From fa00d1eac1392d4e742a17d7c70c6c7be9b3d722 Mon Sep 17 00:00:00 2001
From: Steffen Eiden <seiden@linux.ibm.com>
Date: Wed, 23 Apr 2025 11:24:26 +0200
Subject: [PATCH] pvsecret: Warn during add if a secret-id is already in the
 store
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Warn a user that the secret-id to be added is already in the secret
store, but add it anyways.

This helps users to notice issues before they happen, as retrieve may
not retrieve the expected secret due to duplicated IDs.

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Tested-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 rust/pv/src/uvsecret/asrcb.rs        | 11 +++++++++--
 rust/pv/src/uvsecret/guest_secret.rs |  6 +++---
 rust/pvsecret/src/cmd/add.rs         | 17 ++++++++++++++---
 3 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/rust/pv/src/uvsecret/asrcb.rs b/rust/pv/src/uvsecret/asrcb.rs
index 3e864f51..9e16e5d2 100644
--- a/rust/pv/src/uvsecret/asrcb.rs
+++ b/rust/pv/src/uvsecret/asrcb.rs
@@ -2,7 +2,7 @@
 //
 // Copyright IBM Corp. 2023
 
-use super::user_data::UserData;
+use super::{guest_secret::ListableSecretHdr, user_data::UserData};
 use crate::{
     assert_size,
     crypto::{hkdf_rfc_5869, AeadEncryptionResult},
@@ -17,7 +17,7 @@ use openssl::{
     md::Md,
     pkey::{PKey, Private, Public},
 };
-use pv_core::{request::RequestVersion, secret::AddSecretMagic};
+use pv_core::{request::RequestVersion, secret::AddSecretMagic, uv::SecretId};
 use zerocopy::AsBytes;
 
 /// Authenticated data w/o user data
@@ -283,6 +283,13 @@ impl AddSecretRequest {
             .map(|res| res.into_buf())
     }
 
+    /// Get a copy of the secret ID if any
+    pub fn bin_id(asrcb: &[u8]) -> Result<Option<SecretId>> {
+        AddSecretMagic::try_from_bytes(asrcb)?;
+        BinReqValues::get(asrcb)
+            .map(|req| req.req_dep_aad::<ListableSecretHdr>().map(|a| a.id.clone()))
+    }
+
     /// Get a copy of the add secret request tag
     pub fn bin_tag(asrcb: &[u8]) -> Result<Vec<u8>> {
         AddSecretMagic::try_from_bytes(asrcb)?;
diff --git a/rust/pv/src/uvsecret/guest_secret.rs b/rust/pv/src/uvsecret/guest_secret.rs
index 3f3b6d1a..93b96583 100644
--- a/rust/pv/src/uvsecret/guest_secret.rs
+++ b/rust/pv/src/uvsecret/guest_secret.rs
@@ -26,7 +26,7 @@ use openssl::{
 use pv_core::static_assert;
 use serde::{Deserialize, Serialize};
 use std::fmt::Display;
-use zerocopy::{AsBytes, U16, U32};
+use zerocopy::{AsBytes, FromBytes, FromZeroes, U16, U32};
 
 const ASSOC_SECRET_SIZE: usize = 32;
 /// Maximum size of a plain-text secret payload (8190)
@@ -380,13 +380,13 @@ impl SecretAuth {
 }
 
 #[repr(C)]
-#[derive(Debug, AsBytes)]
+#[derive(Debug, AsBytes, FromZeroes, FromBytes)]
 pub(crate) struct ListableSecretHdr {
     res0: u16,
     kind: U16<BigEndian>,
     secret_len: U32<BigEndian>,
     res8: u64,
-    id: SecretId,
+    pub(crate) id: SecretId,
 }
 assert_size!(ListableSecretHdr, 0x30);
 
diff --git a/rust/pvsecret/src/cmd/add.rs b/rust/pvsecret/src/cmd/add.rs
index 3a9d8f2a..9404ded8 100644
--- a/rust/pvsecret/src/cmd/add.rs
+++ b/rust/pvsecret/src/cmd/add.rs
@@ -2,18 +2,29 @@
 //
 // Copyright IBM Corp. 2023
 
-use crate::cli::AddSecretOpt;
+use crate::{cli::AddSecretOpt, cmd::list::list_uvc};
 use anyhow::{Context, Result};
 use log::warn;
-use pv::uv::{AddCmd, UvDevice};
+use pv::{
+    secret::AddSecretRequest,
+    uv::{AddCmd, UvCmd, UvDevice},
+};
 use utils::get_reader_from_cli_file_arg;
 
 /// Do an Add Secret UVC
 pub fn add(opt: &AddSecretOpt) -> Result<()> {
+    let uv = UvDevice::open()?;
     let mut rd_in = get_reader_from_cli_file_arg(&opt.input)?;
     let mut cmd =
         AddCmd::new(&mut rd_in).context(format!("Processing input file {}", opt.input))?;
-    UvDevice::open()?.send_cmd(&mut cmd)?;
+
+    if let Some(id) = AddSecretRequest::bin_id(cmd.data().unwrap())? {
+        if !list_uvc(&uv)?.iter().any(|e| e.id() == id.as_ref()) {
+            warn!("There is already a secret in the secret store with that id. Adding the secret anyways.");
+        }
+    }
+
+    uv.send_cmd(&mut cmd)?;
     warn!("Successfully added the secret");
     Ok(())
 }