2 * Copyright (C) 1986-2005 The Free Software Foundation, Inc.
4 * Portions Copyright (C) 1998-2005 Derek Price, Ximbiot <http://ximbiot.com>,
7 * Portions Copyright (c) 1995, Cyclic Software, Bloomington, IN, USA
9 * You may distribute under the terms of the GNU General Public License as
10 * specified in the README file that comes with CVS.
12 * Allow user to log in for an authenticating server.
18 #ifdef AUTH_CLIENT_SUPPORT /* This covers the rest of the file. */
20 /* There seems to be very little agreement on which system header
21 getpass is declared in. With a lot of fancy autoconfiscation,
22 we could perhaps detect this, but for now we'll just rely on
23 _CRAY, since Cray is perhaps the only system on which our own
24 declaration won't work (some Crays declare the 2#$@% thing as
25 varadic, believe it or not). On Cray, getpass will be declared
26 in either stdlib.h or unistd.h. */
28 #ifndef CVS_PASSWORD_FILE
29 #define CVS_PASSWORD_FILE ".cvspass"
32 /* If non-NULL, get_cvs_password() will just return this. */
33 static char *cvs_password = NULL;
35 static char *construct_cvspass_filename PROTO ((void));
37 /* The return value will need to be freed. */
39 construct_cvspass_filename ()
44 /* Environment should override file. */
45 if ((passfile = getenv ("CVS_PASSFILE")) != NULL)
46 return xstrdup (passfile);
48 /* Construct absolute pathname to user's password file. */
49 /* todo: does this work under OS/2 ? */
50 homedir = get_homedir ();
53 /* FIXME? This message confuses a lot of users, at least
54 on Win95 (which doesn't set HOMEDRIVE and HOMEPATH like
55 NT does). I suppose the answer for Win95 is to store the
56 passwords in the registry or something (??). And .cvsrc
57 and such too? Wonder what WinCVS does (about .cvsrc, the
58 right thing for a GUI is to just store the password in
60 error (1, 0, "could not find out home directory");
64 passfile = strcat_filename_onto_homedir (homedir, CVS_PASSWORD_FILE);
66 /* Safety first and last, Scouts. */
67 if (isfile (passfile))
68 /* xchmod() is too polite. */
69 chmod (passfile, 0600);
78 * password_entry_parseline (
79 * const char *cvsroot_canonical,
80 * const unsigned char warn,
81 * const int linenumber,
85 * Internal function used by password_entry_operation. Parse a single line
86 * from a ~/.cvsroot password file and return a pointer to the password if the
87 * line refers to the same cvsroot as cvsroot_canonical
90 * cvsroot_canonical the root we are looking for
91 * warn Boolean: print warnings for invalid lines?
92 * linenumber the line number for error messages
93 * linebuf the current line
96 * NULL if the line doesn't match
97 * char *password as a pointer into linebuf
100 * This function temporarily alters linebuf, so it isn't thread safe when
101 * called on the same linebuf
104 password_entry_parseline (cvsroot_canonical, warn, linenumber, linebuf)
105 const char *cvsroot_canonical;
106 const unsigned char warn;
107 const int linenumber;
110 char *password = NULL;
116 /* Yes: slurp '^/\d+\D' and parse the rest of the line according to version number */
118 unsigned long int entry_version = 0;
120 if (isspace(*(linebuf + 1)))
122 /* special case since strtoul ignores leading white space */
127 entry_version = strtoul (linebuf + 1, &q, 10);
128 if (q != linebuf + 1)
129 /* assume a delimiting seperator */
133 switch (entry_version)
136 /* this means the same normalize_cvsroot we are using was
137 * used to create this entry. strcmp is good enough for
143 if (warn && !really_quiet)
144 error (0, 0, "warning: skipping invalid entry in password file at line %d",
150 if (strcmp (cvsroot_canonical, q) == 0)
156 if (warn && !really_quiet)
158 error (0, errno, "warning: unable to convert version number in password file at line %d",
160 error (0, 0, "skipping entry");
164 if (warn && !really_quiet)
165 error (0, 0, "warning: skipping entry with invalid version string in password file at line %d",
169 if (warn && !really_quiet)
170 error (0, 0, "warning: skipping entry with unknown version (%lu) in password file at line %d",
171 entry_version, linenumber);
179 * ^cvsroot Aencoded_password$
181 * as header comment specifies and parse accordingly
184 char *tmp_root_canonical;
186 p = strchr (linebuf, ' ');
189 if (warn && !really_quiet)
190 error (0, 0, "warning: skipping invalid entry in password file at line %d", linenumber);
195 if ((tmp_root = parse_cvsroot (linebuf)) == NULL)
197 if (warn && !really_quiet)
198 error (0, 0, "warning: skipping invalid entry in password file at line %d", linenumber);
203 tmp_root_canonical = normalize_cvsroot (tmp_root);
204 if (strcmp (cvsroot_canonical, tmp_root_canonical) == 0)
207 free (tmp_root_canonical);
208 free_cvsroot_t (tmp_root);
218 * password_entry_operation (
219 * password_entry_operation_t operation,
224 * Search the password file and depending on the value of operation:
227 * password_entry_lookup Return the password
228 * password_entry_delete Delete the entry from the file, if it
230 * password_entry_add Replace the line with the new one, else
233 * Because the user might be accessing multiple repositories, with
234 * different passwords for each one, the format of ~/.cvspass is:
236 * [user@]host:[port]/path Aencoded_password
237 * [user@]host:[port]/path Aencoded_password
240 * New entries are always of the form:
242 * /1 user@host:port/path Aencoded_password
244 * but the old format is supported for backwards compatibility.
245 * The entry version string wasn't strictly necessary, but it avoids the
246 * overhead of parsing some entries since we know it is already in canonical
247 * form and allows room for expansion later, say, if we want to allow spaces
248 * and/or other characters to be escaped in the string. Also, the new entries
249 * would have been ignored by old versions of CVS anyhow since those versions
250 * didn't know how to parse a port number.
252 * The "A" before "encoded_password" is a literal capital A. It's a
253 * version number indicating which form of scrambling we're doing on
254 * the password -- someday we might provide something more secure than
255 * the trivial encoding we do now, and when that day comes, it would
256 * be nice to remain backward-compatible.
258 * Like .netrc, the file's permissions are the only thing preventing
259 * it from being read by others. Unlike .netrc, we will not be
260 * fascist about it, at most issuing a warning, and never refusing to
264 * operation operation to perform
265 * root cvsroot_t to look up
266 * newpassword prescrambled new password, for password_entry_add_mode
269 * -1 if password_entry_lookup_mode not specified
270 * NULL on failed lookup
271 * pointer to a copy of the password string otherwise, which the caller is
272 * responsible for disposing of
275 typedef enum password_entry_operation_e {
276 password_entry_lookup,
277 password_entry_delete,
279 } password_entry_operation_t;
282 password_entry_operation (operation, root, newpassword)
283 password_entry_operation_t operation;
289 char *cvsroot_canonical = NULL;
290 char *password = NULL;
293 char *linebuf = NULL;
298 if (root->method != pserver_method)
301 internal error: can only call password_entry_operation with pserver method");
302 error (1, 0, "CVSROOT: %s", root->original);
305 cvsroot_canonical = normalize_cvsroot (root);
307 /* Yes, the method below reads the user's password file twice when we have
308 * to delete an entry. It's inefficient, but we're not talking about a gig of
312 passfile = construct_cvspass_filename ();
313 fp = CVS_FOPEN (passfile, "r");
316 error (0, errno, "warning: failed to open %s for reading", passfile);
320 /* Check each line to see if we have this entry already. */
322 while ((line_length = getline (&linebuf, &linebuf_len, fp)) >= 0)
325 password = password_entry_parseline (cvsroot_canonical, 1, line,
327 if (password != NULL)
328 /* this is it! break out and deal with linebuf */
331 if (line_length < 0 && !feof (fp))
333 error (0, errno, "cannot read %s", passfile);
337 /* not fatal, unless it cascades */
338 error (0, errno, "cannot close %s", passfile);
341 /* Utter, total, raving paranoia, I know. */
342 chmod (passfile, 0600);
344 /* a copy to return or keep around so we can reuse linebuf */
345 if (password != NULL)
348 p = strchr (password, '\n');
351 password = xstrdup (password);
356 /* might as well return now */
357 if (operation == password_entry_lookup)
361 if (operation == password_entry_delete && password == NULL)
363 error (0, 0, "Entry not found.");
367 /* okay, file errors can simply be fatal from now on since we don't do
368 * anything else if we're in lookup mode
371 /* copy the file with the entry deleted unless we're in add
372 * mode and the line we found contains the same password we're supposed to
375 if (!noexec && password != NULL && (operation == password_entry_delete
376 || (operation == password_entry_add
377 && strcmp (password, newpassword))))
379 long found_at = line;
383 /* open the original file again */
384 fp = CVS_FOPEN (passfile, "r");
386 error (1, errno, "failed to open %s for reading", passfile);
388 /* create and open a temp file */
389 if ((tmp_fp = cvs_temp_file (&tmp_name)) == NULL)
390 error (1, errno, "unable to open temp file %s",
391 tmp_name ? tmp_name : "(null)");
394 while ((line_length = getline (&linebuf, &linebuf_len, fp)) >= 0)
399 && !password_entry_parseline (cvsroot_canonical, 0, line,
402 if (fprintf (tmp_fp, "%s", linebuf) == EOF)
404 /* try and clean up anyhow */
405 error (0, errno, "fatal error: cannot write %s", tmp_name);
406 if (fclose (tmp_fp) == EOF)
407 error (0, errno, "cannot close %s", tmp_name);
408 /* call CVS_UNLINK instead of unlink_file since the file
409 * got created in noexec mode
411 if (CVS_UNLINK (tmp_name) < 0)
412 error (0, errno, "cannot remove %s", tmp_name);
413 /* but quit so we don't remove all the entries from a
414 * user's password file accidentally
416 error (1, 0, "exiting");
420 if (line_length < 0 && !feof (fp))
422 error (0, errno, "cannot read %s", passfile);
426 /* not fatal, unless it cascades */
427 error (0, errno, "cannot close %s", passfile);
428 if (fclose (tmp_fp) < 0)
429 /* not fatal, unless it cascades */
430 /* FIXME - does copy_file return correct results if the file wasn't
431 * closed? should this be fatal?
433 error (0, errno, "cannot close %s", tmp_name);
435 /* FIXME: rename_file would make more sense (e.g. almost
438 * I don't think so, unless we change the way rename_file works to
439 * attempt a cp/rm sequence when rename fails since rename doesn't
440 * work across file systems and it isn't uncommon to have /tmp
441 * on its own partition.
443 * For that matter, it's probably not uncommon to have a home
444 * directory on an NFS mount.
446 copy_file (tmp_name, passfile);
447 if (CVS_UNLINK (tmp_name) < 0)
448 error (0, errno, "cannot remove %s", tmp_name);
452 /* in add mode, if we didn't find an entry or found an entry with a
453 * different password, append the new line
455 if (!noexec && operation == password_entry_add
456 && (password == NULL || strcmp (password, newpassword)))
458 if ((fp = CVS_FOPEN (passfile, "a")) == NULL)
459 error (1, errno, "could not open %s for writing", passfile);
461 if (fprintf (fp, "/1 %s %s\n", cvsroot_canonical, newpassword) == EOF)
462 error (1, errno, "cannot write %s", passfile);
464 error (1, errno, "cannot close %s", passfile);
467 /* Utter, total, raving paranoia, I know. */
468 chmod (passfile, 0600);
479 free (cvsroot_canonical);
484 /* just exit when we're not in lookup mode */
485 if (operation != password_entry_lookup)
486 error (1, 0, "fatal error: exiting");
487 /* clean up and exit in lookup mode so we can try a login with a NULL
488 * password anyhow in case that's what we would have found
493 /* Utter, total, raving paranoia, I know. */
494 chmod (passfile, 0600);
496 error (0, errno, "cannot close %s", passfile);
500 if (cvsroot_canonical)
501 free (cvsroot_canonical);
509 /* Prompt for a password, and store it in the file "CVS/.cvspass".
512 static const char *const login_usage[] =
515 "(Specify the --help global option for a list of other help options)\n",
524 char *typed_password;
525 char *cvsroot_canonical;
530 if (current_parsed_root->method != pserver_method)
532 error (0, 0, "can only use `login' command with the 'pserver' method");
533 error (1, 0, "CVSROOT: %s", current_parsed_root->original);
536 cvsroot_canonical = normalize_cvsroot(current_parsed_root);
537 printf ("Logging in to %s\n", cvsroot_canonical);
540 if (current_parsed_root->password)
542 typed_password = scramble (current_parsed_root->password);
547 tmp = getpass ("CVS password: ");
548 /* Must deal with a NULL return value here. I haven't managed to
549 * disconnect the CVS process from the tty and force a NULL return
550 * in sanity.sh, but the Linux version of getpass is documented
551 * to return NULL when it can't open /dev/tty...
553 if (!tmp) error (1, errno, "login: Failed to read password.");
554 typed_password = scramble (tmp);
555 memset (tmp, 0, strlen (tmp));
558 /* Force get_cvs_password() to use this one (when the client
559 * confirms the new password with the server), instead of
560 * consulting the file. We make a new copy because cvs_password
561 * will get zeroed by connect_to_server(). */
562 cvs_password = xstrdup (typed_password);
564 connect_to_pserver (current_parsed_root, NULL, NULL, 1, 0);
566 password_entry_operation (password_entry_add, current_parsed_root,
569 free_cvs_password (typed_password);
570 free (cvsroot_canonical);
577 /* Free the password returned by get_cvs_password() and also free the
578 * saved cvs_password if they are different pointers. Be paranoid
579 * about the in-memory copy of the password and overwrite it with zero
580 * bytes before doing the free().
583 free_cvs_password (char *password)
585 if (password && password != cvs_password)
587 memset (password, 0, strlen (password));
593 memset (cvs_password, 0, strlen (cvs_password));
599 /* Returns the _scrambled_ password in freshly allocated memory. The server
600 * must descramble before hashing and comparing. If password file not found,
601 * or password not found in the file, just return NULL.
606 if (current_parsed_root->password)
607 return scramble (current_parsed_root->password);
609 /* If someone (i.e., login()) is calling connect_to_pserver() out of
610 context, then assume they have supplied the correct, scrambled
613 return xstrdup (cvs_password);
615 if (getenv ("CVS_PASSWORD") != NULL)
617 /* In previous versions of CVS one could specify a password in
618 * CVS_PASSWORD. This is a bad idea, because in BSD variants
619 * of unix anyone can see the environment variable with 'ps'.
620 * But for users who were using that feature we want to at
621 * least let them know what is going on. After printing this
622 * warning, we should fall through to the regular error where
623 * we tell them to run "cvs login" (unless they already ran
626 error (0, 0, "CVS_PASSWORD is no longer supported; ignored");
629 if (current_parsed_root->method != pserver_method)
631 error (0, 0, "can only call get_cvs_password with pserver method");
632 error (1, 0, "CVSROOT: %s", current_parsed_root->original);
635 return password_entry_operation (password_entry_lookup,
636 current_parsed_root, NULL);
641 static const char *const logout_usage[] =
644 "(Specify the --help global option for a list of other help options)\n",
648 /* Remove any entry for the CVSRoot repository found in .cvspass. */
654 char *cvsroot_canonical;
657 usage (logout_usage);
659 if (current_parsed_root->method != pserver_method)
661 error (0, 0, "can only use pserver method with `logout' command");
662 error (1, 0, "CVSROOT: %s", current_parsed_root->original);
665 /* Hmm. Do we want a variant of this command which deletes _all_
666 the entries from the current .cvspass? Might be easier to
667 remember than "rm ~/.cvspass" but then again if people are
668 mucking with HOME (common in Win95 as the system doesn't set
669 it), then this variant of "cvs logout" might give a false sense
670 of security, in that it wouldn't delete entries from any
671 .cvspass files but the current one. */
675 cvsroot_canonical = normalize_cvsroot(current_parsed_root);
676 printf ("Logging out of %s\n", cvsroot_canonical);
678 free (cvsroot_canonical);
681 password_entry_operation (password_entry_delete, current_parsed_root, NULL);
686 #endif /* AUTH_CLIENT_SUPPORT from beginning of file. */