credential.c

   1 #include "git-compat-util.h"
   2 #include "abspath.h"
   3 #include "config.h"
   4 #include "credential.h"
   5 #include "gettext.h"
   6 #include "string-list.h"
   7 #include "run-command.h"
   8 #include "url.h"
   9 #include "prompt.h"
  10 #include "sigchain.h"
  11 #include "strbuf.h"
  12 #include "urlmatch.h"
  13 #include "git-compat-util.h"
  14
  15 void credential_init(struct credential *c)
  16 {
  17         struct credential blank = CREDENTIAL_INIT;
  18         memcpy(c, &blank, sizeof(*c));
  19 }
  20
  21 void credential_clear(struct credential *c)
  22 {
  23         free(c->protocol);
  24         free(c->host);
  25         free(c->path);
  26         free(c->username);
  27         free(c->password);
  28         free(c->oauth_refresh_token);
  29         string_list_clear(&c->helpers, 0);
  30         strvec_clear(&c->wwwauth_headers);
  31
  32         credential_init(c);
  33 }
  34
  35 int credential_match(const struct credential *want,
  36                      const struct credential *have)
  37 {
  38 #define CHECK(x) (!want->x || (have->x && !strcmp(want->x, have->x)))
  39         return CHECK(protocol) &&
  40                CHECK(host) &&
  41                CHECK(path) &&
  42                CHECK(username);
  43 #undef CHECK
  44 }
  45
  46
  47 static int credential_from_potentially_partial_url(struct credential *c,
  48                                                    const char *url);
  49
  50 static int credential_config_callback(const char *var, const char *value,
  51                                       void *data)
  52 {
  53         struct credential *c = data;
  54         const char *key;
  55
  56         if (!skip_prefix(var, "credential.", &key))
  57                 return 0;
  58
  59         if (!value)
  60                 return config_error_nonbool(var);
  61
  62         if (!strcmp(key, "helper")) {
  63                 if (*value)
  64                         string_list_append(&c->helpers, value);
  65                 else
  66                         string_list_clear(&c->helpers, 0);
  67         } else if (!strcmp(key, "username")) {
  68                 if (!c->username_from_proto) {
  69                         free(c->username);
  70                         c->username = xstrdup(value);
  71                 }
  72         }
  73         else if (!strcmp(key, "usehttppath"))
  74                 c->use_http_path = git_config_bool(var, value);
  75
  76         return 0;
  77 }
  78
  79 static int proto_is_http(const char *s)
  80 {
  81         if (!s)
  82                 return 0;
  83         return !strcmp(s, "https") || !strcmp(s, "http");
  84 }
  85
  86 static void credential_describe(struct credential *c, struct strbuf *out);
  87 static void credential_format(struct credential *c, struct strbuf *out);
  88
  89 static int select_all(const struct urlmatch_item *a,
  90                       const struct urlmatch_item *b)
  91 {
  92         return 0;
  93 }
  94
  95 static int match_partial_url(const char *url, void *cb)
  96 {
  97         struct credential *c = cb;
  98         struct credential want = CREDENTIAL_INIT;
  99         int matches = 0;
 100
 101         if (credential_from_potentially_partial_url(&want, url) < 0)
 102                 warning(_("skipping credential lookup for key: credential.%s"),
 103                         url);
 104         else
 105                 matches = credential_match(&want, c);
 106         credential_clear(&want);
 107
 108         return matches;
 109 }
 110
 111 static void credential_apply_config(struct credential *c)
 112 {
 113         char *normalized_url;
 114         struct urlmatch_config config = URLMATCH_CONFIG_INIT;
 115         struct strbuf url = STRBUF_INIT;
 116
 117         if (!c->host)
 118                 die(_("refusing to work with credential missing host field"));
 119         if (!c->protocol)
 120                 die(_("refusing to work with credential missing protocol field"));
 121
 122         if (c->configured)
 123                 return;
 124
 125         config.section = "credential";
 126         config.key = NULL;
 127         config.collect_fn = credential_config_callback;
 128         config.cascade_fn = NULL;
 129         config.select_fn = select_all;
 130         config.fallback_match_fn = match_partial_url;
 131         config.cb = c;
 132
 133         credential_format(c, &url);
 134         normalized_url = url_normalize(url.buf, &config.url);
 135
 136         git_config(urlmatch_config_entry, &config);
 137         string_list_clear(&config.vars, 1);
 138         free(normalized_url);
 139         urlmatch_config_release(&config);
 140         strbuf_release(&url);
 141
 142         c->configured = 1;
 143
 144         if (!c->use_http_path && proto_is_http(c->protocol)) {
 145                 FREE_AND_NULL(c->path);
 146         }
 147 }
 148
 149 static void credential_describe(struct credential *c, struct strbuf *out)
 150 {
 151         if (!c->protocol)
 152                 return;
 153         strbuf_addf(out, "%s://", c->protocol);
 154         if (c->username && *c->username)
 155                 strbuf_addf(out, "%s@", c->username);
 156         if (c->host)
 157                 strbuf_addstr(out, c->host);
 158         if (c->path)
 159                 strbuf_addf(out, "/%s", c->path);
 160 }
 161
 162 static void credential_format(struct credential *c, struct strbuf *out)
 163 {
 164         if (!c->protocol)
 165                 return;
 166         strbuf_addf(out, "%s://", c->protocol);
 167         if (c->username && *c->username) {
 168                 strbuf_add_percentencode(out, c->username, STRBUF_ENCODE_SLASH);
 169                 strbuf_addch(out, '@');
 170         }
 171         if (c->host)
 172                 strbuf_addstr(out, c->host);
 173         if (c->path) {
 174                 strbuf_addch(out, '/');
 175                 strbuf_add_percentencode(out, c->path, 0);
 176         }
 177 }
 178
 179 static char *credential_ask_one(const char *what, struct credential *c,
 180                                 int flags)
 181 {
 182         struct strbuf desc = STRBUF_INIT;
 183         struct strbuf prompt = STRBUF_INIT;
 184         char *r;
 185
 186         credential_describe(c, &desc);
 187         if (desc.len)
 188                 strbuf_addf(&prompt, "%s for '%s': ", what, desc.buf);
 189         else
 190                 strbuf_addf(&prompt, "%s: ", what);
 191
 192         r = git_prompt(prompt.buf, flags);
 193
 194         strbuf_release(&desc);
 195         strbuf_release(&prompt);
 196         return xstrdup(r);
 197 }
 198
 199 static void credential_getpass(struct credential *c)
 200 {
 201         if (!c->username)
 202                 c->username = credential_ask_one("Username", c,
 203                                                  PROMPT_ASKPASS|PROMPT_ECHO);
 204         if (!c->password)
 205                 c->password = credential_ask_one("Password", c,
 206                                                  PROMPT_ASKPASS);
 207 }
 208
 209 int credential_read(struct credential *c, FILE *fp)
 210 {
 211         struct strbuf line = STRBUF_INIT;
 212
 213         while (strbuf_getline(&line, fp) != EOF) {
 214                 char *key = line.buf;
 215                 char *value = strchr(key, '=');
 216
 217                 if (!line.len)
 218                         break;
 219
 220                 if (!value) {
 221                         warning("invalid credential line: %s", key);
 222                         strbuf_release(&line);
 223                         return -1;
 224                 }
 225                 *value++ = '\0';
 226
 227                 if (!strcmp(key, "username")) {
 228                         free(c->username);
 229                         c->username = xstrdup(value);
 230                         c->username_from_proto = 1;
 231                 } else if (!strcmp(key, "password")) {
 232                         free(c->password);
 233                         c->password = xstrdup(value);
 234                 } else if (!strcmp(key, "protocol")) {
 235                         free(c->protocol);
 236                         c->protocol = xstrdup(value);
 237                 } else if (!strcmp(key, "host")) {
 238                         free(c->host);
 239                         c->host = xstrdup(value);
 240                 } else if (!strcmp(key, "path")) {
 241                         free(c->path);
 242                         c->path = xstrdup(value);
 243                 } else if (!strcmp(key, "wwwauth[]")) {
 244                         strvec_push(&c->wwwauth_headers, value);
 245                 } else if (!strcmp(key, "password_expiry_utc")) {
 246                         errno = 0;
 247                         c->password_expiry_utc = parse_timestamp(value, NULL, 10);
 248                         if (c->password_expiry_utc == 0 || errno == ERANGE)
 249                                 c->password_expiry_utc = TIME_MAX;
 250                 } else if (!strcmp(key, "oauth_refresh_token")) {
 251                         free(c->oauth_refresh_token);
 252                         c->oauth_refresh_token = xstrdup(value);
 253                 } else if (!strcmp(key, "url")) {
 254                         credential_from_url(c, value);
 255                 } else if (!strcmp(key, "quit")) {
 256                         c->quit = !!git_config_bool("quit", value);
 257                 }
 258                 /*
 259                  * Ignore other lines; we don't know what they mean, but
 260                  * this future-proofs us when later versions of git do
 261                  * learn new lines, and the helpers are updated to match.
 262                  */
 263         }
 264
 265         strbuf_release(&line);
 266         return 0;
 267 }
 268
 269 static void credential_write_item(FILE *fp, const char *key, const char *value,
 270                                   int required)
 271 {
 272         if (!value && required)
 273                 BUG("credential value for %s is missing", key);
 274         if (!value)
 275                 return;
 276         if (strchr(value, '\n'))
 277                 die("credential value for %s contains newline", key);
 278         fprintf(fp, "%s=%s\n", key, value);
 279 }
 280
 281 void credential_write(const struct credential *c, FILE *fp)
 282 {
 283         credential_write_item(fp, "protocol", c->protocol, 1);
 284         credential_write_item(fp, "host", c->host, 1);
 285         credential_write_item(fp, "path", c->path, 0);
 286         credential_write_item(fp, "username", c->username, 0);
 287         credential_write_item(fp, "password", c->password, 0);
 288         credential_write_item(fp, "oauth_refresh_token", c->oauth_refresh_token, 0);
 289         if (c->password_expiry_utc != TIME_MAX) {
 290                 char *s = xstrfmt("%"PRItime, c->password_expiry_utc);
 291                 credential_write_item(fp, "password_expiry_utc", s, 0);
 292                 free(s);
 293         }
 294         for (size_t i = 0; i < c->wwwauth_headers.nr; i++)
 295                 credential_write_item(fp, "wwwauth[]", c->wwwauth_headers.v[i], 0);
 296 }
 297
 298 static int run_credential_helper(struct credential *c,
 299                                  const char *cmd,
 300                                  int want_output)
 301 {
 302         struct child_process helper = CHILD_PROCESS_INIT;
 303         FILE *fp;
 304
 305         strvec_push(&helper.args, cmd);
 306         helper.use_shell = 1;
 307         helper.in = -1;
 308         if (want_output)
 309                 helper.out = -1;
 310         else
 311                 helper.no_stdout = 1;
 312
 313         if (start_command(&helper) < 0)
 314                 return -1;
 315
 316         fp = xfdopen(helper.in, "w");
 317         sigchain_push(SIGPIPE, SIG_IGN);
 318         credential_write(c, fp);
 319         fclose(fp);
 320         sigchain_pop(SIGPIPE);
 321
 322         if (want_output) {
 323                 int r;
 324                 fp = xfdopen(helper.out, "r");
 325                 r = credential_read(c, fp);
 326                 fclose(fp);
 327                 if (r < 0) {
 328                         finish_command(&helper);
 329                         return -1;
 330                 }
 331         }
 332
 333         if (finish_command(&helper))
 334                 return -1;
 335         return 0;
 336 }
 337
 338 static int credential_do(struct credential *c, const char *helper,
 339                          const char *operation)
 340 {
 341         struct strbuf cmd = STRBUF_INIT;
 342         int r;
 343
 344         if (helper[0] == '!')
 345                 strbuf_addstr(&cmd, helper + 1);
 346         else if (is_absolute_path(helper))
 347                 strbuf_addstr(&cmd, helper);
 348         else
 349                 strbuf_addf(&cmd, "git credential-%s", helper);
 350
 351         strbuf_addf(&cmd, " %s", operation);
 352         r = run_credential_helper(c, cmd.buf, !strcmp(operation, "get"));
 353
 354         strbuf_release(&cmd);
 355         return r;
 356 }
 357
 358 void credential_fill(struct credential *c)
 359 {
 360         int i;
 361
 362         if (c->username && c->password)
 363                 return;
 364
 365         credential_apply_config(c);
 366
 367         for (i = 0; i < c->helpers.nr; i++) {
 368                 credential_do(c, c->helpers.items[i].string, "get");
 369                 if (c->password_expiry_utc < time(NULL)) {
 370                         /* Discard expired password */
 371                         FREE_AND_NULL(c->password);
 372                         /* Reset expiry to maintain consistency */
 373                         c->password_expiry_utc = TIME_MAX;
 374                 }
 375                 if (c->username && c->password)
 376                         return;
 377                 if (c->quit)
 378                         die("credential helper '%s' told us to quit",
 379                             c->helpers.items[i].string);
 380         }
 381
 382         credential_getpass(c);
 383         if (!c->username && !c->password)
 384                 die("unable to get password from user");
 385 }
 386
 387 void credential_approve(struct credential *c)
 388 {
 389         int i;
 390
 391         if (c->approved)
 392                 return;
 393         if (!c->username || !c->password || c->password_expiry_utc < time(NULL))
 394                 return;
 395
 396         credential_apply_config(c);
 397
 398         for (i = 0; i < c->helpers.nr; i++)
 399                 credential_do(c, c->helpers.items[i].string, "store");
 400         c->approved = 1;
 401 }
 402
 403 void credential_reject(struct credential *c)
 404 {
 405         int i;
 406
 407         credential_apply_config(c);
 408
 409         for (i = 0; i < c->helpers.nr; i++)
 410                 credential_do(c, c->helpers.items[i].string, "erase");
 411
 412         FREE_AND_NULL(c->username);
 413         FREE_AND_NULL(c->password);
 414         FREE_AND_NULL(c->oauth_refresh_token);
 415         c->password_expiry_utc = TIME_MAX;
 416         c->approved = 0;
 417 }
 418
 419 static int check_url_component(const char *url, int quiet,
 420                                const char *name, const char *value)
 421 {
 422         if (!value)
 423                 return 0;
 424         if (!strchr(value, '\n'))
 425                 return 0;
 426
 427         if (!quiet)
 428                 warning(_("url contains a newline in its %s component: %s"),
 429                         name, url);
 430         return -1;
 431 }
 432
 433 /*
 434  * Potentially-partial URLs can, but do not have to, contain
 435  *
 436  * - a protocol (or scheme) of the form "<protocol>://"
 437  *
 438  * - a host name (the part after the protocol and before the first slash after
 439  *   that, if any)
 440  *
 441  * - a user name and potentially a password (as "<user>[:<password>]@" part of
 442  *   the host name)
 443  *
 444  * - a path (the part after the host name, if any, starting with the slash)
 445  *
 446  * Missing parts will be left unset in `struct credential`. Thus, `https://`
 447  * will have only the `protocol` set, `example.com` only the host name, and
 448  * `/git` only the path.
 449  *
 450  * Note that an empty host name in an otherwise fully-qualified URL (e.g.
 451  * `cert:///path/to/cert.pem`) will be treated as unset if we expect the URL to
 452  * be potentially partial, and only then (otherwise, the empty string is used).
 453  *
 454  * The credential_from_url() function does not allow partial URLs.
 455  */
 456 static int credential_from_url_1(struct credential *c, const char *url,
 457                                  int allow_partial_url, int quiet)
 458 {
 459         const char *at, *colon, *cp, *slash, *host, *proto_end;
 460
 461         credential_clear(c);
 462
 463         /*
 464          * Match one of:
 465          *   (1) proto://<host>/...
 466          *   (2) proto://<user>@<host>/...
 467          *   (3) proto://<user>:<pass>@<host>/...
 468          */
 469         proto_end = strstr(url, "://");
 470         if (!allow_partial_url && (!proto_end || proto_end == url)) {
 471                 if (!quiet)
 472                         warning(_("url has no scheme: %s"), url);
 473                 return -1;
 474         }
 475         cp = proto_end ? proto_end + 3 : url;
 476         at = strchr(cp, '@');
 477         colon = strchr(cp, ':');
 478
 479         /*
 480          * A query or fragment marker before the slash ends the host portion.
 481          * We'll just continue to call this "slash" for simplicity. Notably our
 482          * "trim leading slashes" part won't skip over this part of the path,
 483          * but that's what we'd want.
 484          */
 485         slash = cp + strcspn(cp, "/?#");
 486
 487         if (!at || slash <= at) {
 488                 /* Case (1) */
 489                 host = cp;
 490         }
 491         else if (!colon || at <= colon) {
 492                 /* Case (2) */
 493                 c->username = url_decode_mem(cp, at - cp);
 494                 if (c->username && *c->username)
 495                         c->username_from_proto = 1;
 496                 host = at + 1;
 497         } else {
 498                 /* Case (3) */
 499                 c->username = url_decode_mem(cp, colon - cp);
 500                 if (c->username && *c->username)
 501                         c->username_from_proto = 1;
 502                 c->password = url_decode_mem(colon + 1, at - (colon + 1));
 503                 host = at + 1;
 504         }
 505
 506         if (proto_end && proto_end - url > 0)
 507                 c->protocol = xmemdupz(url, proto_end - url);
 508         if (!allow_partial_url || slash - host > 0)
 509                 c->host = url_decode_mem(host, slash - host);
 510         /* Trim leading and trailing slashes from path */
 511         while (*slash == '/')
 512                 slash++;
 513         if (*slash) {
 514                 char *p;
 515                 c->path = url_decode(slash);
 516                 p = c->path + strlen(c->path) - 1;
 517                 while (p > c->path && *p == '/')
 518                         *p-- = '\0';
 519         }
 520
 521         if (check_url_component(url, quiet, "username", c->username) < 0 ||
 522             check_url_component(url, quiet, "password", c->password) < 0 ||
 523             check_url_component(url, quiet, "protocol", c->protocol) < 0 ||
 524             check_url_component(url, quiet, "host", c->host) < 0 ||
 525             check_url_component(url, quiet, "path", c->path) < 0)
 526                 return -1;
 527
 528         return 0;
 529 }
 530
 531 static int credential_from_potentially_partial_url(struct credential *c,
 532                                                    const char *url)
 533 {
 534         return credential_from_url_1(c, url, 1, 0);
 535 }
 536
 537 int credential_from_url_gently(struct credential *c, const char *url, int quiet)
 538 {
 539         return credential_from_url_1(c, url, 0, quiet);
 540 }
 541
 542 void credential_from_url(struct credential *c, const char *url)
 543 {
 544         if (credential_from_url_gently(c, url, 0) < 0)
 545                 die(_("credential url cannot be parsed: %s"), url);
 546 }