To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/passprompt.c
- browse files at revision 13
- compare with another revision
- download diff
- download tarball
- view history from revision 13
- Committer: Björn Påhlsson
- Date: 2008-07-20 02:52:20 UTC
- Revision ID: belorn@braxen-20080720025220-r5u0388uy9iu23h6
Added following support:
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
Pluginbased client handler
rewritten Mandos client
Avahi instead of udp server discovery
openpgp encrypted key support
Passprompt stand alone application for direct console input
Added logging for Mandos server
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/passprompt.c
1
/* -*- coding: utf-8; mode: c; mode: orgtbl -*- */
2
/*
3
* Password-prompt - Read a password from the terminal and print it
4
*
5
* Copyright © 2008-2010 Teddy Hogeborn
6
* Copyright © 2008-2010 Björn Påhlsson
7
*
8
* This program is free software: you can redistribute it and/or
9
* modify it under the terms of the GNU General Public License as
10
* published by the Free Software Foundation, either version 3 of the
11
* License, or (at your option) any later version.
12
*
13
* This program is distributed in the hope that it will be useful, but
14
* WITHOUT ANY WARRANTY; without even the implied warranty of
15
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16
* General Public License for more details.
17
*
18
* You should have received a copy of the GNU General Public License
19
* along with this program. If not, see
20
* <http://www.gnu.org/licenses/>.
21
*
22
* Contact the authors at <mandos@fukt.bsnet.se>.
23
*/
24
25
#define _GNU_SOURCE /* getline(), asprintf() */
26
27
#include <termios.h> /* struct termios, tcsetattr(),
1
#define _GNU_SOURCE /* getline() */
2
#define _FORTIFY_SOURCE 2
3
#include <termios.h> /* struct termios, tcsetattr(),
28
4
TCSAFLUSH, tcgetattr(), ECHO */
29
5
#include <unistd.h> /* struct termios, tcsetattr(),
30
6
STDIN_FILENO, TCSAFLUSH,
31
tcgetattr(), ECHO, readlink() */
7
tcgetattr(), ECHO */
32
8
#include <signal.h> /* sig_atomic_t, raise(), struct
33
9
sigaction, sigemptyset(),
34
10
sigaction(), sigaddset(), SIGINT,
35
SIGQUIT, SIGHUP, SIGTERM,
36
raise() */
37
#include <stddef.h> /* NULL, size_t, ssize_t */
38
#include <sys/types.h> /* ssize_t, struct dirent, pid_t,
39
ssize_t, open() */
40
#include <stdlib.h> /* EXIT_SUCCESS, EXIT_FAILURE,
41
getenv(), free() */
42
#include <dirent.h> /* scandir(), alphasort() */
11
SIGQUIT, SIGHUP, SIGTERM */
12
#include <stddef.h> /* NULL, size_t */
13
#include <sys/types.h> /* ssize_t */
14
#include <stdlib.h> /* EXIT_SUCCESS, EXIT_FAILURE */
43
15
#include <stdio.h> /* fprintf(), stderr, getline(),
44
stdin, feof(), fputc()
45
*/
46
#include <errno.h> /* errno, EBADF, ENOTTY, EINVAL,
47
EFAULT, EFBIG, EIO, ENOSPC, EINTR
48
*/
49
#include <error.h> /* error() */
16
stdin, feof(), perror(), fputc(),
17
stdout */
18
#include <errno.h> /* errno, EINVAL */
50
19
#include <iso646.h> /* or, not */
51
20
#include <stdbool.h> /* bool, false, true */
52
#include <inttypes.h> /* strtoumax() */
53
#include <sys/stat.h> /* struct stat, lstat(), open() */
54
#include <string.h> /* strlen, rindex, memcmp */
55
#include <argp.h> /* struct argp_option, struct
56
argp_state, struct argp,
57
argp_parse(), error_t,
58
ARGP_KEY_ARG, ARGP_KEY_END,
59
ARGP_ERR_UNKNOWN */
60
#include <sysexits.h> /* EX_SOFTWARE, EX_OSERR,
61
EX_UNAVAILABLE, EX_IOERR, EX_OK */
62
#include <fcntl.h> /* open() */
63
64
volatile sig_atomic_t quit_now = 0;
65
int signal_received;
66
bool debug = false;
67
const char *argp_program_version = "password-prompt " VERSION;
68
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
69
70
/* Needed for conflict resolution */
71
const char plymouth_name[] = "plymouthd";
72
const char plymouth_alt_name[] = "plymouthd";
73
74
75
static void termination_handler(int signum){
76
if(quit_now){
77
return;
78
}
79
quit_now = 1;
80
signal_received = signum;
81
}
82
83
bool conflict_detection(void){
84
85
/* plymouth conflicts with password-prompt since both want to read
86
from the terminal. Password-prompt will exit if it detects
87
plymouth since plymouth performs the same functionality.
88
*/
89
int is_plymouth(const struct dirent *proc_entry){
90
int ret;
91
int cl_fd;
92
{
93
uintmax_t maxvalue;
94
char *tmp;
95
errno = 0;
96
maxvalue = strtoumax(proc_entry->d_name, &tmp, 10);
97
98
if(errno != 0 or *tmp != '\0'
99
or maxvalue != (uintmax_t)((pid_t)maxvalue)){
100
return 0;
101
}
102
}
103
104
char *cmdline_filename;
105
ret = asprintf(&cmdline_filename, "/proc/%s/cmdline",
106
proc_entry->d_name);
107
if(ret == -1){
108
error(0, errno, "asprintf");
109
return 0;
110
}
111
112
/* Open /proc/<pid>/cmdline */
113
cl_fd = open(cmdline_filename, O_RDONLY);
114
free(cmdline_filename);
115
if(cl_fd == -1){
116
error(0, errno, "open");
117
return 0;
118
}
119
120
char *cmdline = NULL;
121
{
122
size_t cmdline_len = 0;
123
size_t cmdline_allocated = 0;
124
char *tmp;
125
const size_t blocksize = 1024;
126
ssize_t sret;
127
do {
128
/* Allocate more space? */
129
if(cmdline_len + blocksize + 1 > cmdline_allocated){
130
tmp = realloc(cmdline, cmdline_allocated + blocksize + 1);
131
if(tmp == NULL){
132
error(0, errno, "realloc");
133
free(cmdline);
134
close(cl_fd);
135
return 0;
136
}
137
cmdline = tmp;
138
cmdline_allocated += blocksize;
139
}
140
141
/* Read data */
142
sret = read(cl_fd, cmdline + cmdline_len,
143
cmdline_allocated - cmdline_len);
144
if(sret == -1){
145
error(0, errno, "read");
146
free(cmdline);
147
close(cl_fd);
148
return 0;
149
}
150
cmdline_len += (size_t)sret;
151
} while(sret != 0);
152
ret = close(cl_fd);
153
if(ret == -1){
154
error(0, errno, "close");
155
free(cmdline);
156
return 0;
157
}
158
cmdline[cmdline_len] = '\0'; /* Make sure it is terminated */
159
}
160
/* we now have cmdline */
161
162
/* get basename */
163
char *cmdline_base = strrchr(cmdline, '/');
164
if(cmdline_base != NULL){
165
cmdline_base += 1; /* skip the slash */
166
} else {
167
cmdline_base = cmdline;
168
}
169
170
if((strcmp(cmdline_base, plymouth_name) != 0)
171
and (strcmp(cmdline_base, plymouth_alt_name) != 0)){
172
if(debug){
173
fprintf(stderr, "\"%s\" is not \"%s\" or \"%s\"\n",
174
cmdline_base, plymouth_name, plymouth_alt_name);
175
}
176
free(cmdline);
177
return 0;
178
}
179
fprintf(stderr, "\"%s\" equals \"%s\" or \"%s\"\n",
180
cmdline_base, plymouth_name, plymouth_alt_name);
181
free(cmdline);
182
return 1;
183
}
184
185
struct dirent **direntries;
186
int ret;
187
ret = scandir("/proc", &direntries, is_plymouth, alphasort);
188
if (ret == -1){
189
error(1, errno, "scandir");
190
}
191
return ret > 0;
192
}
193
21
22
volatile bool quit_now = false;
23
24
void termination_handler(int signum){
25
quit_now = true;
26
}
194
27
195
28
int main(int argc, char **argv){
196
ssize_t sret;
197
int ret;
29
ssize_t ret = -1;
198
30
size_t n;
199
31
struct termios t_new, t_old;
200
32
char *buffer = NULL;
201
char *prefix = NULL;
202
33
int status = EXIT_SUCCESS;
203
34
struct sigaction old_action,
204
35
new_action = { .sa_handler = termination_handler,
205
36
.sa_flags = 0 };
206
{
207
struct argp_option options[] = {
208
{ .name = "prefix", .key = 'p',
209
.arg = "PREFIX", .flags = 0,
210
.doc = "Prefix shown before the prompt", .group = 2 },
211
{ .name = "debug", .key = 128,
212
.doc = "Debug mode", .group = 3 },
213
/*
214
* These reproduce what we would get without ARGP_NO_HELP
215
*/
216
{ .name = "help", .key = '?',
217
.doc = "Give this help list", .group = -1 },
218
{ .name = "usage", .key = -3,
219
.doc = "Give a short usage message", .group = -1 },
220
{ .name = "version", .key = 'V',
221
.doc = "Print program version", .group = -1 },
222
{ .name = NULL }
223
};
224
225
error_t parse_opt (int key, char *arg, struct argp_state *state){
226
errno = 0;
227
switch (key){
228
case 'p':
229
prefix = arg;
230
break;
231
case 128:
232
debug = true;
233
break;
234
/*
235
* These reproduce what we would get without ARGP_NO_HELP
236
*/
237
case '?': /* --help */
238
argp_state_help(state, state->out_stream,
239
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
240
& ~(unsigned int)ARGP_HELP_EXIT_OK);
241
case -3: /* --usage */
242
argp_state_help(state, state->out_stream,
243
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
244
case 'V': /* --version */
245
fprintf(state->out_stream, "%s\n", argp_program_version);
246
exit(argp_err_exit_status);
247
break;
248
default:
249
return ARGP_ERR_UNKNOWN;
250
}
251
return errno;
252
}
253
254
struct argp argp = { .options = options, .parser = parse_opt,
255
.args_doc = "",
256
.doc = "Mandos password-prompt -- Read and"
257
" output a password" };
258
ret = argp_parse(&argp, argc, argv,
259
ARGP_IN_ORDER | ARGP_NO_HELP, NULL, NULL);
260
switch(ret){
261
case 0:
262
break;
263
case ENOMEM:
264
default:
265
errno = ret;
266
error(0, errno, "argp_parse");
267
return EX_OSERR;
268
case EINVAL:
269
return EX_USAGE;
270
}
271
}
272
37
273
if(debug){
274
fprintf(stderr, "Starting %s\n", argv[0]);
275
}
276
277
if (conflict_detection()){
278
if(debug){
279
fprintf(stderr, "Stopping %s because of conflict\n", argv[0]);
280
}
38
if (tcgetattr(STDIN_FILENO, &t_old) != 0){
281
39
return EXIT_FAILURE;
282
40
}
283
41
284
if(debug){
285
fprintf(stderr, "Storing current terminal attributes\n");
286
}
287
288
if(tcgetattr(STDIN_FILENO, &t_old) != 0){
289
int e = errno;
290
error(0, errno, "tcgetattr");
291
switch(e){
292
case EBADF:
293
case ENOTTY:
294
return EX_UNAVAILABLE;
295
default:
296
return EX_OSERR;
297
}
298
}
299
300
42
sigemptyset(&new_action.sa_mask);
301
ret = sigaddset(&new_action.sa_mask, SIGINT);
302
if(ret == -1){
303
error(0, errno, "sigaddset");
304
return EX_OSERR;
305
}
306
ret = sigaddset(&new_action.sa_mask, SIGHUP);
307
if(ret == -1){
308
error(0, errno, "sigaddset");
309
return EX_OSERR;
310
}
311
ret = sigaddset(&new_action.sa_mask, SIGTERM);
312
if(ret == -1){
313
error(0, errno, "sigaddset");
314
return EX_OSERR;
315
}
316
/* Need to check if the handler is SIG_IGN before handling:
317
| [[info:libc:Initial Signal Actions]] |
318
| [[info:libc:Basic Signal Handling]] |
319
*/
320
ret = sigaction(SIGINT, NULL, &old_action);
321
if(ret == -1){
322
error(0, errno, "sigaction");
323
return EX_OSERR;
324
}
325
if(old_action.sa_handler != SIG_IGN){
326
ret = sigaction(SIGINT, &new_action, NULL);
327
if(ret == -1){
328
error(0, errno, "sigaction");
329
return EX_OSERR;
330
}
331
}
332
ret = sigaction(SIGHUP, NULL, &old_action);
333
if(ret == -1){
334
error(0, errno, "sigaction");
335
return EX_OSERR;
336
}
337
if(old_action.sa_handler != SIG_IGN){
338
ret = sigaction(SIGHUP, &new_action, NULL);
339
if(ret == -1){
340
error(0, errno, "sigaction");
341
return EX_OSERR;
342
}
343
}
344
ret = sigaction(SIGTERM, NULL, &old_action);
345
if(ret == -1){
346
error(0, errno, "sigaction");
347
return EX_OSERR;
348
}
349
if(old_action.sa_handler != SIG_IGN){
350
ret = sigaction(SIGTERM, &new_action, NULL);
351
if(ret == -1){
352
error(0, errno, "sigaction");
353
return EX_OSERR;
354
}
355
}
356
357
358
if(debug){
359
fprintf(stderr, "Removing echo flag from terminal attributes\n");
360
}
43
sigaddset(&new_action.sa_mask, SIGINT);
44
sigaddset(&new_action.sa_mask, SIGQUIT);
45
sigaddset(&new_action.sa_mask, SIGHUP);
46
sigaddset(&new_action.sa_mask, SIGTERM);
47
sigaction(SIGINT, NULL, &old_action);
48
if (old_action.sa_handler != SIG_IGN)
49
sigaction(SIGINT, &new_action, NULL);
50
sigaction(SIGQUIT, NULL, &old_action);
51
if (old_action.sa_handler != SIG_IGN)
52
sigaction(SIGQUIT, &new_action, NULL);
53
sigaction(SIGHUP, NULL, &old_action);
54
if (old_action.sa_handler != SIG_IGN)
55
sigaction(SIGHUP, &new_action, NULL);
56
sigaction(SIGTERM, NULL, &old_action);
57
if (old_action.sa_handler != SIG_IGN)
58
sigaction(SIGTERM, &new_action, NULL);
361
59
362
60
t_new = t_old;
363
t_new.c_lflag &= ~(tcflag_t)ECHO;
364
if(tcsetattr(STDIN_FILENO, TCSAFLUSH, &t_new) != 0){
365
int e = errno;
366
error(0, errno, "tcsetattr-echo");
367
switch(e){
368
case EBADF:
369
case ENOTTY:
370
return EX_UNAVAILABLE;
371
case EINVAL:
372
default:
373
return EX_OSERR;
374
}
61
t_new.c_lflag &= ~ECHO;
62
if (tcsetattr(STDIN_FILENO, TCSAFLUSH, &t_new) != 0){
63
perror("tcsetattr-echo");
64
return EXIT_FAILURE;
375
65
}
376
66
377
if(debug){
378
fprintf(stderr, "Waiting for input from stdin \n");
379
}
380
67
while(true){
381
if(quit_now){
382
if(debug){
383
fprintf(stderr, "Interrupted by signal, exiting.\n");
384
}
68
if (quit_now){
385
69
status = EXIT_FAILURE;
386
70
break;
387
71
}
388
389
if(prefix){
390
fprintf(stderr, "%s ", prefix);
391
}
392
{
393
const char *cryptsource = getenv("CRYPTTAB_SOURCE");
394
const char *crypttarget = getenv("CRYPTTAB_NAME");
395
/* Before cryptsetup 1.1.0~rc2 */
396
if(cryptsource == NULL){
397
cryptsource = getenv("cryptsource");
398
}
399
if(crypttarget == NULL){
400
crypttarget = getenv("crypttarget");
401
}
402
const char *const prompt1 = "Unlocking the disk";
403
const char *const prompt2 = "Enter passphrase";
404
if(cryptsource == NULL){
405
if(crypttarget == NULL){
406
fprintf(stderr, "%s to unlock the disk: ", prompt2);
407
} else {
408
fprintf(stderr, "%s (%s)\n%s: ", prompt1, crypttarget,
409
prompt2);
410
}
411
} else {
412
if(crypttarget == NULL){
413
fprintf(stderr, "%s %s\n%s: ", prompt1, cryptsource,
414
prompt2);
415
} else {
416
fprintf(stderr, "%s %s (%s)\n%s: ", prompt1, cryptsource,
417
crypttarget, prompt2);
418
}
419
}
420
}
421
sret = getline(&buffer, &n, stdin);
422
if(sret > 0){
72
fprintf(stderr, "Password: ");
73
ret = getline(&buffer, &n, stdin);
74
if (ret > 0){
75
fprintf(stdout, "%s", buffer);
423
76
status = EXIT_SUCCESS;
424
/* Make n = data size instead of allocated buffer size */
425
n = (size_t)sret;
426
/* Strip final newline */
427
if(n > 0 and buffer[n-1] == '\n'){
428
buffer[n-1] = '\0'; /* not strictly necessary */
429
n--;
430
}
431
size_t written = 0;
432
while(written < n){
433
sret = write(STDOUT_FILENO, buffer + written, n - written);
434
if(sret < 0){
435
int e = errno;
436
error(0, errno, "write");
437
switch(e){
438
case EBADF:
439
case EFAULT:
440
case EINVAL:
441
case EFBIG:
442
case EIO:
443
case ENOSPC:
444
default:
445
status = EX_IOERR;
446
break;
447
case EINTR:
448
status = EXIT_FAILURE;
449
break;
450
}
451
break;
452
}
453
written += (size_t)sret;
454
}
455
sret = close(STDOUT_FILENO);
456
if(sret == -1){
457
int e = errno;
458
error(0, errno, "close");
459
switch(e){
460
case EBADF:
461
status = EX_OSFILE;
462
break;
463
case EIO:
464
default:
465
status = EX_IOERR;
466
break;
467
}
468
}
469
77
break;
470
78
}
471
if(sret < 0){
472
int e = errno;
473
if(errno != EINTR and not feof(stdin)){
474
error(0, errno, "getline");
475
switch(e){
476
case EBADF:
477
status = EX_UNAVAILABLE;
478
case EIO:
479
case EINVAL:
480
default:
481
status = EX_IOERR;
482
break;
483
}
79
// ret == 0 makes no other sence than to retry to read from stdin
80
if (ret < 0){
81
if (errno != EINTR and not feof(stdin)){
82
perror("getline");
83
status = EXIT_FAILURE;
484
84
break;
485
85
}
486
86
}
487
/* if(sret == 0), then the only sensible thing to do is to retry
488
to read from stdin */
489
fputc('\n', stderr);
490
if(debug and not quit_now){
491
/* If quit_now is nonzero, we were interrupted by a signal, and
492
will print that later, so no need to show this too. */
493
fprintf(stderr, "getline() returned 0, retrying.\n");
494
}
495
}
496
497
free(buffer);
498
499
if(debug){
500
fprintf(stderr, "Restoring terminal attributes\n");
501
}
502
if(tcsetattr(STDIN_FILENO, TCSAFLUSH, &t_old) != 0){
503
error(0, errno, "tcsetattr+echo");
504
}
505
506
if(quit_now){
507
sigemptyset(&old_action.sa_mask);
508
old_action.sa_handler = SIG_DFL;
509
ret = sigaction(signal_received, &old_action, NULL);
510
if(ret == -1){
511
error(0, errno, "sigaction");
512
}
513
raise(signal_received);
514
}
515
516
if(debug){
517
fprintf(stderr, "%s is exiting with status %d\n", argv[0],
518
status);
519
}
520
if(status == EXIT_SUCCESS or status == EX_OK){
521
fputc('\n', stderr);
87
fputc('\n', stderr);
88
}
89
90
if (tcsetattr(STDIN_FILENO, TCSAFLUSH, &t_old) != 0){
91
perror("tcsetattr+echo");
522
92
}
523
93
524
94
return status;
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0