Coverage Report

Created: 2025-12-03 07:02

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/curl/lib/netrc.c
Line
Count
Source
1
/***************************************************************************
2
 *                                  _   _ ____  _
3
 *  Project                     ___| | | |  _ \| |
4
 *                             / __| | | | |_) | |
5
 *                            | (__| |_| |  _ <| |___
6
 *                             \___|\___/|_| \_\_____|
7
 *
8
 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
9
 *
10
 * This software is licensed as described in the file COPYING, which
11
 * you should have received as part of this distribution. The terms
12
 * are also available at https://curl.se/docs/copyright.html.
13
 *
14
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15
 * copies of the Software, and permit persons to whom the Software is
16
 * furnished to do so, under the terms of the COPYING file.
17
 *
18
 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19
 * KIND, either express or implied.
20
 *
21
 * SPDX-License-Identifier: curl
22
 *
23
 ***************************************************************************/
24
25
#include "curl_setup.h"
26
#ifndef CURL_DISABLE_NETRC
27
28
#ifdef HAVE_PWD_H
29
#ifdef __AMIGA__
30
#undef __NO_NET_API /* required for AmigaOS to declare getpwuid() */
31
#endif
32
#include <pwd.h>
33
#ifdef __AMIGA__
34
#define __NO_NET_API
35
#endif
36
#endif
37
38
#include <curl/curl.h>
39
#include "netrc.h"
40
#include "strcase.h"
41
#include "curl_get_line.h"
42
#include "curlx/fopen.h"
43
#include "curlx/strparse.h"
44
45
/* Get user and password from .netrc when given a machine name */
46
47
enum host_lookup_state {
48
  NOTHING,
49
  HOSTFOUND,    /* the 'machine' keyword was found */
50
  HOSTVALID,    /* this is "our" machine! */
51
  MACDEF
52
};
53
54
enum found_state {
55
  NONE,
56
  LOGIN,
57
  PASSWORD
58
};
59
60
0
#define FOUND_LOGIN    1
61
0
#define FOUND_PASSWORD 2
62
63
0
#define MAX_NETRC_LINE 16384
64
6.06k
#define MAX_NETRC_FILE (128*1024)
65
0
#define MAX_NETRC_TOKEN 4096
66
67
/* convert a dynbuf call CURLcode error to a NETRCcode error */
68
#define curl2netrc(result)                     \
69
0
  (((result) == CURLE_OUT_OF_MEMORY) ?         \
70
0
   NETRC_OUT_OF_MEMORY : NETRC_SYNTAX_ERROR)
71
72
static NETRCcode file2memory(const char *filename, struct dynbuf *filebuf)
73
0
{
74
0
  NETRCcode ret = NETRC_FILE_MISSING; /* if it cannot open the file */
75
0
  FILE *file = curlx_fopen(filename, FOPEN_READTEXT);
76
0
  struct dynbuf linebuf;
77
0
  curlx_dyn_init(&linebuf, MAX_NETRC_LINE);
78
79
0
  if(file) {
80
0
    CURLcode result = CURLE_OK;
81
0
    bool eof;
82
0
    ret = NETRC_OK;
83
0
    do {
84
0
      const char *line;
85
0
      result = Curl_get_line(&linebuf, file, &eof);
86
0
      if(!result) {
87
0
        line = curlx_dyn_ptr(&linebuf);
88
        /* skip comments on load */
89
0
        curlx_str_passblanks(&line);
90
0
        if(*line == '#')
91
0
          continue;
92
0
        result = curlx_dyn_add(filebuf, line);
93
0
      }
94
0
      if(result) {
95
0
        curlx_dyn_free(filebuf);
96
0
        ret = curl2netrc(result);
97
0
        break;
98
0
      }
99
0
    } while(!eof);
100
0
  }
101
0
  curlx_dyn_free(&linebuf);
102
0
  if(file)
103
0
    curlx_fclose(file);
104
0
  return ret;
105
0
}
106
107
/*
108
 * Returns zero on success.
109
 */
110
static NETRCcode parsenetrc(struct store_netrc *store,
111
                            const char *host,
112
                            char **loginp, /* might point to a username */
113
                            char **passwordp,
114
                            const char *netrcfile)
115
0
{
116
0
  NETRCcode retcode = NETRC_NO_MATCH;
117
0
  char *login = *loginp;
118
0
  char *password = NULL;
119
0
  bool specific_login = !!login; /* points to something */
120
0
  enum host_lookup_state state = NOTHING;
121
0
  enum found_state keyword = NONE;
122
0
  unsigned char found = 0; /* login + password found bits, as they can come in
123
                              any order */
124
0
  bool our_login = FALSE;  /* found our login name */
125
0
  bool done = FALSE;
126
0
  char *netrcbuffer;
127
0
  struct dynbuf token;
128
0
  struct dynbuf *filebuf = &store->filebuf;
129
0
  DEBUGASSERT(!*passwordp);
130
0
  curlx_dyn_init(&token, MAX_NETRC_TOKEN);
131
132
0
  if(!store->loaded) {
133
0
    NETRCcode ret = file2memory(netrcfile, filebuf);
134
0
    if(ret)
135
0
      return ret;
136
0
    store->loaded = TRUE;
137
0
  }
138
139
0
  netrcbuffer = curlx_dyn_ptr(filebuf);
140
141
0
  while(!done) {
142
0
    const char *tok = netrcbuffer;
143
0
    while(tok && !done) {
144
0
      const char *tok_end;
145
0
      bool quoted;
146
0
      curlx_dyn_reset(&token);
147
0
      curlx_str_passblanks(&tok);
148
      /* tok is first non-space letter */
149
0
      if(state == MACDEF) {
150
0
        if((*tok == '\n') || (*tok == '\r'))
151
0
          state = NOTHING; /* end of macro definition */
152
0
      }
153
154
0
      if(!*tok || (*tok == '\n'))
155
        /* end of line  */
156
0
        break;
157
158
      /* leading double-quote means quoted string */
159
0
      quoted = (*tok == '\"');
160
161
0
      tok_end = tok;
162
0
      if(!quoted) {
163
0
        size_t len = 0;
164
0
        CURLcode result;
165
0
        while(*tok_end > ' ') {
166
0
          tok_end++;
167
0
          len++;
168
0
        }
169
0
        if(!len) {
170
0
          retcode = NETRC_SYNTAX_ERROR;
171
0
          goto out;
172
0
        }
173
0
        result = curlx_dyn_addn(&token, tok, len);
174
0
        if(result) {
175
0
          retcode = curl2netrc(result);
176
0
          goto out;
177
0
        }
178
0
      }
179
0
      else {
180
0
        bool escape = FALSE;
181
0
        bool endquote = FALSE;
182
0
        tok_end++; /* pass the leading quote */
183
0
        while(*tok_end) {
184
0
          CURLcode result;
185
0
          char s = *tok_end;
186
0
          if(escape) {
187
0
            escape = FALSE;
188
0
            switch(s) {
189
0
            case 'n':
190
0
              s = '\n';
191
0
              break;
192
0
            case 'r':
193
0
              s = '\r';
194
0
              break;
195
0
            case 't':
196
0
              s = '\t';
197
0
              break;
198
0
            }
199
0
          }
200
0
          else if(s == '\\') {
201
0
            escape = TRUE;
202
0
            tok_end++;
203
0
            continue;
204
0
          }
205
0
          else if(s == '\"') {
206
0
            tok_end++; /* pass the ending quote */
207
0
            endquote = TRUE;
208
0
            break;
209
0
          }
210
0
          result = curlx_dyn_addn(&token, &s, 1);
211
0
          if(result) {
212
0
            retcode = curl2netrc(result);
213
0
            goto out;
214
0
          }
215
0
          tok_end++;
216
0
        }
217
0
        if(escape || !endquote) {
218
          /* bad syntax, get out */
219
0
          retcode = NETRC_SYNTAX_ERROR;
220
0
          goto out;
221
0
        }
222
0
      }
223
224
0
      if(curlx_dyn_len(&token))
225
0
        tok = curlx_dyn_ptr(&token);
226
0
      else
227
        /* since tok might actually be NULL for no content, set it to blank
228
           to avoid having to deal with it being NULL */
229
0
        tok = "";
230
231
0
      switch(state) {
232
0
      case NOTHING:
233
0
        if(curl_strequal("macdef", tok))
234
          /* Define a macro. A macro is defined with the specified name; its
235
             contents begin with the next .netrc line and continue until a
236
             null line (consecutive new-line characters) is encountered. */
237
0
          state = MACDEF;
238
0
        else if(curl_strequal("machine", tok)) {
239
          /* the next tok is the machine name, this is in itself the delimiter
240
             that starts the stuff entered for this machine, after this we
241
             need to search for 'login' and 'password'. */
242
0
          state = HOSTFOUND;
243
0
          keyword = NONE;
244
0
          found = 0;
245
0
          our_login = FALSE;
246
0
          Curl_safefree(password);
247
0
          if(!specific_login)
248
0
            Curl_safefree(login);
249
0
        }
250
0
        else if(curl_strequal("default", tok)) {
251
0
          state = HOSTVALID;
252
0
          retcode = NETRC_OK; /* we did find our host */
253
0
        }
254
0
        break;
255
0
      case MACDEF:
256
0
        if(!*tok)
257
0
          state = NOTHING;
258
0
        break;
259
0
      case HOSTFOUND:
260
0
        if(curl_strequal(host, tok)) {
261
          /* and yes, this is our host! */
262
0
          state = HOSTVALID;
263
0
          retcode = NETRC_OK; /* we did find our host */
264
0
        }
265
0
        else
266
          /* not our host */
267
0
          state = NOTHING;
268
0
        break;
269
0
      case HOSTVALID:
270
        /* we are now parsing sub-keywords concerning "our" host */
271
0
        if(keyword == LOGIN) {
272
0
          if(specific_login)
273
0
            our_login = !Curl_timestrcmp(login, tok);
274
0
          else {
275
0
            our_login = TRUE;
276
0
            curlx_free(login);
277
0
            login = curlx_strdup(tok);
278
0
            if(!login) {
279
0
              retcode = NETRC_OUT_OF_MEMORY; /* allocation failed */
280
0
              goto out;
281
0
            }
282
0
          }
283
0
          found |= FOUND_LOGIN;
284
0
          keyword = NONE;
285
0
        }
286
0
        else if(keyword == PASSWORD) {
287
0
          curlx_free(password);
288
0
          password = curlx_strdup(tok);
289
0
          if(!password) {
290
0
            retcode = NETRC_OUT_OF_MEMORY; /* allocation failed */
291
0
            goto out;
292
0
          }
293
0
          if(!specific_login || our_login)
294
0
            found |= FOUND_PASSWORD;
295
0
          keyword = NONE;
296
0
        }
297
0
        else if(curl_strequal("login", tok))
298
0
          keyword = LOGIN;
299
0
        else if(curl_strequal("password", tok))
300
0
          keyword = PASSWORD;
301
0
        else if(curl_strequal("machine", tok)) {
302
          /* a new machine here */
303
0
          if(found & FOUND_PASSWORD) {
304
0
            done = TRUE;
305
0
            break;
306
0
          }
307
0
          state = HOSTFOUND;
308
0
          keyword = NONE;
309
0
          found = 0;
310
0
          Curl_safefree(password);
311
0
          if(!specific_login)
312
0
            Curl_safefree(login);
313
0
        }
314
0
        else if(curl_strequal("default", tok)) {
315
0
          state = HOSTVALID;
316
0
          retcode = NETRC_OK; /* we did find our host */
317
0
          Curl_safefree(password);
318
0
          if(!specific_login)
319
0
            Curl_safefree(login);
320
0
        }
321
0
        if((found == (FOUND_PASSWORD|FOUND_LOGIN)) && our_login) {
322
0
          done = TRUE;
323
0
          break;
324
0
        }
325
0
        break;
326
0
      } /* switch (state) */
327
0
      tok = ++tok_end;
328
0
    }
329
0
    if(!done) {
330
0
      char *nl = NULL;
331
0
      if(tok)
332
0
        nl = strchr(tok, '\n');
333
0
      if(!nl)
334
0
        break;
335
      /* point to next line */
336
0
      netrcbuffer = &nl[1];
337
0
    }
338
0
  } /* while !done */
339
340
0
out:
341
0
  curlx_dyn_free(&token);
342
0
  if(!retcode) {
343
0
    if(!password && our_login) {
344
      /* success without a password, set a blank one */
345
0
      password = curlx_strdup("");
346
0
      if(!password)
347
0
        retcode = NETRC_OUT_OF_MEMORY; /* out of memory */
348
0
    }
349
0
    else if(!login && !password)
350
      /* a default with no credentials */
351
0
      retcode = NETRC_NO_MATCH;
352
0
  }
353
0
  if(!retcode) {
354
    /* success */
355
0
    if(!specific_login)
356
0
      *loginp = login;
357
0
    *passwordp = password;
358
0
  }
359
0
  else {
360
0
    curlx_dyn_free(filebuf);
361
0
    store->loaded = FALSE;
362
0
    if(!specific_login)
363
0
      curlx_free(login);
364
0
    curlx_free(password);
365
0
  }
366
367
0
  return retcode;
368
0
}
369
370
const char *Curl_netrc_strerror(NETRCcode ret)
371
0
{
372
0
  switch(ret) {
373
0
  default:
374
0
    return ""; /* not a legit error */
375
0
  case NETRC_FILE_MISSING:
376
0
    return "no such file";
377
0
  case NETRC_NO_MATCH:
378
0
    return "no matching entry";
379
0
  case NETRC_OUT_OF_MEMORY:
380
0
    return "out of memory";
381
0
  case NETRC_SYNTAX_ERROR:
382
0
    return "syntax error";
383
0
  }
384
  /* never reached */
385
0
}
386
387
/*
388
 * @unittest: 1304
389
 *
390
 * *loginp and *passwordp MUST be allocated if they are not NULL when passed
391
 * in.
392
 */
393
NETRCcode Curl_parsenetrc(struct store_netrc *store, const char *host,
394
                          char **loginp, char **passwordp,
395
                          const char *netrcfile)
396
0
{
397
0
  NETRCcode retcode = NETRC_OK;
398
0
  char *filealloc = NULL;
399
400
0
  if(!netrcfile) {
401
0
    char *home = NULL;
402
0
    char *homea = NULL;
403
0
#if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
404
0
    char pwbuf[1024];
405
0
#endif
406
0
    filealloc = curl_getenv("NETRC");
407
0
    if(!filealloc) {
408
0
      homea = curl_getenv("HOME"); /* portable environment reader */
409
0
      if(homea) {
410
0
        home = homea;
411
0
#if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
412
0
      }
413
0
      else {
414
0
        struct passwd pw, *pw_res;
415
0
        if(!getpwuid_r(geteuid(), &pw, pwbuf, sizeof(pwbuf), &pw_res)
416
0
           && pw_res) {
417
0
          home = pw.pw_dir;
418
0
        }
419
#elif defined(HAVE_GETPWUID) && defined(HAVE_GETEUID)
420
      }
421
      else {
422
        struct passwd *pw;
423
        pw = getpwuid(geteuid());
424
        if(pw) {
425
          home = pw->pw_dir;
426
        }
427
#elif defined(_WIN32)
428
      }
429
      else {
430
        homea = curl_getenv("USERPROFILE");
431
        if(homea) {
432
          home = homea;
433
        }
434
#endif
435
0
      }
436
437
0
      if(!home)
438
0
        return NETRC_FILE_MISSING; /* no home directory found (or possibly out
439
                                      of memory) */
440
441
0
      filealloc = curl_maprintf("%s%s.netrc", home, DIR_CHAR);
442
0
      if(!filealloc) {
443
0
        curlx_free(homea);
444
0
        return NETRC_OUT_OF_MEMORY;
445
0
      }
446
0
    }
447
0
    retcode = parsenetrc(store, host, loginp, passwordp, filealloc);
448
0
    curlx_free(filealloc);
449
#ifdef _WIN32
450
    if(retcode == NETRC_FILE_MISSING) {
451
      /* fallback to the old-style "_netrc" file */
452
      filealloc = curl_maprintf("%s%s_netrc", home, DIR_CHAR);
453
      if(!filealloc) {
454
        curlx_free(homea);
455
        return NETRC_OUT_OF_MEMORY;
456
      }
457
      retcode = parsenetrc(store, host, loginp, passwordp, filealloc);
458
      curlx_free(filealloc);
459
    }
460
#endif
461
0
    curlx_free(homea);
462
0
  }
463
0
  else
464
0
    retcode = parsenetrc(store, host, loginp, passwordp, netrcfile);
465
0
  return retcode;
466
0
}
467
468
void Curl_netrc_init(struct store_netrc *s)
469
6.06k
{
470
6.06k
  curlx_dyn_init(&s->filebuf, MAX_NETRC_FILE);
471
6.06k
  s->loaded = FALSE;
472
6.06k
}
473
void Curl_netrc_cleanup(struct store_netrc *s)
474
6.06k
{
475
6.06k
  curlx_dyn_free(&s->filebuf);
476
  s->loaded = FALSE;
477
6.06k
}
478
#endif