1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce#include "responder/secrets/secsrv_private.h"

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#include "util/crypto/sss_crypto.h"

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce#include <time.h>

8890a30f5d054187fd7d5b50503f82a49cd025f0Lukas Slebodnik#include <sys/stat.h>

8890a30f5d054187fd7d5b50503f82a49cd025f0Lukas Slebodnik#include <fcntl.h>

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce#include <ldb.h>

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#define MKEY_SIZE (256 / 8)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek#define SECRETS_BASEDN "cn=secrets"

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek#define KCM_BASEDN "cn=kcm"

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorcestruct local_context {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct ldb_context *ldb;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct sec_data master_key;

7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek

7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek struct sec_quota *quota_secrets;

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek struct sec_quota *quota_kcm;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce};

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_decrypt(struct local_context *lctx, TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *secret, const char *enctype,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio char **plain_secret)

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce char *output;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (enctype && strcmp(enctype, "masterkey") == 0) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Decrypting with masterkey\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct sec_data _secret;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce size_t outlen;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int ret;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce _secret.data = (char *)sss_base64_decode(mem_ctx, secret,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce &_secret.length);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (!_secret.data) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "sss_base64_decode failed\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EINVAL;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = sss_decrypt(mem_ctx, AES256CBC_HMAC_SHA256,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t *)lctx->master_key.data,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce lctx->master_key.length,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t *)_secret.data, _secret.length,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t **)&output, &outlen);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "sss_decrypt failed [%d]: %s\n", ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (((strnlen(output, outlen) + 1) != outlen) ||

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce output[outlen - 1] != '\0') {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Output length mismatch or output not NULL-terminated\n");

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EIO;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce } else {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce output = talloc_strdup(mem_ctx, secret);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (!output) return ENOMEM;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce *plain_secret = output;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EOK;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_encrypt(struct local_context *lctx, TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *secret, const char *enctype,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio char **ciphertext)

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct sec_data _secret;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce char *output;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int ret;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (enctype == NULL) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "No encryption type\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EINVAL;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (strcmp(enctype, "masterkey") != 0) {

677a31351c80453d9ce006481364399a96312052René Genz DEBUG(SSSDBG_CRIT_FAILURE, "Unknown encryption type '%s'\n", enctype);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EINVAL;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = sss_encrypt(mem_ctx, AES256CBC_HMAC_SHA256,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t *)lctx->master_key.data,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce lctx->master_key.length,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (const uint8_t *)secret, strlen(secret) + 1,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t **)&_secret.data, &_secret.length);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "sss_encrypt failed [%d]: %s\n", ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce output = sss_base64_encode(mem_ctx,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t *)_secret.data, _secret.length);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (!output) return ENOMEM;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce *ciphertext = output;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EOK;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_dn(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_context *ldb,

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek const char *basedn,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *req_path,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_dn **req_dn)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_dn *dn;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce const char *s, *e;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek dn = ldb_dn_new(mem_ctx, ldb, basedn);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!dn) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce s = req_path;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce while (s && *s) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce e = strchr(s, '/');

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (e) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (e == s) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce s++;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce continue;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!ldb_dn_add_child_fmt(dn, "cn=%.*s", (int)(e - s), s)) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce s = e + 1;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!ldb_dn_add_child_fmt(dn, "cn=%s", s)) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce s = NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Local path for [%s] is [%s]\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek req_path, ldb_dn_get_linearized(dn));

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce *req_dn = dn;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic char *local_dn_to_path(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_dn *basedn,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_dn *dn)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int basecomps;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int dncomps;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char *path = NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce basecomps = ldb_dn_get_comp_num(basedn);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce dncomps = ldb_dn_get_comp_num(dn);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce for (int i = dncomps - basecomps; i > 0; i--) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce const struct ldb_val *val;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce val = ldb_dn_get_component_val(dn, i - 1);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!val) return NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (path) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce path = talloc_strdup_append_buffer(path, "/");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!path) return NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce path = talloc_strndup_append_buffer(path, (char *)val->data,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce val->length);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce path = talloc_strndup(mem_ctx, (char *)val->data, val->length);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!path) return NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Secrets path for [%s] is [%s]\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(dn), path);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return path;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozekstruct local_db_req {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek char *path;

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek const char *basedn;

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek struct ldb_dn *req_dn;

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek struct sec_quota *quota;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek};

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce#define LOCAL_SIMPLE_FILTER "(type=simple)"

a8361f37af31a8a9767056bd27c418c947293f56Fabiano Fidêncio#define LOCAL_CONTAINER_FILTER "(type=container)"

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_get_simple(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio char **secret)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce TALLOC_CTX *tmp_ctx;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce static const char *attrs[] = { "secret", "enctype", NULL };

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_result *res;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce const char *attr_secret;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce const char *attr_enctype;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Retrieving a secret from [%s]\n", lc_req->path);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tmp_ctx = talloc_new(mem_ctx);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!tmp_ctx) return ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Searching for [%s] at [%s] with scope=base\n",

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek LOCAL_SIMPLE_FILTER, ldb_dn_get_linearized(lc_req->req_dn));

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, lc_req->req_dn, LDB_SCOPE_BASE,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce attrs, "%s", LOCAL_SIMPLE_FILTER);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_search returned [%d]: %s\n", ret, ldb_strerror(ret));

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce switch (res->count) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case 0:

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "No secret found\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case 1:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce default:

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Too many secrets returned with BASE search\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = E2BIG;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce attr_secret = ldb_msg_find_attr_as_string(res->msgs[0], "secret", NULL);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!attr_secret) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "The 'secret' attribute is missing\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce attr_enctype = ldb_msg_find_attr_as_string(res->msgs[0], "enctype", NULL);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (attr_enctype) {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = local_decrypt(lctx, mem_ctx, attr_secret, attr_enctype, secret);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (ret) goto done;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce } else {

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce *secret = talloc_strdup(mem_ctx, attr_secret);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(tmp_ctx);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_list_keys(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio char ***_keys,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio int *num_keys)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce TALLOC_CTX *tmp_ctx;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce static const char *attrs[] = { "secret", NULL };

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_result *res;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **keys;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tmp_ctx = talloc_new(mem_ctx);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!tmp_ctx) return ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Listing keys at [%s]\n", lc_req->path);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Searching for [%s] at [%s] with scope=subtree\n",

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek LOCAL_SIMPLE_FILTER, ldb_dn_get_linearized(lc_req->req_dn));

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, lc_req->req_dn, LDB_SCOPE_SUBTREE,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce attrs, "%s", LOCAL_SIMPLE_FILTER);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_search returned [%d]: %s\n", ret, ldb_strerror(ret));

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (res->count == 0) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "No secrets found\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce keys = talloc_array(mem_ctx, char *, res->count);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!keys) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce for (unsigned i = 0; i < res->count; i++) {

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek keys[i] = local_dn_to_path(keys, lc_req->req_dn, res->msgs[i]->dn);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!keys[i]) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce *_keys = keys;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Returning %d secrets\n", res->count);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce *num_keys = res->count;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(tmp_ctx);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_check_containers(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_dn *leaf_dn)

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce{

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio TALLOC_CTX *tmp_ctx;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce static const char *attrs[] = { NULL};

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct ldb_result *res = NULL;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct ldb_dn *dn;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int num;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int ret;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio tmp_ctx = talloc_new(mem_ctx);

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio if (!tmp_ctx) return ENOMEM;

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio dn = ldb_dn_copy(tmp_ctx, leaf_dn);

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio if (!dn) {

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio ret = ENOMEM;

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio goto done;

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* We need to exclude the leaf as that will be the new child entry,

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce num = ldb_dn_get_comp_num(dn) - 4;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce for (int i = 0; i < num; i++) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* remove the child first (we do not want to check the leaf) */

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (!ldb_dn_remove_child_components(dn, 1)) return EFAULT;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* and check the parent container exists */

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Searching for [%s] at [%s] with scope=base\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek LOCAL_CONTAINER_FILTER, ldb_dn_get_linearized(dn));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio ret = ldb_search(lctx->ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,

a8361f37af31a8a9767056bd27c418c947293f56Fabiano Fidêncio attrs, LOCAL_CONTAINER_FILTER);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != LDB_SUCCESS || res->count != 1) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "DN [%s] does not exist\n", ldb_dn_get_linearized(dn));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ENOENT;

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio ret = EOK;

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidênciodone:

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio talloc_free(tmp_ctx);

d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio return ret;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce}

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozekstatic int local_db_check_containers_nest_level(struct local_db_req *lc_req,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct ldb_dn *leaf_dn)

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio{

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio int nest_level;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek if (lc_req->quota->containers_nest_level == 0) {

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek return EOK;

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek }

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio /* We need do not care for the synthetic containers that constitute the

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio nest_level = ldb_dn_get_comp_num(leaf_dn) - 3;

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek if (nest_level > lc_req->quota->containers_nest_level) {

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio "Cannot create a nested container of depth %d as the maximum"

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio "allowed number of nested containers is %d.\n",

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek nest_level, lc_req->quota->containers_nest_level);

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio return ERR_SEC_INVALID_CONTAINERS_NEST_LEVEL;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio }

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio return EOK;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio}

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozekstatic struct ldb_dn *per_uid_container(TALLOC_CTX *mem_ctx,

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek struct ldb_dn *req_dn)

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek{

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek int user_comp;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek int num_comp;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek struct ldb_dn *uid_base_dn;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek uid_base_dn = ldb_dn_copy(mem_ctx, req_dn);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (uid_base_dn == NULL) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek return NULL;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek /* Remove all the components up to the per-user base path which consists

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek user_comp = ldb_dn_get_comp_num(uid_base_dn) - 3;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (!ldb_dn_remove_child_components(uid_base_dn, user_comp)) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot remove child components\n");

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek talloc_free(uid_base_dn);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek return NULL;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek num_comp = ldb_dn_get_comp_num(uid_base_dn);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (num_comp != 3) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Expected 3 components got %d\n", num_comp);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek talloc_free(uid_base_dn);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek return NULL;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek return uid_base_dn;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek}

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozekstatic int local_db_check_peruid_number_of_secrets(TALLOC_CTX *mem_ctx,

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek struct local_context *lctx,

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek struct local_db_req *lc_req)

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek{

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek TALLOC_CTX *tmp_ctx;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek static const char *attrs[] = { NULL };

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek struct ldb_result *res = NULL;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek struct ldb_dn *cli_basedn = NULL;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek int ret;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek if (lc_req->quota->max_uid_secrets == 0) {

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek return EOK;

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek }

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek tmp_ctx = talloc_new(mem_ctx);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (tmp_ctx == NULL) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek return ENOMEM;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek cli_basedn = per_uid_container(tmp_ctx, lc_req->req_dn);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (cli_basedn == NULL) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek ret = ENOMEM;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek goto done;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, cli_basedn, LDB_SCOPE_SUBTREE,

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek attrs, LOCAL_SIMPLE_FILTER);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (ret != EOK) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek "ldb_search returned %d: %s\n", ret, ldb_strerror(ret));

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek goto done;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (res->count >= lc_req->quota->max_uid_secrets) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek "Cannot store any more secrets for this client (basedn %s) "

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek "as the maximum allowed limit (%d) has been reached\n",

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek ldb_dn_get_linearized(cli_basedn),

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek lc_req->quota->max_uid_secrets);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek ret = ERR_SEC_INVALID_TOO_MANY_SECRETS;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek goto done;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek ret = EOK;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozekdone:

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek talloc_free(tmp_ctx);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek return ret;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek}

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciostatic int local_db_check_number_of_secrets(TALLOC_CTX *mem_ctx,

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek struct local_context *lctx,

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek struct local_db_req *lc_req)

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio{

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio TALLOC_CTX *tmp_ctx;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio static const char *attrs[] = { NULL };

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct ldb_result *res = NULL;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct ldb_dn *dn;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio int ret;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek if (lc_req->quota->max_secrets == 0) {

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek return EOK;

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek }

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio tmp_ctx = talloc_new(mem_ctx);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio if (!tmp_ctx) return ENOMEM;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek dn = ldb_dn_new(tmp_ctx, lctx->ldb, lc_req->basedn);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio if (!dn) {

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = ENOMEM;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio goto done;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = ldb_search(lctx->ldb, tmp_ctx, &res, dn, LDB_SCOPE_SUBTREE,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio attrs, LOCAL_SIMPLE_FILTER);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (ret != EOK) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek "ldb_search returned %d: %s\n", ret, ldb_strerror(ret));

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek goto done;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek if (res->count >= lc_req->quota->max_secrets) {

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio "Cannot store any more secrets as the maximum allowed limit (%d) "

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek "has been reached\n", lc_req->quota->max_secrets);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = ERR_SEC_INVALID_TOO_MANY_SECRETS;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio goto done;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = EOK;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciodone:

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio talloc_free(tmp_ctx);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio return ret;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio}

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozekstatic int local_check_max_payload_size(struct local_db_req *lc_req,

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio int payload_size)

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio{

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio int max_payload_size;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek if (lc_req->quota->max_payload_size == 0) {

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek return EOK;

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek }

109ed7ca1a82420798efdc6a9b019675a5bd0f4fJakub Hrozek

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek max_payload_size = lc_req->quota->max_payload_size * 1024; /* kb */

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio if (payload_size > max_payload_size) {

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio "Secrets' payload size [%d kb (%d)] exceeds the maximum allowed "

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio "payload size [%d kb (%d)]\n",

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio payload_size * 1024, /* kb */

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio payload_size,

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek lc_req->quota->max_payload_size, /* kb */

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio max_payload_size);

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio return ERR_SEC_PAYLOAD_SIZE_IS_TOO_LARGE;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio }

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio return EOK;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio}

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_put_simple(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *secret)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_message *msg;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce const char *enctype = "masterkey";

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce char *enc_secret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Adding a secret to [%s]\n", lc_req->path);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce msg = ldb_msg_new(mem_ctx);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!msg) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek msg->dn = lc_req->req_dn;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* make sure containers exist */

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = local_db_check_containers(msg, lctx, msg->dn);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "local_db_check_containers failed for [%s]: [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(msg->dn), ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek ret = local_db_check_number_of_secrets(msg, lctx, lc_req);

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio if (ret != EOK) {

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio "local_db_check_number_of_secrets failed [%d]: %s\n",

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret, sss_strerror(ret));

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio goto done;

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }

65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek ret = local_db_check_peruid_number_of_secrets(msg, lctx, lc_req);

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek if (ret != EOK) {

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek "local_db_check_number_of_secrets failed [%d]: %s\n",

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek ret, sss_strerror(ret));

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek goto done;

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek }

6b3bab516355fdf4cc81e6da9d87ec3818ab190fJakub Hrozek

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek ret = local_check_max_payload_size(lc_req, strlen(secret));

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio if (ret != EOK) {

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio "local_check_max_payload_size failed [%d]: %s\n",

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio ret, sss_strerror(ret));

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio goto done;

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio }

7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = local_encrypt(lctx, msg, secret, enctype, &enc_secret);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "local_encrypt failed [%d]: %s\n", ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ldb_msg_add_string(msg, "type", "simple");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding type:simple [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = ldb_msg_add_string(msg, "enctype", enctype);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding enctype [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = ldb_msg_add_string(msg, "secret", enc_secret);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding secret [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ldb_msg_add_fmt(msg, "creationTime", "%lu", time(NULL));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding creationTime [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = ldb_add(lctx->ldb, msg);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Secret %s already exists\n", ldb_dn_get_linearized(msg->dn));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EEXIST;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Failed to add secret [%s]: [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(msg->dn), ret, ldb_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EIO;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(msg);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_delete(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio TALLOC_CTX *tmp_ctx;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio static const char *attrs[] = { NULL };

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio struct ldb_result *res;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Removing a secret from [%s]\n", lc_req->path);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio tmp_ctx = talloc_new(mem_ctx);

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio if (!tmp_ctx) return ENOMEM;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Searching for [%s] at [%s] with scope=base\n",

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek LOCAL_CONTAINER_FILTER, ldb_dn_get_linearized(lc_req->req_dn));

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, lc_req->req_dn, LDB_SCOPE_BASE,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek attrs, LOCAL_CONTAINER_FILTER);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_search returned %d: %s\n", ret, ldb_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio if (res->count == 1) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek "Searching for children of [%s]\n", ldb_dn_get_linearized(lc_req->req_dn));

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, lc_req->req_dn, LDB_SCOPE_ONELEVEL,

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio attrs, NULL);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_search returned %d: %s\n", ret, ldb_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio if (res->count > 0) {

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio ret = EEXIST;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio "Failed to remove '%s': Container is not empty\n",

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek ldb_dn_get_linearized(lc_req->req_dn));

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio goto done;

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio }

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek ret = ldb_delete(lctx->ldb, lc_req->req_dn);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_delete returned %d: %s\n", ret, ldb_strerror(ret));

677a31351c80453d9ce006481364399a96312052René Genz /* fall through */

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio ret = sysdb_error_to_errno(ret);

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidênciodone:

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio talloc_free(tmp_ctx);

ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio return ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_create(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req)

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce{

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct ldb_message *msg;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int ret;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Creating a container at [%s]\n", lc_req->path);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce msg = ldb_msg_new(mem_ctx);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (!msg) {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ENOMEM;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

392f48c039d7a6d70bce6ae2d122042391653566Jakub Hrozek msg->dn = lc_req->req_dn;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* make sure containers exist */

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = local_db_check_containers(msg, lctx, msg->dn);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "local_db_check_containers failed for [%s]: [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(msg->dn), ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek ret = local_db_check_containers_nest_level(lc_req, msg->dn);

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio if (ret != EOK) goto done;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ldb_msg_add_string(msg, "type", "container");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding type:container [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ldb_msg_add_fmt(msg, "creationTime", "%lu", time(NULL));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding creationTime [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ldb_add(lctx->ldb, msg);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Secret %s already exists\n", ldb_dn_get_linearized(msg->dn));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EEXIST;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Failed to add secret [%s]: [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(msg->dn), ret, ldb_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EIO;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = EOK;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorcedone:

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce talloc_free(msg);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce return ret;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce}

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_secrets_map_path(TALLOC_CTX *mem_ctx,

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek struct local_context *lctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct sec_req_ctx *secreq,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req **_lc_req)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req;

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek struct ldb_context *ldb = lctx->ldb;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce /* be strict for now */

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (secreq->parsed_url.fragment != NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Unrecognized URI fragments: [%s]\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce secreq->parsed_url.fragment);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return EINVAL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (secreq->parsed_url.userinfo != NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Unrecognized URI userinfo: [%s]\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce secreq->parsed_url.userinfo);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return EINVAL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce /* only type simple for now */

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (secreq->parsed_url.query != NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = strcmp(secreq->parsed_url.query, "type=simple");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != 0) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Invalid URI query: [%s]\n",

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce secreq->parsed_url.query);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return EINVAL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek lc_req = talloc(mem_ctx, struct local_db_req);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (lc_req == NULL) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek return ENOMEM;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek /* drop the prefix and select a basedn instead */

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (strncmp(secreq->mapped_path,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek SEC_BASEPATH, sizeof(SEC_BASEPATH) - 1) == 0) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek lc_req->path = talloc_strdup(lc_req,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek secreq->mapped_path + (sizeof(SEC_BASEPATH) - 1));

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek lc_req->basedn = SECRETS_BASEDN;

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek lc_req->quota = lctx->quota_secrets;

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek } else if (strncmp(secreq->mapped_path,

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek SEC_KCM_BASEPATH, sizeof(SEC_KCM_BASEPATH) - 1) == 0) {

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek lc_req->path = talloc_strdup(lc_req,

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek secreq->mapped_path + (sizeof(SEC_KCM_BASEPATH) - 1));

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek lc_req->basedn = KCM_BASEDN;

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek lc_req->quota = lctx->quota_kcm;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek } else {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = EINVAL;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (lc_req->path == NULL) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE,

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Failed to map request to local db path\n");

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = ENOMEM;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek ret = local_db_dn(mem_ctx, ldb, lc_req->basedn, lc_req->path, &lc_req->req_dn);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (ret != EOK) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek "Failed to map request to local db DN\n");

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Local DB path is %s\n", lc_req->path);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = EOK;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek *_lc_req = lc_req;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozekdone:

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (ret != EOK) {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek talloc_free(lc_req);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek return ret;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestruct local_secret_state {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_context *ev;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sec_req_ctx *secreq;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce};

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic struct tevent_req *local_secret_req(TALLOC_CTX *mem_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct tevent_context *ev,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio void *provider_ctx,

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct sec_req_ctx *secreq)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_req *req;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct local_secret_state *state;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct local_context *lctx;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sec_data body = { 0 };

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce const char *content_type;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce bool body_is_json;

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char *secret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **keys;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int nkeys;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int plen;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce req = tevent_req_create(mem_ctx, &state, struct local_secret_state);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!req) return NULL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce state->ev = ev;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce state->secreq = secreq;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce lctx = talloc_get_type(provider_ctx, struct local_context);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (!lctx) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EIO;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Received a local secrets request\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (sec_req_has_header(secreq, "Content-Type",

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce "application/json")) {

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body_is_json = true;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce content_type = "application/json";

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce } else if (sec_req_has_header(secreq, "Content-Type",

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce "application/octet-stream")) {

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body_is_json = false;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce content_type = "application/octet-stream";

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce } else {

677a31351c80453d9ce006481364399a96312052René Genz DEBUG(SSSDBG_OP_FAILURE, "No or unknown Content-Type\n");

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = EINVAL;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce goto done;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Content-Type: %s\n", content_type);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek ret = local_secrets_map_path(state, lctx, secreq, &lc_req);

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek if (ret) {

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot map request path to local path\n");

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek goto done;

60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce switch (secreq->method) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case HTTP_GET:

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Processing HTTP GET at [%s]\n", lc_req->path);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (lc_req->path[strlen(lc_req->path) - 1] == '/') {

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_list_keys(state, lctx, lc_req, &keys, &nkeys);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sec_array_to_json(state, keys, nkeys, &body.data);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body.length = strlen(body.data);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce break;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_get_simple(state, lctx, lc_req, &secret);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (ret) goto done;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (body_is_json) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sec_simple_secret_to_json(state, secret, &body.data);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body.length = strlen(body.data);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce } else {

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body.data = (void *)sss_base64_decode(state, secret, &body.length);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = body.data ? EOK : ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (ret) goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case HTTP_PUT:

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek if (secreq->body.length == 0) {

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "PUT with no data\n");

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek ret = EINVAL;

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek goto done;

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek }

73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Processing HTTP PUT at [%s]\n", lc_req->path);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (body_is_json) {

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = sec_json_to_simple_secret(state, secreq->body.data,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce &secret);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce } else {

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce secret = sss_base64_encode(state, (uint8_t *)secreq->body.data,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce secreq->body.length);

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = secret ? EOK : ENOMEM;

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_put_simple(state, lctx, lc_req, secret);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case HTTP_DELETE:

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_delete(state, lctx, lc_req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce case HTTP_POST:

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Processing HTTP POST at [%s]\n", lc_req->path);

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek plen = strlen(lc_req->path);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (lc_req->path[plen - 1] != '/') {

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = EINVAL;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek lc_req->path[plen - 1] = '\0';

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_create(state, lctx, lc_req);

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret) goto done;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce break;

a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce default:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EINVAL;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (body.data) {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sec_http_reply_with_body(secreq, &secreq->reply, STATUS_200,

e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce content_type, &body);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sec_http_status_reply(secreq, &secreq->reply, STATUS_200);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == ENOENT) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Did not find the requested data\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Local secrets request error [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_error(req, ret);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce /* shortcircuit the request here as all called functions are

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Local secrets request done\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_done(req);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return tevent_req_post(req, state->ev);

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int generate_master_key(const char *filename, size_t size)

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce uint8_t buf[size];

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ssize_t rsize;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int ret;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int fd;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = generate_csprng_buffer(buf, size);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "generate_csprng_buffer failed [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce fd = open(filename, O_CREAT|O_EXCL|O_WRONLY, 0600);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (fd == -1) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = errno;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "open(%s) failed [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek filename, ret, strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozek rsize = sss_atomic_write_s(fd, buf, size);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce close(fd);

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (rsize != size) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = errno;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "sss_atomic_write_s failed [%d]: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, strerror(ret));

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik ret = unlink(filename);

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik /* non-fatal failure */

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik if (ret != EOK) {

bc7991db97482eb2ac77f7105ee4bb3d329acff7Lukas Slebodnik ret = errno;

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik DEBUG(SSSDBG_MINOR_FAILURE,

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik "Failed to remove file: %s - %d [%s]!\n",

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik filename, ret, sss_strerror(ret));

6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EFAULT;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EOK;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorceint local_secrets_provider_handle(struct sec_ctx *sctx,

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce struct provider_handle **out_handle)

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce const char *mkey = SECRETS_DB_PATH"/.secrets.mkey";

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce const char *dbpath = SECRETS_DB_PATH"/secrets.ldb";

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce struct provider_handle *handle;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct local_context *lctx;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ssize_t size;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce int mfd;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Creating a local provider handle\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce handle = talloc_zero(sctx, struct provider_handle);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (!handle) return ENOMEM;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce handle->name = "LOCAL";

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce handle->fn = local_secret_req;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce lctx = talloc_zero(handle, struct local_context);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (!lctx) return ENOMEM;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce lctx->ldb = ldb_init(lctx, NULL);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (!lctx->ldb) return ENOMEM;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret = ldb_connect(lctx->ldb, dbpath, 0, NULL);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (ret != LDB_SUCCESS) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_connect(%s) returned %d: %s\n",

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek dbpath, ret, ldb_strerror(ret));

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce talloc_free(lctx->ldb);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce return EIO;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce }

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek lctx->quota_secrets = &sctx->sec_config.quota;

197da163943868216f704fb34031e7d5576e8aeeJakub Hrozek lctx->quota_kcm = &sctx->kcm_config.quota;

efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce lctx->master_key.data = talloc_size(lctx, MKEY_SIZE);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (!lctx->master_key.data) return ENOMEM;

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce lctx->master_key.length = MKEY_SIZE;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret = check_and_open_readonly(mkey, &mfd, 0, 0,

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce S_IFREG|S_IRUSR|S_IWUSR, 0);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (ret == ENOENT) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "No master key, generating a new one..\n");

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret = generate_master_key(mkey, MKEY_SIZE);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (ret) return EFAULT;

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = check_and_open_readonly(mkey, &mfd, 0, 0,

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce S_IFREG|S_IRUSR|S_IWUSR, 0);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce }

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot generate a master key: %d\n", ret);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EFAULT;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozek size = sss_atomic_read_s(mfd, lctx->master_key.data,

942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozek lctx->master_key.length);

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce close(mfd);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (size < 0 || size != lctx->master_key.length) {

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot read a master key: %d\n", ret);

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EIO;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }

625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce handle->context = lctx;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce

8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce *out_handle = handle;

7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Local provider handle created\n");

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return EOK;

1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}