313 lines
11 KiB
Rust
313 lines
11 KiB
Rust
//! The secret store, for every role that needs one: a secret from a systemd credential, an
|
|
//! environment variable, or an owner-only file (M4a spec, section 4; M5b spec, section 5). A
|
|
//! `Secret` cannot be printed. Behind the feature `secrets`: `loopd` holds no credentials and never
|
|
//! enables it.
|
|
|
|
use std::ffi::OsString;
|
|
use std::io::Read;
|
|
use std::os::unix::fs::MetadataExt;
|
|
use std::path::{Path, PathBuf};
|
|
|
|
use serde::Deserialize;
|
|
use zeroize::Zeroizing;
|
|
|
|
pub const RUNBOOK: &str = "see docs/runbook.md#secret-unavailable";
|
|
pub const RUNBOOK_FILE: &str = "see docs/runbook.md#secret-in-a-file";
|
|
|
|
/// `[secrets.<name>]` in a role's configuration: exactly one of the three is set (checked by
|
|
/// `source`). Our own format: unknown keys are errors.
|
|
#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Default)]
|
|
#[serde(deny_unknown_fields)]
|
|
pub struct SecretSpec {
|
|
#[serde(default)]
|
|
pub credential: Option<String>,
|
|
#[serde(default)]
|
|
pub env: Option<String>,
|
|
#[serde(default)]
|
|
pub file: Option<PathBuf>,
|
|
}
|
|
|
|
/// A checked `SecretSpec`.
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub enum SecretSource {
|
|
Credential(String),
|
|
Env(String),
|
|
File(PathBuf),
|
|
}
|
|
|
|
impl SecretSpec {
|
|
/// Exactly one source, well formed.
|
|
pub fn source(&self) -> Result<SecretSource, String> {
|
|
// Exactly one of the three set, else "needs exactly one of credential, env and file".
|
|
// credential: not empty, only ASCII letters, digits, _ . -. env: not empty, only A-Z, 0-9,
|
|
// _. file: an absolute path.
|
|
let mut count = 0;
|
|
if self.credential.is_some() {
|
|
count += 1;
|
|
}
|
|
if self.env.is_some() {
|
|
count += 1;
|
|
}
|
|
if self.file.is_some() {
|
|
count += 1;
|
|
}
|
|
if count != 1 {
|
|
return Err("needs exactly one of credential, env and file".to_string());
|
|
}
|
|
if let Some(credential) = &self.credential {
|
|
if credential.is_empty()
|
|
|| !credential.bytes().all(|b| {
|
|
b.is_ascii_alphabetic() || b.is_ascii_digit() || matches!(b, b'_' | b'.' | b'-')
|
|
})
|
|
{
|
|
return Err(format!(
|
|
"credential {:?} is not a credential name (letters, digits, _ . -)",
|
|
credential
|
|
));
|
|
}
|
|
return Ok(SecretSource::Credential(credential.clone()));
|
|
}
|
|
if let Some(env) = &self.env {
|
|
if env.is_empty()
|
|
|| !env
|
|
.bytes()
|
|
.all(|b| matches!(b, b'A'..=b'Z' | b'0'..=b'9' | b'_'))
|
|
{
|
|
return Err(format!(
|
|
"env {:?} is not a variable name (A-Z, 0-9, _)",
|
|
env
|
|
));
|
|
}
|
|
return Ok(SecretSource::Env(env.clone()));
|
|
}
|
|
// `count == 1` and the two above are `None`, so this is `Some`.
|
|
let file = match &self.file {
|
|
Some(file) => file,
|
|
None => return Err("needs exactly one of credential, env and file".to_string()),
|
|
};
|
|
if !file.is_absolute() {
|
|
return Err(format!(
|
|
"file {:?} must be an absolute path",
|
|
file.display()
|
|
));
|
|
}
|
|
Ok(SecretSource::File(file.clone()))
|
|
}
|
|
}
|
|
|
|
/// A secret's text. No `Display`; `Debug` shows nothing of it; wiped when dropped.
|
|
pub struct Secret(Zeroizing<String>);
|
|
|
|
impl Secret {
|
|
pub fn new(text: String) -> Secret {
|
|
Secret(Zeroizing::new(text))
|
|
}
|
|
|
|
/// The text, for the one place that must send it.
|
|
pub fn expose(&self) -> &str {
|
|
&self.0
|
|
}
|
|
}
|
|
|
|
impl std::fmt::Debug for Secret {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
f.write_str("Secret(…)")
|
|
}
|
|
}
|
|
|
|
/// A loaded secret, and the warning to print for it, if any.
|
|
#[derive(Debug)]
|
|
pub struct Loaded {
|
|
pub secret: Secret,
|
|
pub warning: Option<String>,
|
|
}
|
|
|
|
#[derive(Debug)]
|
|
pub struct SecretError {
|
|
pub name: String,
|
|
pub why: String,
|
|
}
|
|
|
|
impl std::fmt::Display for SecretError {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
write!(f, "secret {}: {}\n{RUNBOOK}", self.name, self.why)
|
|
}
|
|
}
|
|
|
|
impl std::error::Error for SecretError {}
|
|
|
|
/// Load secret `name` from `source` for the program `role` (`"gatewayd"`), which the sentences
|
|
/// name. `env` reads an environment variable (in a role, `std::env::var_os`); tests pass their
|
|
/// own.
|
|
pub fn load(
|
|
role: &str,
|
|
name: &str,
|
|
source: &SecretSource,
|
|
env: &dyn Fn(&str) -> Option<OsString>,
|
|
) -> Result<Loaded, SecretError> {
|
|
// By source (M4a spec, section 4). Credential: read $CREDENTIALS_DIRECTORY/<name> (through
|
|
// `env`, not std::env); an unset variable, or a file that cannot be read, is an error. Env: the
|
|
// variable, UTF-8; unset is an error. File: `read_checked` checks the path, opens and re-checks
|
|
// the same file handle, reads it, and a warning is set. Every value goes through `value`.
|
|
// Every error is a `SecretError` naming the secret, never the value.
|
|
match source {
|
|
SecretSource::Credential(cred) => {
|
|
let dir = match env("CREDENTIALS_DIRECTORY") {
|
|
Some(dir) => dir,
|
|
None => {
|
|
return Err(SecretError {
|
|
name: name.to_string(),
|
|
why: format!(
|
|
"CREDENTIALS_DIRECTORY is not set: {role} was not started by systemd with LoadCredentialEncrypted="
|
|
),
|
|
});
|
|
}
|
|
};
|
|
let path = Path::new(dir.as_os_str()).join(cred);
|
|
let bytes = match std::fs::read(&path) {
|
|
Ok(bytes) => bytes,
|
|
Err(e) => {
|
|
return Err(SecretError {
|
|
name: name.to_string(),
|
|
why: format!("cannot read the credential {}: {}", path.display(), e),
|
|
});
|
|
}
|
|
};
|
|
let secret = value(bytes).map_err(|why| SecretError {
|
|
name: name.to_string(),
|
|
why,
|
|
})?;
|
|
Ok(Loaded {
|
|
secret,
|
|
warning: None,
|
|
})
|
|
}
|
|
SecretSource::Env(var) => {
|
|
let val = match env(var) {
|
|
Some(val) => val,
|
|
None => {
|
|
return Err(SecretError {
|
|
name: name.to_string(),
|
|
why: format!("the environment variable {} is not set", var),
|
|
});
|
|
}
|
|
};
|
|
let text = match val.to_str() {
|
|
Some(text) => text,
|
|
None => {
|
|
return Err(SecretError {
|
|
name: name.to_string(),
|
|
why: format!("the environment variable {} is not UTF-8", var),
|
|
});
|
|
}
|
|
};
|
|
let secret = value(text.as_bytes().to_vec()).map_err(|why| SecretError {
|
|
name: name.to_string(),
|
|
why,
|
|
})?;
|
|
Ok(Loaded {
|
|
secret,
|
|
warning: None,
|
|
})
|
|
}
|
|
SecretSource::File(path) => {
|
|
let mut bytes = match read_checked(role, path, &|| {}) {
|
|
Ok(bytes) => bytes,
|
|
Err(why) => {
|
|
return Err(SecretError {
|
|
name: name.to_string(),
|
|
why,
|
|
});
|
|
}
|
|
};
|
|
let secret = value(std::mem::take(&mut *bytes)).map_err(|why| SecretError {
|
|
name: name.to_string(),
|
|
why,
|
|
})?;
|
|
Ok(Loaded {
|
|
secret,
|
|
warning: Some(format!(
|
|
"{role}: warning: secret {} is read in plaintext from {}; a systemd credential keeps it encrypted at rest ({RUNBOOK_FILE})",
|
|
name,
|
|
path.display()
|
|
)),
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|
|
/// The bytes of an owner-only regular file, read from the very file that was checked. `role`
|
|
/// names the program in the owner check's sentence. `between` runs after the path is checked and
|
|
/// before it is opened: `load` passes `&|| {}`; tests use it to swap the file.
|
|
pub fn read_checked(
|
|
role: &str,
|
|
path: &Path,
|
|
between: &dyn Fn(),
|
|
) -> Result<Zeroizing<Vec<u8>>, String> {
|
|
// The path is checked (absolute, not a link, a regular file), then opened, and the checks
|
|
// that matter are made on the open handle: the same file as the path named, owned by this
|
|
// user, no group or other bits. The race it closes is M4a review, finding 2.
|
|
if !path.is_absolute() {
|
|
return Err(format!("{} is not an absolute path", path.display()));
|
|
}
|
|
let named = std::fs::symlink_metadata(path)
|
|
.map_err(|e| format!("cannot read {}: {}", path.display(), e))?;
|
|
if named.file_type().is_symlink() {
|
|
return Err(format!("{} is a symbolic link", path.display()));
|
|
}
|
|
if !named.file_type().is_file() {
|
|
return Err(format!("{} is not a regular file", path.display()));
|
|
}
|
|
between();
|
|
let mut file =
|
|
std::fs::File::open(path).map_err(|e| format!("cannot read {}: {}", path.display(), e))?;
|
|
let opened = file
|
|
.metadata()
|
|
.map_err(|e| format!("cannot read {}: {}", path.display(), e))?;
|
|
if (opened.dev(), opened.ino()) != (named.dev(), named.ino()) {
|
|
return Err(format!("{} changed while it was read", path.display()));
|
|
}
|
|
let owner = user_id()?;
|
|
if opened.uid() != owner {
|
|
return Err(format!(
|
|
"{} is not owned by the user {role} runs as",
|
|
path.display()
|
|
));
|
|
}
|
|
let mode = opened.mode() & 0o777;
|
|
if mode & 0o077 != 0 {
|
|
return Err(format!(
|
|
"{} has mode {:03o}; only the owner may read it (0600 or 0400)",
|
|
path.display(),
|
|
mode
|
|
));
|
|
}
|
|
let mut bytes = Zeroizing::new(Vec::new());
|
|
file.read_to_end(&mut bytes)
|
|
.map_err(|e| format!("cannot read {}: {}", path.display(), e))?;
|
|
Ok(bytes)
|
|
}
|
|
|
|
/// The user id this process runs as: the owner of a pipe it has just made. `std` has no call for
|
|
/// it, and `/proc/self` is Linux only.
|
|
fn user_id() -> Result<u32, String> {
|
|
let (reader, _writer) = std::io::pipe().map_err(|e| format!("cannot make a pipe: {e}"))?;
|
|
let pipe = std::fs::File::from(std::os::fd::OwnedFd::from(reader));
|
|
let meta = pipe
|
|
.metadata()
|
|
.map_err(|e| format!("cannot read a pipe: {e}"))?;
|
|
Ok(meta.uid())
|
|
}
|
|
|
|
/// The text without one trailing newline; not empty; UTF-8.
|
|
fn value(bytes: Vec<u8>) -> Result<Secret, String> {
|
|
// Keep the bytes in `Zeroizing` until they are inside the `Secret`.
|
|
let bytes = Zeroizing::new(bytes);
|
|
let text = std::str::from_utf8(&bytes).map_err(|_| "the value is not UTF-8".to_string())?;
|
|
let text = text.strip_suffix('\n').unwrap_or(text);
|
|
if text.is_empty() {
|
|
return Err("the value is empty".to_string());
|
|
}
|
|
Ok(Secret::new(text.to_string()))
|
|
}
|