diff options
| author | Martin Willi <martin@revosec.ch> | 2013-02-26 12:26:31 +0100 |
|---|---|---|
| committer | Martin Willi <martin@revosec.ch> | 2013-02-26 13:15:27 +0100 |
| commit | cc787697b8f9cb2bc1480c8e43631e585bb28be7 (patch) | |
| tree | c2715e9753496701e8dd203fe6f20f4c608c5054 | |
| parent | 289b9b7b31bfc8acda4b8d6964446f1ea293904f (diff) | |
| download | strongswan-cc787697b8f9cb2bc1480c8e43631e585bb28be7.tar.bz2 strongswan-cc787697b8f9cb2bc1480c8e43631e585bb28be7.tar.xz | |
Be a little more verbose why a peer_cfg is inacceptable
| -rw-r--r-- | src/libcharon/sa/ikev2/tasks/ike_auth.c | 24 |
1 files changed, 16 insertions, 8 deletions
diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth.c b/src/libcharon/sa/ikev2/tasks/ike_auth.c index b6e4745c4..970e38cf5 100644 --- a/src/libcharon/sa/ikev2/tasks/ike_auth.c +++ b/src/libcharon/sa/ikev2/tasks/ike_auth.c @@ -319,7 +319,7 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict) { if (this->peer_cfg) { - bool complies = TRUE; + char *comply_error = NULL; enumerator_t *e1, *e2, *tmp; auth_cfg_t *c1, *c2; @@ -336,22 +336,30 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict) while (e1->enumerate(e1, &c1)) { /* check if done authentications comply to configured ones */ - if ((!e2->enumerate(e2, &c2)) || - (!strict && !c1->complies(c1, c2, TRUE)) || - (strict && !c2->complies(c2, c1, TRUE))) + if (!e2->enumerate(e2, &c2)) { - complies = FALSE; + comply_error = "insufficient authentication rounds"; + break; + } + if (!strict && !c1->complies(c1, c2, TRUE)) + { + comply_error = "non-matching authentication done"; + break; + } + if (strict && !c2->complies(c2, c1, TRUE)) + { + comply_error = "constraint checking failed"; break; } } e1->destroy(e1); e2->destroy(e2); - if (complies) + if (!comply_error) { break; } - DBG1(DBG_CFG, "selected peer config '%s' inacceptable", - this->peer_cfg->get_name(this->peer_cfg)); + DBG1(DBG_CFG, "selected peer config '%s' inacceptable: %s", + this->peer_cfg->get_name(this->peer_cfg), comply_error); this->peer_cfg->destroy(this->peer_cfg); } if (this->candidates->remove_first(this->candidates, |