SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #30143 from poettering/machine-credential-fixes

Browse Source 
machine credential fixes
This commit is contained in:
Luca Boccassi
2023-11-22 17:43:14 +00:00
committed by GitHub
parent 31897753fb 2105f79ed3
commit c1fd45d067
3 changed files with 31 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nspawn/nspawn.c
+3 -6
View File
@@ -1569,19 +1569,16 @@ static int parse_argv(int argc, char *argv[]) {
case ARG_SET_CREDENTIAL:
r = machine_credential_set(&arg_credentials, &arg_n_credentials, optarg);
if (r == -ENOMEM)
return log_oom();
if (r < 0)
return log_error_errno(r, "Failed to set credential from %s: %m", optarg);
return r;
arg_settings_mask |= SETTING_CREDENTIALS;
break;
case ARG_LOAD_CREDENTIAL:
r = machine_credential_load(&arg_credentials, &arg_n_credentials, optarg);
if (r == -ENOMEM)
return log_oom();
if (r < 0)
return log_error_errno(r, "Failed to load credential from %s: %m", optarg);
return r;
arg_settings_mask |= SETTING_CREDENTIALS;
break;
src/shared/machine-credential.c
+26 -36
View File
@@ -30,26 +30,23 @@ void machine_credential_free_all(MachineCredential *creds, size_t n) {
int machine_credential_set(MachineCredential **credentials, size_t *n_credentials, const char *cred_string) {
_cleanup_free_ char *word = NULL, *data = NULL;
MachineCredential *creds = *ASSERT_PTR(credentials);
ssize_t l;
size_t n_creds = *ASSERT_PTR(n_credentials);
int r;
const char *p = ASSERT_PTR(cred_string);
assert(creds || n_creds == 0);
assert(credentials && n_credentials);
assert(*credentials || *n_credentials == 0);
r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
if (r == -ENOMEM)
return r;
if (r < 0)
return log_error_errno(r, "Failed to parse --set-credential= parameter: %m");
if (r == 0 || !p)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --set-credential=: %s", cred_string);
if (!credential_name_valid(word))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "MachineCredential name is not valid: %s", word);
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
FOREACH_ARRAY(cred, creds, n_creds)
FOREACH_ARRAY(cred, *credentials, *n_credentials)
if (streq(cred->id, word))
return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
@@ -57,19 +54,15 @@ int machine_credential_set(MachineCredential **credentials, size_t *n_credential
if (l < 0)
return log_error_errno(l, "Failed to unescape credential data: %s", p);
GREEDY_REALLOC(creds, n_creds + 1);
if (!creds)
return -ENOMEM;
if (!GREEDY_REALLOC(*credentials, *n_credentials + 1))
return log_oom();
creds[n_creds++] = (MachineCredential) {
(*credentials)[(*n_credentials)++] = (MachineCredential) {
.id = TAKE_PTR(word),
.data = TAKE_PTR(data),
.size = l,
};
*credentials = creds;
*n_credentials = n_creds;
return 0;
}
@@ -77,61 +70,58 @@ int machine_credential_load(MachineCredential **credentials, size_t *n_credentia
ReadFullFileFlags flags = READ_FULL_FILE_SECURE;
_cleanup_(erase_and_freep) char *data = NULL;
_cleanup_free_ char *word = NULL, *j = NULL;
MachineCredential *creds = *ASSERT_PTR(credentials);
size_t size, n_creds = *ASSERT_PTR(n_credentials);
int r;
const char *p = ASSERT_PTR(cred_path);
size_t size;
int r;
assert(creds || n_creds == 0);
assert(credentials && n_credentials);
assert(*credentials || *n_credentials == 0);
r = extract_first_word(&p, &word, ":", EXTRACT_DONT_COALESCE_SEPARATORS);
if (r == -ENOMEM)
return -ENOMEM;
if (r < 0)
return log_error_errno(r, "Failed to parse --load-credential= parameter: %m");
if (r == 0 || !p)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Missing value for --load-credential=: %s", cred_path);
if (!credential_name_valid(word))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "MachineCredential name is not valid: %s", word);
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential name is not valid: %s", word);
FOREACH_ARRAY(cred, creds, n_creds)
FOREACH_ARRAY(cred, *credentials, *n_credentials)
if (streq(cred->id, word))
return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Duplicate credential '%s', refusing.", word);
if (path_is_absolute(p))
if (is_path(p) && path_is_valid(p))
flags |= READ_FULL_FILE_CONNECT_SOCKET;
else {
else if (credential_name_valid(p)) {
const char *e;
r = get_credentials_dir(&e);
if (r < 0)
return log_error_errno(r, "MachineCredential not available (no credentials passed at all): %s", word);
return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
j = path_join(e, p);
if (!j)
return -ENOMEM;
}
return log_oom();
r = read_full_file_full(AT_FDCWD, j ?: p, UINT64_MAX, SIZE_MAX,
p = j;
} else
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential source appears to be neither a valid path nor a credential name: %s", p);
r = read_full_file_full(AT_FDCWD, p, UINT64_MAX, SIZE_MAX,
flags,
NULL,
&data, &size);
if (r < 0)
return log_error_errno(r, "Failed to read credential '%s': %m", j ?: p);
return log_error_errno(r, "Failed to read credential '%s': %m", p);
GREEDY_REALLOC(creds, n_creds + 1);
if (!creds)
return -ENOMEM;
if (!GREEDY_REALLOC(*credentials, *n_credentials + 1))
return log_oom();
creds[n_creds++] = (MachineCredential) {
(*credentials)[(*n_credentials)++] = (MachineCredential) {
.id = TAKE_PTR(word),
.data = TAKE_PTR(data),
.size = size,
};
*credentials = creds;
*n_credentials = n_creds;
return 0;
}
src/vmspawn/vmspawn.c
+2 -6
View File
@@ -225,20 +225,16 @@ static int parse_argv(int argc, char *argv[]) {
case ARG_SET_CREDENTIAL: {
r = machine_credential_set(&arg_credentials, &arg_n_credentials, optarg);
if (r == -ENOMEM)
return log_oom();
if (r < 0)
return log_error_errno(r, "Failed to set credential from %s: %m", optarg);
return r;
arg_settings_mask |= SETTING_CREDENTIALS;
break;
}
case ARG_LOAD_CREDENTIAL: {
r = machine_credential_load(&arg_credentials, &arg_n_credentials, optarg);
if (r == -ENOMEM)
return log_oom();
if (r < 0)
return log_error_errno(r, "Failed to load credential from %s: %m", optarg);
return r;
arg_settings_mask |= SETTING_CREDENTIALS;
break;