2 * Copyright (C) 2011 John Szakmeister <john@szakmeister.net>
3 * 2012 Philipp A. Hartmann <pah@qo.cx>
4 * 2016 Mantas Mikulėnas <grawity@gmail.com>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 * - GNOME Keyring API handling originally written by John Szakmeister
23 * - ported to credential helper API by Philipp A. Hartmann
30 #include <libsecret/secret.h>
33 * This credential struct and API is simplified from git's credential.{h,c}
44 #define CREDENTIAL_INIT { NULL, NULL, 0, NULL, NULL, NULL }
46 typedef int (*credential_op_cb
)(struct credential
*);
48 struct credential_operation
{
53 #define CREDENTIAL_OP_END { NULL, NULL }
55 /* ----------------- Secret Service functions ----------------- */
57 static char *make_label(struct credential
*c
)
60 return g_strdup_printf("Git: %s://%s:%hu/%s",
61 c
->protocol
, c
->host
, c
->port
, c
->path
? c
->path
: "");
63 return g_strdup_printf("Git: %s://%s/%s",
64 c
->protocol
, c
->host
, c
->path
? c
->path
: "");
67 static GHashTable
*make_attr_list(struct credential
*c
)
69 GHashTable
*al
= g_hash_table_new_full(g_str_hash
, g_str_equal
, NULL
, g_free
);
72 g_hash_table_insert(al
, "user", g_strdup(c
->username
));
74 g_hash_table_insert(al
, "protocol", g_strdup(c
->protocol
));
76 g_hash_table_insert(al
, "server", g_strdup(c
->host
));
78 g_hash_table_insert(al
, "port", g_strdup_printf("%hu", c
->port
));
80 g_hash_table_insert(al
, "object", g_strdup(c
->path
));
85 static int keyring_get(struct credential
*c
)
87 SecretService
*service
= NULL
;
88 GHashTable
*attributes
= NULL
;
92 if (!c
->protocol
|| !(c
->host
|| c
->path
))
95 service
= secret_service_get_sync(0, NULL
, &error
);
97 g_critical("could not connect to Secret Service: %s", error
->message
);
102 attributes
= make_attr_list(c
);
103 items
= secret_service_search_sync(service
,
104 SECRET_SCHEMA_COMPAT_NETWORK
,
106 SECRET_SEARCH_LOAD_SECRETS
| SECRET_SEARCH_UNLOCK
,
109 g_hash_table_unref(attributes
);
111 g_critical("lookup failed: %s", error
->message
);
122 secret
= secret_item_get_secret(item
);
123 attributes
= secret_item_get_attributes(item
);
125 s
= g_hash_table_lookup(attributes
, "user");
128 c
->username
= g_strdup(s
);
131 s
= secret_value_get_text(secret
);
134 c
->password
= g_strdup(s
);
137 g_hash_table_unref(attributes
);
138 secret_value_unref(secret
);
139 g_list_free_full(items
, g_object_unref
);
146 static int keyring_store(struct credential
*c
)
149 GHashTable
*attributes
= NULL
;
150 GError
*error
= NULL
;
153 * Sanity check that what we are storing is actually sensible.
154 * In particular, we can't make a URL without a protocol field.
155 * Without either a host or pathname (depending on the scheme),
156 * we have no primary key. And without a username and password,
157 * we are not actually storing a credential.
159 if (!c
->protocol
|| !(c
->host
|| c
->path
) ||
160 !c
->username
|| !c
->password
)
163 label
= make_label(c
);
164 attributes
= make_attr_list(c
);
165 secret_password_storev_sync(SECRET_SCHEMA_COMPAT_NETWORK
,
173 g_hash_table_unref(attributes
);
176 g_critical("store failed: %s", error
->message
);
184 static int keyring_erase(struct credential
*c
)
186 GHashTable
*attributes
= NULL
;
187 GError
*error
= NULL
;
190 * Sanity check that we actually have something to match
191 * against. The input we get is a restrictive pattern,
192 * so technically a blank credential means "erase everything".
193 * But it is too easy to accidentally send this, since it is equivalent
194 * to empty input. So explicitly disallow it, and require that the
195 * pattern have some actual content to match.
197 if (!c
->protocol
&& !c
->host
&& !c
->path
&& !c
->username
)
200 attributes
= make_attr_list(c
);
201 secret_password_clearv_sync(SECRET_SCHEMA_COMPAT_NETWORK
,
205 g_hash_table_unref(attributes
);
208 g_critical("erase failed: %s", error
->message
);
217 * Table with helper operation callbacks, used by generic
218 * credential helper main function.
220 static struct credential_operation
const credential_helper_ops
[] = {
221 { "get", keyring_get
},
222 { "store", keyring_store
},
223 { "erase", keyring_erase
},
227 /* ------------------ credential functions ------------------ */
229 static void credential_init(struct credential
*c
)
231 memset(c
, 0, sizeof(*c
));
234 static void credential_clear(struct credential
*c
)
245 static int credential_read(struct credential
*c
)
252 key
= buf
= g_malloc(1024);
254 while (fgets(buf
, 1024, stdin
)) {
255 line_len
= strlen(buf
);
257 if (line_len
&& buf
[line_len
-1] == '\n')
258 buf
[--line_len
] = '\0';
263 value
= strchr(buf
, '=');
265 g_warning("invalid credential line: %s", key
);
271 if (!strcmp(key
, "protocol")) {
273 c
->protocol
= g_strdup(value
);
274 } else if (!strcmp(key
, "host")) {
276 c
->host
= g_strdup(value
);
277 value
= strrchr(c
->host
, ':');
280 c
->port
= atoi(value
);
282 } else if (!strcmp(key
, "path")) {
284 c
->path
= g_strdup(value
);
285 } else if (!strcmp(key
, "username")) {
287 c
->username
= g_strdup(value
);
288 } else if (!strcmp(key
, "password")) {
290 c
->password
= g_strdup(value
);
295 * Ignore other lines; we don't know what they mean, but
296 * this future-proofs us when later versions of git do
297 * learn new lines, and the helpers are updated to match.
306 static void credential_write_item(FILE *fp
, const char *key
, const char *value
)
310 fprintf(fp
, "%s=%s\n", key
, value
);
313 static void credential_write(const struct credential
*c
)
315 /* only write username/password, if set */
316 credential_write_item(stdout
, "username", c
->username
);
317 credential_write_item(stdout
, "password", c
->password
);
320 static void usage(const char *name
)
322 struct credential_operation
const *try_op
= credential_helper_ops
;
323 const char *basename
= strrchr(name
, '/');
325 basename
= (basename
) ? basename
+ 1 : name
;
326 fprintf(stderr
, "usage: %s <", basename
);
327 while (try_op
->name
) {
328 fprintf(stderr
, "%s", (try_op
++)->name
);
330 fprintf(stderr
, "%s", "|");
332 fprintf(stderr
, "%s", ">\n");
335 int main(int argc
, char *argv
[])
337 int ret
= EXIT_SUCCESS
;
339 struct credential_operation
const *try_op
= credential_helper_ops
;
340 struct credential cred
= CREDENTIAL_INIT
;
347 g_set_application_name("Git Credential Helper");
349 /* lookup operation callback */
350 while (try_op
->name
&& strcmp(argv
[1], try_op
->name
))
353 /* unsupported operation given -- ignore silently */
354 if (!try_op
->name
|| !try_op
->op
)
357 ret
= credential_read(&cred
);
361 /* perform credential operation */
362 ret
= (*try_op
->op
)(&cred
);
364 credential_write(&cred
);
367 credential_clear(&cred
);