diff mbox series

[Openvpn-devel,v1] tls_crypt: print tls-crypt-v2 client key hint before CRYPT_ERROR

Message ID 20261104122103.15637-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] tls_crypt: print tls-crypt-v2 client key hint before CRYPT_ERROR |

Commit Message

Gert Doering Nov. 4, 2026, 12:20 p.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

CRYPT_ERROR() jumps to error_exit, so the hint about a client key
generated for a different server key was never printed. Log it first,
and drop a stray ')' from it.

Broken since 7a477c16 ("Print a more user-friendly error when
tls-crypt-v2 client auth fails").

Change-Id: Icab02b28773a409821fa9b80ccb1560d2796d1df
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2117
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2117
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <frank@lichtenheld.com>
diff mbox series

Patch

diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c
index 99e2411..e769190 100644
--- a/src/openvpn/tls_crypt.c
+++ b/src/openvpn/tls_crypt.c
@@ -488,9 +488,9 @@ 
     {
         dmsg(D_CRYPTO_DEBUG, "tag      : %s", format_hex(tag, sizeof(tag_check), 0, &gc));
         dmsg(D_CRYPTO_DEBUG, "tag_check: %s", format_hex(tag_check, sizeof(tag_check), 0, &gc));
-        CRYPT_ERROR("client key authentication error");
         msg(D_TLS_DEBUG_LOW, "This might be a client-key that was generated for "
-                             "a different tls-crypt-v2 server key)");
+                             "a different tls-crypt-v2 server key");
+        CRYPT_ERROR("client key authentication error");
     }
 
     if (BLENZ(&plaintext) < sizeof(client_key->keys))