responder/secrets/local.c

	local.c revision a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce/*
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   SSSD
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   Secrets Responder
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   Copyright (C) Simo Sorce <ssorce@redhat.com> 2016
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   This program is free software; you can redistribute it and/or modify
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   it under the terms of the GNU General Public License as published by
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   the Free Software Foundation; either version 3 of the License, or
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   (at your option) any later version.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   This program is distributed in the hope that it will be useful,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   but WITHOUT ANY WARRANTY; without even the implied warranty of
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   GNU General Public License for more details.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   You should have received a copy of the GNU General Public License
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce   along with this program.  If not, see <http://www.gnu.org/licenses/>.
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce*/
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce#include "responder/secrets/secsrv_private.h"
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#include "util/crypto/sss_crypto.h"
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce#include <time.h>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce#include <ldb.h>
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce#define MKEY_SIZE (256 / 8)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorcestruct local_context {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    struct ldb_context *ldb;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    struct sec_data master_key;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce};
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorceint local_decrypt(struct local_context *lctx, TALLOC_CTX *mem_ctx,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                  const char *secret, const char *enctype,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                  char **plain_secret)
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    char *output;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (enctype && strcmp(enctype, "masterkey") == 0) {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        struct sec_data _secret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        size_t outlen;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        int ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        _secret.data = (char *)sss_base64_decode(mem_ctx, secret,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                                                 &_secret.length);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        if (!_secret.data) return EINVAL;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        ret = sss_decrypt(mem_ctx, AES256CBC_HMAC_SHA256,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                          (uint8_t *)lctx->master_key.data,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                          lctx->master_key.length,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                          (uint8_t *)_secret.data, _secret.length,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                          (uint8_t **)&output, &outlen);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        if (ret) return ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        if (((strnlen(output, outlen) + 1) != outlen) ||
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce            output[outlen - 1] != '\0') {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce            return EIO;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    } else {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        output = talloc_strdup(mem_ctx, secret);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        if (!output) return ENOMEM;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    *plain_secret = output;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    return EOK;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorceint local_encrypt(struct local_context *lctx, TALLOC_CTX *mem_ctx,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                  const char *secret, const char *enctype,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                  char **ciphertext)
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    struct sec_data _secret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    char *output;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    int ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (!enctype || strcmp(enctype, "masterkey") != 0) return EINVAL;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = sss_encrypt(mem_ctx, AES256CBC_HMAC_SHA256,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                      (uint8_t *)lctx->master_key.data,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                      lctx->master_key.length,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                      (const uint8_t *)secret, strlen(secret) + 1,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                      (uint8_t **)&_secret.data, &_secret.length);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (ret) return ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    output = sss_base64_encode(mem_ctx,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                               (uint8_t *)_secret.data, _secret.length);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (!output) return ENOMEM;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    *ciphertext = output;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    return EOK;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorceint local_db_dn(TALLOC_CTX *mem_ctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                struct ldb_context *ldb,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                const char *req_path,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                struct ldb_dn **req_dn)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct ldb_dn *dn;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    const char *s, *e;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    dn = ldb_dn_new(mem_ctx, ldb, "cn=secrets");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (!dn) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    s = req_path;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    while (s && *s) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        e = strchr(s, '/');
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (e) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            if (e == s) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                s++;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                continue;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            if (!ldb_dn_add_child_fmt(dn, "cn=%.*s", (int)(e - s), s)) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            s = e + 1;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        } else {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            if (!ldb_dn_add_child_fmt(dn, "cn=%s", s)) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            s = NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    *req_dn = dn;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    ret = EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcechar *local_dn_to_path(TALLOC_CTX *mem_ctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                       struct ldb_dn *basedn,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                       struct ldb_dn *dn)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int basecomps;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int dncomps;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    char *path = NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    basecomps = ldb_dn_get_comp_num(basedn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    dncomps = ldb_dn_get_comp_num(dn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    for (int i = dncomps - basecomps; i > 0; i--) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        const struct ldb_val *val;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        val = ldb_dn_get_component_val(dn, i - 1);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (!val) return NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (path) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            path = talloc_strdup_append_buffer(path, "/");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            if (!path) return NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            path = talloc_strndup_append_buffer(path, (char *)val->data,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                                                val->length);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        } else {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            path = talloc_strndup(mem_ctx, (char *)val->data, val->length);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (!path) return NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return path;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce#define LOCAL_SIMPLE_FILTER "(type=simple)"
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorceint local_db_get_simple(TALLOC_CTX *mem_ctx,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                        struct local_context *lctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                        const char *req_path,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                        char **secret)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    TALLOC_CTX *tmp_ctx;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    static const char *attrs[] = { "secret", "enctype", NULL };
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct ldb_result *res;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct ldb_dn *dn;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    const char *attr_secret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    const char *attr_enctype;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    tmp_ctx = talloc_new(mem_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (!tmp_ctx) return ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = local_db_dn(tmp_ctx, lctx->ldb, req_path, &dn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = ldb_search(lctx->ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce                     attrs, "%s", LOCAL_SIMPLE_FILTER);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    switch (res->count) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    case 0:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    case 1:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        break;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    default:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = E2BIG;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    attr_secret = ldb_msg_find_attr_as_string(res->msgs[0], "secret", NULL);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (!attr_secret) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    attr_enctype = ldb_msg_find_attr_as_string(res->msgs[0], "enctype", NULL);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (attr_enctype) {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        ret = local_decrypt(lctx, mem_ctx, attr_secret, attr_enctype, secret);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        if (ret) goto done;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    } else {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        *secret = talloc_strdup(mem_ctx, attr_secret);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    ret = EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    talloc_free(tmp_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorceint local_db_list_keys(TALLOC_CTX *mem_ctx,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                       struct local_context *lctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                       const char *req_path,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                       char ***_keys,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                       int *num_keys)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    TALLOC_CTX *tmp_ctx;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    static const char *attrs[] = { "secret", NULL };
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct ldb_result *res;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct ldb_dn *dn;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    char **keys;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    tmp_ctx = talloc_new(mem_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (!tmp_ctx) return ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = local_db_dn(tmp_ctx, lctx->ldb, req_path, &dn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = ldb_search(lctx->ldb, tmp_ctx, &res, dn, LDB_SCOPE_SUBTREE,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce                     attrs, "%s", LOCAL_SIMPLE_FILTER);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (res->count == 0) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = ENOENT;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    keys = talloc_array(mem_ctx, char *, res->count);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (!keys) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    for (unsigned i = 0; i < res->count; i++) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        keys[i] = local_dn_to_path(keys, dn, res->msgs[i]->dn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (!keys[i]) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    *_keys = keys;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    *num_keys = res->count;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    ret = EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    talloc_free(tmp_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorceint local_db_check_containers(TALLOC_CTX *mem_ctx,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce                              struct local_context *lctx,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce                              struct ldb_dn *leaf_dn)
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce{
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    static const char *attrs[] = { NULL};
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    struct ldb_result *res = NULL;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    struct ldb_dn *dn;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    int num;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    int ret;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    dn = ldb_dn_copy(mem_ctx, leaf_dn);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (!dn) return ENOMEM;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    /* We need to exclude the leaf as that will be the new child entry,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce     * We also do not care for the synthetic containers that constitute the
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce     * base path (cn=<uidnumber>,cn=users,cn=secrets), so in total we remove
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce     * 4 components */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    num = ldb_dn_get_comp_num(dn) - 4;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    for (int i = 0; i < num; i++) {
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        /* remove the child first (we do not want to check the leaf) */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        if (!ldb_dn_remove_child_components(dn, 1)) return EFAULT;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        /* and check the parent container exists */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        ret = ldb_search(lctx->ldb, mem_ctx, &res, dn, LDB_SCOPE_BASE,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce                         attrs, LOCAL_SIMPLE_FILTER);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        if (ret != LDB_SUCCESS) return ENOENT;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        if (res->count != 1) return ENOENT;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        talloc_free(res);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    return EOK;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce}
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorceint local_db_put_simple(TALLOC_CTX *mem_ctx,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                        struct local_context *lctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                        const char *req_path,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                        const char *secret)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct ldb_message *msg;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    const char *enctype = "masterkey";
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    char *enc_secret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    msg = ldb_msg_new(mem_ctx);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (!msg) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = local_db_dn(msg, lctx->ldb, req_path, &msg->dn);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (ret != EOK) goto done;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    /* make sure containers exist */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = local_db_check_containers(msg, lctx, msg->dn);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (ret != EOK) goto done;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = local_encrypt(lctx, msg, secret, enctype, &enc_secret);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    ret = ldb_msg_add_string(msg, "type", "simple");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = ldb_msg_add_string(msg, "enctype", enctype);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (ret != EOK) goto done;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = ldb_msg_add_string(msg, "secret", enc_secret);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = ldb_msg_add_fmt(msg, "creationTime", "%lu", time(NULL));
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (ret != EOK) goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = ldb_add(lctx->ldb, msg);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) ret = EEXIST;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        else ret = EIO;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    ret = EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    talloc_free(msg);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorceint local_db_delete(TALLOC_CTX *mem_ctx,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                    struct local_context *lctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                    const char *req_path)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct ldb_dn *dn;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = local_db_dn(mem_ctx, lctx->ldb, req_path, &dn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = ldb_delete(lctx->ldb, dn);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = EIO;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorceint local_db_create(TALLOC_CTX *mem_ctx,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce                    struct local_context *lctx,
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce                    const char *req_path)
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce{
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    struct ldb_message *msg;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    int ret;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    msg = ldb_msg_new(mem_ctx);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (!msg) {
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        ret = ENOMEM;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = local_db_dn(msg, lctx->ldb, req_path, &msg->dn);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (ret != EOK) goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    /* make sure containers exist */
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = local_db_check_containers(msg, lctx, msg->dn);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (ret != EOK) goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = ldb_msg_add_string(msg, "type", "container");
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (ret != EOK) goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = ldb_msg_add_fmt(msg, "creationTime", "%lu", time(NULL));
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (ret != EOK) goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = ldb_add(lctx->ldb, msg);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    if (ret != EOK) {
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) ret = EEXIST;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        else ret = EIO;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    ret = EOK;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorcedone:
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    talloc_free(msg);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    return ret;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce}
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorceint local_secrets_map_path(TALLOC_CTX *mem_ctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                           struct sec_req_ctx *secreq,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                           char **local_db_path)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    /* be strict for now */
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (secreq->parsed_url.fragment != NULL) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        DEBUG(SSSDBG_CRIT_FAILURE,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce              "Unrecognized URI fragments: [%s]\n",
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce              secreq->parsed_url.fragment);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        return EINVAL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (secreq->parsed_url.userinfo != NULL) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        DEBUG(SSSDBG_CRIT_FAILURE,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce              "Unrecognized URI userinfo: [%s]\n",
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce              secreq->parsed_url.userinfo);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        return EINVAL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    /* only type simple for now */
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (secreq->parsed_url.query != NULL) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = strcmp(secreq->parsed_url.query, "type=simple");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (ret != 0) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            DEBUG(SSSDBG_CRIT_FAILURE,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                  "Invalid URI query: [%s]\n",
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                  secreq->parsed_url.query);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            return EINVAL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    /* drop SEC_BASEPATH prefix */
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    *local_db_path =
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        talloc_strdup(mem_ctx, &secreq->mapped_path[sizeof(SEC_BASEPATH) - 1]);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (!*local_db_path) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        DEBUG(SSSDBG_CRIT_FAILURE,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce              "Failed to map request to local db path\n");
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        return ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestruct local_secret_state {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct tevent_context *ev;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct sec_req_ctx *secreq;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce};
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcestruct tevent_req *local_secret_req(TALLOC_CTX *mem_ctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                                    struct tevent_context *ev,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                                    void *provider_ctx,
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce                                    struct sec_req_ctx *secreq)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct tevent_req *req;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct local_secret_state *state;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    struct local_context *lctx;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    struct sec_data body = { 0 };
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce    const char *content_type;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce    bool body_is_json;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    char *req_path;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    char *secret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    char **keys;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int nkeys;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    int plen;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    req = tevent_req_create(mem_ctx, &state, struct local_secret_state);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (!req) return NULL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    state->ev = ev;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    state->secreq = secreq;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    lctx = talloc_get_type(provider_ctx, struct local_context);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (!lctx) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = EIO;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce    if (sec_req_has_header(secreq, "Content-Type",
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce                                  "application/json")) {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        body_is_json = true;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        content_type = "application/json";
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce    } else if (sec_req_has_header(secreq, "Content-Type",
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce                           "application/octet-stream")) {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        body_is_json = false;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        content_type = "application/octet-stream";
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce    } else {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        ret = EINVAL;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        goto done;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce    }
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    ret = local_secrets_map_path(state, secreq, &req_path);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    switch (secreq->method) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    case HTTP_GET:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (req_path[strlen(req_path) - 1] == '/') {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce            ret = local_db_list_keys(state, lctx, req_path, &keys, &nkeys);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            ret = sec_array_to_json(state, keys, nkeys, &body.data);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce            body.length = strlen(body.data);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce            break;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        }
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        ret = local_db_get_simple(state, lctx, req_path, &secret);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        if (ret) goto done;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        if (body_is_json) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            ret = sec_simple_secret_to_json(state, secret, &body.data);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce            if (ret) goto done;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce            body.length = strlen(body.data);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        } else {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce            body.data = (void *)sss_base64_decode(state, secret, &body.length);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce            ret = body.data ? EOK : ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        }
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        break;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    case HTTP_PUT:
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        if (body_is_json) {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce            ret = sec_json_to_simple_secret(state, secreq->body.data,
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce                                            &secret);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        } else {
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce            secret = sss_base64_encode(state, (uint8_t *)secreq->body.data,
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce                                       secreq->body.length);
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce            ret = secret ? EOK : ENOMEM;
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce        }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        ret = local_db_put_simple(state, lctx, req_path, secret);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        break;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    case HTTP_DELETE:
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        ret = local_db_delete(state, lctx, req_path);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        if (ret) goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        break;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce    case HTTP_POST:
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        plen = strlen(req_path);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        if (req_path[plen - 1] != '/') {
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce            ret = EINVAL;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce            goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        }
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        req_path[plen - 1] = '\0';
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        ret = local_db_create(state, lctx, req_path);
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        if (ret) goto done;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce        break;
a9d46b86993ee8d87fddf0ba50665c0b1b78ebb7Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    default:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = EINVAL;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        goto done;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (body.data) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = sec_http_reply_with_body(secreq, &secreq->reply, STATUS_200,
e625eb47a3091d92eda2271b123f8aab06227b63Simo Sorce                                       content_type, &body);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    } else {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        ret = sec_http_status_reply(secreq, &secreq->reply, STATUS_200);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorcedone:
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    if (ret != EOK) {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        tevent_req_error(req, ret);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    } else {
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        /* shortcircuit the request here as all called functions are
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce         * synchronous and final and no further subrequests are made */
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce        tevent_req_done(req);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return tevent_req_post(req, state->ev);
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorceint generate_master_key(const char *filename, size_t size)
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce{
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    uint8_t buf[size];
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ssize_t rsize;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    int ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    int fd;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    ret = generate_csprng_buffer(buf, size);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (ret) return ret;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    fd = open(filename, O_CREAT|O_EXCL|O_WRONLY, 0600);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (fd == -1) return errno;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    rsize = sss_atomic_io_s(fd, buf, size, false);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    close(fd);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    if (rsize != size) {
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        unlink(filename);
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        return EFAULT;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    }
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    return EOK;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce}
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorceint local_secrets_provider_handle(struct sec_ctx *sctx,
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce                                  struct provider_handle **out_handle)
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce{
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    const char *mkey = SECRETS_DB_PATH"/.secrets.mkey";
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    const char *dbpath = SECRETS_DB_PATH"/secrets.ldb";
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    struct provider_handle *handle;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce    struct local_context *lctx;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    ssize_t size;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    int mfd;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    int ret;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    handle = talloc_zero(sctx, struct provider_handle);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    if (!handle) return ENOMEM;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    handle->name = "LOCAL";
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    handle->fn = local_secret_req;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    lctx = talloc_zero(handle, struct local_context);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    if (!lctx) return ENOMEM;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    lctx->ldb = ldb_init(lctx, NULL);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    if (!lctx->ldb) return ENOMEM;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    ret = ldb_connect(lctx->ldb, dbpath, 0, NULL);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    if (ret != LDB_SUCCESS) {
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce        talloc_free(lctx->ldb);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce        return EIO;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    }
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    lctx->master_key.data = talloc_size(lctx, MKEY_SIZE);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    if (!lctx->master_key.data) return ENOMEM;
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    lctx->master_key.length = MKEY_SIZE;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    ret = check_and_open_readonly(mkey, &mfd, 0, 0,
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce                                  S_IFREG|S_IRUSR|S_IWUSR, 0);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    if (ret == ENOENT) {
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce        ret = generate_master_key(mkey, MKEY_SIZE);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce        if (ret) return EFAULT;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce        ret = check_and_open_readonly(mkey, &mfd, 0, 0,
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce                                      S_IFREG|S_IRUSR|S_IWUSR, 0);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    }
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    if (ret) return EFAULT;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    size = sss_atomic_io_s(mfd, lctx->master_key.data,
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce                           lctx->master_key.length, true);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    close(mfd);
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    if (size < 0 || size != lctx->master_key.length) return EIO;
625bb2ddf15e8f305a53afa44e87f2146fa930afSimo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    handle->context = lctx;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce
8f2a34cc6964a1f80a1434e05315a7ae0bb5774eSimo Sorce    *out_handle = handle;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce    return EOK;
1dd679584241a0f9b29072c7eed1c5c5e4a577e4Simo Sorce}