|
 |
9f2ebf |
From aa476a78b67a60d4ca2433091268a7790b4d62f7 Mon Sep 17 00:00:00 2001
|
|
|
9f2ebf |
From: Sumit Bose <sbose@redhat.com>
|
|
|
9f2ebf |
Date: Mon, 30 Oct 2017 10:22:33 +0100
|
|
|
9f2ebf |
Subject: [PATCH 42/46] p11_child: add descriptions for error codes to debug
|
|
|
9f2ebf |
messages
|
|
|
9f2ebf |
MIME-Version: 1.0
|
|
|
9f2ebf |
Content-Type: text/plain; charset=UTF-8
|
|
|
9f2ebf |
Content-Transfer-Encoding: 8bit
|
|
|
9f2ebf |
|
|
|
9f2ebf |
Additionally to the NSS erro code a text message describing the error is
|
|
|
9f2ebf |
added. This will help to see why p11_child ignores specific
|
|
|
9f2ebf |
certificates. For example it would be more obvious why the certificate
|
|
|
9f2ebf |
is not valid (expired, missing CA cert, failed OCSP etc).
|
|
|
9f2ebf |
|
|
|
9f2ebf |
Related to https://pagure.io/SSSD/sssd/issue/3560
|
|
|
9f2ebf |
|
|
|
9f2ebf |
Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
|
|
|
9f2ebf |
Tested-by: Scott Poore <spoore@redhat.com>
|
|
|
9f2ebf |
(cherry picked from commit 08d1f8c0d6eece6a48201d7f8824b282eac3458d)
|
|
|
9f2ebf |
---
|
|
|
9f2ebf |
src/p11_child/p11_child_nss.c | 91 ++++++++++++++++++++++++-------------------
|
|
|
9f2ebf |
1 file changed, 50 insertions(+), 41 deletions(-)
|
|
|
9f2ebf |
|
|
|
9f2ebf |
diff --git a/src/p11_child/p11_child_nss.c b/src/p11_child/p11_child_nss.c
|
|
|
9f2ebf |
index c676375cf7f6677a1d7f38f09b9bb5fd820d60c5..5f289688e41f4ea610292b907036e05cf95eb29d 100644
|
|
|
9f2ebf |
--- a/src/p11_child/p11_child_nss.c
|
|
|
9f2ebf |
+++ b/src/p11_child/p11_child_nss.c
|
|
|
9f2ebf |
@@ -75,15 +75,16 @@ static char *get_key_id_str(PK11SlotInfo *slot, CERTCertificate *cert)
|
|
|
9f2ebf |
key_id = PK11_GetLowLevelKeyIDForCert(slot, cert, NULL);
|
|
|
9f2ebf |
if (key_id == NULL) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "PK11_GetLowLevelKeyIDForCert failed [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ "PK11_GetLowLevelKeyIDForCert failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return NULL;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
key_id_str = CERT_Hexify(key_id, PR_FALSE);
|
|
|
9f2ebf |
SECITEM_FreeItem(key_id, PR_TRUE);
|
|
|
9f2ebf |
if (key_id_str == NULL) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "CERT_Hexify failed [%d].\n", PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_Hexify failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return NULL;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
@@ -138,8 +139,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
|
|
|
9f2ebf |
nss_ctx = NSS_InitContext(nss_db, "", "", SECMOD_DB, ¶meters, flags);
|
|
|
9f2ebf |
if (nss_ctx == NULL) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "NSS_InitContext failed [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "NSS_InitContext failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
@@ -232,8 +233,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
if (pin != NULL) {
|
|
|
9f2ebf |
rv = PK11_Authenticate(slot, PR_FALSE, discard_const(pin));
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "PK11_Authenticate failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "PK11_Authenticate failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
} else {
|
|
|
9f2ebf |
@@ -246,8 +247,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
|
|
|
9f2ebf |
cert_list = PK11_ListCertsInSlot(slot);
|
|
|
9f2ebf |
if (cert_list == NULL) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "PK11_ListCertsInSlot failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "PK11_ListCertsInSlot failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
@@ -265,31 +266,33 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
|
|
|
9f2ebf |
rv = CERT_FilterCertListByUsage(cert_list, certUsageSSLClient, PR_FALSE);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "CERT_FilterCertListByUsage failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_FilterCertListByUsage failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
rv = CERT_FilterCertListForUserCerts(cert_list);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "CERT_FilterCertListForUserCerts failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
+ "CERT_FilterCertListForUserCerts failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
|
|
|
9f2ebf |
handle = CERT_GetDefaultCertDB();
|
|
|
9f2ebf |
if (handle == NULL) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "CERT_GetDefaultCertDB failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_GetDefaultCertDB failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
if (cert_verify_opts->do_ocsp) {
|
|
|
9f2ebf |
rv = CERT_EnableOCSPChecking(handle);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "CERT_EnableOCSPChecking failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
+ "CERT_EnableOCSPChecking failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
@@ -300,16 +303,16 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
cert_verify_opts->ocsp_default_responder_signing_cert);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "CERT_SetOCSPDefaultResponder failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ "CERT_SetOCSPDefaultResponder failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
rv = CERT_EnableOCSPDefaultResponder(handle);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "CERT_EnableOCSPDefaultResponder failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ "CERT_EnableOCSPDefaultResponder failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -318,8 +321,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
found_cert = NULL;
|
|
|
9f2ebf |
valid_certs = CERT_NewCertList();
|
|
|
9f2ebf |
if (valid_certs == NULL) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "CERT_NewCertList failed [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_NewCertList failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
ret = ENOMEM;
|
|
|
9f2ebf |
goto done;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -345,9 +348,10 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
NULL, NULL);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "Certificate [%s][%s] not valid [%d], skipping.\n",
|
|
|
9f2ebf |
+ "Certificate [%s][%s] not valid [%d][%s], skipping.\n",
|
|
|
9f2ebf |
cert_list_node->cert->nickname,
|
|
|
9f2ebf |
- cert_list_node->cert->subjectName, PR_GetError());
|
|
|
9f2ebf |
+ cert_list_node->cert->subjectName,
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
continue;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -386,7 +390,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
rv = CERT_AddCertToListTail(valid_certs, cert_list_node->cert);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "CERT_AddCertToListTail failed [%d].\n", PR_GetError());
|
|
|
9f2ebf |
+ "CERT_AddCertToListTail failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
ret = EIO;
|
|
|
9f2ebf |
goto done;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -400,8 +405,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
rv = CERT_DisableOCSPDefaultResponder(handle);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "CERT_DisableOCSPDefaultResponder failed: [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ "CERT_DisableOCSPDefaultResponder failed: [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
@@ -433,15 +438,17 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
rv = PK11_GenerateRandom(random_value, sizeof(random_value));
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "PK11_GenerateRandom failed [%d].\n", PR_GetError());
|
|
|
9f2ebf |
+ "PK11_GenerateRandom failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
return EIO;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
priv_key = PK11_FindPrivateKeyFromCert(slot, found_cert, NULL);
|
|
|
9f2ebf |
if (priv_key == NULL) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "PK11_FindPrivateKeyFromCert failed [%d]." \
|
|
|
9f2ebf |
- "Maybe pin is missing.\n", PR_GetError());
|
|
|
9f2ebf |
+ "PK11_FindPrivateKeyFromCert failed [%d][%s]."
|
|
|
9f2ebf |
+ "Maybe pin is missing.\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
ret = EIO;
|
|
|
9f2ebf |
goto done;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -451,8 +458,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
if (algtag == SEC_OID_UNKNOWN) {
|
|
|
9f2ebf |
SECKEY_DestroyPrivateKey(priv_key);
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "SEC_GetSignatureAlgorithmOidTag failed [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ "SEC_GetSignatureAlgorithmOidTag failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
ret = EIO;
|
|
|
9f2ebf |
goto done;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -462,8 +469,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
priv_key, algtag);
|
|
|
9f2ebf |
SECKEY_DestroyPrivateKey(priv_key);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "SEC_SignData failed [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "SEC_SignData failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
ret = EIO;
|
|
|
9f2ebf |
goto done;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -471,7 +478,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
pub_key = CERT_ExtractPublicKey(found_cert);
|
|
|
9f2ebf |
if (pub_key == NULL) {
|
|
|
9f2ebf |
DEBUG(SSSDBG_OP_FAILURE,
|
|
|
9f2ebf |
- "CERT_ExtractPublicKey failed [%d].\n", PR_GetError());
|
|
|
9f2ebf |
+ "CERT_ExtractPublicKey failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
ret = EIO;
|
|
|
9f2ebf |
goto done;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -481,8 +489,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
NULL);
|
|
|
9f2ebf |
SECKEY_DestroyPublicKey(pub_key);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "VFY_VerifyData failed [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "VFY_VerifyData failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
ret = EACCES;
|
|
|
9f2ebf |
goto done;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -507,7 +515,8 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db,
|
|
|
9f2ebf |
PORT_Free(key_id_str);
|
|
|
9f2ebf |
key_id_str = get_key_id_str(slot, found_cert);
|
|
|
9f2ebf |
if (key_id_str == NULL) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "get_key_id_str [%d].\n", PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "get_key_id_str [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
ret = ENOMEM;
|
|
|
9f2ebf |
goto done;
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
@@ -562,8 +571,8 @@ done:
|
|
|
9f2ebf |
|
|
|
9f2ebf |
rv = NSS_ShutdownContext(nss_ctx);
|
|
|
9f2ebf |
if (rv != SECSuccess) {
|
|
|
9f2ebf |
- DEBUG(SSSDBG_OP_FAILURE, "NSS_ShutdownContext failed [%d].\n",
|
|
|
9f2ebf |
- PR_GetError());
|
|
|
9f2ebf |
+ DEBUG(SSSDBG_OP_FAILURE, "NSS_ShutdownContext failed [%d][%s].\n",
|
|
|
9f2ebf |
+ PR_GetError(), PORT_ErrorToString(PR_GetError()));
|
|
|
9f2ebf |
}
|
|
|
9f2ebf |
|
|
|
9f2ebf |
return ret;
|
|
|
9f2ebf |
--
|
|
|
9f2ebf |
2.13.6
|
|
|
9f2ebf |
|