nss: inspect returnvalue of token check

[danielgustafsson]

PK11_IsPresent() checks for the token for the given slot is available, and sets needlogin flags for the PK11_Authenticate() call. Should it return false, we should however treat it as an error and bail out.

@kdudka is there a reason to ignore the returnvalue of PK11_IsPresent() that I'm not seeing?

[kdudka]

The only purpose of the SECMOD_WaitForAnyTokenEvent()/PK11_IsPresent() calls is to force NSS to invalidate its internal cache (originally intended to optimize out unneeded accesses to HW tokens, which could be slow I/O devices). Even NSS itself ignores the return value of PK11_IsPresent() in such cases:
https://github.com/nss-dev/nss/blob/ac64f9e6/lib/pk11wrap/pk11util.c#L1505
https://github.com/nss-dev/nss/blob/ac64f9e6/lib/pk11wrap/pk11util.c#L1635

However, your patch looks fine and it could ease debugging of some unexpected situations.

[jay]

Thanks

[danielgustafsson]

The only purpose of the SECMOD_WaitForAnyTokenEvent()/PK11_IsPresent() calls is to force NSS to invalidate its internal cache (originally intended to optimize out unneeded accesses to HW tokens, which could be slow I/O devices). Even NSS itself ignores the return value of PK11_IsPresent() in such cases:

Aha, when scanning the NSS code (not carefully enough) I came across cases where the return value was checked and missed these. This makes a lot of sense though, thanks for clarifying.