From 6236b14d20151053f5ccad1fc8ee9b669d4b0ffb Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Tue, 14 Mar 2017 11:17:05 +0100
Subject: [PATCH 34/36] KCM: Make the secrets ccache back end configurable,
make secrets the default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Adds a new option 'ccache_storage' that allows to select either the
memory back end or the secrets back end. The secrets back end is the
default one and this option is even undocumented.
Reviewed-by: Michal Židek <mzidek@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
---
src/confdb/confdb.h | 1 +
src/config/cfg_rules.ini | 1 +
src/responder/kcm/kcm.c | 49 ++++++++++++++++++++++++++++++++----
src/responder/kcm/kcmsrv_ccache.c | 2 +-
src/responder/kcm/kcmsrv_ccache.h | 6 +----
src/responder/kcm/kcmsrv_ccache_be.h | 1 +
src/responder/kcm/kcmsrv_pvt.h | 7 ++++++
7 files changed, 56 insertions(+), 11 deletions(-)
diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index c443e869a7a6782265b42c4ad122867c4e3dd8e0..fb60675ca8beb2c2a157bf021ed9cad362742988 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -234,6 +234,7 @@
/* KCM Service */
#define CONFDB_KCM_CONF_ENTRY "config/kcm"
#define CONFDB_KCM_SOCKET "socket_path"
+#define CONFDB_KCM_DB "ccache_storage" /* Undocumented on purpose */
struct confdb_ctx;
struct config_file_ctx;
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index 5e789c51658c51c0af1338d23d6c0f30f40bf119..67a5d1f5ad447a942b437ffd04a7f5d7cfe77d7f 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -280,6 +280,7 @@ option = fd_limit
option = client_idle_timeout
option = description
option = socket_path
+option = ccache_storage
[rule/allowed_domain_options]
validator = ini_allowed_options
diff --git a/src/responder/kcm/kcm.c b/src/responder/kcm/kcm.c
index 2c12ef215ce3967df183e51c20590c5f439d278f..063c27b915b4b92f6259496feee891aa94a498b6 100644
--- a/src/responder/kcm/kcm.c
+++ b/src/responder/kcm/kcm.c
@@ -47,6 +47,37 @@ static int kcm_responder_ctx_destructor(void *ptr)
return 0;
}
+static errno_t kcm_get_ccdb_be(struct kcm_ctx *kctx)
+{
+ errno_t ret;
+ char *str_db;
+
+ ret = confdb_get_string(kctx->rctx->cdb,
+ kctx->rctx,
+ kctx->rctx->confdb_service_path,
+ CONFDB_KCM_DB,
+ "secrets",
+ &str_db);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Cannot get the KCM database type [%d]: %s\n",
+ ret, strerror(ret));
+ return ret;
+ }
+
+ DEBUG(SSSDBG_CONF_SETTINGS, "KCM database type: %s\n", str_db);
+ if (strcasecmp(str_db, "memory") == 0) {
+ kctx->cc_be = CCDB_BE_MEMORY;
+ return EOK;
+ } else if (strcasecmp(str_db, "secrets") == 0) {
+ kctx->cc_be = CCDB_BE_SECRETS;
+ return EOK;
+ }
+
+ DEBUG(SSSDBG_FATAL_FAILURE, "Unexpected KCM database type %s\n", str_db);
+ return EOK;
+}
+
static int kcm_get_config(struct kcm_ctx *kctx)
{
int ret;
@@ -88,14 +119,21 @@ static int kcm_get_config(struct kcm_ctx *kctx)
&sock_name);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE,
- "Cannot get the client idle timeout [%d]: %s\n",
+ "Cannot get KCM socket path [%d]: %s\n",
ret, strerror(ret));
goto done;
}
kctx->rctx->sock_name = sock_name;
+ ret = kcm_get_ccdb_be(kctx);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Cannot get KCM ccache DB [%d]: %s\n",
+ ret, strerror(ret));
+ goto done;
+ }
+
ret = EOK;
-
done:
return ret;
}
@@ -111,7 +149,8 @@ static int kcm_data_destructor(void *ptr)
}
static struct kcm_resp_ctx *kcm_data_setup(TALLOC_CTX *mem_ctx,
- struct tevent_context *ev)
+ struct tevent_context *ev,
+ enum kcm_ccdb_be cc_be)
{
struct kcm_resp_ctx *kcm_data;
krb5_error_code kret;
@@ -122,7 +161,7 @@ static struct kcm_resp_ctx *kcm_data_setup(TALLOC_CTX *mem_ctx,
return NULL;
}
- kcm_data->db = kcm_ccdb_init(kcm_data, ev, CCDB_BE_MEMORY);
+ kcm_data->db = kcm_ccdb_init(kcm_data, ev, cc_be);
if (kcm_data->db == NULL) {
talloc_free(kcm_data);
return NULL;
@@ -176,7 +215,7 @@ static int kcm_process_init(TALLOC_CTX *mem_ctx,
goto fail;
}
- kctx->kcm_data = kcm_data_setup(kctx, ev);
+ kctx->kcm_data = kcm_data_setup(kctx, ev, kctx->cc_be);
if (kctx->kcm_data == NULL) {
DEBUG(SSSDBG_FATAL_FAILURE,
"fatal error initializing responder data\n");
diff --git a/src/responder/kcm/kcmsrv_ccache.c b/src/responder/kcm/kcmsrv_ccache.c
index 2ae120269b0c62275ba2acdff6d6daa8b7077708..a22184e0f2b1300f3678bb343b6a110bf144a36b 100644
--- a/src/responder/kcm/kcmsrv_ccache.c
+++ b/src/responder/kcm/kcmsrv_ccache.c
@@ -244,7 +244,7 @@ struct kcm_ccdb *kcm_ccdb_init(TALLOC_CTX *mem_ctx,
break;
case CCDB_BE_SECRETS:
DEBUG(SSSDBG_FUNC_DATA, "KCM back end: sssd-secrets\n");
- /* Not implemented yet */
+ ccdb->ops = &ccdb_sec_ops;
break;
default:
DEBUG(SSSDBG_CRIT_FAILURE, "Unknown ccache database\n");
diff --git a/src/responder/kcm/kcmsrv_ccache.h b/src/responder/kcm/kcmsrv_ccache.h
index 18c8c47ad4ecb24521a85a1833b239c7a2a8bb45..36c481c5335d557318f0ed0204d93e533b4b6c41 100644
--- a/src/responder/kcm/kcmsrv_ccache.h
+++ b/src/responder/kcm/kcmsrv_ccache.h
@@ -29,6 +29,7 @@
#include "util/util.h"
#include "util/sss_iobuf.h"
#include "util/util_creds.h"
+#include "responder/kcm/kcmsrv_pvt.h"
#define UUID_BYTES 16
#define UUID_STR_SIZE 37
@@ -113,11 +114,6 @@ errno_t kcm_cc_store_cred_blob(struct kcm_ccache *cc,
struct kcm_cred *kcm_cc_get_cred(struct kcm_ccache *cc);
struct kcm_cred *kcm_cc_next_cred(struct kcm_cred *crd);
-enum kcm_ccdb_be {
- CCDB_BE_MEMORY,
- CCDB_BE_SECRETS,
-};
-
/* An opaque database that contains all the ccaches */
struct kcm_ccdb;
diff --git a/src/responder/kcm/kcmsrv_ccache_be.h b/src/responder/kcm/kcmsrv_ccache_be.h
index 1bd2b6981e227675866e82e0a5389445cac4df66..a0796c298bae15a01adf612a6195a494ba6b4d23 100644
--- a/src/responder/kcm/kcmsrv_ccache_be.h
+++ b/src/responder/kcm/kcmsrv_ccache_be.h
@@ -200,5 +200,6 @@ struct kcm_ccdb_ops {
};
extern const struct kcm_ccdb_ops ccdb_mem_ops;
+extern const struct kcm_ccdb_ops ccdb_sec_ops;
#endif /* _KCMSRV_CCACHE_BE_ */
diff --git a/src/responder/kcm/kcmsrv_pvt.h b/src/responder/kcm/kcmsrv_pvt.h
index a29680246c1e616da75e1bbff951ce2fad66fb65..74f30c00014105ed533744779b02c5d42523722d 100644
--- a/src/responder/kcm/kcmsrv_pvt.h
+++ b/src/responder/kcm/kcmsrv_pvt.h
@@ -49,6 +49,12 @@ struct kcm_resp_ctx {
struct kcm_ccdb *db;
};
+/* Supported ccache back ends */
+enum kcm_ccdb_be {
+ CCDB_BE_MEMORY,
+ CCDB_BE_SECRETS,
+};
+
/*
* responder context that contains both the responder data,
* like the ccaches and the sssd-specific stuff like the
@@ -58,6 +64,7 @@ struct kcm_ctx {
struct resp_ctx *rctx;
int fd_limit;
char *socket_path;
+ enum kcm_ccdb_be cc_be;
struct kcm_resp_ctx *kcm_data;
};
--
2.9.3