pvsecret: Warn during add if a secret-id is already in the store

Warn a user that the secret-id to be added is already in the secret
store, but add it anyways.

This helps users to notice issues before they happen, as retrieve may
not retrieve the expected secret due to duplicated IDs.

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

rust/pv/src/uvsecret/asrcb.rs

@@ -2,7 +2,7 @@
 //
 // Copyright IBM Corp. 2023
 
-use super::user_data::UserData;
+use super::{guest_secret::ListableSecretHdr, user_data::UserData};
 use crate::{
     assert_size,
     crypto::{hkdf_rfc_5869, AeadEncryptionResult},
@@ -17,7 +17,7 @@ use openssl::{
     md::Md,
     pkey::{PKey, Private, Public},
 };
-use pv_core::{request::RequestVersion, secret::AddSecretMagic};
+use pv_core::{request::RequestVersion, secret::AddSecretMagic, uv::SecretId};
 use zerocopy::AsBytes;
 
 /// Authenticated data w/o user data
@@ -283,6 +283,13 @@ impl AddSecretRequest {
             .map(|res| res.into_buf())
     }
 
+    /// Get a copy of the secret ID if any
+    pub fn bin_id(asrcb: &[u8]) -> Result<Option<SecretId>> {
+        AddSecretMagic::try_from_bytes(asrcb)?;
+        BinReqValues::get(asrcb)
+            .map(|req| req.req_dep_aad::<ListableSecretHdr>().map(|a| a.id.clone()))
+    }
+
     /// Get a copy of the add secret request tag
     pub fn bin_tag(asrcb: &[u8]) -> Result<Vec<u8>> {
         AddSecretMagic::try_from_bytes(asrcb)?;

rust/pv/src/uvsecret/guest_secret.rs

@@ -26,7 +26,7 @@ use openssl::{
 use pv_core::static_assert;
 use serde::{Deserialize, Serialize};
 use std::fmt::Display;
-use zerocopy::{AsBytes, U16, U32};
+use zerocopy::{AsBytes, FromBytes, FromZeroes, U16, U32};
 
 const ASSOC_SECRET_SIZE: usize = 32;
 /// Maximum size of a plain-text secret payload (8190)
@@ -380,13 +380,13 @@ impl SecretAuth {
 }
 
 #[repr(C)]
-#[derive(Debug, AsBytes)]
+#[derive(Debug, AsBytes, FromZeroes, FromBytes)]
 pub(crate) struct ListableSecretHdr {
     res0: u16,
     kind: U16<BigEndian>,
     secret_len: U32<BigEndian>,
     res8: u64,
-    id: SecretId,
+    pub(crate) id: SecretId,
 }
 assert_size!(ListableSecretHdr, 0x30);
 

rust/pvsecret/src/cmd/add.rs

@@ -2,18 +2,29 @@
 //
 // Copyright IBM Corp. 2023
 
-use crate::cli::AddSecretOpt;
+use crate::{cli::AddSecretOpt, cmd::list::list_uvc};
 use anyhow::{Context, Result};
 use log::warn;
-use pv::uv::{AddCmd, UvDevice};
+use pv::{
+    secret::AddSecretRequest,
+    uv::{AddCmd, UvCmd, UvDevice},
+};
 use utils::get_reader_from_cli_file_arg;
 
 /// Do an Add Secret UVC
 pub fn add(opt: &AddSecretOpt) -> Result<()> {
+    let uv = UvDevice::open()?;
     let mut rd_in = get_reader_from_cli_file_arg(&opt.input)?;
     let mut cmd =
         AddCmd::new(&mut rd_in).context(format!("Processing input file {}", opt.input))?;
-    UvDevice::open()?.send_cmd(&mut cmd)?;
+
+    if let Some(id) = AddSecretRequest::bin_id(cmd.data().unwrap())? {
+        if !list_uvc(&uv)?.iter().any(|e| e.id() == id.as_ref()) {
+            warn!("There is already a secret in the secret store with that id. Adding the secret anyways.");
+        }
+    }
+
+    uv.send_cmd(&mut cmd)?;
     warn!("Successfully added the secret");
     Ok(())
 }