2 * Copyright (C) 1986-2005 The Free Software Foundation, Inc.
4 * Portions Copyright (C) 1998-2005 Derek Price, Ximbiot <http://ximbiot.com>,
7 * Portions Copyright (c) 1995, Cyclic Software, Bloomington, IN, USA
9 * You may distribute under the terms of the GNU General Public License as
10 * specified in the README file that comes with CVS.
12 * Allow user to log in for an authenticating server.
18 /* There seems to be very little agreement on which system header
19 getpass is declared in. With a lot of fancy autoconfiscation,
20 we could perhaps detect this, but for now we'll just rely on
21 _CRAY, since Cray is perhaps the only system on which our own
22 declaration won't work (some Crays declare the 2#$@% thing as
23 varadic, believe it or not). On Cray, getpass will be declared
24 in either stdlib.h or unistd.h. */
27 #ifdef AUTH_CLIENT_SUPPORT /* This covers the rest of the file. */
30 #ifndef CVS_PASSWORD_FILE
31 #define CVS_PASSWORD_FILE ".cvspass"
34 /* If non-NULL, get_cvs_password() will just return this. */
35 static char *cvs_password = NULL;
37 static char *construct_cvspass_filename (void);
39 /* The return value will need to be freed. */
41 construct_cvspass_filename (void)
46 /* Environment should override file. */
47 if ((passfile = getenv ("CVS_PASSFILE")) != NULL)
48 return xstrdup (passfile);
50 /* Construct absolute pathname to user's password file. */
51 /* todo: does this work under OS/2 ? */
52 homedir = get_homedir ();
55 /* FIXME? This message confuses a lot of users, at least
56 on Win95 (which doesn't set HOMEDRIVE and HOMEPATH like
57 NT does). I suppose the answer for Win95 is to store the
58 passwords in the registry or something (??). And .cvsrc
59 and such too? Wonder what WinCVS does (about .cvsrc, the
60 right thing for a GUI is to just store the password in
62 error (1, 0, "could not find out home directory");
66 passfile = strcat_filename_onto_homedir (homedir, CVS_PASSWORD_FILE);
68 /* Safety first and last, Scouts. */
69 if (isfile (passfile))
70 /* xchmod() is too polite. */
71 chmod (passfile, 0600);
80 * password_entry_parseline (
81 * const char *cvsroot_canonical,
82 * const unsigned char warn,
83 * const int linenumber,
87 * Internal function used by password_entry_operation. Parse a single line
88 * from a ~/.cvsroot password file and return a pointer to the password if the
89 * line refers to the same cvsroot as cvsroot_canonical
92 * cvsroot_canonical the root we are looking for
93 * warn Boolean: print warnings for invalid lines?
94 * linenumber the line number for error messages
95 * linebuf the current line
98 * NULL if the line doesn't match
99 * char *password as a pointer into linebuf
102 * This function temporarily alters linebuf, so it isn't thread safe when
103 * called on the same linebuf
106 password_entry_parseline (const char *cvsroot_canonical,
107 const unsigned char warn, const int linenumber,
110 char *password = NULL;
116 /* Yes: slurp '^/\d+\D' and parse the rest of the line according to
120 unsigned long int entry_version = 0 /* Placate -Wall. */;
122 if (isspace(*(linebuf + 1)))
123 /* special case since strtoul ignores leading white space */
126 entry_version = strtoul (linebuf + 1, &q, 10);
128 if (q != linebuf + 1)
129 /* assume a delimiting seperator */
131 /* else, no valid digits found by strtoul */
133 switch (entry_version)
136 /* this means the same normalize_cvsroot we are using was
137 * used to create this entry. strcmp is good enough for
143 if (warn && !really_quiet)
144 error (0, 0, "warning: skipping invalid entry in password file at line %d",
150 if (strcmp (cvsroot_canonical, q) == 0)
156 if (warn && !really_quiet)
158 error (0, errno, "warning: unable to convert version number in password file at line %d",
160 error (0, 0, "skipping entry");
164 if (warn && !really_quiet)
165 error (0, 0, "warning: skipping entry with invalid version string in password file at line %d",
169 if (warn && !really_quiet)
170 error (0, 0, "warning: skipping entry with unknown version (%lu) in password file at line %d",
171 entry_version, linenumber);
179 * ^cvsroot Aencoded_password$
181 * as header comment specifies and parse accordingly
184 char *tmp_root_canonical;
186 p = strchr (linebuf, ' ');
189 if (warn && !really_quiet)
190 error (0, 0, "warning: skipping invalid entry in password file at line %d", linenumber);
195 if ((tmp_root = parse_cvsroot (linebuf)) == NULL)
197 if (warn && !really_quiet)
198 error (0, 0, "warning: skipping invalid entry in password file at line %d", linenumber);
203 switch (tmp_root->method)
209 #endif /* HAVE_KERBEROS */
210 tmp_root_canonical = normalize_cvsroot (tmp_root);
211 if (strcmp (cvsroot_canonical, tmp_root_canonical) == 0)
213 free (tmp_root_canonical);
227 * password_entry_operation (
228 * password_entry_operation_t operation,
233 * Search the password file and depending on the value of operation:
236 * password_entry_lookup Return the password
237 * password_entry_delete Delete the entry from the file, if it
239 * password_entry_add Replace the line with the new one, else
242 * Because the user might be accessing multiple repositories, with
243 * different passwords for each one, the format of ~/.cvspass is:
245 * [user@]host:[port]/path Aencoded_password
246 * [user@]host:[port]/path Aencoded_password
249 * New entries are always of the form:
251 * /1 user@host:port/path Aencoded_password
253 * but the old format is supported for backwards compatibility.
254 * The entry version string wasn't strictly necessary, but it avoids the
255 * overhead of parsing some entries since we know it is already in canonical
256 * form and allows room for expansion later, say, if we want to allow spaces
257 * and/or other characters to be escaped in the string. Also, the new entries
258 * would have been ignored by old versions of CVS anyhow since those versions
259 * didn't know how to parse a port number.
261 * The "A" before "encoded_password" is a literal capital A. It's a
262 * version number indicating which form of scrambling we're doing on
263 * the password -- someday we might provide something more secure than
264 * the trivial encoding we do now, and when that day comes, it would
265 * be nice to remain backward-compatible.
267 * Like .netrc, the file's permissions are the only thing preventing
268 * it from being read by others. Unlike .netrc, we will not be
269 * fascist about it, at most issuing a warning, and never refusing to
273 * operation operation to perform
274 * root cvsroot_t to look up
275 * newpassword prescrambled new password, for password_entry_add_mode
278 * -1 if password_entry_lookup_mode not specified
279 * NULL on failed lookup
280 * pointer to a copy of the password string otherwise, which the caller is
281 * responsible for disposing of
284 typedef enum password_entry_operation_e {
285 password_entry_lookup,
286 password_entry_delete,
288 } password_entry_operation_t;
291 password_entry_operation (password_entry_operation_t operation, cvsroot_t *root, char *newpassword)
295 char *cvsroot_canonical = NULL;
296 char *password = NULL;
299 char *linebuf = NULL;
304 if (root->method != pserver_method)
307 internal error: can only call password_entry_operation with pserver method");
308 error (1, 0, "CVSROOT: %s", root->original);
311 cvsroot_canonical = normalize_cvsroot (root);
313 /* Yes, the method below reads the user's password file twice when we have
314 * to delete an entry. It's inefficient, but we're not talking about a gig of
318 passfile = construct_cvspass_filename ();
319 fp = CVS_FOPEN (passfile, "r");
322 if (errno != ENOENT) {
323 error (0, errno, "warning: failed to open %s for reading", passfile);
328 /* Check each line to see if we have this entry already. */
330 while ((line_length = getline (&linebuf, &linebuf_len, fp)) >= 0)
333 password = password_entry_parseline (cvsroot_canonical, 1, line,
335 if (password != NULL)
336 /* this is it! break out and deal with linebuf */
339 if (line_length < 0 && !feof (fp))
341 error (0, errno, "cannot read %s", passfile);
345 /* not fatal, unless it cascades */
346 error (0, errno, "cannot close %s", passfile);
349 /* Utter, total, raving paranoia, I know. */
350 chmod (passfile, 0600);
352 /* a copy to return or keep around so we can reuse linebuf */
353 if (password != NULL)
356 p = strchr (password, '\n');
359 password = xstrdup (password);
364 /* might as well return now */
365 if (operation == password_entry_lookup)
369 if (operation == password_entry_delete && password == NULL)
371 error (0, 0, "Entry not found.");
375 /* okay, file errors can simply be fatal from now on since we don't do
376 * anything else if we're in lookup mode
379 /* copy the file with the entry deleted unless we're in add
380 * mode and the line we found contains the same password we're supposed to
383 if (!noexec && password != NULL && (operation == password_entry_delete
384 || (operation == password_entry_add
385 && strcmp (password, newpassword))))
387 long found_at = line;
391 /* open the original file again */
392 fp = CVS_FOPEN (passfile, "r");
394 error (1, errno, "failed to open %s for reading", passfile);
396 /* create and open a temp file */
397 if ((tmp_fp = cvs_temp_file (&tmp_name)) == NULL)
398 error (1, errno, "unable to open temp file %s", tmp_name);
401 while ((line_length = getline (&linebuf, &linebuf_len, fp)) >= 0)
406 && !password_entry_parseline (cvsroot_canonical, 0, line,
409 if (fprintf (tmp_fp, "%s", linebuf) == EOF)
411 /* try and clean up anyhow */
412 error (0, errno, "fatal error: cannot write %s", tmp_name);
413 if (fclose (tmp_fp) == EOF)
414 error (0, errno, "cannot close %s", tmp_name);
415 /* call CVS_UNLINK instead of unlink_file since the file
416 * got created in noexec mode
418 if (CVS_UNLINK (tmp_name) < 0)
419 error (0, errno, "cannot remove %s", tmp_name);
420 /* but quit so we don't remove all the entries from a
421 * user's password file accidentally
423 error (1, 0, "exiting");
427 if (line_length < 0 && !feof (fp))
429 error (0, errno, "cannot read %s", passfile);
433 /* not fatal, unless it cascades */
434 error (0, errno, "cannot close %s", passfile);
435 if (fclose (tmp_fp) < 0)
436 /* not fatal, unless it cascades */
437 /* FIXME - does copy_file return correct results if the file wasn't
438 * closed? should this be fatal?
440 error (0, errno, "cannot close %s", tmp_name);
442 /* FIXME: rename_file would make more sense (e.g. almost
445 * I don't think so, unless we change the way rename_file works to
446 * attempt a cp/rm sequence when rename fails since rename doesn't
447 * work across file systems and it isn't uncommon to have /tmp
448 * on its own partition.
450 * For that matter, it's probably not uncommon to have a home
451 * directory on an NFS mount.
453 copy_file (tmp_name, passfile);
454 if (CVS_UNLINK (tmp_name) < 0)
455 error (0, errno, "cannot remove %s", tmp_name);
459 /* in add mode, if we didn't find an entry or found an entry with a
460 * different password, append the new line
462 if (!noexec && operation == password_entry_add
463 && (password == NULL || strcmp (password, newpassword)))
465 if ((fp = CVS_FOPEN (passfile, "a")) == NULL)
466 error (1, errno, "could not open %s for writing", passfile);
468 if (fprintf (fp, "/1 %s %s\n", cvsroot_canonical, newpassword) == EOF)
469 error (1, errno, "cannot write %s", passfile);
471 error (1, errno, "cannot close %s", passfile);
474 /* Utter, total, raving paranoia, I know. */
475 chmod (passfile, 0600);
486 free (cvsroot_canonical);
491 /* just exit when we're not in lookup mode */
492 if (operation != password_entry_lookup)
493 error (1, 0, "fatal error: exiting");
494 /* clean up and exit in lookup mode so we can try a login with a NULL
495 * password anyhow in case that's what we would have found
500 /* Utter, total, raving paranoia, I know. */
501 chmod (passfile, 0600);
503 error (0, errno, "cannot close %s", passfile);
507 if (cvsroot_canonical)
508 free (cvsroot_canonical);
516 /* Prompt for a password, and store it in the file "CVS/.cvspass".
519 static const char *const login_usage[] =
522 "(Specify the --help global option for a list of other help options)\n",
527 login (int argc, char **argv)
529 char *typed_password;
530 char *cvsroot_canonical;
535 if (current_parsed_root->method != pserver_method)
537 error (0, 0, "can only use `login' command with the 'pserver' method");
538 error (1, 0, "CVSROOT: %s", current_parsed_root->original);
541 cvsroot_canonical = normalize_cvsroot(current_parsed_root);
542 printf ("Logging in to %s\n", cvsroot_canonical);
545 if (current_parsed_root->password)
547 typed_password = scramble (current_parsed_root->password);
552 tmp = getpass ("CVS password: ");
553 /* Must deal with a NULL return value here. I haven't managed to
554 * disconnect the CVS process from the tty and force a NULL return
555 * in sanity.sh, but the Linux version of getpass is documented
556 * to return NULL when it can't open /dev/tty...
558 if (!tmp) error (1, errno, "login: Failed to read password.");
559 typed_password = scramble (tmp);
560 memset (tmp, 0, strlen (tmp));
563 /* Force get_cvs_password() to use this one (when the client
564 * confirms the new password with the server), instead of
565 * consulting the file. We make a new copy because cvs_password
566 * will get zeroed by connect_to_server(). */
567 cvs_password = xstrdup (typed_password);
569 connect_to_pserver (current_parsed_root, NULL, NULL, 1, 0);
571 password_entry_operation (password_entry_add, current_parsed_root,
574 memset (typed_password, 0, strlen (typed_password));
575 free (typed_password);
578 free (cvsroot_canonical);
586 /* Returns the _scrambled_ password. The server must descramble
587 before hashing and comparing. If password file not found, or
588 password not found in the file, just return NULL. */
590 get_cvs_password (void)
592 if (current_parsed_root->password)
593 return scramble (current_parsed_root->password);
595 /* If someone (i.e., login()) is calling connect_to_pserver() out of
596 context, then assume they have supplied the correct, scrambled
601 if (getenv ("CVS_PASSWORD") != NULL)
603 /* In previous versions of CVS one could specify a password in
604 * CVS_PASSWORD. This is a bad idea, because in BSD variants
605 * of unix anyone can see the environment variable with 'ps'.
606 * But for users who were using that feature we want to at
607 * least let them know what is going on. After printing this
608 * warning, we should fall through to the regular error where
609 * we tell them to run "cvs login" (unless they already ran
612 error (0, 0, "CVS_PASSWORD is no longer supported; ignored");
615 if (current_parsed_root->method != pserver_method)
617 error (0, 0, "can only call get_cvs_password with pserver method");
618 error (1, 0, "CVSROOT: %s", current_parsed_root->original);
621 return password_entry_operation (password_entry_lookup,
622 current_parsed_root, NULL);
627 static const char *const logout_usage[] =
630 "(Specify the --help global option for a list of other help options)\n",
634 /* Remove any entry for the CVSRoot repository found in .cvspass. */
636 logout (int argc, char **argv)
638 char *cvsroot_canonical;
641 usage (logout_usage);
643 if (current_parsed_root->method != pserver_method)
645 error (0, 0, "can only use pserver method with `logout' command");
646 error (1, 0, "CVSROOT: %s", current_parsed_root->original);
649 /* Hmm. Do we want a variant of this command which deletes _all_
650 the entries from the current .cvspass? Might be easier to
651 remember than "rm ~/.cvspass" but then again if people are
652 mucking with HOME (common in Win95 as the system doesn't set
653 it), then this variant of "cvs logout" might give a false sense
654 of security, in that it wouldn't delete entries from any
655 .cvspass files but the current one. */
659 cvsroot_canonical = normalize_cvsroot(current_parsed_root);
660 printf ("Logging out of %s\n", cvsroot_canonical);
662 free (cvsroot_canonical);
665 password_entry_operation (password_entry_delete, current_parsed_root, NULL);
670 #endif /* AUTH_CLIENT_SUPPORT from beginning of file. */