Be more verbose when rejecting connections; including which bogus ciphersuite.
diff --git a/server.go b/server.go
index 7ab54f8..c719146 100644
--- a/server.go
+++ b/server.go
@@ -251,7 +251,7 @@
// excuses here. If we really must, we could allow an
// "AllowInsecureWeakCiphers" option on the server later.
// Let's see how it plays out first.
- sc.rejectConn(ErrCodeInadequateSecurity, "Prohibited TLS 1.2 Cipher Suite")
+ sc.rejectConn(ErrCodeInadequateSecurity, fmt.Sprintf("Prohibited TLS 1.2 Cipher Suite: %x", sc.tlsState.CipherSuite))
return
}
}
@@ -287,6 +287,7 @@
}
func (sc *serverConn) rejectConn(err ErrCode, debug string) {
+ log.Printf("REJECTING conn: %v, %s", err, debug)
// ignoring errors. hanging up anyway.
sc.framer.WriteGoAway(0, err, []byte(debug))
sc.bw.Flush()
