From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58090) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anWja-0008QU-Cq for qemu-devel@nongnu.org; Tue, 05 Apr 2016 15:33:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1anWjV-0002ko-D3 for qemu-devel@nongnu.org; Tue, 05 Apr 2016 15:33:54 -0400 Received: from mail.avalus.com ([89.16.176.221]:38552) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anWjV-0002kc-6P for qemu-devel@nongnu.org; Tue, 05 Apr 2016 15:33:49 -0400 From: Alex Bligh Date: Tue, 5 Apr 2016 20:33:48 +0100 Message-Id: <1459884828-25902-1-git-send-email-alex@alex.org.uk> Subject: [Qemu-devel] [PATCH] TLS: provide slightly more information when TLS certificate loading fails List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" , Paolo Bonzini , Kevin Wolf , Eric Blake , "qemu-devel@nongnu.org" Cc: Wouter Verhelst , Alex Bligh Give slightly more information when certification loading fails. Rather than have no information, you now get gnutls's only slightly less unhelpful error messages. Signed-off-by: Alex Bligh --- crypto/tlscredsx509.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index 6a0179c..520d34d 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -392,11 +392,14 @@ qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds, gsize buflen; GError *gerr; int ret = -1; + int err; trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile); - if (gnutls_x509_crt_init(&cert) < 0) { - error_setg(errp, "Unable to initialize certificate"); + err = gnutls_x509_crt_init(&cert); + if (err < 0) { + error_setg(errp, "Unable to initialize certificate: %s", + gnutls_strerror(err)); goto cleanup; } @@ -410,11 +413,13 @@ qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds, data.data = (unsigned char *)buf; data.size = strlen(buf); - if (gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM) < 0) { + err = gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM); + if (err < 0) { error_setg(errp, isServer ? - "Unable to import server certificate %s" : - "Unable to import client certificate %s", - certFile); + "Unable to import server certificate %s: %s" : + "Unable to import client certificate %s: %s", + certFile, + gnutls_strerror(err)); goto cleanup; } -- 1.9.1