|
 |
8ad293 |
From 18b98836ef8e337992f0ecb239a32b9c3cedb750 Mon Sep 17 00:00:00 2001
|
|
|
8ad293 |
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
|
|
8ad293 |
Date: Wed, 9 Dec 2020 14:07:22 +0100
|
|
|
8ad293 |
Subject: [PATCH] kcm: decode base64 encoded secret on upgrade path
|
|
|
8ad293 |
|
|
|
8ad293 |
Previous unefficient code encoded the secret multiple times:
|
|
|
8ad293 |
secret -> base64 -> masterkey -> base64
|
|
|
8ad293 |
|
|
|
8ad293 |
To allow smooth upgrade for already existant ccache we need to also decode
|
|
|
8ad293 |
the secret if it is still in the old format (type == simple). Otherwise
|
|
|
8ad293 |
users are not able to log in.
|
|
|
8ad293 |
|
|
|
8ad293 |
Resolves: https://github.com/SSSD/sssd/issues/5349
|
|
|
8ad293 |
|
|
|
8ad293 |
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
|
|
|
8ad293 |
---
|
|
|
8ad293 |
src/responder/kcm/kcmsrv_ccache_secdb.c | 10 ++++++++++
|
|
|
8ad293 |
1 file changed, 10 insertions(+)
|
|
|
8ad293 |
|
|
|
8ad293 |
diff --git a/src/responder/kcm/kcmsrv_ccache_secdb.c b/src/responder/kcm/kcmsrv_ccache_secdb.c
|
|
|
8ad293 |
index 726711ac4..ea5c8f9ee 100644
|
|
|
8ad293 |
--- a/src/responder/kcm/kcmsrv_ccache_secdb.c
|
|
|
8ad293 |
+++ b/src/responder/kcm/kcmsrv_ccache_secdb.c
|
|
|
8ad293 |
@@ -59,6 +59,16 @@ static errno_t sec_get(TALLOC_CTX *mem_ctx,
|
|
|
8ad293 |
goto done;
|
|
|
8ad293 |
}
|
|
|
8ad293 |
|
|
|
8ad293 |
+ if (strcmp(datatype, "simple") == 0) {
|
|
|
8ad293 |
+ /* The secret is stored in b64 encoding, we need to decode it first. */
|
|
|
8ad293 |
+ data = sss_base64_decode(tmp_ctx, (const char*)data, &len;;
|
|
|
8ad293 |
+ if (data == NULL) {
|
|
|
8ad293 |
+ DEBUG(SSSDBG_CRIT_FAILURE, "Cannot decode secret from base64\n");
|
|
|
8ad293 |
+ ret = EIO;
|
|
|
8ad293 |
+ goto done;
|
|
|
8ad293 |
+ }
|
|
|
8ad293 |
+ }
|
|
|
8ad293 |
+
|
|
|
8ad293 |
buf = sss_iobuf_init_steal(tmp_ctx, data, len);
|
|
|
8ad293 |
if (buf == NULL) {
|
|
|
8ad293 |
DEBUG(SSSDBG_CRIT_FAILURE, "Cannot init the iobuf\n");
|
|
|
8ad293 |
--
|
|
|
8ad293 |
2.21.3
|
|
|
8ad293 |
|