From: Razvan Cojocaru <[email protected]>
CRYPT_ERROR() jumps to error_exit, so the hint about a client key
generated for a different server key was never printed. Log it first,
and drop a stray ')' from it.
Broken since 7a477c16 ("Print a more user-friendly error when
tls-crypt-v2 client auth fails").
Change-Id: Icab02b28773a409821fa9b80ccb1560d2796d1df
Signed-off-by: Razvan Cojocaru <[email protected]>
Acked-by: Frank Lichtenheld <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2117
---
This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2117
This mail reflects revision 1 of this Change.
Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <[email protected]>
diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c
index 99e2411..e769190 100644
--- a/src/openvpn/tls_crypt.c
+++ b/src/openvpn/tls_crypt.c
@@ -488,9 +488,9 @@
{
dmsg(D_CRYPTO_DEBUG, "tag : %s", format_hex(tag,
sizeof(tag_check), 0, &gc));
dmsg(D_CRYPTO_DEBUG, "tag_check: %s", format_hex(tag_check,
sizeof(tag_check), 0, &gc));
- CRYPT_ERROR("client key authentication error");
msg(D_TLS_DEBUG_LOW, "This might be a client-key that was generated
for "
- "a different tls-crypt-v2 server key)");
+ "a different tls-crypt-v2 server key");
+ CRYPT_ERROR("client key authentication error");
}
if (BLENZ(&plaintext) < sizeof(client_key->keys))
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
