Add add_key().

src/keys.c

@@ -350,12 +350,93 @@ KEY_Get(uint8_t *id, uint8_t idlen)
 	return (key->key);
 }
 
+/* MUST be called under the writer lock */
+static struct key *
+key_insert(VRT_CTX, uint8_t *id, uint8_t idlen, const uint8_t *key,
+	   struct key_tree *tree_h)
+{
+	struct key *k;
+	struct addr_ent *addr_ent;
+
+	errno = 0;
+	ALLOC_OBJ(k, KEY_MAGIC);
+	if (k == NULL) {
+		VRT_fail(ctx, "cannot allocate key entry: %s",
+			 vstrerror(errno));
+		return NULL;
+	}
+
+	errno = 0;
+	k->id = malloc(idlen);
+	if (k->id == NULL) {
+		VRT_fail(ctx, "cannot allocate key id: %s", vstrerror(errno));
+		FREE_OBJ(k);
+		return NULL;
+	}
+
+	Lck_Lock(&page_mtx);
+	if (VSTAILQ_EMPTY(&addr_head))
+		if (key_alloc_page(ctx) != 0) {
+			Lck_Unlock(&page_mtx);
+			free(k->id);
+			FREE_OBJ(k);
+			return NULL;
+		}
+	assert(!VSTAILQ_EMPTY(&addr_head));
+	addr_ent = VSTAILQ_FIRST(&addr_head);
+	CHECK_OBJ_NOTNULL(addr_ent, ADDR_ENTRY_MAGIC);
+	AN(addr_ent->addr);
+	VSTAILQ_REMOVE_HEAD(&addr_head, list);
+	Lck_Unlock(&page_mtx);
+
+	k->key = addr_ent->addr;
+	FREE_OBJ(addr_ent);
+	memcpy(k->key, key, AES128_KEYLEN);
+	memcpy(k->id, id, idlen);
+	k->idlen = idlen;
+	VRBT_INSERT(key_tree, tree_h, k);
+	return (k);
+}
+
+int
+KEY_Add(VRT_CTX, uint8_t *id, uint8_t idlen, const uint8_t *key)
+{
+	struct key_tree *tree_h;
+	struct key *k;
+
+	CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
+	AN(id);
+	AN(key);
+
+	key_wrlock(idlen);
+
+	tree_h = &key_tbl[idlen].tree;
+	k = key_find(tree_h, id, idlen);
+	if (k != NULL) {
+		VRT_fail(ctx, "key \"%.*s\" already exists", idlen, id);
+		KEY_Unlock(idlen);
+		return (-1);
+	}
+	if ((k = key_insert(ctx, id, idlen, key, tree_h)) == NULL) {
+		KEY_Unlock(idlen);
+		return (-1);
+	}
+	KEY_Unlock(idlen);
+
+	CHECK_OBJ(k, KEY_MAGIC);
+	AN(k->key);
+	AN(k->id);
+	AZ(memcmp(k->key, key, AES128_KEYLEN));
+	assert(k->idlen == idlen);
+	AZ(memcmp(k->id, id, idlen));
+	return (0);
+}
+
 int
 KEY_Set(VRT_CTX, uint8_t *id, uint8_t idlen, const uint8_t *key)
 {
 	struct key_tree *tree_h;
 	struct key *k;
-	struct addr_ent *addr_ent;
 
 	CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
 	AN(id);
@@ -366,51 +447,28 @@ KEY_Set(VRT_CTX, uint8_t *id, uint8_t idlen, const uint8_t *key)
 	tree_h = &key_tbl[idlen].tree;
 	k = key_find(tree_h, id, idlen);
 	if (k == NULL) {
-		errno = 0;
-		ALLOC_OBJ(k, KEY_MAGIC);
-		if (k == NULL) {
-			VRT_fail(ctx, "cannot allocate key entry: %s",
-				 vstrerror(errno));
-			goto fail;
-		}
-
-		errno = 0;
-		k->id = malloc(idlen);
-		if (k->id == NULL) {
-			VRT_fail(ctx, "cannot allocate key id: %s",
-				 vstrerror(errno));
-			goto fail;
+		k = key_insert(ctx, id, idlen, key, tree_h);
+		KEY_Unlock(idlen);
+		if (k != NULL) {
+			CHECK_OBJ(k, KEY_MAGIC);
+			AN(k->key);
+			AN(k->id);
+			AZ(memcmp(k->key, key, AES128_KEYLEN));
+			assert(k->idlen == idlen);
+			AZ(memcmp(k->id, id, idlen));
+			return (0);
 		}
-
-		Lck_Lock(&page_mtx);
-		if (VSTAILQ_EMPTY(&addr_head))
-			if (key_alloc_page(ctx) != 0) {
-				Lck_Unlock(&page_mtx);
-				goto fail;
-			}
-		assert(!VSTAILQ_EMPTY(&addr_head));
-		addr_ent = VSTAILQ_FIRST(&addr_head);
-		CHECK_OBJ_NOTNULL(addr_ent, ADDR_ENTRY_MAGIC);
-		AN(addr_ent->addr);
-		VSTAILQ_REMOVE_HEAD(&addr_head, list);
-		Lck_Unlock(&page_mtx);
-
-		k->key = addr_ent->addr;
-		FREE_OBJ(addr_ent);
-		memcpy(k->id, id, idlen);
-		k->idlen = idlen;
-		VRBT_INSERT(key_tree, tree_h, k);
+		else
+			return (-1);
 	}
-	CHECK_OBJ_NOTNULL(k, KEY_MAGIC);
+	CHECK_OBJ(k, KEY_MAGIC);
 	AN(k->key);
 	memcpy(k->key, key, AES128_KEYLEN);
-
 	KEY_Unlock(idlen);
-	return (0);
 
- fail:
-	KEY_Unlock(idlen);
-	return (-1);
+	assert(k->idlen == idlen);
+	AZ(memcmp(k->id, id, idlen));
+	return (0);
 }
 
 int

src/keys.h

@@ -37,6 +37,7 @@ void KEY_Fini(void);
 void KEY_Rdlock(uint8_t idlen);
 void KEY_Unlock(uint8_t idlen);
 uint8_t *KEY_Get(uint8_t *id, uint8_t idlen);
+int KEY_Add(VRT_CTX, uint8_t *id, uint8_t idlen, const uint8_t *key);
 int KEY_Set(VRT_CTX, uint8_t *id, uint8_t idlen, const uint8_t *key);
 void KEY_Wipe(void * const key);
 int KEY_Delete(VRT_CTX, uint8_t *id, uint8_t idlen);

src/tests/keys.vtc

@@ -51,6 +51,66 @@ logexpect l1 -v v1 -d 1 -g vxid -q "FetchError" {
 	expect * = End
 } -run
 
+server s1 -wait
+server s1 {
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 53"
+	sendhex "23 50 6c c6 d1 6d b6 5b f7 bb f3 a8 f7 8c 67 9b"
+	sendhex "00 00 10 00 00 f8 d0 15 b9 bd aa 16 00 44 b9 02"
+	sendhex "91 6a 9a 19 bb e2 31 90 8b da dc c1 01 d4 f0 fe"
+	sendhex "97 2f 13 86 38"
+} -start
+
+varnish v1 -vcl+backend {
+	import ${vmod_ece};
+	import blob;
+
+	sub vcl_init {
+		ece.add_key("", blob.decode(BASE64URLNOPAD,
+		                            encoded="yqdlZ-tYemfogSmv7Ws5PQ"));
+	}
+
+	sub vcl_recv {
+		set req.http.Exists-Before = ece.key_exists("");
+		if (req.url == "/add") {
+			ece.add_key("", blob.decode(BASE64,
+					encoded="7l7lrhy91XNHfVW1SwhSBA=="));
+		}
+	}
+
+	sub vcl_backend_response {
+		set bereq.http.X-ECE-Key-ID = "";
+		set beresp.filters = "ece_decrypt";
+	}
+
+	sub vcl_deliver {
+		set resp.http.Exists-Before = req.http.Exists-Before;
+	}
+}
+
+logexpect l1 -v v1 -d 0 -g vxid -q "VCL_Error" {
+	expect 0 * Begin	req
+	expect * = VCL_Error	{^key "" already exists$}
+	expect * = End
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 200
+	expect resp.bodylen == 15
+	expect resp.body == "I am the walrus"
+	expect resp.http.Exists-Before == "true"
+
+	txreq -url /add
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "VCL failed"
+} -run
+
+logexpect l1 -wait
+
 varnish v1 -vcl {
 	import ${vmod_ece};
 	import blob;
@@ -106,6 +166,28 @@ varnish v1 -vcl {
 1234567890123456789012345678901234567890123456789012345678901234567890
 "});
 		}
+		elsif (req.url == "/add/nullblob") {
+			ece.add_key("key", blob.decode(HEX,
+						encoded="bad blob"));
+		}
+		elsif (req.url == "/add/nullid") {
+			ece.add_key(req.http.No-Such-Header, blob.decode(HEX,
+							encoded="f00"));
+		}
+		elsif (req.url == "/add/shortkey") {
+			ece.add_key("key", blob.decode(HEX,
+							encoded="f00"));
+		}
+		elsif (req.url == "/add/toolong") {
+			ece.add_key({"
+1234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890
+"},
+				blob.decode(BASE64,
+				    encoded="75cIt3LwTqbq66pKSmp2fA=="));
+		}
 	}
 }
 
@@ -134,10 +216,30 @@ logexpect l1 -v v1 -d 0 -g vxid -q "VCL_Error" {
 	expect * = VCL_Error	{^illegal key length \d+ \(must be 16\)$}
 	expect * = End
 
+	expect 0 * Begin	req
+	expect * = VCL_Error	{(?s)^key id .+ too long \(length \d+ > 255\)$}
+	expect * = End
+
+	expect 0 * Begin	req
+	expect * = VCL_Error	{^key id is NULL$}
+	expect * = End
+
+	expect 0 * Begin	req
+	expect * = VCL_Error	{(?s)^key id .+ too long \(length \d+ > 255\)$}
+	expect * = End
+
+	expect 0 * Begin	req
+	expect * = VCL_Error	{^vmod blob error}
+	expect * = End
+
 	expect 0 * Begin	req
 	expect * = VCL_Error	{^key id is NULL$}
 	expect * = End
 
+	expect 0 * Begin	req
+	expect * = VCL_Error	{^illegal key length \d+ \(must be 16\)$}
+	expect * = End
+
 	expect 0 * Begin	req
 	expect * = VCL_Error	{(?s)^key id .+ too long \(length \d+ > 255\)$}
 	expect * = End
@@ -185,6 +287,13 @@ client c1 {
 	expect resp.reason == "VCL failed"
 } -run
 
+client c1 {
+	txreq -url /set/toolong
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "VCL failed"
+} -run
+
 client c1 {
 	txreq -url /exists/null
 	rxresp
@@ -199,4 +308,32 @@ client c1 {
 	expect resp.reason == "VCL failed"
 } -run
 
+client c1 {
+	txreq -url /add/nullblob
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "VCL failed"
+} -run
+
+client c1 {
+	txreq -url /add/nullid
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "VCL failed"
+} -run
+
+client c1 {
+	txreq -url /add/shortkey
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "VCL failed"
+} -run
+
+client c1 {
+	txreq -url /add/toolong
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "VCL failed"
+} -run
+
 logexpect l1 -wait

src/vmod_ece.c

@@ -74,6 +74,36 @@ VPFX(event)(VRT_CTX, struct vmod_priv *priv, enum vcl_event_e e)
 	NEEDLESS(return (0));
 }
 
+VCL_VOID
+vmod_add_key(VRT_CTX, VCL_STRING id, VCL_BLOB key)
+{
+	size_t len;
+
+	CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
+
+	if (id == NULL) {
+		VRT_fail(ctx, "key id is NULL");
+		return;
+	}
+	if (key == NULL || key->blob == NULL) {
+		VRT_fail(ctx, "key contents are empty");
+		return;
+	}
+	if (key->len != 16) {
+		VRT_fail(ctx, "illegal key length %zu (must be 16)", key->len);
+		return;
+	}
+	len = strlen(id);
+	if (len > 255) {
+		VRT_fail(ctx, "key id \"%.80s...\" too long (length %zu > 255)",
+			 id, len);
+		return;
+	}
+
+	/* KEY_Add calls VRT_fail() on error. */
+	(void)KEY_Add(ctx, (uint8_t *)id, (uint8_t)len, key->blob);
+}
+
 VCL_VOID
 vmod_set_key(VRT_CTX, VCL_STRING id, VCL_BLOB key)
 {

src/vmod_ece.vcc

@@ -56,6 +56,13 @@ Encryption and HTTP
 
 XXX ...
 
+$Function VOID add_key(STRING id, BLOB key)
+
+Add the keying material identified by ``id`` with the contents of the
+blob ``key``, provided that ``id`` does not already exist.
+
+XXX ...
+
 $Function VOID set_key(STRING id, BLOB key)
 
 Set the keying material identified by ``id`` to the contents of the