[tor-commits] [tor/maint-0.3.5] NSS: Log an error message when SSL_ExportKeyingMaterial() fails

[teor at torproject.org]

commit 680fd3f8fb7157432398a3552ee9c98c72bd7397
Author: Nick Mathewson <nickm at torproject.org>
Date:   Fri Mar 29 13:38:14 2019 -0400

    NSS: Log an error message when SSL_ExportKeyingMaterial() fails
    
    Diagnostic for 29241.
---
 changes/29241_diagnostic | 4 ++++
 src/lib/tls/tortls_nss.c | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/changes/29241_diagnostic b/changes/29241_diagnostic
new file mode 100644
index 000000000..1e3865495
--- /dev/null
+++ b/changes/29241_diagnostic
@@ -0,0 +1,4 @@
+  o Minor features (NSS, diagnostic):
+    - Try to log an error from NSS (if there is any) and a more useful
+      description of our situation if we are using NSS and a call to
+      SSL_ExportKeyingMaterial() fails.  Diagnostic for ticket 29241.
diff --git a/src/lib/tls/tortls_nss.c b/src/lib/tls/tortls_nss.c
index 00c4af0e9..4e107fae7 100644
--- a/src/lib/tls/tortls_nss.c
+++ b/src/lib/tls/tortls_nss.c
@@ -726,10 +726,18 @@ tor_tls_export_key_material,(tor_tls_t *tls, uint8_t *secrets_out,
   tor_assert(context_len <= UINT_MAX);
 
   SECStatus s;
+  /* Make sure that the error code is set here, so that we can be sure that
+   * any error code set after a failure was in fact caused by
+   * SSL_ExportKeyingMaterial. */
+  PR_SetError(PR_UNKNOWN_ERROR, 0);
   s = SSL_ExportKeyingMaterial(tls->ssl,
                                label, (unsigned)strlen(label),
                                PR_TRUE, context, (unsigned)context_len,
                                secrets_out, DIGEST256_LEN);
+  if (s != SECSuccess) {
+    tls_log_errors(tls, LOG_WARN, LD_CRYPTO,
+                   "exporting key material for a TLS handshake");
+  }
 
   return (s == SECSuccess) ? 0 : -1;
 }