1 /* 2 * Dropbear SSH 3 * 4 * Copyright (c) 2002,2003 Matt Johnston 5 * All rights reserved. 6 * 7 * Permission is hereby granted, free of charge, to any person obtaining a copy 8 * of this software and associated documentation files (the "Software"), to deal 9 * in the Software without restriction, including without limitation the rights 10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 11 * copies of the Software, and to permit persons to whom the Software is 12 * furnished to do so, subject to the following conditions: 13 * 14 * The above copyright notice and this permission notice shall be included in 15 * all copies or substantial portions of the Software. 16 * 17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 23 * SOFTWARE. */ 24 25 #include "includes.h" 26 #include "buffer.h" 27 #include "dbutil.h" 28 #include "session.h" 29 #include "ssh.h" 30 #include "runopts.h" 31 32 #ifdef ENABLE_CLI_PASSWORD_AUTH 33 34 #ifdef ENABLE_CLI_ASKPASS_HELPER 35 /* Returns 1 if we want to use the askpass program, 0 otherwise */ want_askpass()36 static int want_askpass() 37 { 38 char* askpass_prog = NULL; 39 40 askpass_prog = getenv("SSH_ASKPASS"); 41 return askpass_prog && !isatty(STDIN_FILENO) && getenv("DISPLAY"); 42 } 43 44 /* returns a statically allocated password from a helper app, or NULL 45 * on failure */ gui_getpass(const char * prompt)46 static char *gui_getpass(const char *prompt) { 47 48 pid_t pid; 49 int p[2], maxlen, len, status; 50 static char buf[DROPBEAR_MAX_CLI_PASS + 1]; 51 char* helper = NULL; 52 53 TRACE(("enter gui_getpass")) 54 55 helper = getenv("SSH_ASKPASS"); 56 if (!helper) 57 { 58 TRACE(("leave gui_getpass: no askpass program")) 59 return NULL; 60 } 61 62 if (pipe(p) < 0) { 63 TRACE(("error creating child pipe")) 64 return NULL; 65 } 66 67 pid = fork(); 68 69 if (pid < 0) { 70 TRACE(("fork error")) 71 return NULL; 72 } 73 74 if (!pid) { 75 /* child */ 76 close(p[0]); 77 if (dup2(p[1], STDOUT_FILENO) < 0) { 78 TRACE(("error redirecting stdout")) 79 exit(1); 80 } 81 close(p[1]); 82 execlp(helper, helper, prompt, (char *)0); 83 TRACE(("execlp error")) 84 exit(1); 85 } 86 87 close(p[1]); 88 maxlen = sizeof(buf); 89 while (maxlen > 0) { 90 len = read(p[0], buf + sizeof(buf) - maxlen, maxlen); 91 if (len > 0) { 92 maxlen -= len; 93 } else { 94 if (errno != EINTR) 95 break; 96 } 97 } 98 99 close(p[0]); 100 101 while (waitpid(pid, &status, 0) < 0 && errno == EINTR) 102 ; 103 if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) 104 return(NULL); 105 106 len = sizeof(buf) - maxlen; 107 buf[len] = '\0'; 108 if (len > 0 && buf[len - 1] == '\n') 109 buf[len - 1] = '\0'; 110 111 TRACE(("leave gui_getpass")) 112 return(buf); 113 } 114 #endif /* ENABLE_CLI_ASKPASS_HELPER */ 115 cli_auth_password()116 void cli_auth_password() { 117 118 char* password = NULL; 119 char prompt[80]; 120 121 TRACE(("enter cli_auth_password")) 122 CHECKCLEARTOWRITE(); 123 124 snprintf(prompt, sizeof(prompt), "%s@%s's password: ", 125 cli_opts.username, cli_opts.remotehost); 126 #ifdef ENABLE_CLI_ASKPASS_HELPER 127 if (want_askpass()) 128 password = gui_getpass(prompt); 129 else 130 #endif 131 password = getpass_or_cancel(prompt); 132 133 buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_REQUEST); 134 135 buf_putstring(ses.writepayload, cli_opts.username, 136 strlen(cli_opts.username)); 137 138 buf_putstring(ses.writepayload, SSH_SERVICE_CONNECTION, 139 SSH_SERVICE_CONNECTION_LEN); 140 141 buf_putstring(ses.writepayload, AUTH_METHOD_PASSWORD, 142 AUTH_METHOD_PASSWORD_LEN); 143 144 buf_putbyte(ses.writepayload, 0); /* FALSE - so says the spec */ 145 146 buf_putstring(ses.writepayload, password, strlen(password)); 147 148 encrypt_packet(); 149 m_burn(password, strlen(password)); 150 151 TRACE(("leave cli_auth_password")) 152 } 153 #endif /* ENABLE_CLI_PASSWORD_AUTH */ 154