From 5a10aa73a97b18bf572523e7f86d48797071fb38 Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Mon, 3 Dec 2018 16:14:09 +0100
Subject: [PATCH] zkey: Enhance error message about missing CCA library
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make the error message when the CCA library is missing more
user friendly. Also display an URL where the CCA package
can be downloaded.

The CCA library is used for the REENCIPHER commands of
zkey and zkey-cryptsetup and must be installed separately
as part of the IBM CCA Host Libraries and Tools package.
This packages is not provided by the distributors, but must
be downloaded from an IBM web page and installed separately.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 zkey/pkey.c            | 13 +++++++++----
 zkey/zkey-cryptsetup.1 |  3 ++-
 zkey/zkey.1            |  3 ++-
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/zkey/pkey.c b/zkey/pkey.c
index 7c6411ae..a88c4e90 100644
--- a/zkey/pkey.c
+++ b/zkey/pkey.c
@@ -48,6 +48,7 @@
  * Definitions for the CCA library
  */
 #define CCA_LIBRARY_NAME	"libcsulcca.so"
+#define CCA_WEB_PAGE		"http://www.ibm.com/security/cryptocards"
 
 #define DEFAULT_KEYBITS 256
 
@@ -71,16 +72,20 @@ int load_cca_library(void **lib_csulcca, t_CSNBKTC *dll_CSNBKTC, bool verbose)
 	/* Load the CCA library */
 	*lib_csulcca = dlopen(CCA_LIBRARY_NAME, RTLD_GLOBAL | RTLD_NOW);
 	if (*lib_csulcca == NULL) {
-		warnx("%s\nEnsure that the IBM CCA Host Libraries and "
-		      "Tools are installed properly", dlerror());
+		pr_verbose(verbose, "%s", dlerror());
+		warnx("The command requires the IBM CCA Host Libraries and "
+		      "Tools.\nFor the supported environments and downloads, "
+		      "see:\n%s", CCA_WEB_PAGE);
 		return  -ELIBACC;
 	}
 
 	/* Get the Key Token Change function */
 	*dll_CSNBKTC = (t_CSNBKTC)dlsym(*lib_csulcca, "CSNBKTC");
 	if (*dll_CSNBKTC == NULL) {
-		warnx("%s\nEnsure that the IBM CCA Host Libraries and "
-		      "Tools are installed properly", dlerror());
+		pr_verbose(verbose, "%s", dlerror());
+		warnx("The command requires the IBM CCA Host Libraries and "
+		      "Tools.\nFor the supported environments and downloads, "
+		      "see:\n%s", CCA_WEB_PAGE);
 		dlclose(*lib_csulcca);
 		*lib_csulcca = NULL;
 		return -ELIBACC;
diff --git a/zkey/zkey-cryptsetup.1 b/zkey/zkey-cryptsetup.1
index bf92e219..988ef76c 100644
--- a/zkey/zkey-cryptsetup.1
+++ b/zkey/zkey-cryptsetup.1
@@ -182,7 +182,8 @@ behave in the same way as with \fBcryptsetup\fP.
 .PP
 .B Note:
 The \fBreencipher\fP command requires the CCA host library (libcsulcca.so)
-to be installed.
+to be installed. For the supported environments and downloads, see:
+\fIhttp://www.ibm.com/security/cryptocards\fP
 .
 .
 .
diff --git a/zkey/zkey.1 b/zkey/zkey.1
index f3a46b59..19ef1a4a 100644
--- a/zkey/zkey.1
+++ b/zkey/zkey.1
@@ -282,7 +282,8 @@ a staged re-enciphering for the \fBOLD\fP to \fBCURRENT\fP case.
 .PP
 .B Note:
 The \fBreencipher\fP command requires the CCA host library (libcsulcca.so)
-to be installed.
+to be installed. For the supported environments and downloads, see:
+\fIhttp://www.ibm.com/security/cryptocards\fP
 .
 .SS "Import existing AES secure keys into the secure key repository"
 .