Re: linux-ipsec: Bad Error message

> ...now that we have left/right/unity keys I need to know which key

(For those who are not sure what's going on here: there were some hasty additions to "ipsec manual" to support the Binghamton interop last week, including provisions for asymmetric keying, so that a bidirectional pair of SAs can have different keys.)

More detailed reporting of what went wrong (X bytes out of Y) is Richard's department, and would not seem difficult.

Reporting exactly which key it happened on is a little tricky. Either spi needs to include some sort of identifier in its messages, or ipsec-manual has to intercept the messages and add information to them.

Interception at first seems more appealing, but I fear it will complicate the script that ipsec-manual generates to the point of unreadability. The script is already fairly substantial, but I've made efforts to keep it halfway readable, and I think that's a good thing, both for debugging and for people with special needs (who can custom-modify a skeleton supplied by ipsec-manual). Fitting error interception in looks messy.

The alternative would be to give spi an option specifying a string to be included in error reports. (Just including the SA identifier would be better than nothing, but wouldn't be as informative as a string intended to be human-readable, e.g. "leftward AH".)

Suggestions welcome (especially if I've missed a third way).

                                                          Henry Spencer
                                                       henry@spsystems.net
                                                     (henry@zoo.toronto.edu)