[#3959] Added legal/forensic log

diff --git a/doc/examples/kea4/all-keys.json b/doc/examples/kea4/all-keys.json
index 683c7d326d66b5317d36e39b1374fa226591b350..bd7befc21a29f0c9dd376c02b6b40a4770e27e4c 100644 (file)
--- a/doc/examples/kea4/all-keys.json
+++ b/doc/examples/kea4/all-keys.json
@@ -486,6 +486,9 @@
                 // Database password.
                 "password": "1234",
 
+                // Database password file.
+                //"password-file": "hiddenp",
+
                 // Port on which the database is available.
                 "port": 3306,
 
@@ -549,6 +552,9 @@
                 // Database password.
                 "password": "1234",
 
+                // Database password file.
+                //"password-file": "hiddenp",
+
                 // Port on which the database is available.
                 "port": 5432,
 

diff --git a/doc/examples/kea6/all-keys.json b/doc/examples/kea6/all-keys.json
index 31f1260bb7a679e7b3cef41a72f9883c9039500f..89192051a4d6c3a81d4ecbd9aebb826f989b0d30 100644 (file)
--- a/doc/examples/kea6/all-keys.json
+++ b/doc/examples/kea6/all-keys.json
@@ -432,6 +432,9 @@
                 // Database password.
                 "password": "1234",
 
+                // Database password file.
+                //"password-file": "hiddenp",
+
                 // Port on which the database is available.
                 "port": 3306,
 
@@ -495,6 +498,9 @@
                 // Database password.
                 "password": "1234",
 
+                // Database password file.
+                //"password-file": "hiddenp",
+
                 // Port on which the database is available.
                 "port": 5432,
 

diff --git a/src/hooks/dhcp/mysql/mysql_legal_log.h b/src/hooks/dhcp/mysql/mysql_legal_log.h
index 1cc01ba1cd1bf5f770b1747f722ee01a251d7178..b8b4dde6d52966c45c9961d1c7aae4605dc26666 100644 (file)
--- a/src/hooks/dhcp/mysql/mysql_legal_log.h
+++ b/src/hooks/dhcp/mysql/mysql_legal_log.h
@@ -92,6 +92,7 @@ public:
     ///       - name
     ///       - host
     ///       - password
+    ///       - password-file
     ///       - port
     ///       - user
     ///       - trust-anchor

diff --git a/src/hooks/dhcp/mysql/tests/mysql_forensic_unittest.cc b/src/hooks/dhcp/mysql/tests/mysql_forensic_unittest.cc
index c3b90d67c3f70354fdb62685a0668abd16e33e0f..554c5e4444dba35ab0459022ae215f64848f2dce 100644 (file)
--- a/src/hooks/dhcp/mysql/tests/mysql_forensic_unittest.cc
+++ b/src/hooks/dhcp/mysql/tests/mysql_forensic_unittest.cc
@@ -10,6 +10,7 @@
 #include <config.h>
 
 #include <exceptions/exceptions.h>
+#include <database/testutils/password_file.h>
 #include <dhcpsrv/testutils/forensic_test_utils.h>
 #include <dhcpsrv/testutils/test_utils.h>
 #include <mysql/testutils/mysql_schema.h>
@@ -203,6 +204,44 @@ TEST_F(MySqlTest, open) {
     EXPECT_NO_THROW_LOG(store_.reset());
 }
 
+/// @brief Tests opening with password file.
+TEST_F(MySqlTest, passwordFile) {
+    // Construct the store_
+    DatabaseConnection::ParameterMap params;
+    params["name"] = "keatest";
+    params["user"] = "keatest";
+    params["password-file"] = PASSWORD_FILE;
+    ASSERT_NO_THROW_LOG(store_.reset(new MySqlStore(params)));
+
+    // Check the type is mysql
+    EXPECT_EQ("mysql", store_->getType());
+
+    // Open the database
+    ASSERT_NO_THROW_LOG(store_->open());
+
+    // Close does nothing
+    EXPECT_NO_THROW_LOG(store_->close());
+
+    // Destructor close the database
+    EXPECT_NO_THROW_LOG(store_.reset());
+}
+
+/// @brief Tests opening with bad password file.
+TEST_F(MySqlTest, badPasswordFile) {
+    // Construct the store_
+    DatabaseConnection::ParameterMap params;
+    params["name"] = "keatest";
+    params["user"] = "keatest";
+    params["password-file"] = BAD_PASSWORD_FILE;
+    ASSERT_NO_THROW_LOG(store_.reset(new MySqlStore(params)));
+
+    // Check the type is mysql
+    EXPECT_EQ("mysql", store_->getType());
+
+    // Open the database
+    EXPECT_THROW(store_->open(), DbOpenError);
+}
+
 /// @brief Tests opening MySqlStore with invalid SSL/TLS
 TEST_F(MySqlTest, invalidTls) {
     // Construct the store_

diff --git a/src/hooks/dhcp/pgsql/pgsql_legal_log.h b/src/hooks/dhcp/pgsql/pgsql_legal_log.h
index d5b2183bb006d58588bbd664dabb988d7ff73308..59d1730e93738ec2e3a090a35c7216c9034193d7 100644 (file)
--- a/src/hooks/dhcp/pgsql/pgsql_legal_log.h
+++ b/src/hooks/dhcp/pgsql/pgsql_legal_log.h
@@ -91,6 +91,7 @@ public:
     ///       - name
     ///       - host
     ///       - password
+    ///       - password-file
     ///       - port
     ///       - user
     ///       - trust-anchor

diff --git a/src/hooks/dhcp/pgsql/tests/pgsql_forensic_unittest.cc b/src/hooks/dhcp/pgsql/tests/pgsql_forensic_unittest.cc
index a818a3ce3583f47b1b6e05c15d62d69f2672320e..4390b801602d60c3afd8ea2c5817e2b596bae95e 100644 (file)
--- a/src/hooks/dhcp/pgsql/tests/pgsql_forensic_unittest.cc
+++ b/src/hooks/dhcp/pgsql/tests/pgsql_forensic_unittest.cc
@@ -10,6 +10,7 @@
 #include <config.h>
 
 #include <exceptions/exceptions.h>
+#include <database/testutils/password_file.h>
 #include <dhcpsrv/testutils/forensic_test_utils.h>
 #include <dhcpsrv/testutils/test_utils.h>
 #include <pgsql/testutils/pgsql_schema.h>
@@ -204,6 +205,44 @@ TEST_F(PgSqlTest, open) {
     EXPECT_NO_THROW_LOG(store_.reset());
 }
 
+/// @brief Tests opening with password file.
+TEST_F(PgSqlTest, passwordFile) {
+    // Construct the store_
+    DatabaseConnection::ParameterMap params;
+    params["name"] = "keatest";
+    params["user"] = "keatest";
+    params["password-file"] = PASSWORD_FILE;
+    ASSERT_NO_THROW_LOG(store_.reset(new PgSqlStore(params)));
+
+    // Check the type is postgresql
+    EXPECT_EQ("postgresql", store_->getType());
+
+    // Open the database
+    ASSERT_NO_THROW_LOG(store_->open());
+
+    // Close does nothing
+    EXPECT_NO_THROW_LOG(store_->close());
+
+    // Destructor close the database
+    EXPECT_NO_THROW_LOG(store_.reset());
+}
+
+/// @brief Tests opening with bad password file.
+TEST_F(PgSqlTest, badPasswordFile) {
+    // Construct the store_
+    DatabaseConnection::ParameterMap params;
+    params["name"] = "keatest";
+    params["user"] = "keatest";
+    params["password-file"] = BAD_PASSWORD_FILE;
+    ASSERT_NO_THROW_LOG(store_.reset(new PgSqlStore(params)));
+
+    // Check the type is postgresql
+    EXPECT_EQ("postgresql", store_->getType());
+
+    // Open the database
+    EXPECT_THROW(store_->open(), DbOpenError);
+}
+
 /// @brief Tests opening PgSqlStore with invalid SSL/TLS
 TEST_F(PgSqlTest, invalidTls) {
     // Construct the store_

diff --git a/src/lib/database/testutils/meson.build b/src/lib/database/testutils/meson.build
index 60e4d2de3c005385211e81e0f99fd320449c762b..6eb537874c8e18f4560cbe7f849d58eb615706a2 100644 (file)
--- a/src/lib/database/testutils/meson.build
+++ b/src/lib/database/testutils/meson.build
@@ -5,6 +5,7 @@ endif
 current_source_dir = meson.current_source_dir()
 kea_database_testutils_lib = static_library(
     'kea-database-testutils',
+    'password_file.cc',
     'schema.cc',
     cpp_args: [
         f'-DTEST_CA_DIR="@TEST_CA_DIR@"',

diff --git a/src/lib/database/testutils/password_file.cc b/src/lib/database/testutils/password_file.cc
new file mode 100644 (file)
index 0000000..fcf9ce8
--- /dev/null
+++ b/src/lib/database/testutils/password_file.cc
@@ -0,0 +1,22 @@
+// Copyright (C) 2026 Internet Systems Consortium, Inc. ("ISC")
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#include <config.h>
+
+#include <password_file.h>
+
+using namespace std;
+
+namespace isc {
+namespace db {
+namespace test {
+
+const string PASSWORD_FILE = FILE_DIR "/password";
+const string BAD_PASSWORD_FILE = FILE_DIR "/bad-password";
+
+}
+}
+}

diff --git a/src/lib/database/testutils/password_file.h b/src/lib/database/testutils/password_file.h
new file mode 100644 (file)
index 0000000..90e5e50
--- /dev/null
+++ b/src/lib/database/testutils/password_file.h
@@ -0,0 +1,24 @@
+// Copyright (C) 2026 Internet Systems Consortium, Inc. ("ISC")
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#ifndef PASSWORD_FILE_H
+#define PASSWORD_FILE_H
+
+#include <config.h>
+#include <string>
+
+namespace isc {
+namespace db {
+namespace test {
+
+extern const std::string PASSWORD_FILE;
+extern const std::string BAD_PASSWORD_FILE;
+
+}
+}
+}
+
+#endif

diff --git a/src/lib/dhcpsrv/legal_log_mgr.cc b/src/lib/dhcpsrv/legal_log_mgr.cc
index 2379f6145fd9bddf891716a17846400aef3adc2e..6b145311af31116bca42fcefee6b316d74e87970 100644 (file)
--- a/src/lib/dhcpsrv/legal_log_mgr.cc
+++ b/src/lib/dhcpsrv/legal_log_mgr.cc
@@ -62,12 +62,18 @@ LegalLogMgr::parseDatabase(const ConstElementPtr& parameters, DatabaseConnection
         isc_throw(BadValue, "no parameters specified for the hook library");
     }
 
+    // Reject password and password-file both being specified.
+    if (parameters->get("password") && parameters->get("password-file")) {
+        isc_throw(BadValue, "can't specify both 'password' and "
+                  << "'password-file'");
+    }
+
     DatabaseConnection::ParameterMap db_parameters;
 
     // Strings
     for (char const* const& key : {
-         "type", "user", "password", "host", "name", "trust-anchor",
-         "cert-file", "key-file", "ssl-mode", "cipher-list" }) {
+        "type", "user", "password", "password-file", "host", "name",
+        "trust-anchor", "cert-file", "key-file", "ssl-mode", "cipher-list" }) {
         ConstElementPtr const value(parameters->get(key));
         if (value) {
             db_parameters.emplace(key, value->stringValue());

diff --git a/src/lib/dhcpsrv/legal_log_mgr.h b/src/lib/dhcpsrv/legal_log_mgr.h
index c14291473c1ec128b42aa2b7f88377c37254bdc1..e7e1dde803bd26021a0560a81c55da8ddc5c4d43 100644 (file)
--- a/src/lib/dhcpsrv/legal_log_mgr.h
+++ b/src/lib/dhcpsrv/legal_log_mgr.h
@@ -101,6 +101,7 @@ public:
     ///       - name
     ///       - host
     ///       - password
+    ///       - password-file
     ///       - port
     ///       - user
     ///       - trust-anchor