtr ptrHandler, Context::Ptr ptrContext)
 {
+	Poco::FastMutex::ScopedLock lock(_mutex);
 	_ptrClientPassphraseHandler  = ptrPassphraseHandler;
 	_ptrClientCertificateHandler = ptrHandler;
 	_ptrDefaultClientContext     = ptrContext;

vendor/POCO/NetSSL_OpenSSL/src/SecureServerSocket.cpp

@@ -26,7 +26,7 @@ namespace Poco {
 namespace Net {
 
 
-SecureServerSocket::SecureServerSocket(): 
+SecureServerSocket::SecureServerSocket():
 	ServerSocket(new SecureServerSocketImpl(SSLManager::instance().defaultServerContext()), true)
 {
 }
@@ -38,7 +38,7 @@ SecureServerSocket::SecureServerSocket(Context::Ptr pContext):
 }
 
 
-SecureServerSocket::SecureServerSocket(const Socket& socket): 
+SecureServerSocket::SecureServerSocket(const Socket& socket):
 	ServerSocket(socket)
 {
 	if (!dynamic_cast<SecureServerSocketImpl*>(impl()))
@@ -46,7 +46,7 @@ SecureServerSocket::SecureServerSocket(const Socket& socket):
 }
 
 
-SecureServerSocket::SecureServerSocket(const SocketAddress& address, int backlog): 
+SecureServerSocket::SecureServerSocket(const SocketAddress& address, int backlog):
 	ServerSocket(new SecureServerSocketImpl(SSLManager::instance().defaultServerContext()), true)
 {
 	impl()->bind(address, true);
@@ -54,7 +54,7 @@ SecureServerSocket::SecureServerSocket(const SocketAddress& address, int backlog
 }
 
 
-SecureServerSocket::SecureServerSocket(const SocketAddress& address, int backlog, Context::Ptr pContext): 
+SecureServerSocket::SecureServerSocket(const SocketAddress& address, int backlog, Context::Ptr pContext):
 	ServerSocket(new SecureServerSocketImpl(pContext), true)
 {
 	impl()->bind(address, true);
@@ -62,7 +62,7 @@ SecureServerSocket::SecureServerSocket(const SocketAddress& address, int backlog
 }
 
 
-SecureServerSocket::SecureServerSocket(Poco::UInt16 port, int backlog): 
+SecureServerSocket::SecureServerSocket(Poco::UInt16 port, int backlog):
 	ServerSocket(new SecureServerSocketImpl(SSLManager::instance().defaultServerContext()), true)
 {
 	IPAddress wildcardAddr;
@@ -71,7 +71,7 @@ SecureServerSocket::SecureServerSocket(Poco::UInt16 port, int backlog):
 	impl()->listen(backlog);
 }
 
-SecureServerSocket::SecureServerSocket(Poco::UInt16 port, int backlog, Context::Ptr pContext): 
+SecureServerSocket::SecureServerSocket(Poco::UInt16 port, int backlog, Context::Ptr pContext):
 	ServerSocket(new SecureServerSocketImpl(pContext), true)
 {
 	IPAddress wildcardAddr;

vendor/POCO/NetSSL_OpenSSL/src/SecureSocketImpl.cpp

@@ -157,12 +157,10 @@ void SecureSocketImpl::connectSSL(bool performHandshake)
 	}
 	SSL_set_bio(_pSSL, pBIO, pBIO);
 
-#if OPENSSL_VERSION_NUMBER >= 0x0908060L && !defined(OPENSSL_NO_TLSEXT)
 	if (!_peerHostName.empty())
 	{
 		SSL_set_tlsext_host_name(_pSSL, _peerHostName.c_str());
 	}
-#endif
 
 #if OPENSSL_VERSION_NUMBER >= 0x10001000L
 	if(_pContext->ocspStaplingResponseVerificationEnabled())
@@ -255,7 +253,41 @@ void SecureSocketImpl::shutdown()
 			// most web browsers, so we just set the shutdown
 			// flag by calling SSL_shutdown() once and be
 			// done with it.
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+			int rc = 0;
+			if (!_bidirectShutdown)
+				rc = SSL_shutdown(_pSSL);
+			else
+			{
+				Poco::Timespan recvTimeout = _pSocket->getReceiveTimeout();
+				Poco::Timespan pollTimeout(0, 100000);
+				Poco::Timestamp tsNow;
+				do
+				{
+					rc = SSL_shutdown(_pSSL);
+					if (rc == 1) break;
+					if (rc < 0)
+					{
+						int err = SSL_get_error(_pSSL, rc);
+						if (err == SSL_ERROR_WANT_READ)
+							_pSocket->poll(pollTimeout, Poco::Net::Socket::SELECT_READ);
+						else if (err == SSL_ERROR_WANT_WRITE)
+							_pSocket->poll(pollTimeout, Poco::Net::Socket::SELECT_WRITE);
+						else
+						{
+							int socketError = SocketImpl::lastError();
+							long lastError = ERR_get_error();
+							if ((err == SSL_ERROR_SSL) && (socketError == 0) && (lastError == 0x0A000123))
+								rc = 0;
+							break;
+						}
+					}
+					else _pSocket->poll(pollTimeout, Poco::Net::Socket::SELECT_READ);
+				} while (!tsNow.isElapsed(recvTimeout.totalMicroseconds()));
+			}
+#else
 			int rc = SSL_shutdown(_pSSL);
+#endif
 			if (rc < 0) handleError(rc);
 			if (_pSocket->getBlocking())
 			{
@@ -279,6 +311,22 @@ void SecureSocketImpl::close()
 }
 
 
+void SecureSocketImpl::setBlocking(bool flag)
+{
+	poco_check_ptr (_pSocket);
+
+	_pSocket->setBlocking(flag);
+}
+
+
+bool SecureSocketImpl::getBlocking() const
+{
+	poco_check_ptr (_pSocket);
+
+	return _pSocket->getBlocking();
+}
+
+
 int SecureSocketImpl::sendBytes(const void* buffer, int length, int flags)
 {
 	poco_assert (_pSocket->initialized());
@@ -328,6 +376,7 @@ int SecureSocketImpl::receiveBytes(void* buffer, int length, int flags)
 		rc = SSL_read(_pSSL, buffer, length);
 	}
 	while (mustRetry(rc));
+	_bidirectShutdown = false;
 	if (rc <= 0)
 	{
 		return handleError(rc);
@@ -467,7 +516,7 @@ int SecureSocketImpl::handleError(int rc)
 	if (rc > 0) return rc;
 
 	int sslError = SSL_get_error(_pSSL, rc);
-	int error = SocketImpl::lastError();
+	int socketError = SocketImpl::lastError();
 
 	switch (sslError)
 	{
@@ -483,16 +532,43 @@ int SecureSocketImpl::handleError(int rc)
 		// these should not occur
 		poco_bugcheck();
 		return rc;
+	// SSL_GET_ERROR(3ossl):
+	// On an unexpected EOF, versions before OpenSSL 3.0 returned
+	// SSL_ERROR_SYSCALL, nothing was added to the error stack, and
+	// errno was 0.  Since OpenSSL 3.0 the returned error is
+	// SSL_ERROR_SSL with a meaningful error on the error stack.
+	// However, we still need to check for socket errors in both
+	// cases with OpenSSL 3.0 or later.
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	case SSL_ERROR_SSL:
+		// fallthrough to handle socket errors first
+#endif
 	case SSL_ERROR_SYSCALL:
-		if (error != 0)
+		if (socketError)
 		{
-			SocketImpl::error(error);
+			SocketImpl::error(socketError);
 		}
 		// fallthrough
 	default:
 		{
 			long lastError = ERR_get_error();
+			std::string msg;
+			if (lastError)
+			{
+				char buffer[256];
+				ERR_error_string_n(lastError, buffer, sizeof(buffer));
+				msg = buffer;
+			}
+			// SSL_GET_ERROR(3ossl):
+			// On an unexpected EOF, versions before OpenSSL 3.0 returned
+			// SSL_ERROR_SYSCALL, nothing was added to the error stack, and
+			// errno was 0.  Since OpenSSL 3.0 the returned error is
+			// SSL_ERROR_SSL with a meaningful error on the error stack.
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+			if (sslError == SSL_ERROR_SSL)
+#else
 			if (lastError == 0)
+#endif
 			{
 				if (rc == 0)
 				{
@@ -500,22 +576,19 @@ int SecureSocketImpl::handleError(int rc)
 					if (_pContext->isForServerUse())
 						return 0;
 					else
-						throw SSLConnectionUnexpectedlyClosedException();
+						throw SSLConnectionUnexpectedlyClosedException(msg);
 				}
 				else if (rc == -1)
 				{
-					throw SSLConnectionUnexpectedlyClosedException();
+					throw SSLConnectionUnexpectedlyClosedException(msg);
 				}
 				else
 				{
 					SecureStreamSocketImpl::error(Poco::format("The BIO reported an error: %d", rc));
 				}
 			}
-			else
+			else if (lastError)
 			{
-				char buffer[256];
-				ERR_error_string_n(lastError, buffer, sizeof(buffer));
-				std::string msg(buffer);
 				throw SSLException(msg);
 			}
 		}

vendor/POCO/NetSSL_OpenSSL/src/SecureStreamSocket.cpp

@@ -26,33 +26,33 @@ namespace Poco {
 namespace Net {
 
 
-SecureStreamSocket::SecureStreamSocket(): 
+SecureStreamSocket::SecureStreamSocket():
 	StreamSocket(new SecureStreamSocketImpl(SSLManager::instance().defaultClientContext()))
 {
 }
 
 
-SecureStreamSocket::SecureStreamSocket(Context::Ptr pContext): 
+SecureStreamSocket::SecureStreamSocket(Context::Ptr pContext):
 	StreamSocket(new SecureStreamSocketImpl(pContext))
 {
 }
 
 
-SecureStreamSocket::SecureStreamSocket(Context::Ptr pContext, Session::Ptr pSession): 
+SecureStreamSocket::SecureStreamSocket(Context::Ptr pContext, Session::Ptr pSession):
 	StreamSocket(new SecureStreamSocketImpl(pContext))
 {
 	useSession(pSession);
 }
 
 
-SecureStreamSocket::SecureStreamSocket(const SocketAddress& address): 
+SecureStreamSocket::SecureStreamSocket(const SocketAddress& address):
 	StreamSocket(new SecureStreamSocketImpl(SSLManager::instance().defaultClientContext()))
 {
 	connect(address);
 }
 
 
-SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::string& hostName): 
+SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::string& hostName):
 	StreamSocket(new SecureStreamSocketImpl(SSLManager::instance().defaultClientContext()))
 {
 	static_cast<SecureStreamSocketImpl*>(impl())->setPeerHostName(hostName);
@@ -60,14 +60,14 @@ SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::
 }
 
 
-SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, Context::Ptr pContext): 
+SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, Context::Ptr pContext):
 	StreamSocket(new SecureStreamSocketImpl(pContext))
 {
 	connect(address);
 }
 
 
-SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, Context::Ptr pContext, Session::Ptr pSession): 
+SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, Context::Ptr pContext, Session::Ptr pSession):
 	StreamSocket(new SecureStreamSocketImpl(pContext))
 {
 	useSession(pSession);
@@ -75,7 +75,7 @@ SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, Context::Pt
 }
 
 
-SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::string& hostName, Context::Ptr pContext): 
+SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::string& hostName, Context::Ptr pContext):
 	StreamSocket(new SecureStreamSocketImpl(pContext))
 {
 	static_cast<SecureStreamSocketImpl*>(impl())->setPeerHostName(hostName);
@@ -83,7 +83,7 @@ SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::
 }
 
 
-SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::string& hostName, Context::Ptr pContext, Session::Ptr pSession): 
+SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::string& hostName, Context::Ptr pContext, Session::Ptr pSession):
 	StreamSocket(new SecureStreamSocketImpl(pContext))
 {
 	static_cast<SecureStreamSocketImpl*>(impl())->setPeerHostName(hostName);
@@ -92,7 +92,7 @@ SecureStreamSocket::SecureStreamSocket(const SocketAddress& address, const std::
 }
 
 
-SecureStreamSocket::SecureStreamSocket(const Socket& socket): 
+SecureStreamSocket::SecureStreamSocket(const Socket& socket):
 	StreamSocket(socket)
 {
 	if (!dynamic_cast<SecureStreamSocketImpl*>(impl()))
@@ -100,7 +100,7 @@ SecureStreamSocket::SecureStreamSocket(const Socket& socket):
 }
 
 
-SecureStreamSocket::SecureStreamSocket(SocketImpl* pImpl): 
+SecureStreamSocket::SecureStreamSocket(SocketImpl* pImpl):
 	StreamSocket(pImpl)
 {
 	if (!dynamic_cast<SecureStreamSocketImpl*>(impl()))
@@ -140,7 +140,7 @@ void SecureStreamSocket::setPeerHostName(const std::string& hostName)
 	static_cast<SecureStreamSocketImpl*>(impl())->setPeerHostName(hostName);
 }
 
-	
+
 const std::string& SecureStreamSocket::getPeerHostName() const
 {
 	return static_cast<SecureStreamSocketImpl*>(impl())->getPeerHostName();
@@ -235,7 +235,7 @@ void SecureStreamSocket::setLazyHandshake(bool flag)
 	static_cast<SecureStreamSocketImpl*>(impl())->setLazyHandshake(flag);
 }
 
-	
+
 bool SecureStreamSocket::getLazyHandshake() const
 {
 	return static_cast<SecureStreamSocketImpl*>(impl())->getLazyHandshake();
@@ -265,13 +265,13 @@ Session::Ptr SecureStreamSocket::currentSession()
 	return static_cast<SecureStreamSocketImpl*>(impl())->currentSession();
 }
 
-	
+
 void SecureStreamSocket::useSession(Session::Ptr pSession)
 {
 	static_cast<SecureStreamSocketImpl*>(impl())->useSession(pSession);
 }
 
-	
+
 bool SecureStreamSocket::sessionWasReused()
 {
 	return static_cast<SecureStreamSocketImpl*>(impl())->sessionWasReused();

vendor/POCO/NetSSL_OpenSSL/src/SecureStreamSocketImpl.cpp

@@ -74,7 +74,7 @@ void SecureStreamSocketImpl::connect(const SocketAddress& address, const Poco::T
 	_impl.connect(address, timeout, !_lazyHandshake);
 	reset(_impl.sockfd());
 }
-	
+
 
 void SecureStreamSocketImpl::connectNB(const SocketAddress& address)
 {
@@ -87,19 +87,19 @@ void SecureStreamSocketImpl::connectSSL()
 {
 	_impl.connectSSL(!_lazyHandshake);
 }
-	
+
 
 void SecureStreamSocketImpl::bind(const SocketAddress& address, bool reuseAddress)
 {
 	throw Poco::InvalidAccessException("Cannot bind() a SecureStreamSocketImpl");
 }
 
-	
+
 void SecureStreamSocketImpl::listen(int backlog)
 {
 	throw Poco::InvalidAccessException("Cannot listen() on a SecureStreamSocketImpl");
 }
-	
+
 
 void SecureStreamSocketImpl::close()
 {
@@ -155,12 +155,12 @@ void SecureStreamSocketImpl::shutdownReceive()
 {
 }
 
-	
+
 void SecureStreamSocketImpl::shutdownSend()
 {
 }
 
-	
+
 void SecureStreamSocketImpl::shutdown()
 {
 	_impl.shutdown();
@@ -200,7 +200,7 @@ void SecureStreamSocketImpl::setLazyHandshake(bool flag)
 	_lazyHandshake = flag;
 }
 
-	
+
 bool SecureStreamSocketImpl::getLazyHandshake() const
 {
 	return _lazyHandshake;

vendor/POCO/NetSSL_OpenSSL/src/Session.cpp

@@ -14,7 +14,7 @@
 
 #if defined(__APPLE__)
 // Some OpenSSL functions are deprecated in OS X 10.7
-#pragma GCC diagnostic ignored "-Wdeprecated-declarations" 
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 #endif
 
 

vendor/POCO/NetSSL_OpenSSL/src/Utility.cpp

@@ -15,6 +15,7 @@
 #include "Poco/Net/Utility.h"
 #include "Poco/String.h"
 #include "Poco/Util/OptionException.h"
+#include "Poco/Crypto/Crypto.h"
 #include <openssl/err.h>
 
 
@@ -51,14 +52,9 @@ std::string Utility::convertCertificateError(long errCode)
 
 std::string Utility::getLastError()
 {
-	unsigned long errCode = ERR_get_error();
-	if (errCode != 0)
-	{
-		char buffer[256];
-		ERR_error_string_n(errCode, buffer, sizeof(buffer));
-		return std::string(buffer);
-	}
-	else return "No error";
+	std::string msg;
+	Poco::Crypto::getError(msg);
+	return msg;
 }