ssl_client_cert_pw_providers.c [plain text]
#include <apr_pools.h>
#include "svn_auth.h"
#include "svn_error.h"
#include "svn_config.h"
#include "svn_string.h"
#include "private/svn_auth_private.h"
#include "svn_private_config.h"
#define AUTHN_PASSPHRASE_KEY "passphrase"
#define AUTHN_PASSTYPE_KEY "passtype"
typedef struct
{
svn_auth_plaintext_passphrase_prompt_func_t plaintext_passphrase_prompt_func;
void *prompt_baton;
apr_hash_t *plaintext_answers;
} ssl_client_cert_pw_file_provider_baton_t;
svn_boolean_t
svn_auth__ssl_client_cert_pw_get(const char **passphrase,
apr_hash_t *creds,
const char *realmstring,
const char *username,
apr_hash_t *parameters,
svn_boolean_t non_interactive,
apr_pool_t *pool)
{
svn_string_t *str;
str = apr_hash_get(creds, AUTHN_PASSPHRASE_KEY, APR_HASH_KEY_STRING);
if (str && str->data)
{
*passphrase = str->data;
return TRUE;
}
return FALSE;
}
svn_boolean_t
svn_auth__ssl_client_cert_pw_set(apr_hash_t *creds,
const char *realmstring,
const char *username,
const char *passphrase,
apr_hash_t *parameters,
svn_boolean_t non_interactive,
apr_pool_t *pool)
{
apr_hash_set(creds, AUTHN_PASSPHRASE_KEY, APR_HASH_KEY_STRING,
svn_string_create(passphrase, pool));
return TRUE;
}
svn_error_t *
svn_auth__ssl_client_cert_pw_file_first_creds_helper
(void **credentials_p,
void **iter_baton,
void *provider_baton,
apr_hash_t *parameters,
const char *realmstring,
svn_auth__password_get_t passphrase_get,
const char *passtype,
apr_pool_t *pool)
{
svn_config_t *cfg = apr_hash_get(parameters,
SVN_AUTH_PARAM_CONFIG_CATEGORY_SERVERS,
APR_HASH_KEY_STRING);
const char *server_group = apr_hash_get(parameters,
SVN_AUTH_PARAM_SERVER_GROUP,
APR_HASH_KEY_STRING);
svn_boolean_t non_interactive = apr_hash_get(parameters,
SVN_AUTH_PARAM_NON_INTERACTIVE,
APR_HASH_KEY_STRING) != NULL;
const char *password =
svn_config_get_server_setting(cfg, server_group,
SVN_CONFIG_OPTION_SSL_CLIENT_CERT_PASSWORD,
NULL);
if (! password)
{
svn_error_t *err;
apr_hash_t *creds_hash = NULL;
const char *config_dir = apr_hash_get(parameters,
SVN_AUTH_PARAM_CONFIG_DIR,
APR_HASH_KEY_STRING);
err = svn_config_read_auth_data(&creds_hash,
SVN_AUTH_CRED_SSL_CLIENT_CERT_PW,
realmstring, config_dir, pool);
svn_error_clear(err);
if (! err && creds_hash)
{
if (!passphrase_get(&password, creds_hash, realmstring,
NULL, parameters, non_interactive, pool))
password = NULL;
}
}
if (password)
{
svn_auth_cred_ssl_client_cert_pw_t *cred
= apr_palloc(pool, sizeof(*cred));
cred->password = password;
cred->may_save = FALSE;
*credentials_p = cred;
}
else *credentials_p = NULL;
*iter_baton = NULL;
return SVN_NO_ERROR;
}
svn_error_t *
svn_auth__ssl_client_cert_pw_file_save_creds_helper
(svn_boolean_t *saved,
void *credentials,
void *provider_baton,
apr_hash_t *parameters,
const char *realmstring,
svn_auth__password_set_t passphrase_set,
const char *passtype,
apr_pool_t *pool)
{
svn_auth_cred_ssl_client_cert_pw_t *creds = credentials;
apr_hash_t *creds_hash = NULL;
const char *config_dir;
svn_error_t *err;
svn_boolean_t dont_store_passphrase =
apr_hash_get(parameters,
SVN_AUTH_PARAM_DONT_STORE_SSL_CLIENT_CERT_PP,
APR_HASH_KEY_STRING) != NULL;
const char *store_ssl_client_cert_pp_plaintext =
apr_hash_get(parameters,
SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP_PLAINTEXT,
APR_HASH_KEY_STRING);
svn_boolean_t non_interactive = apr_hash_get(parameters,
SVN_AUTH_PARAM_NON_INTERACTIVE,
APR_HASH_KEY_STRING) != NULL;
ssl_client_cert_pw_file_provider_baton_t *b =
(ssl_client_cert_pw_file_provider_baton_t *)provider_baton;
svn_boolean_t no_auth_cache =
(! creds->may_save) || (apr_hash_get(parameters,
SVN_AUTH_PARAM_NO_AUTH_CACHE,
APR_HASH_KEY_STRING) != NULL);
*saved = FALSE;
if (no_auth_cache)
return SVN_NO_ERROR;
config_dir = apr_hash_get(parameters,
SVN_AUTH_PARAM_CONFIG_DIR,
APR_HASH_KEY_STRING);
creds_hash = apr_hash_make(pool);
if (! dont_store_passphrase)
{
svn_boolean_t may_save_passphrase = FALSE;
if (strcmp(passtype, SVN_AUTH__WINCRYPT_PASSWORD_TYPE) == 0
|| strcmp(passtype, SVN_AUTH__KWALLET_PASSWORD_TYPE) == 0
|| strcmp(passtype, SVN_AUTH__GNOME_KEYRING_PASSWORD_TYPE) == 0
|| strcmp(passtype, SVN_AUTH__KEYCHAIN_PASSWORD_TYPE) == 0)
{
may_save_passphrase = TRUE;
}
else
{
if (svn_cstring_casecmp(store_ssl_client_cert_pp_plaintext,
SVN_CONFIG_ASK) == 0)
{
if (non_interactive)
{
may_save_passphrase = FALSE;
}
else if (b->plaintext_passphrase_prompt_func)
{
svn_boolean_t *cached_answer =
apr_hash_get(b->plaintext_answers, realmstring,
APR_HASH_KEY_STRING);
if (cached_answer != NULL)
{
may_save_passphrase = *cached_answer;
}
else
{
apr_pool_t *cached_answer_pool;
SVN_ERR((*b->plaintext_passphrase_prompt_func)
(&may_save_passphrase,
realmstring,
b->prompt_baton,
pool));
cached_answer_pool = apr_hash_pool_get(b->plaintext_answers);
cached_answer = apr_palloc(cached_answer_pool,
sizeof(*cached_answer));
*cached_answer = may_save_passphrase;
apr_hash_set(b->plaintext_answers, realmstring,
APR_HASH_KEY_STRING, cached_answer);
}
}
else
{
may_save_passphrase = FALSE;
}
}
else if (svn_cstring_casecmp(store_ssl_client_cert_pp_plaintext,
SVN_CONFIG_FALSE) == 0)
{
may_save_passphrase = FALSE;
}
else if (svn_cstring_casecmp(store_ssl_client_cert_pp_plaintext,
SVN_CONFIG_TRUE) == 0)
{
may_save_passphrase = TRUE;
}
else
{
return svn_error_createf
(SVN_ERR_RA_DAV_INVALID_CONFIG_VALUE, NULL,
_("Config error: invalid value '%s' for option '%s'"),
store_ssl_client_cert_pp_plaintext,
SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP_PLAINTEXT);
}
}
if (may_save_passphrase)
{
*saved = passphrase_set(creds_hash, realmstring,
NULL, creds->password, parameters,
non_interactive, pool);
if (*saved && passtype)
{
apr_hash_set(creds_hash, AUTHN_PASSTYPE_KEY,
APR_HASH_KEY_STRING,
svn_string_create(passtype, pool));
}
err = svn_config_write_auth_data(creds_hash,
SVN_AUTH_CRED_SSL_CLIENT_CERT_PW,
realmstring, config_dir, pool);
svn_error_clear(err);
*saved = ! err;
}
}
return SVN_NO_ERROR;
}
static svn_error_t *
ssl_client_cert_pw_file_first_credentials(void **credentials_p,
void **iter_baton,
void *provider_baton,
apr_hash_t *parameters,
const char *realmstring,
apr_pool_t *pool)
{
return svn_auth__ssl_client_cert_pw_file_first_creds_helper
(credentials_p,
iter_baton,
provider_baton,
parameters,
realmstring,
svn_auth__ssl_client_cert_pw_get,
SVN_AUTH__SIMPLE_PASSWORD_TYPE,
pool);
}
static svn_error_t *
ssl_client_cert_pw_file_save_credentials(svn_boolean_t *saved,
void *credentials,
void *provider_baton,
apr_hash_t *parameters,
const char *realmstring,
apr_pool_t *pool)
{
return svn_auth__ssl_client_cert_pw_file_save_creds_helper
(saved, credentials,
provider_baton,
parameters,
realmstring,
svn_auth__ssl_client_cert_pw_set,
SVN_AUTH__SIMPLE_PASSWORD_TYPE,
pool);
}
static const svn_auth_provider_t ssl_client_cert_pw_file_provider = {
SVN_AUTH_CRED_SSL_CLIENT_CERT_PW,
ssl_client_cert_pw_file_first_credentials,
NULL,
ssl_client_cert_pw_file_save_credentials
};
void
svn_auth_get_ssl_client_cert_pw_file_provider2
(svn_auth_provider_object_t **provider,
svn_auth_plaintext_passphrase_prompt_func_t plaintext_passphrase_prompt_func,
void *prompt_baton,
apr_pool_t *pool)
{
svn_auth_provider_object_t *po = apr_pcalloc(pool, sizeof(*po));
ssl_client_cert_pw_file_provider_baton_t *pb = apr_pcalloc(pool,
sizeof(*pb));
pb->plaintext_passphrase_prompt_func = plaintext_passphrase_prompt_func;
pb->prompt_baton = prompt_baton;
pb->plaintext_answers = apr_hash_make(pool);
po->vtable = &ssl_client_cert_pw_file_provider;
po->provider_baton = pb;
*provider = po;
}
typedef struct
{
svn_auth_ssl_client_cert_pw_prompt_func_t prompt_func;
void *prompt_baton;
int retry_limit;
} ssl_client_cert_pw_prompt_provider_baton_t;
typedef struct
{
ssl_client_cert_pw_prompt_provider_baton_t *pb;
const char *realmstring;
int retries;
} ssl_client_cert_pw_prompt_iter_baton_t;
static svn_error_t *
ssl_client_cert_pw_prompt_first_cred(void **credentials_p,
void **iter_baton,
void *provider_baton,
apr_hash_t *parameters,
const char *realmstring,
apr_pool_t *pool)
{
ssl_client_cert_pw_prompt_provider_baton_t *pb = provider_baton;
ssl_client_cert_pw_prompt_iter_baton_t *ib =
apr_pcalloc(pool, sizeof(*ib));
const char *no_auth_cache = apr_hash_get(parameters,
SVN_AUTH_PARAM_NO_AUTH_CACHE,
APR_HASH_KEY_STRING);
SVN_ERR(pb->prompt_func((svn_auth_cred_ssl_client_cert_pw_t **)
credentials_p, pb->prompt_baton, realmstring,
! no_auth_cache, pool));
ib->pb = pb;
ib->realmstring = apr_pstrdup(pool, realmstring);
ib->retries = 0;
*iter_baton = ib;
return SVN_NO_ERROR;
}
static svn_error_t *
ssl_client_cert_pw_prompt_next_cred(void **credentials_p,
void *iter_baton,
void *provider_baton,
apr_hash_t *parameters,
const char *realmstring,
apr_pool_t *pool)
{
ssl_client_cert_pw_prompt_iter_baton_t *ib = iter_baton;
const char *no_auth_cache = apr_hash_get(parameters,
SVN_AUTH_PARAM_NO_AUTH_CACHE,
APR_HASH_KEY_STRING);
if ((ib->pb->retry_limit >= 0) && (ib->retries >= ib->pb->retry_limit))
{
*credentials_p = NULL;
return SVN_NO_ERROR;
}
ib->retries++;
return ib->pb->prompt_func((svn_auth_cred_ssl_client_cert_pw_t **)
credentials_p, ib->pb->prompt_baton,
ib->realmstring, ! no_auth_cache, pool);
}
static const svn_auth_provider_t client_cert_pw_prompt_provider = {
SVN_AUTH_CRED_SSL_CLIENT_CERT_PW,
ssl_client_cert_pw_prompt_first_cred,
ssl_client_cert_pw_prompt_next_cred,
NULL
};
void svn_auth_get_ssl_client_cert_pw_prompt_provider
(svn_auth_provider_object_t **provider,
svn_auth_ssl_client_cert_pw_prompt_func_t prompt_func,
void *prompt_baton,
int retry_limit,
apr_pool_t *pool)
{
svn_auth_provider_object_t *po = apr_pcalloc(pool, sizeof(*po));
ssl_client_cert_pw_prompt_provider_baton_t *pb =
apr_palloc(pool, sizeof(*pb));
pb->prompt_func = prompt_func;
pb->prompt_baton = prompt_baton;
pb->retry_limit = retry_limit;
po->vtable = &client_cert_pw_prompt_provider;
po->provider_baton = pb;
*provider = po;
}