From 9dace75877be97990ab64074a6d166f60be68a91 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
Date: Wed, 9 Dec 2020 14:07:22 +0100
Subject: [PATCH] kcm: decode base64 encoded secret on upgrade path

Previous unefficient code encoded the secret multiple times:
  secret -> base64 -> masterkey -> base64

To allow smooth upgrade for already existant ccache we need to also decode
the secret if it is still in the old format (type == simple). Otherwise
users are not able to log in.

Resolves: https://github.com/SSSD/sssd/issues/5349
---
 src/responder/kcm/kcmsrv_ccache_secdb.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/responder/kcm/kcmsrv_ccache_secdb.c b/src/responder/kcm/kcmsrv_ccache_secdb.c
index 726711ac44..755b75585b 100644
--- a/src/responder/kcm/kcmsrv_ccache_secdb.c
+++ b/src/responder/kcm/kcmsrv_ccache_secdb.c
@@ -59,7 +59,20 @@ static errno_t sec_get(TALLOC_CTX *mem_ctx,
         goto done;
     }
 
-    buf = sss_iobuf_init_steal(tmp_ctx, data, len);
+    if (strcmp(datatype, "simple") != 0) {
+        buf = sss_iobuf_init_steal(tmp_ctx, data, len);
+    } else {
+        /* The secret is stored in b64 encoding, we need to decode it first. */
+        data = sss_base64_decode(tmp_ctx, (const char*)data, &len);
+        if (data == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot decode secret from base64\n");
+            ret = EIO;
+            goto done;
+        }
+
+        buf = sss_iobuf_init_readonly(tmp_ctx, data, len);
+    }
+
     if (buf == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, "Cannot init the iobuf\n");
         ret = EIO;
