xref: /freebsd/contrib/libarchive/libarchive_fe/passphrase.c (revision 59c8e88e72633afbc47a4ace0d2170d00d51f7dc)
1 /*-
2  * Copyright (c) 2014 Michihiro NAKAJIMA
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer
10  *    in this position and unchanged.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 /*	$OpenBSD: readpassphrase.c,v 1.27 2019/01/25 00:19:25 millert Exp $	*/
27 
28 /*
29  * Copyright (c) 2000-2002, 2007, 2010
30  * 	Todd C. Miller <millert@openbsd.org>
31  *
32  * Permission to use, copy, modify, and distribute this software for any
33  * purpose with or without fee is hereby granted, provided that the above
34  * copyright notice and this permission notice appear in all copies.
35  *
36  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
37  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
38  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
39  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
40  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
41  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
42  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
43  *
44  * Sponsored in part by the Defense Advanced Research Projects
45  * Agency (DARPA) and Air Force Research Laboratory, Air Force
46  * Materiel Command, USAF, under agreement number F39502-99-1-0512.
47  */
48 
49 /* OPENBSD ORIGINAL: lib/libc/gen/readpassphrase.c */
50 
51 
52 #include "lafe_platform.h"
53 __FBSDID("$FreeBSD$");
54 
55 #include <errno.h>
56 #ifdef HAVE_STDLIB_H
57 #include <stdlib.h>
58 #endif
59 #ifdef HAVE_UNISTD_H
60 #include <unistd.h>
61 #endif
62 #ifdef HAVE_READPASSPHRASE_H
63 #include <readpassphrase.h>
64 #endif
65 
66 #include "err.h"
67 #include "passphrase.h"
68 
69 #ifndef HAVE_READPASSPHRASE
70 
71 #define RPP_ECHO_OFF    0x00		/* Turn off echo (default). */
72 #define RPP_ECHO_ON     0x01		/* Leave echo on. */
73 #define RPP_REQUIRE_TTY 0x02		/* Fail if there is no tty. */
74 #define RPP_FORCELOWER  0x04		/* Force input to lower case. */
75 #define RPP_FORCEUPPER  0x08		/* Force input to upper case. */
76 #define RPP_SEVENBIT    0x10		/* Strip the high bit from input. */
77 #define RPP_STDIN       0x20		/* Read from stdin, not /dev/tty */
78 
79 
80 #if defined(_WIN32) && !defined(__CYGWIN__)
81 #include <windows.h>
82 
83 static char *
84 readpassphrase(const char *prompt, char *buf, size_t bufsiz, int flags)
85 {
86 	HANDLE hStdin, hStdout;
87 	DWORD mode, rbytes;
88 	BOOL success;
89 
90 	(void)flags;
91 
92 	hStdin = GetStdHandle(STD_INPUT_HANDLE);
93 	if (hStdin == INVALID_HANDLE_VALUE)
94 		return (NULL);
95 	hStdout = GetStdHandle(STD_OUTPUT_HANDLE);
96 	if (hStdout == INVALID_HANDLE_VALUE)
97 		return (NULL);
98 
99 	success = GetConsoleMode(hStdin, &mode);
100 	if (!success)
101 		return (NULL);
102 	mode &= ~ENABLE_ECHO_INPUT;
103 	mode |= ENABLE_LINE_INPUT | ENABLE_PROCESSED_INPUT;
104 	success = SetConsoleMode(hStdin, mode);
105 	if (!success)
106 		return (NULL);
107 
108 	success = WriteFile(hStdout, prompt, (DWORD)strlen(prompt),
109 		NULL, NULL);
110 	if (!success)
111 		return (NULL);
112 	success = ReadFile(hStdin, buf, (DWORD)bufsiz - 1, &rbytes, NULL);
113 	if (!success)
114 		return (NULL);
115 	WriteFile(hStdout, "\r\n", 2, NULL, NULL);
116 	buf[rbytes] = '\0';
117 	/* Remove trailing carriage return(s). */
118 	if (rbytes > 2 && buf[rbytes - 2] == '\r' && buf[rbytes - 1] == '\n')
119 		buf[rbytes - 2] = '\0';
120 
121 	return (buf);
122 }
123 
124 #else /* _WIN32 && !__CYGWIN__ */
125 
126 #include <assert.h>
127 #include <ctype.h>
128 #include <fcntl.h>
129 #ifdef HAVE_PATHS_H
130 #include <paths.h>
131 #endif
132 #include <signal.h>
133 #include <string.h>
134 #include <termios.h>
135 #include <unistd.h>
136 
137 #ifndef _PATH_TTY
138 #define _PATH_TTY "/dev/tty"
139 #endif
140 
141 #ifdef TCSASOFT
142 # define _T_FLUSH	(TCSAFLUSH|TCSASOFT)
143 #else
144 # define _T_FLUSH	(TCSAFLUSH)
145 #endif
146 
147 /* SunOS 4.x which lacks _POSIX_VDISABLE, but has VDISABLE */
148 #if !defined(_POSIX_VDISABLE) && defined(VDISABLE)
149 #  define _POSIX_VDISABLE       VDISABLE
150 #endif
151 
152 #define M(a,b) (a > b ? a : b)
153 #define MAX_SIGNO M(M(M(SIGALRM, SIGHUP), \
154                       M(SIGINT, SIGPIPE)), \
155                     M(M(SIGQUIT, SIGTERM), \
156                       M(M(SIGTSTP, SIGTTIN), SIGTTOU)))
157 
158 static volatile sig_atomic_t signo[MAX_SIGNO + 1];
159 
160 static void
161 handler(int s)
162 {
163 	assert(s <= MAX_SIGNO);
164 	signo[s] = 1;
165 }
166 
167 static char *
168 readpassphrase(const char *prompt, char *buf, size_t bufsiz, int flags)
169 {
170 	ssize_t nr;
171 	int input, output, save_errno, i, need_restart;
172 	char ch, *p, *end;
173 	struct termios term, oterm;
174 #ifdef HAVE_SIGACTION
175 	struct sigaction sa, savealrm, saveint, savehup, savequit, saveterm;
176 	struct sigaction savetstp, savettin, savettou, savepipe;
177 #endif
178 
179 	/* I suppose we could alloc on demand in this case (XXX). */
180 	if (bufsiz == 0) {
181 		errno = EINVAL;
182 		return(NULL);
183 	}
184 
185 restart:
186 	for (i = 0; i <= MAX_SIGNO; i++)
187 		signo[i] = 0;
188 	nr = -1;
189 	save_errno = 0;
190 	need_restart = 0;
191 	/*
192 	 * Read and write to /dev/tty if available.  If not, read from
193 	 * stdin and write to stderr unless a tty is required.
194 	 */
195 	if ((flags & RPP_STDIN) ||
196 	    (input = output = open(_PATH_TTY, O_RDWR)) == -1) {
197 		if (flags & RPP_REQUIRE_TTY) {
198 			errno = ENOTTY;
199 			return(NULL);
200 		}
201 		input = STDIN_FILENO;
202 		output = STDERR_FILENO;
203 	}
204 
205 	/*
206 	 * Turn off echo if possible.
207 	 * If we are using a tty but are not the foreground pgrp this will
208 	 * generate SIGTTOU, so do it *before* installing the signal handlers.
209 	 */
210 	if (input != STDIN_FILENO && tcgetattr(input, &oterm) == 0) {
211 		memcpy(&term, &oterm, sizeof(term));
212 		if (!(flags & RPP_ECHO_ON))
213 			term.c_lflag &= ~(ECHO | ECHONL);
214 #ifdef VSTATUS
215 		if (term.c_cc[VSTATUS] != _POSIX_VDISABLE)
216 			term.c_cc[VSTATUS] = _POSIX_VDISABLE;
217 #endif
218 		(void)tcsetattr(input, _T_FLUSH, &term);
219 	} else {
220 		memset(&term, 0, sizeof(term));
221 		term.c_lflag |= ECHO;
222 		memset(&oterm, 0, sizeof(oterm));
223 		oterm.c_lflag |= ECHO;
224 	}
225 
226 #ifdef HAVE_SIGACTION
227 	/*
228 	 * Catch signals that would otherwise cause the user to end
229 	 * up with echo turned off in the shell.  Don't worry about
230 	 * things like SIGXCPU and SIGVTALRM for now.
231 	 */
232 	sigemptyset(&sa.sa_mask);
233 	sa.sa_flags = 0;		/* don't restart system calls */
234 	sa.sa_handler = handler;
235 	/* Keep this list in sync with MAX_SIGNO! */
236 	(void)sigaction(SIGALRM, &sa, &savealrm);
237 	(void)sigaction(SIGHUP, &sa, &savehup);
238 	(void)sigaction(SIGINT, &sa, &saveint);
239 	(void)sigaction(SIGPIPE, &sa, &savepipe);
240 	(void)sigaction(SIGQUIT, &sa, &savequit);
241 	(void)sigaction(SIGTERM, &sa, &saveterm);
242 	(void)sigaction(SIGTSTP, &sa, &savetstp);
243 	(void)sigaction(SIGTTIN, &sa, &savettin);
244 	(void)sigaction(SIGTTOU, &sa, &savettou);
245 #endif
246 
247 	if (!(flags & RPP_STDIN)) {
248 		int r = write(output, prompt, strlen(prompt));
249 		(void)r;
250 	}
251 	end = buf + bufsiz - 1;
252 	p = buf;
253 	while ((nr = read(input, &ch, 1)) == 1 && ch != '\n' && ch != '\r') {
254 		if (p < end) {
255 			if ((flags & RPP_SEVENBIT))
256 				ch &= 0x7f;
257 			if (isalpha((unsigned char)ch)) {
258 				if ((flags & RPP_FORCELOWER))
259 					ch = (char)tolower((unsigned char)ch);
260 				if ((flags & RPP_FORCEUPPER))
261 					ch = (char)toupper((unsigned char)ch);
262 			}
263 			*p++ = ch;
264 		}
265 	}
266 	*p = '\0';
267 	save_errno = errno;
268 	if (!(term.c_lflag & ECHO)) {
269 		int r = write(output, "\n", 1);
270 		(void)r;
271 	}
272 
273 	/* Restore old terminal settings and signals. */
274 	if (memcmp(&term, &oterm, sizeof(term)) != 0) {
275 		const int sigttou = signo[SIGTTOU];
276 
277 		/* Ignore SIGTTOU generated when we are not the fg pgrp. */
278 		while (tcsetattr(input, _T_FLUSH, &oterm) == -1 &&
279 		    errno == EINTR && !signo[SIGTTOU])
280 			continue;
281 		signo[SIGTTOU] = sigttou;
282 	}
283 #ifdef HAVE_SIGACTION
284 	(void)sigaction(SIGALRM, &savealrm, NULL);
285 	(void)sigaction(SIGHUP, &savehup, NULL);
286 	(void)sigaction(SIGINT, &saveint, NULL);
287 	(void)sigaction(SIGQUIT, &savequit, NULL);
288 	(void)sigaction(SIGPIPE, &savepipe, NULL);
289 	(void)sigaction(SIGTERM, &saveterm, NULL);
290 	(void)sigaction(SIGTSTP, &savetstp, NULL);
291 	(void)sigaction(SIGTTIN, &savettin, NULL);
292 	(void)sigaction(SIGTTOU, &savettou, NULL);
293 #endif
294 	if (input != STDIN_FILENO)
295 		(void)close(input);
296 
297 	/*
298 	 * If we were interrupted by a signal, resend it to ourselves
299 	 * now that we have restored the signal handlers.
300 	 */
301 	for (i = 0; i <= MAX_SIGNO; i++) {
302 		if (signo[i]) {
303 			kill(getpid(), i);
304 			switch (i) {
305 			case SIGTSTP:
306 			case SIGTTIN:
307 			case SIGTTOU:
308 				need_restart = 1;
309 			}
310 		}
311 	}
312 	if (need_restart)
313 		goto restart;
314 
315 	if (save_errno)
316 		errno = save_errno;
317 	return(nr == -1 ? NULL : buf);
318 }
319 #endif /* _WIN32 && !__CYGWIN__ */
320 #endif /* HAVE_READPASSPHRASE */
321 
322 char *
323 lafe_readpassphrase(const char *prompt, char *buf, size_t bufsiz)
324 {
325 	char *p;
326 
327 	p = readpassphrase(prompt, buf, bufsiz, RPP_ECHO_OFF);
328 	if (p == NULL) {
329 		switch (errno) {
330 		case EINTR:
331 			break;
332 		default:
333 			lafe_errc(1, errno, "Couldn't read passphrase");
334 			break;
335 		}
336 	}
337 	return (p);
338 }
339 
340