Log detailed openssl error also for digests failures

Make output still only shown in verbose detail. But provide openssl
error details to make a reason more obvious.

Author: pemensik

validator/val_secalgo.c

@@ -97,6 +97,23 @@ log_crypto_error(const char* str, unsigned long e)
 	log_err("%s crypto %s", str, buf);
 }
 
+/**
+ * Output a libcrypto openssl error to the logfile as a debug message.
+ * @param level: debug level to use in verbose() call
+ * @param str: string to add to it.
+ * @param e: the error to output, error number from ERR_get_error().
+ */
+static void
+log_crypto_verbose(enum verbosity_value level, const char str, unsigned long e)
+{
+	char buf[128];
+	/* or use ERR_error_string if ERR_error_string_n is not avail TODO */
+	ERR_error_string_n(e, buf, sizeof(buf));
+	/* buf now contains */
+	/* error:[error code]:[library name]:[function name]:[reason string] */
+	verbose(level, "%s crypto %s", str, buf);
+}
+
 /* return size of digest if supported, or 0 otherwise */
 size_t
 nsec3_hash_algo_size_supported(int id)
@@ -763,14 +780,16 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 #ifndef HAVE_EVP_DIGESTVERIFY
 	if(EVP_DigestInit(ctx, digest_type) == 0) {
 		enum sec_status sec = digest_error_status();
-		verbose(VERB_QUERY, "verify: EVP_DigestInit failed");
+		log_crypto_verbose(VERB_QUERY, "verify: EVP_DigestInit failed",
+				   ERR_get_error());
 		digest_ctx_free(ctx, evp_key, sigblock,
 				dofree, docrypto_free);
 		return sec;
 	}
 	if(EVP_DigestUpdate(ctx, (unsigned char*)sldns_buffer_begin(buf), 
 		(unsigned int)sldns_buffer_limit(buf)) == 0) {
-		verbose(VERB_QUERY, "verify: EVP_DigestUpdate failed");
+		log_crypto_verbose(VERB_QUERY, "verify: EVP_DigestUpdate failed",
+				   ERR_get_error());
 		digest_ctx_free(ctx, evp_key, sigblock,
 				dofree, docrypto_free);
 		return sec_status_unchecked;
@@ -780,7 +799,8 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 #else /* HAVE_EVP_DIGESTVERIFY */
 	if(EVP_DigestVerifyInit(ctx, NULL, digest_type, NULL, evp_key) == 0) {
 		enum sec_status sec = digest_error_status();
-		verbose(VERB_QUERY, "verify: EVP_DigestVerifyInit failed");
+		log_crypto_verbose(VERB_QUERY, "verify: EVP_DigestVerifyInit failed",
+				   ERR_get_error());
 		digest_ctx_free(ctx, evp_key, sigblock,
 				dofree, docrypto_free);
 		return sec;