Index: subversion/libsvn_ra/ra_loader.c =================================================================== --- subversion/libsvn_ra/ra_loader.c (revision 31081) +++ subversion/libsvn_ra/ra_loader.c (working copy) @@ -401,6 +401,7 @@ svn_boolean_t store_auth_creds = SVN_CONFIG_DEFAULT_OPTION_STORE_AUTH_CREDS; const char *store_plaintext_passwords = SVN_CONFIG_DEFAULT_OPTION_STORE_PLAINTEXT_PASSWORDS; + svn_boolean_t store_passphrase = SVN_CONFIG_DEFAULT_OPTION_STORE_PASSPHRASE; if (callbacks->auth_baton) { @@ -451,6 +452,11 @@ SVN_CONFIG_OPTION_STORE_AUTH_CREDS, store_auth_creds)); + SVN_ERR(svn_config_get_bool + (servers, &store_passphrase, SVN_CONFIG_SECTION_GLOBAL, + SVN_CONFIG_OPTION_STORE_SSL_CLIENT_CERT_PP, + store_passphrase)); + /* Find out where we're about to connect to, and * try to pick a server group based on the destination. */ apr_err = apr_uri_parse(pool, repos_URL, &repos_URI); @@ -479,6 +485,12 @@ (servers, &store_plaintext_passwords, server_group, SVN_CONFIG_OPTION_STORE_PLAINTEXT_PASSWORDS, store_plaintext_passwords)); + + SVN_ERR(svn_config_get_bool + (servers, &store_passphrase, + server_group, + SVN_CONFIG_OPTION_STORE_SSL_CLIENT_CERT_PP, + store_passphrase)); } #ifdef MUST_CHOOSE_DAV /* Now, which DAV-based RA method do we want to use today? */ @@ -512,6 +524,11 @@ if (! store_auth_creds) svn_auth_set_parameter(callbacks->auth_baton, SVN_AUTH_PARAM_NO_AUTH_CACHE, ""); + + if (store_passphrase) + svn_auth_set_parameter(callbacks->auth_baton, + SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP, ""); + } /* Find the library. */ Index: subversion/include/svn_config.h =================================================================== --- subversion/include/svn_config.h (revision 31081) +++ subversion/include/svn_config.h (working copy) @@ -77,6 +77,7 @@ #define SVN_CONFIG_OPTION_STORE_PASSWORDS "store-passwords" #define SVN_CONFIG_OPTION_STORE_PLAINTEXT_PASSWORDS "store-plaintext-passwords" #define SVN_CONFIG_OPTION_STORE_AUTH_CREDS "store-auth-creds" +#define SVN_CONFIG_OPTION_STORE_SSL_CLIENT_CERT_PP "store-ssl-client-cert-pp" #define SVN_CONFIG_CATEGORY_CONFIG "config" #define SVN_CONFIG_SECTION_AUTH "auth" @@ -148,6 +149,7 @@ #define SVN_CONFIG_DEFAULT_OPTION_STORE_PASSWORDS TRUE #define SVN_CONFIG_DEFAULT_OPTION_STORE_PLAINTEXT_PASSWORDS SVN_CONFIG_ASK #define SVN_CONFIG_DEFAULT_OPTION_STORE_AUTH_CREDS TRUE +#define SVN_CONFIG_DEFAULT_OPTION_STORE_PASSPHRASE TRUE /** Read configuration information from the standard sources and merge it * into the hash @a *cfg_hash. If @a config_dir is not NULL it specifies a Index: subversion/include/svn_auth.h =================================================================== --- subversion/include/svn_auth.h (revision 31081) +++ subversion/include/svn_auth.h (working copy) @@ -568,6 +568,12 @@ #define SVN_AUTH_PARAM_STORE_PLAINTEXT_PASSWORDS SVN_AUTH_PARAM_PREFIX \ "store-plaintext-passwords" +/** @brief The application wants providers to save ssl client + * certificate passphrases to disk. Property value is irrelevant; only + * property's existence matters. */ +#define SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP SVN_AUTH_PARAM_PREFIX \ + "store-ssl-client-cert-pp" + /** @brief The application doesn't want any providers to save credentials * to disk. Property value is irrelevant; only property's existence * matters. */ Index: subversion/libsvn_subr/config_file.c =================================================================== --- subversion/libsvn_subr/config_file.c (revision 31081) +++ subversion/libsvn_subr/config_file.c (working copy) @@ -497,6 +497,15 @@ svn_error_clear(err); svn_error_clear(svn_io_dir_make(auth_subdir, APR_OS_DEFAULT, pool)); } + + auth_subdir = svn_path_join_many(pool, auth_dir, + SVN_AUTH_CRED_SSL_CLIENT_CERT_PW, NULL); + err = svn_io_check_path(auth_subdir, &kind, pool); + if (err || kind == svn_node_none) + { + svn_error_clear(err); + svn_error_clear(svn_io_dir_make(auth_subdir, APR_OS_DEFAULT, pool)); + } } @@ -758,6 +767,11 @@ "### store-plaintext-passwords Specifies whether passwords may" NL "### be cached on disk unencrypted." NL "###" NL + "### store-ssl-client-cert-pp Specifies whether passphrases used"NL + "### to authenticate against a client" NL + "### certificate key may be cached" NL + "### to disk" NL + "###" NL "### store-auth-creds Specifies whether any auth info" NL "### (passwords as well as server certs)" NL @@ -771,6 +785,12 @@ "### it doesn't invalidate existing passwords. (To do that, remove" NL "### the cache files by hand as described in the Subversion book.)" NL "###" NL + "### Set store-ssl-client-cert-pp to 'no' to avoid storing" NL + "### ssl client certificate passphrase keys in unencrypted form in" NL + "### the auth/ area of your config directory. Set it to 'yes' to" NL + "### allow Subversion to store unencrypted passphrases in the auth/" NL + "### area. The default is 'yes'." NL + "###" NL "### Set store-plaintext-passwords to 'no' to avoid storing" NL "### passwords in unencrypted form in the auth/ area of your config" NL "### directory. Set it to 'yes' to allow Subversion to store" NL Index: subversion/libsvn_subr/ssl_client_cert_pw_providers.c =================================================================== --- subversion/libsvn_subr/ssl_client_cert_pw_providers.c (revision 31081) +++ subversion/libsvn_subr/ssl_client_cert_pw_providers.c (working copy) @@ -33,7 +33,11 @@ /* File provider */ /*-----------------------------------------------------------------------*/ -/* retrieve and load a password for a client certificate from servers file */ +/* The keys that will be stored on disk */ +#define SVN_AUTH__AUTHFILE_PASSPHRASE_KEY "passphrase" + +/* retrieve and load a password for a client certificate from servers file, + * else from the auth/ cache. */ static svn_error_t * ssl_client_cert_pw_file_first_credentials(void **credentials_p, void **iter_baton, @@ -53,6 +57,29 @@ svn_config_get_server_setting(cfg, server_group, SVN_CONFIG_OPTION_SSL_CLIENT_CERT_PASSWORD, NULL); + if (! password) + { + svn_error_t *err; + apr_hash_t *creds_hash = NULL; + const char *config_dir = apr_hash_get(parameters, + SVN_AUTH_PARAM_CONFIG_DIR, + APR_HASH_KEY_STRING); + + /* Try to load passphrase from the auth/ cache. */ + err = svn_config_read_auth_data(&creds_hash, + SVN_AUTH_CRED_SSL_CLIENT_CERT_PW, + realmstring, config_dir, pool); + svn_error_clear(err); + if (! err && creds_hash) + { + svn_string_t *str; + str = apr_hash_get(creds_hash, SVN_AUTH__AUTHFILE_PASSPHRASE_KEY, + APR_HASH_KEY_STRING); + if (str && str->data) + password = str->data; + } + } + if (password) { svn_auth_cred_ssl_client_cert_pw_t *cred @@ -67,11 +94,63 @@ } +/* Save passphrase for a client certificate in auth/ cache */ +static svn_error_t * +ssl_client_cert_pw_file_save_credentials(svn_boolean_t *saved, + void *credentials, + void *provider_baton, + apr_hash_t *parameters, + const char *realmstring, + apr_pool_t *pool) +{ + svn_auth_cred_ssl_client_cert_pw_t *creds = credentials; + apr_hash_t *creds_hash = NULL; + const char *config_dir; + svn_error_t *err; + + svn_boolean_t store_ssl_client_cert_passphrase = + apr_hash_get(parameters, + SVN_AUTH_PARAM_STORE_SSL_CLIENT_CERT_PP, + APR_HASH_KEY_STRING) != NULL; + + svn_boolean_t no_auth_cache = + (! creds->may_save) || (apr_hash_get(parameters, + SVN_AUTH_PARAM_NO_AUTH_CACHE, + APR_HASH_KEY_STRING) != NULL); + + *saved = FALSE; + + if (no_auth_cache) + return SVN_NO_ERROR; + + config_dir = apr_hash_get(parameters, + SVN_AUTH_PARAM_CONFIG_DIR, + APR_HASH_KEY_STRING); + + creds_hash = apr_hash_make(pool); + + if (store_ssl_client_cert_passphrase) + { + apr_hash_set(creds_hash, SVN_AUTH__AUTHFILE_PASSPHRASE_KEY, + APR_HASH_KEY_STRING, + svn_string_create(creds->password, pool)); + /* Save credentials to disk. */ + err = svn_config_write_auth_data(creds_hash, + SVN_AUTH_CRED_SSL_CLIENT_CERT_PW, + realmstring, config_dir, pool); + svn_error_clear(err); + *saved = ! err; + } + + return SVN_NO_ERROR; +} + + static const svn_auth_provider_t ssl_client_cert_pw_file_provider = { SVN_AUTH_CRED_SSL_CLIENT_CERT_PW, ssl_client_cert_pw_file_first_credentials, NULL, - NULL + ssl_client_cert_pw_file_save_credentials }; Index: subversion/libsvn_ra_neon/session.c =================================================================== --- subversion/libsvn_ra_neon/session.c (revision 31081) +++ subversion/libsvn_ra_neon/session.c (working copy) @@ -290,6 +290,10 @@ if (ne_ssl_clicert_decrypt(clicert, pw_creds->password) == 0) { + error = svn_auth_save_credentials(state, pool); + if (error) + svn_error_clear(error); + /* Success */ ok = TRUE; break;