local.c revision 7a162ca3ea0bf8ef6b13795a00baa28d17f6131d
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce/*
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce SSSD
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Secrets Responder
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce Copyright (C) Simo Sorce <ssorce@redhat.com> 2016
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce This program is free software; you can redistribute it and/or modify
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce it under the terms of the GNU General Public License as published by
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce the Free Software Foundation; either version 3 of the License, or
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce (at your option) any later version.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce This program is distributed in the hope that it will be useful,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce but WITHOUT ANY WARRANTY; without even the implied warranty of
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce GNU General Public License for more details.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce You should have received a copy of the GNU General Public License
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce along with this program. If not, see <http://www.gnu.org/licenses/>.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce*/
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce#include "responder/secrets/secsrv_private.h"
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#include "util/crypto/sss_crypto.h"
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce#include <time.h>
8890a30f5d054187fd7d5b50503f82a49cd025f0Lukas Slebodnik#include <sys/stat.h>
8890a30f5d054187fd7d5b50503f82a49cd025f0Lukas Slebodnik#include <fcntl.h>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce#include <ldb.h>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#define MKEY_SIZE (256 / 8)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek#define SECRETS_BASEDN "cn=secrets"
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek#define KCM_BASEDN "cn=kcm"
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorcestruct local_context {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct ldb_context *ldb;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct sec_data master_key;
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek struct sec_quota *quota_secrets;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce};
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_decrypt(struct local_context *lctx, TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *secret, const char *enctype,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio char **plain_secret)
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce char *output;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (enctype && strcmp(enctype, "masterkey") == 0) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Decrypting with masterkey\n");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct sec_data _secret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce size_t outlen;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce _secret.data = (char *)sss_base64_decode(mem_ctx, secret,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce &_secret.length);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (!_secret.data) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "sss_base64_decode failed\n");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EINVAL;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = sss_decrypt(mem_ctx, AES256CBC_HMAC_SHA256,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t *)lctx->master_key.data,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce lctx->master_key.length,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t *)_secret.data, _secret.length,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t **)&output, &outlen);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "sss_decrypt failed [%d]: %s\n", ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (((strnlen(output, outlen) + 1) != outlen) ||
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce output[outlen - 1] != '\0') {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Output length mismatch or output not NULL-terminated\n");
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EIO;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce } else {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce output = talloc_strdup(mem_ctx, secret);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (!output) return ENOMEM;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce *plain_secret = output;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EOK;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_encrypt(struct local_context *lctx, TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *secret, const char *enctype,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio char **ciphertext)
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct sec_data _secret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce char *output;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (enctype == NULL) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "No encryption type\n");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EINVAL;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (strcmp(enctype, "masterkey") != 0) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "Uknown encryption type '%s'\n", enctype);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EINVAL;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = sss_encrypt(mem_ctx, AES256CBC_HMAC_SHA256,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t *)lctx->master_key.data,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce lctx->master_key.length,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (const uint8_t *)secret, strlen(secret) + 1,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t **)&_secret.data, &_secret.length);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "sss_encrypt failed [%d]: %s\n", ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce output = sss_base64_encode(mem_ctx,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce (uint8_t *)_secret.data, _secret.length);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (!output) return ENOMEM;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce *ciphertext = output;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EOK;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_dn(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_context *ldb,
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek const char *basedn,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *req_path,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_dn **req_dn)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_dn *dn;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce const char *s, *e;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek dn = ldb_dn_new(mem_ctx, ldb, basedn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!dn) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce s = req_path;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce while (s && *s) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce e = strchr(s, '/');
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (e) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (e == s) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce s++;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce continue;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!ldb_dn_add_child_fmt(dn, "cn=%.*s", (int)(e - s), s)) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce s = e + 1;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!ldb_dn_add_child_fmt(dn, "cn=%s", s)) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce s = NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Local path for [%s] is [%s]\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek req_path, ldb_dn_get_linearized(dn));
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce *req_dn = dn;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic char *local_dn_to_path(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_dn *basedn,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_dn *dn)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int basecomps;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int dncomps;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char *path = NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce basecomps = ldb_dn_get_comp_num(basedn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce dncomps = ldb_dn_get_comp_num(dn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce for (int i = dncomps - basecomps; i > 0; i--) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce const struct ldb_val *val;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce val = ldb_dn_get_component_val(dn, i - 1);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!val) return NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (path) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce path = talloc_strdup_append_buffer(path, "/");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!path) return NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce path = talloc_strndup_append_buffer(path, (char *)val->data,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce val->length);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce path = talloc_strndup(mem_ctx, (char *)val->data, val->length);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!path) return NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Secrets path for [%s] is [%s]\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(dn), path);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return path;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozekstruct local_db_req {
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek char *path;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct ldb_dn *basedn;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek};
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce#define LOCAL_SIMPLE_FILTER "(type=simple)"
a8361f37af31a8a9767056bd27c418c947293f56Fabiano Fidêncio#define LOCAL_CONTAINER_FILTER "(type=container)"
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_get_simple(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio char **secret)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce TALLOC_CTX *tmp_ctx;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce static const char *attrs[] = { "secret", "enctype", NULL };
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_result *res;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce const char *attr_secret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce const char *attr_enctype;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Retrieving a secret from [%s]\n", lc_req->path);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tmp_ctx = talloc_new(mem_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!tmp_ctx) return ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Searching for [%s] at [%s] with scope=base\n",
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek LOCAL_SIMPLE_FILTER, ldb_dn_get_linearized(lc_req->basedn));
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, lc_req->basedn, LDB_SCOPE_BASE,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce attrs, "%s", LOCAL_SIMPLE_FILTER);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_search returned [%d]: %s\n", ret, ldb_strerror(ret));
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce switch (res->count) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case 0:
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "No secret found\n");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case 1:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce default:
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Too many secrets returned with BASE search\n");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = E2BIG;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce attr_secret = ldb_msg_find_attr_as_string(res->msgs[0], "secret", NULL);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!attr_secret) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "The 'secret' attribute is missing\n");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce attr_enctype = ldb_msg_find_attr_as_string(res->msgs[0], "enctype", NULL);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (attr_enctype) {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = local_decrypt(lctx, mem_ctx, attr_secret, attr_enctype, secret);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (ret) goto done;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce } else {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce *secret = talloc_strdup(mem_ctx, attr_secret);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(tmp_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_list_keys(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio char ***_keys,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio int *num_keys)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce TALLOC_CTX *tmp_ctx;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce static const char *attrs[] = { "secret", NULL };
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_result *res;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **keys;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tmp_ctx = talloc_new(mem_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!tmp_ctx) return ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Listing keys at [%s]\n", lc_req->path);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Searching for [%s] at [%s] with scope=subtree\n",
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek LOCAL_SIMPLE_FILTER, ldb_dn_get_linearized(lc_req->basedn));
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, lc_req->basedn, LDB_SCOPE_SUBTREE,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce attrs, "%s", LOCAL_SIMPLE_FILTER);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_search returned [%d]: %s\n", ret, ldb_strerror(ret));
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (res->count == 0) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "No secrets found\n");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce keys = talloc_array(mem_ctx, char *, res->count);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!keys) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce for (unsigned i = 0; i < res->count; i++) {
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek keys[i] = local_dn_to_path(keys, lc_req->basedn, res->msgs[i]->dn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!keys[i]) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce *_keys = keys;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Returning %d secrets\n", res->count);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce *num_keys = res->count;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(tmp_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_check_containers(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct ldb_dn *leaf_dn)
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce{
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio TALLOC_CTX *tmp_ctx;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce static const char *attrs[] = { NULL};
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct ldb_result *res = NULL;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct ldb_dn *dn;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int num;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int ret;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio tmp_ctx = talloc_new(mem_ctx);
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio if (!tmp_ctx) return ENOMEM;
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio dn = ldb_dn_copy(tmp_ctx, leaf_dn);
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio if (!dn) {
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio ret = ENOMEM;
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio goto done;
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* We need to exclude the leaf as that will be the new child entry,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce * We also do not care for the synthetic containers that constitute the
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce * base path (cn=<uidnumber>,cn=users,cn=secrets), so in total we remove
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce * 4 components */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce num = ldb_dn_get_comp_num(dn) - 4;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce for (int i = 0; i < num; i++) {
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* remove the child first (we do not want to check the leaf) */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (!ldb_dn_remove_child_components(dn, 1)) return EFAULT;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* and check the parent container exists */
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Searching for [%s] at [%s] with scope=base\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek LOCAL_CONTAINER_FILTER, ldb_dn_get_linearized(dn));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio ret = ldb_search(lctx->ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
a8361f37af31a8a9767056bd27c418c947293f56Fabiano Fidêncio attrs, LOCAL_CONTAINER_FILTER);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != LDB_SUCCESS || res->count != 1) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "DN [%s] does not exist\n", ldb_dn_get_linearized(dn));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ENOENT;
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio ret = EOK;
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidênciodone:
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio talloc_free(tmp_ctx);
d806427f200dc1ffd44d37724eb40125af5cc8c2Fabiano Fidêncio return ret;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce}
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidênciostatic int local_db_check_containers_nest_level(struct local_context *lctx,
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio struct ldb_dn *leaf_dn)
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio{
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio int nest_level;
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio /* We need do not care for the synthetic containers that constitute the
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio * base path (cn=<uidnumber>,cn=user,cn=secrets). */
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio nest_level = ldb_dn_get_comp_num(leaf_dn) - 3;
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek if (nest_level > lctx->quota_secrets->containers_nest_level) {
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio "Cannot create a nested container of depth %d as the maximum"
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio "allowed number of nested containers is %d.\n",
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek nest_level, lctx->quota_secrets->containers_nest_level);
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio return ERR_SEC_INVALID_CONTAINERS_NEST_LEVEL;
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio }
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio return EOK;
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio}
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciostatic int local_db_check_number_of_secrets(TALLOC_CTX *mem_ctx,
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct local_context *lctx)
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio{
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio TALLOC_CTX *tmp_ctx;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio static const char *attrs[] = { NULL };
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct ldb_result *res = NULL;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio struct ldb_dn *dn;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio int ret;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio tmp_ctx = talloc_new(mem_ctx);
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio if (!tmp_ctx) return ENOMEM;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio dn = ldb_dn_new(tmp_ctx, lctx->ldb, "cn=secrets");
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio if (!dn) {
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = ENOMEM;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio goto done;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = ldb_search(lctx->ldb, tmp_ctx, &res, dn, LDB_SCOPE_SUBTREE,
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio attrs, LOCAL_SIMPLE_FILTER);
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek if (res->count >= lctx->quota_secrets->max_secrets) {
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio "Cannot store any more secrets as the maximum allowed limit (%d) "
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek "has been reached\n", lctx->quota_secrets->max_secrets);
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = ERR_SEC_INVALID_TOO_MANY_SECRETS;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio goto done;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = EOK;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidênciodone:
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio talloc_free(tmp_ctx);
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio return ret;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio}
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidênciostatic int local_check_max_payload_size(struct local_context *lctx,
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio int payload_size)
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio{
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio int max_payload_size;
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek max_payload_size = lctx->quota_secrets->max_payload_size * 1024; /* kb */
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio if (payload_size > max_payload_size) {
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio "Secrets' payload size [%d kb (%d)] exceeds the maximum allowed "
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio "payload size [%d kb (%d)]\n",
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio payload_size * 1024, /* kb */
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio payload_size,
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek lctx->quota_secrets->max_payload_size, /* kb */
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio max_payload_size);
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio return ERR_SEC_PAYLOAD_SIZE_IS_TOO_LARGE;
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio }
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio return EOK;
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio}
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_put_simple(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio const char *secret)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct ldb_message *msg;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce const char *enctype = "masterkey";
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce char *enc_secret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Adding a secret to [%s]\n", lc_req->path);
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce msg = ldb_msg_new(mem_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!msg) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek msg->dn = lc_req->basedn;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* make sure containers exist */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = local_db_check_containers(msg, lctx, msg->dn);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "local_db_check_containers failed for [%s]: [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(msg->dn), ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret = local_db_check_number_of_secrets(msg, lctx);
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio if (ret != EOK) {
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio "local_db_check_number_of_secrets failed [%d]: %s\n",
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio ret, sss_strerror(ret));
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio goto done;
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio }
65a38b8c9cabde6c46cc0e9868f54cb9bb10afbfFabiano Fidêncio
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio ret = local_check_max_payload_size(lctx, strlen(secret));
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio if (ret != EOK) {
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio "local_check_max_payload_size failed [%d]: %s\n",
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio ret, sss_strerror(ret));
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio goto done;
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio }
7171a7584dda534dde5409f3e7f4657e845ece15Fabiano Fidêncio
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = local_encrypt(lctx, msg, secret, enctype, &enc_secret);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "local_encrypt failed [%d]: %s\n", ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = ldb_msg_add_string(msg, "type", "simple");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding type:simple [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = ldb_msg_add_string(msg, "enctype", enctype);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding enctype [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = ldb_msg_add_string(msg, "secret", enc_secret);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding secret [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ldb_msg_add_fmt(msg, "creationTime", "%lu", time(NULL));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding creationTime [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = ldb_add(lctx->ldb, msg);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Secret %s already exists\n", ldb_dn_get_linearized(msg->dn));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EEXIST;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Failed to add secret [%s]: [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(msg->dn), ret, ldb_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EIO;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce talloc_free(msg);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_delete(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio TALLOC_CTX *tmp_ctx;
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio static const char *attrs[] = { NULL };
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio struct ldb_result *res;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Removing a secret from [%s]\n", lc_req->path);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio tmp_ctx = talloc_new(mem_ctx);
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio if (!tmp_ctx) return ENOMEM;
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Searching for [%s] at [%s] with scope=base\n",
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek LOCAL_CONTAINER_FILTER, ldb_dn_get_linearized(lc_req->basedn));
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, lc_req->basedn, LDB_SCOPE_BASE,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek attrs, LOCAL_CONTAINER_FILTER);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_search returned %d: %s\n", ret, ldb_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio if (res->count == 1) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek "Searching for children of [%s]\n", ldb_dn_get_linearized(lc_req->basedn));
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = ldb_search(lctx->ldb, tmp_ctx, &res, lc_req->basedn, LDB_SCOPE_ONELEVEL,
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio attrs, NULL);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_search returned %d: %s\n", ret, ldb_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio if (res->count > 0) {
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio ret = EEXIST;
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio DEBUG(SSSDBG_OP_FAILURE,
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio "Failed to remove '%s': Container is not empty\n",
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ldb_dn_get_linearized(lc_req->basedn));
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio goto done;
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio }
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = ldb_delete(lctx->ldb, lc_req->basedn);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_delete returned %d: %s\n", ret, ldb_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek /* fallthrough */
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio ret = sysdb_error_to_errno(ret);
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidênciodone:
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio talloc_free(tmp_ctx);
ab7b33fd7d820688545d5994a402cedf4bcdb6e1Fabiano Fidêncio return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_db_create(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct local_context *lctx,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req)
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce{
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce struct ldb_message *msg;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int ret;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "Creating a container at [%s]\n", lc_req->path);
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce msg = ldb_msg_new(mem_ctx);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (!msg) {
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ENOMEM;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek msg->dn = lc_req->basedn;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce /* make sure containers exist */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = local_db_check_containers(msg, lctx, msg->dn);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "local_db_check_containers failed for [%s]: [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(msg->dn), ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio ret = local_db_check_containers_nest_level(lctx, msg->dn);
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio if (ret != EOK) goto done;
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ldb_msg_add_string(msg, "type", "container");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding type:container [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ldb_msg_add_fmt(msg, "creationTime", "%lu", time(NULL));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_msg_add_string failed adding creationTime [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek goto done;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = ldb_add(lctx->ldb, msg);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Secret %s already exists\n", ldb_dn_get_linearized(msg->dn));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EEXIST;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Failed to add secret [%s]: [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ldb_dn_get_linearized(msg->dn), ret, ldb_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = EIO;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = EOK;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorcedone:
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce talloc_free(msg);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce return ret;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce}
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int local_secrets_map_path(TALLOC_CTX *mem_ctx,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct ldb_context *ldb,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct sec_req_ctx *secreq,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req **_lc_req)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek const char *basedn;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce /* be strict for now */
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (secreq->parsed_url.fragment != NULL) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Unrecognized URI fragments: [%s]\n",
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce secreq->parsed_url.fragment);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return EINVAL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (secreq->parsed_url.userinfo != NULL) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Unrecognized URI userinfo: [%s]\n",
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce secreq->parsed_url.userinfo);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return EINVAL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce /* only type simple for now */
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (secreq->parsed_url.query != NULL) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = strcmp(secreq->parsed_url.query, "type=simple");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != 0) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Invalid URI query: [%s]\n",
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce secreq->parsed_url.query);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return EINVAL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek lc_req = talloc(mem_ctx, struct local_db_req);
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (lc_req == NULL) {
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek return ENOMEM;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek /* drop the prefix and select a basedn instead */
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (strncmp(secreq->mapped_path,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek SEC_BASEPATH, sizeof(SEC_BASEPATH) - 1) == 0) {
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek lc_req->path = talloc_strdup(lc_req,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek secreq->mapped_path + (sizeof(SEC_BASEPATH) - 1));
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek basedn = SECRETS_BASEDN;
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek } else if (strncmp(secreq->mapped_path,
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek SEC_KCM_BASEPATH, sizeof(SEC_KCM_BASEPATH) - 1) == 0) {
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek lc_req->path = talloc_strdup(lc_req,
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek secreq->mapped_path + (sizeof(SEC_KCM_BASEPATH) - 1));
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek basedn = KCM_BASEDN;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek } else {
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = EINVAL;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (lc_req->path == NULL) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce DEBUG(SSSDBG_CRIT_FAILURE,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce "Failed to map request to local db path\n");
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = ENOMEM;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_dn(mem_ctx, ldb, basedn, lc_req->path, &lc_req->basedn);
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (ret != EOK) {
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE,
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek "Failed to map request to local db DN\n");
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek goto done;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Local DB path is %s\n", lc_req->path);
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = EOK;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek *_lc_req = lc_req;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozekdone:
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (ret != EOK) {
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek talloc_free(lc_req);
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek }
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek return ret;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestruct local_secret_state {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_context *ev;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sec_req_ctx *secreq;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce};
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic struct tevent_req *local_secret_req(TALLOC_CTX *mem_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct tevent_context *ev,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio void *provider_ctx,
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidêncio struct sec_req_ctx *secreq)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct tevent_req *req;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct local_secret_state *state;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct local_context *lctx;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce struct sec_data body = { 0 };
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce const char *content_type;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce bool body_is_json;
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek struct local_db_req *lc_req;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char *secret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce char **keys;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int nkeys;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce int plen;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce req = tevent_req_create(mem_ctx, &state, struct local_secret_state);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (!req) return NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce state->ev = ev;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce state->secreq = secreq;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce lctx = talloc_get_type(provider_ctx, struct local_context);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (!lctx) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EIO;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Received a local secrets request\n");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (sec_req_has_header(secreq, "Content-Type",
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce "application/json")) {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body_is_json = true;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce content_type = "application/json";
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce } else if (sec_req_has_header(secreq, "Content-Type",
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce "application/octet-stream")) {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body_is_json = false;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce content_type = "application/octet-stream";
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce } else {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "No or uknown Content-Type\n");
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = EINVAL;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce goto done;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Content-Type: %s\n", content_type);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_secrets_map_path(state, lctx->ldb, secreq, &lc_req);
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek if (ret) {
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot map request path to local path\n");
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek goto done;
60612b5fbdaaa62ebe6c7f4c27200316f08506d6Jakub Hrozek }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce switch (secreq->method) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case HTTP_GET:
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Processing HTTP GET at [%s]\n", lc_req->path);
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (lc_req->path[strlen(lc_req->path) - 1] == '/') {
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_list_keys(state, lctx, lc_req, &keys, &nkeys);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sec_array_to_json(state, keys, nkeys, &body.data);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body.length = strlen(body.data);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce break;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_get_simple(state, lctx, lc_req, &secret);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (ret) goto done;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (body_is_json) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sec_simple_secret_to_json(state, secret, &body.data);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body.length = strlen(body.data);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce } else {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce body.data = (void *)sss_base64_decode(state, secret, &body.length);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = body.data ? EOK : ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case HTTP_PUT:
73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek if (secreq->body.length == 0) {
73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "PUT with no data\n");
73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek ret = EINVAL;
73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek goto done;
73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek }
73ce539aa70f43ccd5302b3ef8a02ff028558b12Jakub Hrozek
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Processing HTTP PUT at [%s]\n", lc_req->path);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce if (body_is_json) {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = sec_json_to_simple_secret(state, secreq->body.data,
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce &secret);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce } else {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce secret = sss_base64_encode(state, (uint8_t *)secreq->body.data,
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce secreq->body.length);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce ret = secret ? EOK : ENOMEM;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_put_simple(state, lctx, lc_req, secret);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce case HTTP_DELETE:
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_delete(state, lctx, lc_req);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce break;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce case HTTP_POST:
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Processing HTTP POST at [%s]\n", lc_req->path);
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek plen = strlen(lc_req->path);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek if (lc_req->path[plen - 1] != '/') {
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce ret = EINVAL;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek lc_req->path[plen - 1] = '\0';
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
8bb2fcbce7c3fcfd986f1bc835fbcc43ac7cd9d1Jakub Hrozek ret = local_db_create(state, lctx, lc_req);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce if (ret) goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce break;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce default:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = EINVAL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (body.data) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sec_http_reply_with_body(secreq, &secreq->reply, STATUS_200,
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce content_type, &body);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce ret = sec_http_status_reply(secreq, &secreq->reply, STATUS_200);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce if (ret != EOK) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret == ENOENT) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS, "Did not find the requested data\n");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek } else {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "Local secrets request error [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_error(req, ret);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce } else {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce /* shortcircuit the request here as all called functions are
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce * synchronous and final and no further subrequests are made */
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Local secrets request done\n");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce tevent_req_done(req);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return tevent_req_post(req, state->ev);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
f35f4e4c8bd5b834504c0554552d78db3624706aFabiano Fidênciostatic int generate_master_key(const char *filename, size_t size)
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce uint8_t buf[size];
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ssize_t rsize;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce int fd;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = generate_csprng_buffer(buf, size);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "generate_csprng_buffer failed [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, sss_strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce fd = open(filename, O_CREAT|O_EXCL|O_WRONLY, 0600);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (fd == -1) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = errno;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "open(%s) failed [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek filename, ret, strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return ret;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozek rsize = sss_atomic_write_s(fd, buf, size);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce close(fd);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce if (rsize != size) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret = errno;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "sss_atomic_write_s failed [%d]: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek ret, strerror(ret));
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik ret = unlink(filename);
6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik /* non-fatal failure */
6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik if (ret != EOK) {
bc7991db97482eb2ac77f7105ee4bb3d329acff7Lukas Slebodnik ret = errno;
6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik DEBUG(SSSDBG_MINOR_FAILURE,
6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik "Failed to remove file: %s - %d [%s]!\n",
6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik filename, ret, sss_strerror(ret));
6c82774653f37945bdd0a311eb1ecc289cac683dLukas Slebodnik }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EFAULT;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce return EOK;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorceint local_secrets_provider_handle(struct sec_ctx *sctx,
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce struct provider_handle **out_handle)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce const char *mkey = SECRETS_DB_PATH"/.secrets.mkey";
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce const char *dbpath = SECRETS_DB_PATH"/secrets.ldb";
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce struct provider_handle *handle;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce struct local_context *lctx;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ssize_t size;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce int mfd;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Creating a local provider handle\n");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce handle = talloc_zero(sctx, struct provider_handle);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (!handle) return ENOMEM;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce handle->name = "LOCAL";
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce handle->fn = local_secret_req;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce lctx = talloc_zero(handle, struct local_context);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (!lctx) return ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce lctx->ldb = ldb_init(lctx, NULL);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (!lctx->ldb) return ENOMEM;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret = ldb_connect(lctx->ldb, dbpath, 0, NULL);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (ret != LDB_SUCCESS) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_LIBS,
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek "ldb_connect(%s) returned %d: %s\n",
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek dbpath, ret, ldb_strerror(ret));
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce talloc_free(lctx->ldb);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce return EIO;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
7a162ca3ea0bf8ef6b13795a00baa28d17f6131dJakub Hrozek lctx->quota_secrets = &sctx->sec_config.quota;
efc65e78fa4e01e6cecc8690a9899af61213be62Fabiano Fidêncio
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce lctx->master_key.data = talloc_size(lctx, MKEY_SIZE);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (!lctx->master_key.data) return ENOMEM;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce lctx->master_key.length = MKEY_SIZE;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret = check_and_open_readonly(mkey, &mfd, 0, 0,
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce S_IFREG|S_IRUSR|S_IWUSR, 0);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (ret == ENOENT) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC, "No master key, generating a new one..\n");
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce ret = generate_master_key(mkey, MKEY_SIZE);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce if (ret) return EFAULT;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce ret = check_and_open_readonly(mkey, &mfd, 0, 0,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce S_IFREG|S_IRUSR|S_IWUSR, 0);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce }
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (ret) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot generate a master key: %d\n", ret);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EFAULT;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozek size = sss_atomic_read_s(mfd, lctx->master_key.data,
942b4ce6e60e88e4e31600655fad8980f3986f68Jakub Hrozek lctx->master_key.length);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce close(mfd);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek if (size < 0 || size != lctx->master_key.length) {
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Cannot read a master key: %d\n", ret);
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek return EIO;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce handle->context = lctx;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce *out_handle = handle;
7128fadade544efcd86b113a5090b00d20993671Jakub Hrozek DEBUG(SSSDBG_TRACE_INTERNAL, "Local provider handle created\n");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce return EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}