CA-404460: Expose Stunnel_verify_error for mismatched certificate

Xapi uses stunnel to connect to remote peer and exposes certificate
verify error by parsing stunnel logs. And when connect with a
mismatched certificate, the log from stunnel would be:

stunnel 5.60 on x86_64-koji-linux-gnu platform
Compiled/running with OpenSSL 3.0.9 30 May 2023
Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,SNI Auth:LIBWRAP
Reading configuration from descriptor 8
UTF-8 byte order mark not detected
FIPS mode disabled
Configuration successful
Service [stunnel] accepted connection from unnamed socket
s_connect: connected 10.63.96.116:443
Service [stunnel] connected remote server from 10.63.97.76:34138
CERT: Pre-verification error: self-signed certificate
Rejected by CERT at depth=0: CN=10.63.96.116
SSL_connect: ssl/statem/statem_clnt.c:1889: error:0A000086:SSL routines::certificate verify failed
Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket

This commit fixes the exposing of Stunnel_verify_error by checking
"certificate verify failed" in the log, and expose it with reason
"0A000086:SSL routines::certificate verify failed".

We can find that the log "VERIFY ERROR" is not print by stunnel 5.60,
which is the version of stunnel used in XS now, but it indeed was
printed before:

20d6d2faf740ee5eb9b13752b076ee583fec94d8:src/verify.c:        s_log(LOG_WARNING, "VERIFY ERROR: depth=%d, error=%s: %s",

[gangj@xenrt10715872 stunnel]$ git branch --contains 20d6d2faf740ee5eb9b13752b076ee583fec94d8
  master
* private/gangj/stunnel-5.60

While we can find the log "certificate verify failed" which comes from
openssl library:
https://github.com/openssl/openssl/blob/openssl-3.0.9/ssl/ssl_err.c

    {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_CERTIFICATE_VERIFY_FAILED),
    "certificate verify failed"},

Signed-off-by: Gang Ji <[email protected]>

Author: gangj

ocaml/libs/stunnel/stunnel.ml

@@ -483,12 +483,17 @@ let check_verify_error line =
   let split_1 c s =
     match Astring.String.cut ~sep:c s with Some (x, _) -> x | None -> s
   in
-  if Astring.String.is_infix ~affix:"VERIFY ERROR: " line then
-    match Astring.String.find_sub ~sub:"error=" line with
+  (* When verified with a mismatched certificate, one line of log from stunnel
+   * would look like:
+     SSL_connect: ssl/statem/statem_clnt.c:1889: error:0A000086:SSL routines::certificate verify failed
+   * in this case, Stunnel_verify_error can be raised with detailed error as
+   * reason if it can found in the log *)
+  if Astring.String.is_infix ~affix:"certificate verify failed" line then
+    match Astring.String.find_sub ~sub:"error:" line with
     | Some e ->
         raise
           (Stunnel_verify_error
-             (split_1 "," (sub_after (e + String.length "error=") line))
+             (split_1 "," (sub_after (e + String.length "error:") line))
           )
     | None ->
         raise (Stunnel_verify_error "")