From: Francis Dupont Date: Thu, 13 Aug 2026 07:36:28 +0000 (+0200) Subject: [#3959] Added legal/forensic log X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9e97ac4ca50bb39166177d55abc23194df974df0;p=thirdparty%2Fkea.git [#3959] Added legal/forensic log --- diff --git a/doc/examples/kea4/all-keys.json b/doc/examples/kea4/all-keys.json index 683c7d326d..bd7befc21a 100644 --- a/doc/examples/kea4/all-keys.json +++ b/doc/examples/kea4/all-keys.json @@ -486,6 +486,9 @@ // Database password. "password": "1234", + // Database password file. + //"password-file": "hiddenp", + // Port on which the database is available. "port": 3306, @@ -549,6 +552,9 @@ // Database password. "password": "1234", + // Database password file. + //"password-file": "hiddenp", + // Port on which the database is available. "port": 5432, diff --git a/doc/examples/kea6/all-keys.json b/doc/examples/kea6/all-keys.json index 31f1260bb7..89192051a4 100644 --- a/doc/examples/kea6/all-keys.json +++ b/doc/examples/kea6/all-keys.json @@ -432,6 +432,9 @@ // Database password. "password": "1234", + // Database password file. + //"password-file": "hiddenp", + // Port on which the database is available. "port": 3306, @@ -495,6 +498,9 @@ // Database password. "password": "1234", + // Database password file. + //"password-file": "hiddenp", + // Port on which the database is available. "port": 5432, diff --git a/src/hooks/dhcp/mysql/mysql_legal_log.h b/src/hooks/dhcp/mysql/mysql_legal_log.h index 1cc01ba1cd..b8b4dde6d5 100644 --- a/src/hooks/dhcp/mysql/mysql_legal_log.h +++ b/src/hooks/dhcp/mysql/mysql_legal_log.h @@ -92,6 +92,7 @@ public: /// - name /// - host /// - password + /// - password-file /// - port /// - user /// - trust-anchor diff --git a/src/hooks/dhcp/mysql/tests/mysql_forensic_unittest.cc b/src/hooks/dhcp/mysql/tests/mysql_forensic_unittest.cc index c3b90d67c3..554c5e4444 100644 --- a/src/hooks/dhcp/mysql/tests/mysql_forensic_unittest.cc +++ b/src/hooks/dhcp/mysql/tests/mysql_forensic_unittest.cc @@ -10,6 +10,7 @@ #include #include +#include #include #include #include @@ -203,6 +204,44 @@ TEST_F(MySqlTest, open) { EXPECT_NO_THROW_LOG(store_.reset()); } +/// @brief Tests opening with password file. +TEST_F(MySqlTest, passwordFile) { + // Construct the store_ + DatabaseConnection::ParameterMap params; + params["name"] = "keatest"; + params["user"] = "keatest"; + params["password-file"] = PASSWORD_FILE; + ASSERT_NO_THROW_LOG(store_.reset(new MySqlStore(params))); + + // Check the type is mysql + EXPECT_EQ("mysql", store_->getType()); + + // Open the database + ASSERT_NO_THROW_LOG(store_->open()); + + // Close does nothing + EXPECT_NO_THROW_LOG(store_->close()); + + // Destructor close the database + EXPECT_NO_THROW_LOG(store_.reset()); +} + +/// @brief Tests opening with bad password file. +TEST_F(MySqlTest, badPasswordFile) { + // Construct the store_ + DatabaseConnection::ParameterMap params; + params["name"] = "keatest"; + params["user"] = "keatest"; + params["password-file"] = BAD_PASSWORD_FILE; + ASSERT_NO_THROW_LOG(store_.reset(new MySqlStore(params))); + + // Check the type is mysql + EXPECT_EQ("mysql", store_->getType()); + + // Open the database + EXPECT_THROW(store_->open(), DbOpenError); +} + /// @brief Tests opening MySqlStore with invalid SSL/TLS TEST_F(MySqlTest, invalidTls) { // Construct the store_ diff --git a/src/hooks/dhcp/pgsql/pgsql_legal_log.h b/src/hooks/dhcp/pgsql/pgsql_legal_log.h index d5b2183bb0..59d1730e93 100644 --- a/src/hooks/dhcp/pgsql/pgsql_legal_log.h +++ b/src/hooks/dhcp/pgsql/pgsql_legal_log.h @@ -91,6 +91,7 @@ public: /// - name /// - host /// - password + /// - password-file /// - port /// - user /// - trust-anchor diff --git a/src/hooks/dhcp/pgsql/tests/pgsql_forensic_unittest.cc b/src/hooks/dhcp/pgsql/tests/pgsql_forensic_unittest.cc index a818a3ce35..4390b80160 100644 --- a/src/hooks/dhcp/pgsql/tests/pgsql_forensic_unittest.cc +++ b/src/hooks/dhcp/pgsql/tests/pgsql_forensic_unittest.cc @@ -10,6 +10,7 @@ #include #include +#include #include #include #include @@ -204,6 +205,44 @@ TEST_F(PgSqlTest, open) { EXPECT_NO_THROW_LOG(store_.reset()); } +/// @brief Tests opening with password file. +TEST_F(PgSqlTest, passwordFile) { + // Construct the store_ + DatabaseConnection::ParameterMap params; + params["name"] = "keatest"; + params["user"] = "keatest"; + params["password-file"] = PASSWORD_FILE; + ASSERT_NO_THROW_LOG(store_.reset(new PgSqlStore(params))); + + // Check the type is postgresql + EXPECT_EQ("postgresql", store_->getType()); + + // Open the database + ASSERT_NO_THROW_LOG(store_->open()); + + // Close does nothing + EXPECT_NO_THROW_LOG(store_->close()); + + // Destructor close the database + EXPECT_NO_THROW_LOG(store_.reset()); +} + +/// @brief Tests opening with bad password file. +TEST_F(PgSqlTest, badPasswordFile) { + // Construct the store_ + DatabaseConnection::ParameterMap params; + params["name"] = "keatest"; + params["user"] = "keatest"; + params["password-file"] = BAD_PASSWORD_FILE; + ASSERT_NO_THROW_LOG(store_.reset(new PgSqlStore(params))); + + // Check the type is postgresql + EXPECT_EQ("postgresql", store_->getType()); + + // Open the database + EXPECT_THROW(store_->open(), DbOpenError); +} + /// @brief Tests opening PgSqlStore with invalid SSL/TLS TEST_F(PgSqlTest, invalidTls) { // Construct the store_ diff --git a/src/lib/database/testutils/meson.build b/src/lib/database/testutils/meson.build index 60e4d2de3c..6eb537874c 100644 --- a/src/lib/database/testutils/meson.build +++ b/src/lib/database/testutils/meson.build @@ -5,6 +5,7 @@ endif current_source_dir = meson.current_source_dir() kea_database_testutils_lib = static_library( 'kea-database-testutils', + 'password_file.cc', 'schema.cc', cpp_args: [ f'-DTEST_CA_DIR="@TEST_CA_DIR@"', diff --git a/src/lib/database/testutils/password_file.cc b/src/lib/database/testutils/password_file.cc new file mode 100644 index 0000000000..fcf9ce856e --- /dev/null +++ b/src/lib/database/testutils/password_file.cc @@ -0,0 +1,22 @@ +// Copyright (C) 2026 Internet Systems Consortium, Inc. ("ISC") +// +// This Source Code Form is subject to the terms of the Mozilla Public +// License, v. 2.0. If a copy of the MPL was not distributed with this +// file, You can obtain one at http://mozilla.org/MPL/2.0/. + +#include + +#include + +using namespace std; + +namespace isc { +namespace db { +namespace test { + +const string PASSWORD_FILE = FILE_DIR "/password"; +const string BAD_PASSWORD_FILE = FILE_DIR "/bad-password"; + +} +} +} diff --git a/src/lib/database/testutils/password_file.h b/src/lib/database/testutils/password_file.h new file mode 100644 index 0000000000..90e5e5026c --- /dev/null +++ b/src/lib/database/testutils/password_file.h @@ -0,0 +1,24 @@ +// Copyright (C) 2026 Internet Systems Consortium, Inc. ("ISC") +// +// This Source Code Form is subject to the terms of the Mozilla Public +// License, v. 2.0. If a copy of the MPL was not distributed with this +// file, You can obtain one at http://mozilla.org/MPL/2.0/. + +#ifndef PASSWORD_FILE_H +#define PASSWORD_FILE_H + +#include +#include + +namespace isc { +namespace db { +namespace test { + +extern const std::string PASSWORD_FILE; +extern const std::string BAD_PASSWORD_FILE; + +} +} +} + +#endif diff --git a/src/lib/dhcpsrv/legal_log_mgr.cc b/src/lib/dhcpsrv/legal_log_mgr.cc index 2379f6145f..6b145311af 100644 --- a/src/lib/dhcpsrv/legal_log_mgr.cc +++ b/src/lib/dhcpsrv/legal_log_mgr.cc @@ -62,12 +62,18 @@ LegalLogMgr::parseDatabase(const ConstElementPtr& parameters, DatabaseConnection isc_throw(BadValue, "no parameters specified for the hook library"); } + // Reject password and password-file both being specified. + if (parameters->get("password") && parameters->get("password-file")) { + isc_throw(BadValue, "can't specify both 'password' and " + << "'password-file'"); + } + DatabaseConnection::ParameterMap db_parameters; // Strings for (char const* const& key : { - "type", "user", "password", "host", "name", "trust-anchor", - "cert-file", "key-file", "ssl-mode", "cipher-list" }) { + "type", "user", "password", "password-file", "host", "name", + "trust-anchor", "cert-file", "key-file", "ssl-mode", "cipher-list" }) { ConstElementPtr const value(parameters->get(key)); if (value) { db_parameters.emplace(key, value->stringValue()); diff --git a/src/lib/dhcpsrv/legal_log_mgr.h b/src/lib/dhcpsrv/legal_log_mgr.h index c14291473c..e7e1dde803 100644 --- a/src/lib/dhcpsrv/legal_log_mgr.h +++ b/src/lib/dhcpsrv/legal_log_mgr.h @@ -101,6 +101,7 @@ public: /// - name /// - host /// - password + /// - password-file /// - port /// - user /// - trust-anchor