FreeTDS Development Group

[christos AT zoulas.com (Christos Zoulas)]

On Jun 27,  2:04pm, craigberry AT mac.com ("Craig A. Berry") wrote:
-- Subject: Re: [freetds] minor fixes.

| 
| On Jun 23, 2010, at 4:48 PM, Christos Zoulas wrote:
| 
| > Hello,
| >
| > 1. add a getpassarg() function and use it in all applications that
| >   get a password from the command line. This overwrites the command
| >   line provided password with stars for a bit more security.
| 
| Thanks for noticing that we leave the password sitting there in memory  
| if -P happens to be the last option processed. That could be rectified  
| with a simple memset() (or, better, IMO, bzero()).

memset() is more portable than bzero() which is just an ancient BSD
artifact. You would still need to count the password length first
and set later, so I decided to not bother with 2 scans. Also the
length is revealed because on some OS's (including linux) the
width of the argument is not changed. That is why I chose '*'.

| It looks like your  
| function also reads the password from stdin if someone specifies -P-,  
| but it does so without calling getpass() or readpassphrase(), so  
| echoing will not be suppressed nor any other longstanding security  
| goodness provided by those tried and true functions.

That is what freebcp did; no other application interpreted -P-.
I just moved the code in a single place.  getpass(3) reads the passwd
from /dev/tty not stdin, so I decided not to change the semantics.

| You could make your function call readpassphrase() instead of reading  
| from stdin itself, but I would rather see the same behavior as the  
| vendor utilities have implemented consistently, i.e., from the Sybase  
| docs, "If you do not specify the -P flag, isql prompts for a  
| password."  I think some of our utilities do that and some don't.

Yes, I believe most ask. We can check the code and make sure.

| > 2. add a -a <name> argument to TSQL so that we can specify the  
| > "application
| >   name" in the sql process table.
| 
| For the Sybase client, -a means "display_charset" and for Microsoft  
| clients it means "packetsize" (which is -A for Sybase).  I guess we  
| could be inconsistent for tsql, but I don't really understand the need  
| for this feature.  The application is tsql, so why would you want to  
| have it show up as something else?

We (@work) typically wrap tsql to call for particular tasks (do
db-reindex, fix statistics, update data on particular tables). It
is nice to know which tsql script you are running. I saw -a was
unused so I used it. I don't mind if we choose a long option or a
different character.

| > 3. if you could not find a specific host in the configuration  
| > section, don't
| >   fail, just try with the global settings as before.
| 
| But if we didn't find them before, how would we find them by doing the  
| same thing again?

I want it to just use the global options and proceed if a server
name is not found, instead for me to have to enumerate all my sql
servers in the config file. Unless that has been fixed differently.

| > What's up with the nightly snapshot? I have not seen a new one since  
| > 20100522?
| 
| I think they've been working the last couple of nights.

Thanks,

christos