beb795
From b9194a0292ce57418b3c9f5faf2ee5509f0fb749 Mon Sep 17 00:00:00 2001
beb795
From: Robbie Harwood <rharwood@redhat.com>
beb795
Date: Thu, 1 Mar 2018 14:25:55 -0500
beb795
Subject: [PATCH] Log errors from NSS during FIPS OTP key import
beb795
beb795
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
beb795
Reviewed-By: Christian Heimes <cheimes@redhat.com>
beb795
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
beb795
---
beb795
 daemons/ipa-slapi-plugins/libotp/hotp.c | 16 ++++++++++++++--
beb795
 1 file changed, 14 insertions(+), 2 deletions(-)
beb795
beb795
diff --git a/daemons/ipa-slapi-plugins/libotp/hotp.c b/daemons/ipa-slapi-plugins/libotp/hotp.c
beb795
index 0c9de96d37183e597867b736d6324db60fa1b3bb..1b9110ebf89a705c9c670d4d33fc7ed615ad25f3 100644
beb795
--- a/daemons/ipa-slapi-plugins/libotp/hotp.c
beb795
+++ b/daemons/ipa-slapi-plugins/libotp/hotp.c
beb795
@@ -49,7 +49,9 @@
beb795
 #include <blapit.h>
beb795
 #include <pk11pub.h>
beb795
 #include <hasht.h>
beb795
+#include <prerror.h>
beb795
 #include <prnetdb.h>
beb795
+#include <syslog.h>
beb795
 
beb795
 struct digest_buffer {
beb795
     uint8_t buf[SHA512_LENGTH];
beb795
@@ -93,17 +95,27 @@ import_key(PK11SlotInfo *slot, CK_MECHANISM_TYPE mech, SECItem *key)
beb795
                                      PK11_ATTR_SESSION |
beb795
                                      PK11_ATTR_PRIVATE |
beb795
                                      PK11_ATTR_SENSITIVE, NULL);
beb795
-    if (!ekey)
beb795
+    if (!ekey) {
beb795
+        syslog(LOG_ERR, "libotp: in FIPS, PK11_TokenKeyGenWithFlags failed: %d",
beb795
+               PR_GetError());
beb795
         goto egress;
beb795
+    }
beb795
 
beb795
     /* Encrypt the input key. */
beb795
     if (PK11_Encrypt(ekey, CKM_AES_CBC_PAD, &ivitem, ctitem.data, &ctitem.len,
beb795
-                     ctitem.len, key->data, key->len) != SECSuccess)
beb795
+                     ctitem.len, key->data, key->len) != SECSuccess) {
beb795
+        syslog(LOG_ERR, "libotp: in FIPS, PK11_Encrypt failed: %d",
beb795
+               PR_GetError());
beb795
         goto egress;
beb795
+    }
beb795
 
beb795
     /* Unwrap the input key. */
beb795
     skey = PK11_UnwrapSymKey(ekey, CKM_AES_CBC_PAD, &ivitem,
beb795
                              &ctitem, mech, CKA_SIGN, key->len);
beb795
+    if (!skey) {
beb795
+        syslog(LOG_ERR, "libotp: in FIPS, PK11_UnwrapSymKey failed: %d",
beb795
+               PR_GetError());
beb795
+    }
beb795
 
beb795
 egress:
beb795
     PK11_FreeSymKey(ekey);
beb795
-- 
beb795
2.14.3
beb795