Re: linux-ipsec: Bad Error message

> > Reporting exactly which key it happened on is a little tricky. Either spi

I think you've missed the point slightly, although my wording was a bit vague. When ipsec-manual is invoking spi *more than once*, how does the user tell which invocation caused the problem? Being specific about the exact source of spi's dissatisfaction is not really enough, because the question "which invocation of spi?" remains.

In principle one can provide enough information to disambiguate, but in practice I think it is harder than it looks. The error messages should not contain actual key text, for obvious reasons, and in any case, neither the key text nor the SA ID is all that meaningful to an unsophisticated user -- they become meaningful only with careful detective work. What is wanted, I think, is to tag the messages with a "which SA is this about" string optimized for human readability.

                                                          Henry Spencer
                                                       henry@spsystems.net
                                                     (henry@zoo.toronto.edu)