1 /* Licensed to the Apache Software Foundation (ASF) under one or more
2 * contributor license agreements. See the NOTICE file distributed with
3 * this work for additional information regarding copyright ownership.
4 * The ASF licenses this file to You under the Apache License, Version 2.0
5 * (the "License"); you may not use this file except in compliance with
6 * the License. You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
17 /******************************************************************************
18 ******************************************************************************
19 * NOTE! This program is not safe as a setuid executable! Do not make it
21 ******************************************************************************
22 *****************************************************************************/
24 * htdigest.c: simple program for manipulating digest passwd file for Apache
26 * by Alexei Kosut, based on htpasswd.c, by Rob McCool
30 #include "apr_file_io.h"
32 #include "apr_lib.h" /* for apr_getpass() */
33 #include "apr_general.h"
34 #include "apr_signal.h"
35 #include "apr_strings.h" /* for apr_pstrdup() */
37 #define APR_WANT_STDIO
38 #define APR_WANT_STRFUNC
41 #if APR_HAVE_SYS_TYPES_H
42 #include <sys/types.h>
53 #if APR_CHARSET_EBCDIC
59 #endif /* APR_CHARSET_EBCDIC */
61 #define MAX_STRING_LEN 256
62 #define MAX_LINE_LEN 768
64 apr_file_t *tfp = NULL;
67 #if APR_CHARSET_EBCDIC
68 apr_xlate_t *to_ascii;
71 static void cleanup_tempfile_and_exit(int rc)
79 static int getword(char *word, char *line, char stop)
83 for (x = 0; ((line[x]) && (line[x] != stop)); x++) {
84 if (x == (MAX_STRING_LEN - 1)) {
95 while ((line[y++] = line[x++]));
100 static int get_line(char *s, int n, apr_file_t *f)
104 apr_status_t rv = APR_EINVAL;
106 /* we need 2 remaining bytes in buffer */
107 while (i < (n - 2) &&
108 ((rv = apr_file_getc(&ch, f)) == APR_SUCCESS) && (ch != '\n')) {
111 /* First remaining byte potentially used here */
114 /* Second remaining byte used here */
117 if (rv != APR_SUCCESS)
123 static void putline(apr_file_t *f, char *l)
127 for (x = 0; l[x]; x++)
128 apr_file_putc(l[x], f);
132 static void add_password(const char *user, const char *realm, apr_file_t *f)
135 apr_md5_ctx_t context;
136 unsigned char digest[16];
137 char string[MAX_LINE_LEN]; /* this includes room for 2 * ':' + '\0' */
138 char pwin[MAX_STRING_LEN];
139 char pwv[MAX_STRING_LEN];
141 apr_size_t len = sizeof(pwin);
143 if (apr_password_get("New password: ", pwin, &len) != APR_SUCCESS) {
144 apr_file_printf(errfile, "password too long");
145 cleanup_tempfile_and_exit(5);
148 apr_password_get("Re-type new password: ", pwv, &len);
149 if (strcmp(pwin, pwv) != 0) {
150 apr_file_printf(errfile, "They don't match, sorry.\n");
151 cleanup_tempfile_and_exit(1);
154 apr_file_printf(f, "%s:%s:", user, realm);
157 apr_snprintf(string, sizeof(string), "%s:%s:%s", user, realm, pw);
159 apr_md5_init(&context);
160 #if APR_CHARSET_EBCDIC
161 apr_md5_set_xlate(&context, to_ascii);
163 apr_md5_update(&context, (unsigned char *) string, strlen(string));
164 apr_md5_final(digest, &context);
166 for (i = 0; i < 16; i++)
167 apr_file_printf(f, "%02x", digest[i]);
169 apr_file_printf(f, "\n");
172 static void usage(void)
174 apr_file_printf(errfile, "Usage: htdigest [-c] passwordfile realm username\n");
175 apr_file_printf(errfile, "The -c flag creates a new file.\n");
179 static void interrupted(void)
181 apr_file_printf(errfile, "Interrupted.\n");
182 cleanup_tempfile_and_exit(1);
185 static void terminate(void)
193 int main(int argc, const char * const argv[])
197 char tn[] = "htdigest.tmp.XXXXXX";
199 char user[MAX_STRING_LEN];
200 char realm[MAX_STRING_LEN];
201 char line[MAX_LINE_LEN];
202 char l[MAX_LINE_LEN];
203 char w[MAX_STRING_LEN];
204 char x[MAX_STRING_LEN];
207 apr_app_initialize(&argc, &argv, NULL);
209 apr_pool_create(&cntxt, NULL);
210 apr_file_open_stderr(&errfile, cntxt);
212 #if APR_CHARSET_EBCDIC
213 rv = apr_xlate_open(&to_ascii, "ISO-8859-1", APR_DEFAULT_CHARSET, cntxt);
215 apr_file_printf(errfile, "apr_xlate_open(): %pm (%d)\n",
221 apr_signal(SIGINT, (void (*)(int)) interrupted);
223 if (strcmp(argv[1], "-c"))
225 rv = apr_file_open(&f, argv[2], APR_WRITE | APR_CREATE,
226 APR_OS_DEFAULT, cntxt);
227 if (rv != APR_SUCCESS) {
228 apr_file_printf(errfile, "Could not open passwd file %s for writing: %pm\n",
232 apr_cpystrn(user, argv[4], sizeof(user));
233 apr_cpystrn(realm, argv[3], sizeof(realm));
234 apr_file_printf(errfile, "Adding password for %s in realm %s.\n",
236 add_password(user, realm, f);
243 if (apr_temp_dir_get((const char**)&dirname, cntxt) != APR_SUCCESS) {
244 apr_file_printf(errfile, "%s: could not determine temp dir\n",
248 dirname = apr_psprintf(cntxt, "%s/%s", dirname, tn);
250 if (apr_file_mktemp(&tfp, dirname, 0, cntxt) != APR_SUCCESS) {
251 apr_file_printf(errfile, "Could not open temp file %s.\n", dirname);
255 if (apr_file_open(&f, argv[1], APR_READ, APR_OS_DEFAULT, cntxt) != APR_SUCCESS) {
256 apr_file_printf(errfile,
257 "Could not open passwd file %s for reading.\n", argv[1]);
258 apr_file_printf(errfile, "Use -c option to create new one.\n");
259 cleanup_tempfile_and_exit(1);
261 apr_cpystrn(user, argv[3], sizeof(user));
262 apr_cpystrn(realm, argv[2], sizeof(realm));
265 while (!(get_line(line, sizeof(line), f))) {
266 if (found || (line[0] == '#') || (!line[0])) {
271 if (getword(w, l, ':') || getword(x, l, ':')) {
272 apr_file_printf(errfile, "The following line contains a string longer than the "
273 "allowed maximum size (%i): %s\n", MAX_STRING_LEN - 1, line);
274 cleanup_tempfile_and_exit(1);
276 if (strcmp(user, w) || strcmp(realm, x)) {
281 apr_file_printf(errfile, "Changing password for user %s in realm %s\n",
283 add_password(user, realm, tfp);
288 apr_file_printf(errfile, "Adding user %s in realm %s\n", user, realm);
289 add_password(user, realm, tfp);
293 /* The temporary file has all the data, just copy it to the new location.
295 if (apr_file_copy(dirname, argv[1], APR_OS_DEFAULT, cntxt) !=
297 apr_file_printf(errfile, "%s: unable to update file %s\n",