Merge pull request #2774 from reaperhulk/improve-unknown-error

improve the messages from openssl InternalError

2 files changed, 50 insertions, 5 deletions

diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py
index b2215de3..5d7466f9 100644
--- a/src/cryptography/hazmat/bindings/openssl/binding.py
+++ b/src/cryptography/hazmat/bindings/openssl/binding.py
@@ -17,6 +17,9 @@ from cryptography.hazmat.bindings.openssl._conditional import CONDITIONAL_NAMES
 
 _OpenSSLError = collections.namedtuple("_OpenSSLError",
                                        ["code", "lib", "func", "reason"])
+_OpenSSLErrorWithText = collections.namedtuple(
+    "_OpenSSLErrorWithText", ["code", "lib", "func", "reason", "reason_text"]
+)
 
 
 def _consume_errors(lib):
@@ -31,17 +34,33 @@ def _consume_errors(lib):
         err_reason = lib.ERR_GET_REASON(code)
 
         errors.append(_OpenSSLError(code, err_lib, err_func, err_reason))
+
     return errors
 
 
 def _openssl_assert(lib, ok):
     if not ok:
         errors = _consume_errors(lib)
+        errors_with_text = []
+        for err in errors:
+            err_text_reason = ffi.string(
+                lib.ERR_error_string(err.code, ffi.NULL)
+            )
+            errors_with_text.append(
+                _OpenSSLErrorWithText(
+                    err.code, err.lib, err.func, err.reason, err_text_reason
+                )
+            )
+
         raise InternalError(
-            "Unknown OpenSSL error. Please file an issue at https://github.com"
-            "/pyca/cryptography/issues with information on how to reproduce "
-            "this. ({0!r})".format(errors),
-            errors
+            "Unknown OpenSSL error. This error is commonly encountered when "
+            "another library is not cleaning up the OpenSSL error stack. If "
+            "you are using cryptography with another library that uses "
+            "OpenSSL try disabling it before reporting a bug. Otherwise "
+            "please file an issue at https://github.com/pyca/cryptography/"
+            "issues with information on how to reproduce "
+            "this. ({0!r})".format(errors_with_text),
+            errors_with_text
         )
 
 
diff --git a/tests/hazmat/bindings/test_openssl.py b/tests/hazmat/bindings/test_openssl.py
index 76a9218b..457799d3 100644
--- a/tests/hazmat/bindings/test_openssl.py
+++ b/tests/hazmat/bindings/test_openssl.py
@@ -6,7 +6,10 @@ from __future__ import absolute_import, division, print_function
 
 import pytest
 
-from cryptography.hazmat.bindings.openssl.binding import Binding
+from cryptography.exceptions import InternalError
+from cryptography.hazmat.bindings.openssl.binding import (
+    Binding, _OpenSSLErrorWithText, _openssl_assert
+)
 
 
 class TestOpenSSL(object):
@@ -149,3 +152,26 @@ class TestOpenSSL(object):
         else:
             with pytest.raises(AttributeError):
                 b.lib.CMAC_Init
+
+    def test_openssl_assert_error_on_stack(self):
+        b = Binding()
+        b.lib.ERR_put_error(
+            b.lib.ERR_LIB_EVP,
+            b.lib.EVP_F_EVP_ENCRYPTFINAL_EX,
+            b.lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH,
+            b"",
+            -1
+        )
+        with pytest.raises(InternalError) as exc_info:
+            _openssl_assert(b.lib, False)
+
+        assert exc_info.value.err_code == [_OpenSSLErrorWithText(
+            code=101183626,
+            lib=b.lib.ERR_LIB_EVP,
+            func=b.lib.EVP_F_EVP_ENCRYPTFINAL_EX,
+            reason=b.lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH,
+            reason_text=(
+                b'error:0607F08A:digital envelope routines:EVP_EncryptFinal_'
+                b'ex:data not multiple of block length'
+            )
+        )]