FreeTDS Development Group

["Craig A. Berry" <craigberry AT mac.com>]

On Jun 23, 2010, at 4:48 PM, Christos Zoulas wrote:

> Hello,
>
> 1. add a getpassarg() function and use it in all applications that
>   get a password from the command line. This overwrites the command
>   line provided password with stars for a bit more security.

Thanks for noticing that we leave the password sitting there in memory  
if -P happens to be the last option processed. That could be rectified  
with a simple memset() (or, better, IMO, bzero()).  It looks like your  
function also reads the password from stdin if someone specifies -P-,  
but it does so without calling getpass() or readpassphrase(), so  
echoing will not be suppressed nor any other longstanding security  
goodness provided by those tried and true functions.

You could make your function call readpassphrase() instead of reading  
from stdin itself, but I would rather see the same behavior as the  
vendor utilities have implemented consistently, i.e., from the Sybase  
docs, "If you do not specify the -P flag, isql prompts for a  
password."  I think some of our utilities do that and some don't.

> 2. add a -a <name> argument to TSQL so that we can specify the  
> "application
>   name" in the sql process table.

For the Sybase client, -a means "display_charset" and for Microsoft  
clients it means "packetsize" (which is -A for Sybase).  I guess we  
could be inconsistent for tsql, but I don't really understand the need  
for this feature.  The application is tsql, so why would you want to  
have it show up as something else?

> 3. if you could not find a specific host in the configuration  
> section, don't
>   fail, just try with the global settings as before.

But if we didn't find them before, how would we find them by doing the  
same thing again?

> What's up with the nightly snapshot? I have not seen a new one since  
> 20100522?

I think they've been working the last couple of nights.

> christos
>
> Index: include/replacements.h
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/include/ 
> replacements.h,v
> retrieving revision 1.1.1.7
> retrieving revision 1.2
> diff -u -u -r1.1.1.7 -r1.2
> --- include/replacements.h      7 Jun 2010 14:37:14 -0000       1.1.1.7
> +++ include/replacements.h      23 Jun 2010 21:16:31 -0000      1.2
> @@ -95,6 +95,8 @@
> #else
> char *tds_basename(char *path);
> #endif
> +
> +char *getpassarg(char *arg);
>
> /*
>  * Microsoft's C Runtime library is missing strcasecmp and  
> strncasecmp.
> Index: src/apps/bsqldb.c
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/src/apps/ 
> bsqldb.c,v
> retrieving revision 1.1.1.6
> retrieving revision 1.2
> diff -u -u -r1.1.1.6 -r1.2
> --- src/apps/bsqldb.c   7 Jun 2010 14:37:14 -0000       1.1.1.6
> +++ src/apps/bsqldb.c   23 Jun 2010 21:16:31 -0000      1.2
> @@ -795,7 +795,7 @@
> {
>         LOGINREC *login;
>         int ch;
> -       int got_password = 0;
> +       char *password = NULL;
>
>         extern char *optarg;
>
> @@ -825,8 +825,8 @@
>                         DBSETLUSER(login, optarg);
>                         break;
>                 case 'P':
> -                       got_password = 1;
> -                       DBSETLPWD(login, optarg);
> +                       password = getpassarg(optarg);
> +                       DBSETLPWD(login, password);
>                         break;
>                 case 'S':
>                         options->servername = strdup(optarg);
> @@ -864,11 +864,11 @@
>                 }
>         }
>
> -       if (!got_password) {
> -               char password[128];
> +       if (password == NULL) {
> +               char pwd[128];
>
> -		readpassphrase("Password: ", password, sizeof(password),  
> RPP_ECHO_OFF);
> -               DBSETLPWD(login, password);
> +               readpassphrase("Password: ", pwd, sizeof(pwd), RPP_ECHO_OFF);
> +               DBSETLPWD(login, pwd);
>         }
>
>         if (!options->servername) {
> Index: src/apps/bsqlodbc.c
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/src/apps/ 
> bsqlodbc.c,v
> retrieving revision 1.1.1.3
> retrieving revision 1.2
> diff -u -u -r1.1.1.3 -r1.2
> --- src/apps/bsqlodbc.c 7 Jun 2010 14:37:14 -0000       1.1.1.3
> +++ src/apps/bsqlodbc.c 23 Jun 2010 21:16:31 -0000      1.2
> @@ -839,7 +839,7 @@
>                         login->username = strdup(optarg);
>                         break;
>                 case 'P':
> -                       login->password = strdup(optarg);
> +                       login->password = getpassarg(optarg);
>                         break;
>                 case 'S':
>                         options->servername = strdup(optarg);
> Index: src/apps/defncopy.c
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/src/apps/ 
> defncopy.c,v
> retrieving revision 1.1.1.5
> retrieving revision 1.2
> diff -u -u -r1.1.1.5 -r1.2
> --- src/apps/defncopy.c 7 Jun 2010 14:37:14 -0000       1.1.1.5
> +++ src/apps/defncopy.c 23 Jun 2010 21:16:31 -0000      1.2
> @@ -643,6 +643,7 @@
> get_login(int argc, char *argv[], OPTIONS *options)
> {
>         LOGINREC *login;
> +       char *password;
>         int ch;
>         int fdomain = TRUE;
>
> @@ -673,7 +674,8 @@
>                         fdomain = FALSE;
>                         break;
>                 case 'P':
> -                       DBSETLPWD(login, optarg);
> +                       password = getpassarg(optarg);
> +                       DBSETLPWD(login, password);
>                         fdomain = FALSE;
>                         break;
>                 case 'S':
> Index: src/apps/freebcp.c
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/src/apps/ 
> freebcp.c,v
> retrieving revision 1.1.1.10
> retrieving revision 1.2
> diff -u -u -r1.1.1.10 -r1.2
> --- src/apps/freebcp.c  7 Jun 2010 14:37:14 -0000       1.1.1.10
> +++ src/apps/freebcp.c  23 Jun 2010 21:16:31 -0000      1.2
> @@ -256,16 +256,7 @@
>                         break;
>                 case 'P':
>                         pdata->Pflag++;
> -                       if ((strcmp(optarg, "-")) == 0) {
> -                               char pwd[255], *nl;
> -                               memset(pwd, 0, 255);
> -                               fgets(pwd, 255, stdin);
> -                               nl = strchr(pwd, '\n');
> -                               if(nl) *nl = '\0';
> -                               pdata->pass = strdup(pwd);
> -                       } else {
> -                               pdata->pass = strdup(optarg);
> -                       }
> +                       pdata->pass = getpassarg(optarg);
>                         break;
>                 case 'i':
>                         free(pdata->inputfile);
> Index: src/apps/tsql.c
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/src/apps/ 
> tsql.c,v
> retrieving revision 1.1.1.10
> retrieving revision 1.19
> diff -u -u -r1.1.1.10 -r1.19
> --- src/apps/tsql.c     7 Jun 2010 14:37:14 -0000       1.1.1.10
> +++ src/apps/tsql.c     23 Jun 2010 21:16:31 -0000      1.19
> @@ -297,7 +297,7 @@
> tsql_print_usage(const char *progname)
> {
>         fprintf(stderr,
> -		"Usage:\t%s [-S <server> | -H <hostname> -p <port>] -U <username>  
> [-P <password>] [-I <config file>] [-o <options>] [-t delim] [-r  
> delim] [-D database]\n"
> +		"Usage:\t%s [-a <appname>] [-S <server> | -H <hostname> -p  
> <port>] -U <username> [-P <password>] [-I <config file>] [-o  
> <options>] [-t delim] [-r delim] [-D database]\n"
>                 "\t%s -C\n"
>                 "Options:\n"
>                 "\tf\tDo not print footer\n"
> @@ -402,6 +405,7 @@
>         char *confile = NULL;
>         int port = 0;
>         int opt;
> +       const char *appname = "TSQL";
>         const char *locale = NULL;
>         const char *charset = NULL;
>         char *opt_flags_str = NULL;
> @@ -418,8 +422,11 @@
> #endif
>
>
> -	while ((opt = getopt(argc, argv, "H:S:I:P:U:p:Co:t:r:D:Lv")) !=  
> -1) {
> +	while ((opt = getopt(argc, argv, "a:H:S:I:P:U:p:Co:t:r:D:Lv")) !=  
> -1) {
>                 switch (opt) {
> +               case 'a':
> +                       appname = optarg;
> +                       break;
>                 case 't':
>                         opt_col_term = strdup(optarg);
>                         break;
> @@ -446,7 +453,7 @@
>                         break;
>                 case 'P':
>                         free(password);
> -                       password = strdup(optarg);
> +                       password = getpassarg(optarg);
>                         break;
>                 case 'I':
>                         free(confile);
> @@ -579,7 +586,7 @@
>         /* if it's a servername */
>         if (servername) {
>                 tds_set_user(login, username);
> -               tds_set_app(login, "TSQL");
> +               tds_set_app(login, appname);
>                 tds_set_library(login, "TDS-Library");
>                 tds_set_server(login, servername);
>                 tds_set_client_charset(login, charset);
> @@ -591,7 +598,7 @@
>                 /* else we specified hostname/port */
>         } else {
>                 tds_set_user(login, username);
> -               tds_set_app(login, "TSQL");
> +               tds_set_app(login, appname);
>                 tds_set_library(login, "TDS-Library");
>                 tds_set_server(login, hostname);
>                 tds_set_port(login, port);
> Index: src/apps/fisql/fisql.c
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/src/apps/ 
> fisql/fisql.c,v
> retrieving revision 1.1.1.2
> retrieving revision 1.2
> diff -u -u -r1.1.1.2 -r1.2
> --- src/apps/fisql/fisql.c      7 Jun 2010 14:37:14 -0000       1.1.1.2
> +++ src/apps/fisql/fisql.c      23 Jun 2010 21:16:32 -0000      1.2
> @@ -345,7 +345,7 @@
>                         output_filename = optarg;
>                         break;
>                 case 'P':
> -                       password = optarg;
> +                       password = getpassarg(optarg);
>                         break;
>                 case 's':
>                         colseparator = optarg;
> Index: src/replacements/Makefile.am
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/src/ 
> replacements/Makefile.am,v
> retrieving revision 1.1.1.8
> retrieving revision 1.2
> diff -u -u -r1.1.1.8 -r1.2
> --- src/replacements/Makefile.am        7 Jun 2010 14:37:14 -0000       
> 1.1.1.8
> +++ src/replacements/Makefile.am        23 Jun 2010 21:16:33 -0000      1.2
> @@ -1,7 +1,7 @@
> -# $Id: Makefile.am,v 1.1.1.8 2010/06/07 14:37:14 christos Exp $
> +# $Id: Makefile.am,v 1.2 2010/06/23 21:16:33 christos Exp $
> AM_CPPFLAGS=			-I$(top_srcdir)/include -I$(top_srcdir)/src/ 
> replacements
> noinst_LTLIBRARIES=             libreplacements.la
> -libreplacements_la_SOURCES=    iconv.c gettimeofday.c fakepoll.c
> +libreplacements_la_SOURCES=	iconv.c gettimeofday.c fakepoll.c  
> getpassarg.c
> libreplacements_la_LDFLAGS=
> libreplacements_la_LIBADD=      @LTLIBOBJS@
> EXTRA_DIST=     asprintf.c \
> Index: src/replacements/getpassarg.c
> ===================================================================
> RCS file: src/replacements/getpassarg.c
> diff -N src/replacements/getpassarg.c
> --- /dev/null   1 Jan 1970 00:00:00 -0000
> +++ src/replacements/getpassarg.c       23 Jun 2010 21:36:33 -0000
> @@ -0,0 +1,74 @@
> +/* FreeTDS - Library of routines accessing Sybase and Microsoft  
> databases
> + * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005   
> Brian Bruns
> + * Copyright (C) 2006, 2007, 2008, 2009, 2010  Frediano Ziglio
> + *
> + * This library is free software; you can redistribute it and/or
> + * modify it under the terms of the GNU Library General Public
> + * License as published by the Free Software Foundation; either
> + * version 2 of the License, or (at your option) any later version.
> + *
> + * This library is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> + * Library General Public License for more details.
> + *
> + * You should have received a copy of the GNU Library General Public
> + * License along with this library; if not, write to the
> + * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
> + * Boston, MA 02111-1307, USA.
> + */
> +
> +#if HAVE_CONFIG_H
> +#include <config.h>
> +#endif
> +
> +#include <stdio.h>
> +
> +#if HAVE_LIMITS_H
> +#include <limits.h>
> +#endif
> +
> +#if HAVE_STRING_H
> +#include <string.h>
> +#endif /* HAVE_STRING_H */
> +
> +#include <tds.h>
> +#include <tdsthread.h>
> +#include <tdsconvert.h>
> +#include <replacements.h>
> +#include <sybfront.h>
> +#include <sybdb.h>
> +#include <syberror.h>
> +#include <dblib.h>
> +
> +#ifdef DMALLOC
> +#include <dmalloc.h>
> +#endif
> +
> +TDS_RCSID(var, "$Id: getpass.c,v 1.1.1.14 2010/06/07 14:37:14  
> christos Exp $");
> +
> +/*
> + * return a copy of the password, reading from stdin if arg is '-'
> + * trashing he argument in the process.
> + */
> +char *
> +getpassarg(char *arg)
> +{
> +       char pwd[255], *ptr, *q;
> +
> +       if (strcmp(arg, "-") == 0) {
> +               memset(pwd, 0, sizeof(pwd));
> +               if (fgets(pwd, sizeof(pwd), stdin) == NULL)
> +                       return NULL;
> +               ptr = strchr(pwd, '\n');
> +               if (ptr) *ptr = '\0';
> +               arg = pwd;
> +       }
> +
> +       ptr = strdup(arg);
> +
> +       for (q = arg; *q; *q++ = '*')
> +               continue;
> +
> +       return ptr;
> +}
> Index: src/tds/config.c
> ===================================================================
> RCS file: /src/twosigma/cvsroot/external/public/freetds/src/tds/ 
> config.c,v
> retrieving revision 1.1.1.14
> retrieving revision 1.17
> diff -u -u -r1.1.1.14 -r1.17
> --- src/tds/config.c    7 Jun 2010 14:37:14 -0000       1.1.1.14
> +++ src/tds/config.c    7 Jun 2010 15:07:21 -0000       1.17
> @@ -202,7 +202,11 @@
> 		if (!tds_read_interfaces(tds_dstr_cstr(&login->server_name),  
> connection)) {
> 			tdsdump_log(TDS_DBG_INFO1, "Failed to find [%s] in configuration  
> files; trying '%s' instead.\n",
> 						   tds_dstr_cstr(&login->server_name),  
> tds_dstr_cstr(&connection->server_name));
> +#if 1
> +			if (!tds_read_conf_file(connection, tds_dstr_cstr(&connection- 
> >server_name)))
> +#else
>                         if (tds_dstr_isempty(&connection->ip_addr))
> +#endif
>                                 tdserror(tds->tds_ctx, tds, TDSEINTF, 0);
>                 }
>         }
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds

________________________________________
Craig A. Berry
mailto:craigberry AT mac.com

"... getting out of a sonnet is much more
 difficult than getting in."
                 Brad Leithauser