CA-404460: Expose Stunnel_verify_error for corrupted certificate

Xapi uses stunnel to connect to remote peer and exposes certificate
verify error by parsing stunnel logs. And when connecting with a
corrupted certificate, the log from stunnel would be:

Initializing inetd mode configuration
Clients allowed=500
stunnel 5.60 on x86_64-koji-linux-gnu platform
Compiled/running with OpenSSL 3.0.9 30 May 2023
Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI Auth:LIBWRAP
errno: (*__errno_location ())
Initializing inetd mode configuration
Reading configuration from descriptor 8
UTF-8 byte order mark not detected
FIPS mode disabled
No PRNG seeding was required
stunnel default security level set: 2
Ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256
TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256
TLS options: 0x02100000 (+0x00000000, -0x00000000)
Session resumption enabled
No certificate or private key specified
error queue: crypto/x509/by_file.c:234: error:05880009:x509 certificate routines::PEM lib
error queue: crypto/pem/pem_info.c:169: error:0488000D:PEM routines::ASN1 lib
error queue: crypto/asn1/tasn_dec.c:349: error:0688010A:asn1 encoding routines::nested asn1 error
error queue: crypto/asn1/tasn_dec.c:1178: error:06800066:asn1 encoding routines::bad object header
SSL_CTX_load_verify_locations: crypto/asn1/asn1_lib.c:95: error:0680009B:asn1 encoding routines::too long
Inetd mode: Failed to initialize TLS context
Configuration failed
Deallocating temporary section defaults

This commit exposes Stunnel_verify_error by checking
"No certificate or private key specified" in the log, and expose it with
reason "The specified certificate is corrupt".

And the log "No certificate or private key specified" comes from
stunnel:
https://github.com/mtrojnar/stunnel/blob/9f291d5ba27f0fa45353ae87cf9ac5f05401b012/src/ctx.c#L690

    /* load the certificate and private key */
    if(!section->cert || !section->key) {
        s_log(LOG_DEBUG, "No certificate or private key specified");
        return 0; /* OK */
    }

Signed-off-by: Gang Ji <[email protected]>

Author: gangj

ocaml/libs/stunnel/stunnel.ml

@@ -497,6 +497,11 @@ let check_verify_error line =
           )
     | None ->
         raise (Stunnel_verify_error "")
+  else if
+    Astring.String.is_infix ~affix:"No certificate or private key specified"
+      line
+  then
+    raise (Stunnel_verify_error "The specified certificate is corrupt")
   else
     ()