SECRETS: Add configurable payload size limit of a secret

Resolves:
https://fedorahosted.org/sssd/ticket/3169

Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

5 files changed, 50 insertions, 0 deletions

diff --git a/src/responder/secrets/local.c b/src/responder/secrets/local.c
index f6c936f81..ed70193bc 100644
--- a/src/responder/secrets/local.c
+++ b/src/responder/secrets/local.c
@@ -31,6 +31,7 @@ struct local_context {
     struct sec_data master_key;
     int containers_nest_level;
     int max_secrets;
+    int max_payload_size;
 };
 
 static int local_decrypt(struct local_context *lctx, TALLOC_CTX *mem_ctx,
@@ -450,6 +451,27 @@ done:
     return ret;
 }
 
+static int local_check_max_payload_size(struct local_context *lctx,
+                                        int payload_size)
+{
+    int max_payload_size;
+
+    max_payload_size = lctx->max_payload_size * 1024; /* kb */
+    if (payload_size > max_payload_size) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Secrets' payload size [%d kb (%d)] exceeds the maximum allowed "
+              "payload size [%d kb (%d)]\n",
+              payload_size * 1024, /* kb */
+              payload_size,
+              lctx->max_payload_size, /* kb */
+              max_payload_size);
+
+        return ERR_SEC_PAYLOAD_SIZE_IS_TOO_LARGE;
+    }
+
+    return EOK;
+}
+
 static int local_db_put_simple(TALLOC_CTX *mem_ctx,
                                struct local_context *lctx,
                                const char *req_path,
@@ -492,6 +514,14 @@ static int local_db_put_simple(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
+    ret = local_check_max_payload_size(lctx, strlen(secret));
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "local_check_max_payload_size failed [%d]: %s\n",
+              ret, sss_strerror(ret));
+        goto done;
+    }
+
     ret = local_encrypt(lctx, msg, secret, enctype, &enc_secret);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE,
@@ -973,6 +1003,7 @@ int local_secrets_provider_handle(struct sec_ctx *sctx,
 
     lctx->containers_nest_level = sctx->containers_nest_level;
     lctx->max_secrets = sctx->max_secrets;
+    lctx->max_payload_size = sctx->max_payload_size;
 
     lctx->master_key.data = talloc_size(lctx, MKEY_SIZE);
     if (!lctx->master_key.data) return ENOMEM;
diff --git a/src/responder/secrets/providers.c b/src/responder/secrets/providers.c
index 5f4b0fcc8..eba555d2e 100644
--- a/src/responder/secrets/providers.c
+++ b/src/responder/secrets/providers.c
@@ -178,6 +178,8 @@ static struct sec_http_status_format_table {
       "The request cannot be accepted." },
     { 409, "Conflict",
       "The requested resource already exists." },
+    { 413, "Payload Too Large",
+      "The secret payload is too large." },
     { 500, "Internal Server Error",
       "The server encountered an internal error." },
     { 504, "Gateway timeout",
@@ -352,6 +354,8 @@ enum sec_http_status_codes sec_errno_to_http_status(errno_t err)
         return STATUS_406;
     case EEXIST:
         return STATUS_409;
+    case ERR_SEC_PAYLOAD_SIZE_IS_TOO_LARGE:
+        return STATUS_413;
     case ERR_SEC_NO_PROXY:
         return STATUS_504;
     case ERR_SEC_INVALID_TOO_MANY_SECRETS:
diff --git a/src/responder/secrets/secsrv.c b/src/responder/secrets/secsrv.c
index 4c0824bb5..09b0d2251 100644
--- a/src/responder/secrets/secsrv.c
+++ b/src/responder/secrets/secsrv.c
@@ -31,6 +31,7 @@
 #define DEFAULT_SEC_FD_LIMIT 2048
 #define DEFAULT_SEC_CONTAINERS_NEST_LEVEL 4
 #define DEFAULT_SEC_MAX_SECRETS 1024
+#define DEFAULT_SEC_MAX_PAYLOAD_SIZE 16
 
 static int sec_get_config(struct sec_ctx *sctx)
 {
@@ -71,6 +72,18 @@ static int sec_get_config(struct sec_ctx *sctx)
         goto fail;
     }
 
+    ret = confdb_get_int(sctx->rctx->cdb,
+                         sctx->rctx->confdb_service_path,
+                         CONFDB_SEC_MAX_PAYLOAD_SIZE,
+                         DEFAULT_SEC_MAX_PAYLOAD_SIZE,
+                         &sctx->max_payload_size);
+
+    if (ret != EOK) {
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "Failed to get payload's maximum size for an entry\n");
+        goto fail;
+    }
+
     ret = confdb_get_int(sctx->rctx->cdb, sctx->rctx->confdb_service_path,
                          CONFDB_RESPONDER_CLI_IDLE_TIMEOUT,
                          CONFDB_RESPONDER_CLI_IDLE_DEFAULT_TIMEOUT,
diff --git a/src/responder/secrets/secsrv.h b/src/responder/secrets/secsrv.h
index 972d34265..3d23c405b 100644
--- a/src/responder/secrets/secsrv.h
+++ b/src/responder/secrets/secsrv.h
@@ -40,6 +40,7 @@ struct sec_ctx {
     int fd_limit;
     int containers_nest_level;
     int max_secrets;
+    int max_payload_size;
 
     struct provider_handle **providers;
 };
diff --git a/src/responder/secrets/secsrv_private.h b/src/responder/secrets/secsrv_private.h
index 4129fe60b..1c3fbd8ea 100644
--- a/src/responder/secrets/secsrv_private.h
+++ b/src/responder/secrets/secsrv_private.h
@@ -46,6 +46,7 @@ enum sec_http_status_codes {
     STATUS_405,
     STATUS_406,
     STATUS_409,
+    STATUS_413,
     STATUS_500,
     STATUS_504,
     STATUS_507,