improve diagnostic output

rfm · rfm · commit 4ca6f1b50a48 · 2026-05-18T10:13:48.000+01:00
diff --git a/Source/GSTLS.m b/Source/GSTLS.m
@@ -1192,7 +1192,7 @@ + (GSTLSCredentials*) credentialsFromCAFile: (NSString*)ca
   if (nil != c)
     {
       [c retain];
-      if (YES == debug)
+      if (debug)
         {
           NSLog(@"Re-used credentials %p for '%@'", c, k);
         }
@@ -1306,7 +1306,7 @@ + (GSTLSCredentials*) credentialsFromCAFile: (NSString*)ca
                 {
                   NSLog(@"No certificates processed from %@", ca);
                 }
-              if (YES == debug)
+              if (debug)
                 {
                   NSLog(@"Trusted authorities (from %@): %d", ca, ret);
                 }
@@ -1330,7 +1330,7 @@ + (GSTLSCredentials*) credentialsFromCAFile: (NSString*)ca
             }
           else
             {
-              if (YES == debug)
+              if (debug)
                 {
                   NSLog(@"Default revocations (from %@): %d", drv, ret);
                 }
@@ -1358,7 +1358,7 @@ + (GSTLSCredentials*) credentialsFromCAFile: (NSString*)ca
                 {
                   NSLog(@"No revocations processed from %@", rv);
                 }
-              if (YES == debug)
+              if (debug)
                 {
                   NSLog(@"Revocations (from %@): %d", rv, ret);
                 }
@@ -1418,7 +1418,7 @@ + (GSTLSCredentials*) credentialsFromCAFile: (NSString*)ca
 */
         }
 
-      if (YES == debug)
+      if (debug)
         {
           NSLog(@"%@ created credentials %p for '%@'", self, c, k);
         }
@@ -1725,7 +1725,7 @@ - (id) initWithOptions: (NSDictionary*)options
               int               ret;
 
               ret = gnutls_server_name_set(session, GNUTLS_NAME_DNS, ptr, len);
-              if (YES == debug)
+              if (debug)
                 {
                   if (ret < 0)
                     {
@@ -1739,7 +1739,7 @@ - (id) initWithOptions: (NSDictionary*)options
                     }
                 }
             }
-          else if (YES == debug)
+          else if (debug)
             {
               NSLog(@"%p %@: not set", handle, GSTLSServerName);
             }
@@ -1922,7 +1922,7 @@ - (id) initWithOptions: (NSDictionary*)options
         [credentials credentials]);
 
 #if GNUTLS_VERSION_NUMBER >= 0x020C00
-      if (YES == outgoing && YES == debug)
+      if (YES == outgoing && debug)
         {
           /* Set a callback to log handling of a request (from the server)
            * for the client certificate.  The callback always returns the
@@ -2000,7 +2000,7 @@ - (BOOL) handshake
 		  p = [p stringByAppendingFormat: @"\n%@", extra];
 		}
               ASSIGN(problem, p);
-              if (YES == debug)
+              if (debug)
                 {
                   NSLog(@"%p in handshake: %@", handle, p);
                 }
@@ -2134,7 +2134,7 @@ - (NSInteger) read: (void*)buf length: (NSUInteger)len
         {
           p = [NSString stringWithFormat: @"%s", gnutls_strerror(result)];
           ASSIGN(problem, p);
-          if (YES == debug)
+          if (debug)
             {
               NSLog(@"%p in tls read: %@", handle, p);
             }
@@ -2147,7 +2147,7 @@ - (NSInteger) read: (void*)buf length: (NSUInteger)len
         {
           if (GNUTLS_E_WARNING_ALERT_RECEIVED == result)
             {
-              if (YES == debug)
+              if (debug)
                 {
                   p = [NSString stringWithFormat: @"%s",
                     gnutls_alert_get_name(gnutls_alert_get(session))];
@@ -2192,7 +2192,7 @@ - (NSInteger) write: (const void*)buf length: (NSUInteger)len
 
           p = [NSString stringWithFormat: @"%s", gnutls_strerror(result)];
           ASSIGN(problem, p);
-          if (YES == debug)
+          if (debug)
             {
               NSLog(@"%p in tls write: %@", handle, p);
             }
@@ -2239,6 +2239,16 @@ - (NSString*) sessionInfo
 
   str = [NSMutableString stringWithCapacity: 2000];
 
+  if (outgoing)
+    {
+      [str appendFormat: @"outgoing session %p to '%@'\n",
+	self, [self hostName]];
+    }
+  else
+    {
+      [str appendFormat: @"incoming session %p\n", self];
+    }
+
   /* get the key exchange's algorithm name
    */
   kx = gnutls_kx_get(session);
@@ -2433,35 +2443,44 @@ - (int) verify
       str = [NSString stringWithFormat:
         @"TLS verification: error %s", gnutls_strerror(ret)];
       ASSIGN(problem, str);
-      if (YES == debug) NSLog(@"%p %@", handle, problem);
+      if (debug) NSLog(@"%p %@", handle, problem);
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
-  if (YES == debug)
-    {
-      if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
-        NSLog(@"%p TLS verification: certificate hasn't got a known issuer.",
-          handle);
+  str = @"";
+  if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
+    str = [str stringByAppendingString:
+      @", certificate hasn't got a known issuer"];
 
-      if (status & GNUTLS_CERT_REVOKED)
-        NSLog(@"%p TLS verification: certificate has been revoked.", handle);
+  if (status & GNUTLS_CERT_REVOKED)
+    str = [str stringByAppendingString:
+      @", certificate has been revoked"];
 
 #if     defined(GNUTLS_CERT_EXPIRED)
-      if (status & GNUTLS_CERT_EXPIRED)
-        NSLog(@"%p TLS verification: certificate has expired", handle);
+  if (status & GNUTLS_CERT_EXPIRED)
+    str = [str stringByAppendingString:
+      @", certificate has expired"];
 #endif
 
 #if     defined(GNUTLS_CERT_NOT_ACTIVATED)
-      if (status & GNUTLS_CERT_NOT_ACTIVATED)
-        NSLog(@"%p TLS verification: certificate is not yet activated", handle);
+  if (status & GNUTLS_CERT_NOT_ACTIVATED)
+    str = [str stringByAppendingString:
+      @", certificate is not yet activated"];
 #endif
-    }
 
   if (status & GNUTLS_CERT_INVALID)
     {
-      ASSIGN(problem,
-        @"TLS verification: remote certificate is not trusted.");
-      if (YES == debug) NSLog(@"%p %@", handle, problem);
+      if ([str length])
+	{
+          str = [NSString stringWithFormat:
+	    @"TLS verification: remote certificate is not trusted%@.", str];
+	}
+      else
+	{
+	  str = @"TLS verification: remote certificate is not trusted.";
+	}
+      ASSIGN(problem, str);
+      if (debug) NSLog(@"%p %@", handle, problem);
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
@@ -2473,15 +2492,15 @@ - (int) verify
     {
       ASSIGN(problem,
         @"TLS verification: remote certificate not of the X509 type.");
-      if (YES == debug) NSLog(@"%p %@", handle, problem);
+      if (debug) NSLog(@"%p %@", handle, problem);
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
   if (gnutls_x509_crt_init(&cert) < 0)
     {
       ASSIGN(problem, @"TLS verification: error in certificate initialization");
       gnutls_x509_crt_deinit(cert);
-      if (YES == debug) NSLog(@"%p %@", handle, problem);
+      if (debug) NSLog(@"%p %@", handle, problem);
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
@@ -2490,15 +2509,15 @@ - (int) verify
     {
       ASSIGN(problem, @"TLS verification: no certificate from remote end!");
       gnutls_x509_crt_deinit(cert);
-      if (YES == debug) NSLog(@"%p %@", handle, problem);
+      if (debug) NSLog(@"%p %@", handle, problem);
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
 
   if (gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0)
     {
       ASSIGN(problem, @"TLS verification: error parsing certificate");
       gnutls_x509_crt_deinit(cert);
-      if (YES == debug) NSLog(@"%p %@", handle, problem);
+      if (debug) NSLog(@"%p %@", handle, problem);
       return GNUTLS_E_CERTIFICATE_ERROR;
     }
   else
@@ -2586,7 +2605,7 @@ - (int) verify
             nameList, ci];
           ASSIGN(problem, str);
           gnutls_x509_crt_deinit(cert);
-          if (YES == debug) NSLog(@"%p %@", handle, problem);
+          if (debug) NSLog(@"%p %@", handle, problem);
           return GNUTLS_E_CERTIFICATE_ERROR;
         }
     }
@@ -2601,7 +2620,7 @@ - (int) verify
             names, ci];
           ASSIGN(problem, str);
 	  gnutls_x509_crt_deinit(cert);
-          if (YES == debug) NSLog(@"%p %@", handle, problem);
+          if (debug) NSLog(@"%p %@", handle, problem);
           return GNUTLS_E_CERTIFICATE_ERROR;
         }
     }
@@ -2616,7 +2635,7 @@ - (int) verify
             names, ci];
           ASSIGN(problem, str);
 	  gnutls_x509_crt_deinit(cert);
-          if (YES == debug) NSLog(@"%p %@", handle, problem);
+          if (debug) NSLog(@"%p %@", handle, problem);
           return GNUTLS_E_CERTIFICATE_ERROR;
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -1192,7 +1192,7 @@ + (GSTLSCredentials) credentialsFromCAFile: (NSString)ca`
`1192`	`1192`	`if (nil != c)`
`1193`	`1193`	`{`
`1194`	`1194`	`[c retain];`
`1195`		`- if (YES == debug)`
	`1195`	`+ if (debug)`
`1196`	`1196`	`{`
`1197`	`1197`	`NSLog(@"Re-used credentials %p for '%@'", c, k);`
`1198`	`1198`	`}`
`@@ -1306,7 +1306,7 @@ + (GSTLSCredentials) credentialsFromCAFile: (NSString)ca`
`1306`	`1306`	`{`
`1307`	`1307`	`NSLog(@"No certificates processed from %@", ca);`
`1308`	`1308`	`}`
`1309`		`- if (YES == debug)`
	`1309`	`+ if (debug)`
`1310`	`1310`	`{`
`1311`	`1311`	`NSLog(@"Trusted authorities (from %@): %d", ca, ret);`
`1312`	`1312`	`}`
`@@ -1330,7 +1330,7 @@ + (GSTLSCredentials) credentialsFromCAFile: (NSString)ca`
`1330`	`1330`	`}`
`1331`	`1331`	`else`
`1332`	`1332`	`{`
`1333`		`- if (YES == debug)`
	`1333`	`+ if (debug)`
`1334`	`1334`	`{`
`1335`	`1335`	`NSLog(@"Default revocations (from %@): %d", drv, ret);`
`1336`	`1336`	`}`
`@@ -1358,7 +1358,7 @@ + (GSTLSCredentials) credentialsFromCAFile: (NSString)ca`
`1358`	`1358`	`{`
`1359`	`1359`	`NSLog(@"No revocations processed from %@", rv);`
`1360`	`1360`	`}`
`1361`		`- if (YES == debug)`
	`1361`	`+ if (debug)`
`1362`	`1362`	`{`
`1363`	`1363`	`NSLog(@"Revocations (from %@): %d", rv, ret);`
`1364`	`1364`	`}`
`@@ -1418,7 +1418,7 @@ + (GSTLSCredentials) credentialsFromCAFile: (NSString)ca`
`1418`	`1418`	`*/`
`1419`	`1419`	`}`
`1420`	`1420`
`1421`		`- if (YES == debug)`
	`1421`	`+ if (debug)`
`1422`	`1422`	`{`
`1423`	`1423`	`NSLog(@"%@ created credentials %p for '%@'", self, c, k);`
`1424`	`1424`	`}`
`@@ -1725,7 +1725,7 @@ - (id) initWithOptions: (NSDictionary*)options`
`1725`	`1725`	`int ret;`
`1726`	`1726`
`1727`	`1727`	`ret = gnutls_server_name_set(session, GNUTLS_NAME_DNS, ptr, len);`
`1728`		`- if (YES == debug)`
	`1728`	`+ if (debug)`
`1729`	`1729`	`{`
`1730`	`1730`	`if (ret < 0)`
`1731`	`1731`	`{`
`@@ -1739,7 +1739,7 @@ - (id) initWithOptions: (NSDictionary*)options`
`1739`	`1739`	`}`
`1740`	`1740`	`}`
`1741`	`1741`	`}`
`1742`		`- else if (YES == debug)`
	`1742`	`+ else if (debug)`
`1743`	`1743`	`{`
`1744`	`1744`	`NSLog(@"%p %@: not set", handle, GSTLSServerName);`
`1745`	`1745`	`}`
`@@ -1922,7 +1922,7 @@ - (id) initWithOptions: (NSDictionary*)options`
`1922`	`1922`	`[credentials credentials]);`
`1923`	`1923`
`1924`	`1924`	`#if GNUTLS_VERSION_NUMBER >= 0x020C00`
`1925`		`- if (YES == outgoing && YES == debug)`
	`1925`	`+ if (YES == outgoing && debug)`
`1926`	`1926`	`{`
`1927`	`1927`	`/* Set a callback to log handling of a request (from the server)`
`1928`	`1928`	`* for the client certificate. The callback always returns the`
`@@ -2000,7 +2000,7 @@ - (BOOL) handshake`
`2000`	`2000`	`p = [p stringByAppendingFormat: @"\n%@", extra];`
`2001`	`2001`	`}`
`2002`	`2002`	`ASSIGN(problem, p);`
`2003`		`- if (YES == debug)`
	`2003`	`+ if (debug)`
`2004`	`2004`	`{`
`2005`	`2005`	`NSLog(@"%p in handshake: %@", handle, p);`
`2006`	`2006`	`}`
`@@ -2134,7 +2134,7 @@ - (NSInteger) read: (void*)buf length: (NSUInteger)len`
`2134`	`2134`	`{`
`2135`	`2135`	`p = [NSString stringWithFormat: @"%s", gnutls_strerror(result)];`
`2136`	`2136`	`ASSIGN(problem, p);`
`2137`		`- if (YES == debug)`
	`2137`	`+ if (debug)`
`2138`	`2138`	`{`
`2139`	`2139`	`NSLog(@"%p in tls read: %@", handle, p);`
`2140`	`2140`	`}`
`@@ -2147,7 +2147,7 @@ - (NSInteger) read: (void*)buf length: (NSUInteger)len`
`2147`	`2147`	`{`
`2148`	`2148`	`if (GNUTLS_E_WARNING_ALERT_RECEIVED == result)`
`2149`	`2149`	`{`
`2150`		`- if (YES == debug)`
	`2150`	`+ if (debug)`
`2151`	`2151`	`{`
`2152`	`2152`	`p = [NSString stringWithFormat: @"%s",`
`2153`	`2153`	`gnutls_alert_get_name(gnutls_alert_get(session))];`
`@@ -2192,7 +2192,7 @@ - (NSInteger) write: (const void*)buf length: (NSUInteger)len`
`2192`	`2192`
`2193`	`2193`	`p = [NSString stringWithFormat: @"%s", gnutls_strerror(result)];`
`2194`	`2194`	`ASSIGN(problem, p);`
`2195`		`- if (YES == debug)`
	`2195`	`+ if (debug)`
`2196`	`2196`	`{`
`2197`	`2197`	`NSLog(@"%p in tls write: %@", handle, p);`
`2198`	`2198`	`}`
`@@ -2239,6 +2239,16 @@ - (NSString*) sessionInfo`
`2239`	`2239`
`2240`	`2240`	`str = [NSMutableString stringWithCapacity: 2000];`
`2241`	`2241`
	`2242`	`+ if (outgoing)`
	`2243`	`+ {`
	`2244`	`+ [str appendFormat: @"outgoing session %p to '%@'\n",`
	`2245`	`+ self, [self hostName]];`
	`2246`	`+ }`
	`2247`	`+ else`
	`2248`	`+ {`
	`2249`	`+ [str appendFormat: @"incoming session %p\n", self];`
	`2250`	`+ }`
	`2251`	`+`
`2242`	`2252`	`/* get the key exchange's algorithm name`
`2243`	`2253`	`*/`
`2244`	`2254`	`kx = gnutls_kx_get(session);`
`@@ -2433,35 +2443,44 @@ - (int) verify`
`2433`	`2443`	`str = [NSString stringWithFormat:`
`2434`	`2444`	`@"TLS verification: error %s", gnutls_strerror(ret)];`
`2435`	`2445`	`ASSIGN(problem, str);`
`2436`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2446`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2437`	`2447`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2438`	`2448`	`}`
`2439`	`2449`
`2440`		`- if (YES == debug)`
`2441`		`- {`
`2442`		`- if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)`
`2443`		`- NSLog(@"%p TLS verification: certificate hasn't got a known issuer.",`
`2444`		`- handle);`
	`2450`	`+ str = @"";`
	`2451`	`+ if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)`
	`2452`	`+ str = [str stringByAppendingString:`
	`2453`	`+ @", certificate hasn't got a known issuer"];`
`2445`	`2454`
`2446`		`- if (status & GNUTLS_CERT_REVOKED)`
`2447`		`- NSLog(@"%p TLS verification: certificate has been revoked.", handle);`
	`2455`	`+ if (status & GNUTLS_CERT_REVOKED)`
	`2456`	`+ str = [str stringByAppendingString:`
	`2457`	`+ @", certificate has been revoked"];`
`2448`	`2458`
`2449`	`2459`	`#if defined(GNUTLS_CERT_EXPIRED)`
`2450`		`- if (status & GNUTLS_CERT_EXPIRED)`
`2451`		`- NSLog(@"%p TLS verification: certificate has expired", handle);`
	`2460`	`+ if (status & GNUTLS_CERT_EXPIRED)`
	`2461`	`+ str = [str stringByAppendingString:`
	`2462`	`+ @", certificate has expired"];`
`2452`	`2463`	`#endif`
`2453`	`2464`
`2454`	`2465`	`#if defined(GNUTLS_CERT_NOT_ACTIVATED)`
`2455`		`- if (status & GNUTLS_CERT_NOT_ACTIVATED)`
`2456`		`- NSLog(@"%p TLS verification: certificate is not yet activated", handle);`
	`2466`	`+ if (status & GNUTLS_CERT_NOT_ACTIVATED)`
	`2467`	`+ str = [str stringByAppendingString:`
	`2468`	`+ @", certificate is not yet activated"];`
`2457`	`2469`	`#endif`
`2458`		`- }`
`2459`	`2470`
`2460`	`2471`	`if (status & GNUTLS_CERT_INVALID)`
`2461`	`2472`	`{`
`2462`		`- ASSIGN(problem,`
`2463`		`- @"TLS verification: remote certificate is not trusted.");`
`2464`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2473`	`+ if ([str length])`
	`2474`	`+ {`
	`2475`	`+ str = [NSString stringWithFormat:`
	`2476`	`+ @"TLS verification: remote certificate is not trusted%@.", str];`
	`2477`	`+ }`
	`2478`	`+ else`
	`2479`	`+ {`
	`2480`	`+ str = @"TLS verification: remote certificate is not trusted.";`
	`2481`	`+ }`
	`2482`	`+ ASSIGN(problem, str);`
	`2483`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2465`	`2484`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2466`	`2485`	`}`
`2467`	`2486`
`@@ -2473,15 +2492,15 @@ - (int) verify`
`2473`	`2492`	`{`
`2474`	`2493`	`ASSIGN(problem,`
`2475`	`2494`	`@"TLS verification: remote certificate not of the X509 type.");`
`2476`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2495`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2477`	`2496`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2478`	`2497`	`}`
`2479`	`2498`
`2480`	`2499`	`if (gnutls_x509_crt_init(&cert) < 0)`
`2481`	`2500`	`{`
`2482`	`2501`	`ASSIGN(problem, @"TLS verification: error in certificate initialization");`
`2483`	`2502`	`gnutls_x509_crt_deinit(cert);`
`2484`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2503`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2485`	`2504`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2486`	`2505`	`}`
`2487`	`2506`
`@@ -2490,15 +2509,15 @@ - (int) verify`
`2490`	`2509`	`{`
`2491`	`2510`	`ASSIGN(problem, @"TLS verification: no certificate from remote end!");`
`2492`	`2511`	`gnutls_x509_crt_deinit(cert);`
`2493`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2512`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2494`	`2513`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2495`	`2514`	`}`
`2496`	`2515`
`2497`	`2516`	`if (gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER) < 0)`
`2498`	`2517`	`{`
`2499`	`2518`	`ASSIGN(problem, @"TLS verification: error parsing certificate");`
`2500`	`2519`	`gnutls_x509_crt_deinit(cert);`
`2501`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2520`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2502`	`2521`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2503`	`2522`	`}`
`2504`	`2523`	`else`
`@@ -2586,7 +2605,7 @@ - (int) verify`
`2586`	`2605`	`nameList, ci];`
`2587`	`2606`	`ASSIGN(problem, str);`
`2588`	`2607`	`gnutls_x509_crt_deinit(cert);`
`2589`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2608`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2590`	`2609`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2591`	`2610`	`}`
`2592`	`2611`	`}`
`@@ -2601,7 +2620,7 @@ - (int) verify`
`2601`	`2620`	`names, ci];`
`2602`	`2621`	`ASSIGN(problem, str);`
`2603`	`2622`	`gnutls_x509_crt_deinit(cert);`
`2604`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2623`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2605`	`2624`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2606`	`2625`	`}`
`2607`	`2626`	`}`
`@@ -2616,7 +2635,7 @@ - (int) verify`
`2616`	`2635`	`names, ci];`
`2617`	`2636`	`ASSIGN(problem, str);`
`2618`	`2637`	`gnutls_x509_crt_deinit(cert);`
`2619`		`- if (YES == debug) NSLog(@"%p %@", handle, problem);`
	`2638`	`+ if (debug) NSLog(@"%p %@", handle, problem);`
`2620`	`2639`	`return GNUTLS_E_CERTIFICATE_ERROR;`
`2621`	`2640`	`}`
`2622`	`2641`	`}`