Changeset 11153 in ntrip for trunk

Timestamp:

Oct 31, 2026, 11:50:15 PM (6 days ago)

Author:

stuerze

Message:

Credentials files are implemented, with existing configs keep working unchanged

Location:

trunk/BNC

Files:

• CHANGELOG.md (modified) (1 diff)
• src/bnccredentials.cpp (added)
• src/bnccredentials.h (added)
• src/bncgetthread.cpp (modified) (6 diffs)
• src/bncgetthread.h (modified) (1 diff)
• src/bnchelp.html (modified) (1 diff)
• src/bncmain.cpp (modified) (1 diff)
• src/bncsettings.cpp (modified) (1 diff)
• src/bnctabledlg.cpp (modified) (2 diffs)
• src/bncwindow.cpp (modified) (6 diffs)
• src/bncwindow.h (modified) (1 diff)
• src/src.pri (modified) (2 diffs)
• src/upload/bncuploadcaster.cpp (modified) (2 diffs)
• tests/README.md (modified) (2 diffs)
• tests/tools/cred_check.py (added)
• tests/tools/fakecaster.py (modified) (7 diffs)

trunk/BNC/CHANGELOG.md

@@ -82 +82 @@
 - CHANGED: Plot scripts (cmbPlot.pl, pppPlot.pl, compareSP3Plot.pl) delete only the images they created (cmbPlot.pl deleted all PNG files of the input directory)
 - CHANGED: Linux build with stack protector, bounds-checked std containers (_GLIBCXX_ASSERTIONS) and read-only relocations, independent of the distribution's compiler defaults
+- ADDED: Option 'Credentials files' (key credentialsFile): passwords of Ntrip Broadcasters can be kept in credentials files instead of the configuration file, in netrc format ('machine host[:port] login user password secret', default $NETRC or ~/.netrc) or BNC format ('host port|* user|- password'); several users per host, URLs without user stay anonymous, passwords in the configuration file are used as before
 
 ## 2.13.7 (2026-07-31)

trunk/BNC/src/bncgetthread.cpp

@@ -65 +65 @@
 #include "bncnetqueryudp.h"
 #include "bncnetqueryudp0.h"
+#include "bnccredentials.h"
 #include "bncnetquerys.h"
 #include "bncsettings.h"
@@ -95 +96 @@
   _rawFile = 0;
   _mountPoint   = mountPoint;
+  _requestUrl   = mountPoint;
+  bncCredentials::complete(_requestUrl); // password from a credentials file
   _staID        = mountPoint.path().mid(1).toLatin1();
   _format       = format;
@@ -356 +359 @@
   msleep(100); //sleep 0.1 sec
 
-  _decoder->initRinex(_staID, _mountPoint, _latitude, _longitude, _nmea,
+  _decoder->initRinex(_staID, _requestUrl, _latitude, _longitude, _nmea,
       _ntripVersion);
 
@@ -768 +771 @@
     if (_nmea == "yes") {
       if (_serialNMEA == MANUAL_NMEA) {
-        _query->startRequest(_mountPoint, _manualNMEAString);
+        _query->startRequest(_requestUrl, _manualNMEAString);
         _lastNMEA = QDateTime::currentDateTime();
       } else if (_serialNMEA == AUTO_NMEA) {
@@ -783 +786 @@
               if (i2 != -1 && data.size() > i2 + 1) {
                 QByteArray gga = data.mid(i1, i2 - i1 + 3);
-                _query->startRequest(_mountPoint, gga);
+                _query->startRequest(_requestUrl, gga);
                 _lastNMEA = QDateTime::currentDateTime();
               }
@@ -791 +794 @@
       }
     } else {
-      _query->startRequest(_mountPoint, "");
+      _query->startRequest(_requestUrl, "");
     }
 

trunk/BNC/src/bncgetthread.h

@@ -109 +109 @@
    GPSDecoder*                _decoder;
    bncNetQuery*               _query;
-   QUrl                       _mountPoint;
+   QUrl                       _mountPoint;   // as configured (identifies the stream)
+   QUrl                       _requestUrl;   // with password from a credentials file
    QByteArray                 _staID;
    QByteArray                 _format;

trunk/BNC/src/bnchelp.html

@@ -2692 +2692 @@
     and feed in manipulated data. The ignored errors are logged. Better save the CA certificate of the Ntrip
     Broadcaster in the 'Path to SSL certificates' directory.
+  </p>
+  <p>
+    Passwords of Ntrip Broadcasters can be kept in 'Credentials files' instead of BNC's configuration file, which
+    then contains no secrets and can be passed on. Give the user name without password in the stream's URL, e.g.
+    '//user@products.igs-ip.net:443/SSRA00BKG1', or in the upload settings (empty password). BNC takes the password
+    from the first matching entry of the credentials files. Streams without user name are retrieved without
+    authentication, even if a file contains an entry for that host. A password still given in the configuration
+    file is used as before (with a hint in the logfile), so configurations can be changed step by step.
+  </p>
+  <p>
+    Two file formats are accepted and detected from the content:
+  <ul>
+    <li>netrc, as used by curl, wget or git: 'machine products.igs-ip.net login user password secret'. The machine
+      may also be given as 'host:port' for an account that applies to one port only. The netrc 'default' entry is
+      not used.</li>
+    <li>BNC: one entry per line '&lt;host&gt; &lt;port&gt; &lt;user&gt; &lt;password&gt;', port '*' for any port,
+      user '-' for an entry without user (Ntrip Version 1 upload).</li>
+  </ul>
+    Several users per host are distinguished by the user name. An entry for the exact port is preferred over one
+    for any port. Words containing blanks are quoted: "my secret". A '#' starts a comment. Several files can be
+    given, separated by commas; default is the file named in the environment variable NETRC, otherwise ~/.netrc.
+    A file readable for other users is not used (chmod 600). Note that a password containing '%' followed by two
+    hexadecimal digits is not supported, in the configuration file neither.
   </p>
   <p><img src="IMG/Figure07.png" width=800 /></p>

trunk/BNC/src/bncmain.cpp

@@ -136 +136 @@
         "   sslClientCertPath {Full path to client SSL certificates [character string]}\n"
         "   sslIgnoreErrors   {Ignore SSL authorization errors [integer number: 0=no,2=yes]}\n"
+        "   credentialsFile   {Credentials files, netrc or BNC format, default $NETRC or ~/.netrc [character string, comma separated list]}\n"
         "\n"
         "General Panel keys:\n"

trunk/BNC/src/bncsettings.cpp

@@ -75 +75 @@
         setValue_p("sslClientCertPath", "");
         setValue_p("sslIgnoreErrors", "0");
+        setValue_p("credentialsFile", "");
         // General
         setValue_p("logFile", "");

trunk/BNC/src/bnctabledlg.cpp

@@ -47 +47 @@
 
 #include "bnctabledlg.h"
+#include "bnccredentials.h"
 #include "bncgetthread.h"
 #include "bncnetqueryv1.h"
@@ -238 +239 @@
   }
   url.setUserName(QUrl::toPercentEncoding(casterUser));
-  url.setPassword(QUrl::toPercentEncoding(casterPassword));
+  QString password = casterPassword; // empty: from a credentials file
+  bncCredentials::complete(casterHost, casterPort, casterUser, password, false, false);
+  url.setPassword(QUrl::toPercentEncoding(password));
   QByteArray outData;
   query->waitForRequestResult(url, outData);

trunk/BNC/src/bncwindow.cpp

@@ -194 +194 @@
   _sslIgnoreErrorsCheckBox->setCheckState(Qt::CheckState(
                                                          settings.value("sslIgnoreErrors").toInt()));
+  _credentialsFileLineEdit = new QLineEdit(settings.value("credentialsFile").toString());
 
   // General Options
@@ -828 +829 @@
   pLayout->addWidget(new QLabel("Ignore SSL authorization errors"), 5, 0);
   pLayout->addWidget(_sslIgnoreErrorsCheckBox, 5, 1, 1, 10);
-  pLayout->addWidget(new QLabel(""), 6, 1);
-  pLayout->setRowStretch(6, 999);
+  pLayout->addWidget(new QLabel("Credentials files"), 6, 0);
+  pLayout->addWidget(_credentialsFileLineEdit, 6, 1, 1, 10);
+  pLayout->addWidget(new QLabel("Default:  $NETRC or ~/.netrc"), 6, 11, 1, 20);
+  pLayout->addWidget(new QLabel(""), 7, 1);
+  pLayout->setRowStretch(7, 999);
 
   pgroup->setLayout(pLayout);
@@ -1558 +1562 @@
   _sslCaCertPathLineEdit->setWhatsThis(tr("<p>Communication with an Ntrip Broadcaster over SSL requires the exchange of server certificates. Specify the path to a directory where you save CA certificates on your system. </p><p>BNC creates from *.crt and *.pem files a CA certificate database, which is used by the socket during the handshake phase to validate the peer's certificate. </p><p>Note that SSL communication is usually done over port 443. <i>[key: sslCaCertPath]</i></p>"));
   _sslClientCertPathLineEdit->setWhatsThis(tr("<p>Two-sided communication with an Ntrip Broadcaster over SSL requires in addition the exchange of client certificates. Specify the full path to the client certificates on your system.</p><p></p><p>The file naming convention for client certificates in BNC is as follows: &lt;hostname&gt;.&lt;port&gt;.crt for the certificate and &lt;hostname&gt;.&lt;port&gt;.key for the private key, where &lt;hostname&gt; is without https://. </p><p> If available, the client or personal authentication certificate is presented to the peer during the SSL handshake process. Password protected key files are not supported. </p><p>Don't try communication via two sided SSL if you are not sure whether this is supported by the involved Ntrip Broadcaster. </p><p>Note that SSL communication is usually done over port 443. <i>[key: sslClientCertPath]</i></p>"));
+  _credentialsFileLineEdit->setWhatsThis(tr("<p>Passwords of Ntrip Broadcasters can be kept in credentials files instead of the configuration file: give the user name without password in the stream's URL (e.g. '//user@products.igs-ip.net:443/SSRA00BKG1') or in the upload settings (empty password). BNC then takes the password from the first matching entry of these files. Streams without user name are retrieved without authentication.</p><p>Two formats are accepted, detected from the file content:<br>netrc: 'machine products.igs-ip.net login user password secret', where the machine may also be given as 'host:port';<br>BNC: one entry per line '&lt;host&gt; &lt;port&gt; &lt;user&gt; &lt;password&gt;', port '*' for any port, user '-' for an entry without user (Ntrip Version 1 upload).</p><p>An entry for the exact port is preferred. Several files can be given, separated by commas; default is the file named in the environment variable NETRC or ~/.netrc. A file readable for other users is not used. A password still given in the configuration file is used as before. <i>[key: credentialsFile]</i></p>"));
   _sslIgnoreErrorsCheckBox->setWhatsThis(tr("<p>Tick 'Ignore SSL authorization errors' to accept a server certificate that cannot be verified, e.g. a self-signed certificate or one issued for another host name. The connection is then still encrypted, but the server is not authenticated: anybody able to intercept the connection may receive your user name and password and feed in manipulated data. The ignored errors are logged. Better save the CA certificate of the Ntrip Broadcaster in the 'Path to SSL certificates' directory. <i>[key: sslIgnoreErrors]</i></p>"));
 
@@ -1874 +1879 @@
   delete _sslClientCertPathLineEdit;
   delete _sslIgnoreErrorsCheckBox;
+  delete _credentialsFileLineEdit;
   delete _logFileLineEdit;
   delete _rawOutFileLineEdit;
@@ -2088 +2094 @@
   settings.setValue("sslClientCertPath", _sslClientCertPathLineEdit->text());
   settings.setValue("sslIgnoreErrors", _sslIgnoreErrorsCheckBox->checkState());
+  settings.setValue("credentialsFile", _credentialsFileLineEdit->text());
 
   QMessageBox msgBox;
@@ -2404 +2411 @@
   settings.setValue("sslClientCertPath", _sslClientCertPathLineEdit->text());
   settings.setValue("sslIgnoreErrors", _sslIgnoreErrorsCheckBox->checkState());
+  settings.setValue("credentialsFile", _credentialsFileLineEdit->text());
   // General
   settings.setValue("logFile", _logFileLineEdit->text());

trunk/BNC/src/bncwindow.h

@@ -141 +141 @@
     QLineEdit* _sslClientCertPathLineEdit;
     QCheckBox* _sslIgnoreErrorsCheckBox;
+    QLineEdit* _credentialsFileLineEdit;
     QLineEdit* _outFileLineEdit;
     QLineEdit* _outPortLineEdit;

trunk/BNC/src/src.pri

@@ -67 +67 @@
           bncoutf.h bncclockrinex.h bncsp3.h bncsinextro.h            \
           bncbiassinex.h                                              \
-          bncbytescounter.h bncsslconfig.h reqcdlg.h                  \
+          bncbytescounter.h bncsslconfig.h bnccredentials.h reqcdlg.h                  \
           ephemeris.h t_prn.h satObs.h                                \
           upload/bncrtnetdecoder.h upload/bncuploadcaster.h           \
@@ -110 +110 @@
           bncbiassinex.cpp                                            \
           ephemeris.cpp t_prn.cpp satObs.cpp                          \
-          bncbytescounter.cpp bncsslconfig.cpp reqcdlg.cpp            \
+          bncbytescounter.cpp bncsslconfig.cpp bnccredentials.cpp reqcdlg.cpp            \
           upload/bncrtnetdecoder.cpp upload/bncuploadcaster.cpp       \
           upload/bncrawuploadcaster.cpp                               \

trunk/BNC/src/upload/bncuploadcaster.cpp

@@ -22 +22 @@
 #include "bncsettings.h"
 #include "bncsslconfig.h"
+#include "bnccredentials.h"
 
 using namespace std;
@@ -46 +47 @@
   _userName = userName;
   _password = password;
+  if (!_mountpoint.isEmpty() && !_casterOutHost.isEmpty()) {
+    // empty password: from a credentials file, also without user (Ntrip Version 1)
+    bncCredentials::complete(_casterOutHost, _casterOutPort, _userName, _password, true, true);
+  }
   _outSocket = 0;
   _sOpenTrial = 0;

trunk/BNC/tests/README.md

@@ -32 +32 @@
 | `tools/ssl_check.py` | TLS checks of the Ntrip 2s client and upload (not part of `run_tests.py`) |
 | `tools/net_check.py` | UDP/RTP sender filter and upload status checks on loopback (not part of `run_tests.py`) |
+| `tools/cred_check.py` | credentials files (`~/.netrc`, BNC format) for download and upload (not part of `run_tests.py`) |
 | `work/` | scratch output, not versioned |
 
@@ -179 +180 @@
 as broken. Takes about 2 min.
 
+## Credentials check
+
+```
+tests/tools/cred_check.py [--bnc PATH]
+```
+
+BNC against `tools/fakecaster.py --auth user:password` (other credentials
+rejected), each scenario with its own `HOME`: password in the configuration
+file (hint logged), `~/.netrc` with two users for the host, `$NETRC` with
+`machine host:port` preferred, BNC format file (`credentialsFile`) with exact
+port preferred over `*` and a quoted password, URL without user (no
+credentials sent), user without entry, `~/.netrc` readable for others and the
+netrc `default` entry (not used), Ntrip 1 download, Ntrip 2 upload and
+Ntrip 1 upload without user. Takes about 2 min.
+
 ## Adding a replay case
 

trunk/BNC/tests/tools/fakecaster.py

@@ -16 +16 @@
 a GET request (BNC as Ntrip client) is answered with the RTCM bytes of the
 given raw file. With --reply an upload is answered with this text instead
-of the 200 status (e.g. a rejection), and the connection is closed. Failed
+of the 200 status (e.g. a rejection), and the connection is closed. With
+--auth user:password (repeatable, ':password' for an Ntrip 1 upload) only
+these credentials are accepted, others get 401 / 'ERROR - Bad Password'.
+The user received ("-" without user, "none" without credentials) and failed
 TLS handshakes are reported on stdout.
 """
 
 import argparse
+import base64
 import os
 import socket
@@ -70 +74 @@
 
 
-def serve(conn, store, timeout, tls=None, served=None, reply=None):
+def credentials(header):
+    """(user, password) of a request header, None without credentials."""
+    lines = header.split(b"\r\n")
+    if lines[0].startswith(b"SOURCE"):
+        parts = lines[0].split(b" ")
+        return "", parts[1].decode("latin-1") if len(parts) > 1 else ""
+    for line in lines[1:]:
+        key, _, value = line.partition(b":")
+        value = value.strip()
+        if key.strip().lower() == b"authorization" and value.lower().startswith(b"basic "):
+            user, _, password = base64.b64decode(value[6:]).decode("latin-1").partition(":")
+            return user, password
+    return None
+
+
+def serve(conn, store, timeout, tls=None, served=None, reply=None, auth=None):
     conn.settimeout(timeout)
     buf = b""
@@ -88 +107 @@
         header, _, pending = buf.partition(b"\r\n\r\n")
         chunked = b"chunked" in header.lower()
+        cred = credentials(header)
+        ok = auth is None or cred in auth
+        print("auth %s %s" % ("none" if cred is None else (cred[0] or "-"),
+                              "accepted" if ok else "rejected"), flush=True)
+        if not ok:
+            conn.sendall(b"ERROR - Bad Password\r\n" if header.startswith(b"SOURCE")
+                         else b"HTTP/1.1 401 Unauthorized\r\n\r\n")
+            store.rejected += 1
+            return
         if header.startswith(b"GET") and served is not None:
-            conn.sendall(b"HTTP/1.1 200 OK\r\nNtrip-Version: Ntrip/2.0\r\n"
-                         b"Content-Type: gnss/data\r\nConnection: close\r\n\r\n" + served)
+            if b"ntrip-version" in header.lower():
+                conn.sendall(b"HTTP/1.1 200 OK\r\nNtrip-Version: Ntrip/2.0\r\n"
+                             b"Content-Type: gnss/data\r\nConnection: close\r\n\r\n" + served)
+            else:  # Ntrip 1
+                conn.sendall(b"ICY 200 OK\r\n\r\n" + served)
             store.served += len(served)
             return
@@ -134 +165 @@
     ap.add_argument("--tls-client-ca", help="require a client certificate of this CA")
     ap.add_argument("--serve", help="raw file whose RTCM bytes are sent on GET")
+    ap.add_argument("--auth", action="append",
+                    help="accepted user:password (repeatable), others rejected")
     ap.add_argument("--reply", help="answer to uploads instead of 200 ('\\r\\n' escapes allowed)")
     args = ap.parse_args()
@@ -147 +180 @@
     if args.reply is not None:
         reply = args.reply.encode("latin-1").decode("unicode_escape").encode("latin-1")
+    auth = None
+    if args.auth:
+        auth = [tuple(a.split(":", 1)) for a in args.auth]
     served = None
     if args.serve:
@@ -166 +202 @@
         except socket.timeout:
             break
-        t = threading.Thread(target=serve, args=(conn, store, args.timeout, tls, served, reply),
+        t = threading.Thread(target=serve, args=(conn, store, args.timeout, tls, served, reply, auth),
                              daemon=True)
         t.start()
@@ -177 +213 @@
     if served is not None:
         print("served %d bytes" % store.served, flush=True)
-    if reply is not None:
-        print("%d upload(s) answered with --reply" % store.rejected, flush=True)
+    if reply is not None or auth is not None:
+        print("%d connection(s) rejected" % store.rejected, flush=True)
     return 0