1 /* 2 * Copyright (c) 2000-2002 Damien Miller. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 23 */ 24 25 /* GTK2 support by Nalin Dahyabhai <nalin@redhat.com> */ 26 27 /* 28 * This is a simple GNOME SSH passphrase grabber. To use it, set the 29 * environment variable SSH_ASKPASS to point to the location of 30 * gnome-ssh-askpass before calling "ssh-add < /dev/null". 31 * 32 * There is only two run-time options: if you set the environment variable 33 * "GNOME_SSH_ASKPASS_GRAB_SERVER=true" then gnome-ssh-askpass will grab 34 * the X server. If you set "GNOME_SSH_ASKPASS_GRAB_POINTER=true", then the 35 * pointer will be grabbed too. These may have some benefit to security if 36 * you don't trust your X server. We grab the keyboard always. 37 */ 38 39 #define GRAB_TRIES 16 40 #define GRAB_WAIT 250 /* milliseconds */ 41 42 #define PROMPT_ENTRY 0 43 #define PROMPT_CONFIRM 1 44 #define PROMPT_NONE 2 45 46 /* 47 * Compile with: 48 * 49 * cc -Wall `pkg-config --cflags gtk+-2.0` \ 50 * gnome-ssh-askpass2.c -o gnome-ssh-askpass \ 51 * `pkg-config --libs gtk+-2.0` 52 * 53 */ 54 55 #include <stdlib.h> 56 #include <stdio.h> 57 #include <string.h> 58 #include <unistd.h> 59 60 #include <X11/Xlib.h> 61 #include <gtk/gtk.h> 62 #include <gdk/gdkx.h> 63 #include <gdk/gdkkeysyms.h> 64 65 static void 66 report_failed_grab (GtkWidget *parent_window, const char *what) 67 { 68 GtkWidget *err; 69 70 err = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0, 71 GTK_MESSAGE_ERROR, GTK_BUTTONS_CLOSE, 72 "Could not grab %s. A malicious client may be eavesdropping " 73 "on your session.", what); 74 gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER); 75 76 gtk_dialog_run(GTK_DIALOG(err)); 77 78 gtk_widget_destroy(err); 79 } 80 81 static void 82 ok_dialog(GtkWidget *entry, gpointer dialog) 83 { 84 g_return_if_fail(GTK_IS_DIALOG(dialog)); 85 gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK); 86 } 87 88 static gboolean 89 check_none(GtkWidget *widget, GdkEventKey *event, gpointer dialog) 90 { 91 switch (event->keyval) { 92 case GDK_KEY_Escape: 93 /* esc -> close dialog */ 94 gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_CLOSE); 95 return TRUE; 96 case GDK_KEY_Tab: 97 /* tab -> focus close button */ 98 gtk_widget_grab_focus(gtk_dialog_get_widget_for_response( 99 dialog, GTK_RESPONSE_CLOSE)); 100 return TRUE; 101 default: 102 /* eat all other key events */ 103 return TRUE; 104 } 105 } 106 107 static int 108 parse_env_hex_color(const char *env, GdkColor *c) 109 { 110 const char *s; 111 unsigned long ul; 112 char *ep; 113 size_t n; 114 115 if ((s = getenv(env)) == NULL) 116 return 0; 117 118 memset(c, 0, sizeof(*c)); 119 120 /* Permit hex rgb or rrggbb optionally prefixed by '#' or '0x' */ 121 if (*s == '#') 122 s++; 123 else if (strncmp(s, "0x", 2) == 0) 124 s += 2; 125 n = strlen(s); 126 if (n != 3 && n != 6) 127 goto bad; 128 ul = strtoul(s, &ep, 16); 129 if (*ep != '\0' || ul > 0xffffff) { 130 bad: 131 fprintf(stderr, "Invalid $%s - invalid hex color code\n", env); 132 return 0; 133 } 134 /* Valid hex sequence; expand into a GdkColor */ 135 if (n == 3) { 136 /* 4-bit RGB */ 137 c->red = ((ul >> 8) & 0xf) << 12; 138 c->green = ((ul >> 4) & 0xf) << 12; 139 c->blue = (ul & 0xf) << 12; 140 } else { 141 /* 8-bit RGB */ 142 c->red = ((ul >> 16) & 0xff) << 8; 143 c->green = ((ul >> 8) & 0xff) << 8; 144 c->blue = (ul & 0xff) << 8; 145 } 146 return 1; 147 } 148 149 static int 150 passphrase_dialog(char *message, int prompt_type) 151 { 152 const char *failed; 153 char *passphrase, *local; 154 int result, grab_tries, grab_server, grab_pointer; 155 int buttons, default_response; 156 GtkWidget *parent_window, *dialog, *entry; 157 GdkGrabStatus status; 158 GdkColor fg, bg; 159 int fg_set = 0, bg_set = 0; 160 161 grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL); 162 grab_pointer = (getenv("GNOME_SSH_ASKPASS_GRAB_POINTER") != NULL); 163 grab_tries = 0; 164 165 fg_set = parse_env_hex_color("GNOME_SSH_ASKPASS_FG_COLOR", &fg); 166 bg_set = parse_env_hex_color("GNOME_SSH_ASKPASS_BG_COLOR", &bg); 167 168 /* Create an invisible parent window so that GtkDialog doesn't 169 * complain. */ 170 parent_window = gtk_window_new(GTK_WINDOW_TOPLEVEL); 171 172 switch (prompt_type) { 173 case PROMPT_CONFIRM: 174 buttons = GTK_BUTTONS_YES_NO; 175 default_response = GTK_RESPONSE_YES; 176 break; 177 case PROMPT_NONE: 178 buttons = GTK_BUTTONS_CLOSE; 179 default_response = GTK_RESPONSE_CLOSE; 180 break; 181 default: 182 buttons = GTK_BUTTONS_OK_CANCEL; 183 default_response = GTK_RESPONSE_OK; 184 break; 185 } 186 187 dialog = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0, 188 GTK_MESSAGE_QUESTION, buttons, "%s", message); 189 190 gtk_window_set_title(GTK_WINDOW(dialog), "OpenSSH"); 191 gtk_window_set_position (GTK_WINDOW(dialog), GTK_WIN_POS_CENTER); 192 gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE); 193 gtk_dialog_set_default_response(GTK_DIALOG(dialog), default_response); 194 gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE); 195 196 if (fg_set) 197 gtk_widget_modify_fg(dialog, GTK_STATE_NORMAL, &fg); 198 if (bg_set) 199 gtk_widget_modify_bg(dialog, GTK_STATE_NORMAL, &bg); 200 201 if (prompt_type == PROMPT_ENTRY || prompt_type == PROMPT_NONE) { 202 entry = gtk_entry_new(); 203 if (fg_set) 204 gtk_widget_modify_fg(entry, GTK_STATE_NORMAL, &fg); 205 if (bg_set) 206 gtk_widget_modify_bg(entry, GTK_STATE_NORMAL, &bg); 207 gtk_box_pack_start( 208 GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))), 209 entry, FALSE, FALSE, 0); 210 gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE); 211 gtk_widget_grab_focus(entry); 212 if (prompt_type == PROMPT_ENTRY) { 213 gtk_widget_show(entry); 214 /* Make <enter> close dialog */ 215 g_signal_connect(G_OBJECT(entry), "activate", 216 G_CALLBACK(ok_dialog), dialog); 217 } else { 218 /* 219 * Ensure the 'close' button is not focused by default 220 * but is still reachable via tab. This is a bit of a 221 * hack - it uses a hidden entry that responds to a 222 * couple of keypress events (escape and tab only). 223 */ 224 gtk_widget_realize(entry); 225 g_signal_connect(G_OBJECT(entry), "key_press_event", 226 G_CALLBACK(check_none), dialog); 227 } 228 } 229 230 /* Grab focus */ 231 gtk_widget_show_now(dialog); 232 if (grab_pointer) { 233 for(;;) { 234 status = gdk_pointer_grab( 235 (gtk_widget_get_window(GTK_WIDGET(dialog))), TRUE, 236 0, NULL, NULL, GDK_CURRENT_TIME); 237 if (status == GDK_GRAB_SUCCESS) 238 break; 239 usleep(GRAB_WAIT * 1000); 240 if (++grab_tries > GRAB_TRIES) { 241 failed = "mouse"; 242 goto nograb; 243 } 244 } 245 } 246 for(;;) { 247 status = gdk_keyboard_grab( 248 gtk_widget_get_window(GTK_WIDGET(dialog)), FALSE, 249 GDK_CURRENT_TIME); 250 if (status == GDK_GRAB_SUCCESS) 251 break; 252 usleep(GRAB_WAIT * 1000); 253 if (++grab_tries > GRAB_TRIES) { 254 failed = "keyboard"; 255 goto nograbkb; 256 } 257 } 258 if (grab_server) { 259 gdk_x11_grab_server(); 260 } 261 262 result = gtk_dialog_run(GTK_DIALOG(dialog)); 263 264 /* Ungrab */ 265 if (grab_server) 266 XUngrabServer(gdk_x11_get_default_xdisplay()); 267 if (grab_pointer) 268 gdk_pointer_ungrab(GDK_CURRENT_TIME); 269 gdk_keyboard_ungrab(GDK_CURRENT_TIME); 270 gdk_flush(); 271 272 /* Report passphrase if user selected OK */ 273 if (prompt_type == PROMPT_ENTRY) { 274 passphrase = g_strdup(gtk_entry_get_text(GTK_ENTRY(entry))); 275 if (result == GTK_RESPONSE_OK) { 276 local = g_locale_from_utf8(passphrase, 277 strlen(passphrase), NULL, NULL, NULL); 278 if (local != NULL) { 279 puts(local); 280 memset(local, '\0', strlen(local)); 281 g_free(local); 282 } else { 283 puts(passphrase); 284 } 285 } 286 /* Zero passphrase in memory */ 287 memset(passphrase, '\b', strlen(passphrase)); 288 gtk_entry_set_text(GTK_ENTRY(entry), passphrase); 289 memset(passphrase, '\0', strlen(passphrase)); 290 g_free(passphrase); 291 } 292 293 gtk_widget_destroy(dialog); 294 if (result != GTK_RESPONSE_OK && result != GTK_RESPONSE_YES) 295 return -1; 296 return 0; 297 298 nograbkb: 299 /* 300 * At least one grab failed - ungrab what we got, and report 301 * the failure to the user. Note that XGrabServer() cannot 302 * fail. 303 */ 304 gdk_pointer_ungrab(GDK_CURRENT_TIME); 305 nograb: 306 if (grab_server) 307 XUngrabServer(gdk_x11_get_default_xdisplay()); 308 gtk_widget_destroy(dialog); 309 310 report_failed_grab(parent_window, failed); 311 312 return (-1); 313 } 314 315 int 316 main(int argc, char **argv) 317 { 318 char *message, *prompt_mode; 319 int result, prompt_type = PROMPT_ENTRY; 320 321 gtk_init(&argc, &argv); 322 323 if (argc > 1) { 324 message = g_strjoinv(" ", argv + 1); 325 } else { 326 message = g_strdup("Enter your OpenSSH passphrase:"); 327 } 328 329 if ((prompt_mode = getenv("SSH_ASKPASS_PROMPT")) != NULL) { 330 if (strcasecmp(prompt_mode, "confirm") == 0) 331 prompt_type = PROMPT_CONFIRM; 332 else if (strcasecmp(prompt_mode, "none") == 0) 333 prompt_type = PROMPT_NONE; 334 } 335 336 setvbuf(stdout, 0, _IONBF, 0); 337 result = passphrase_dialog(message, prompt_type); 338 g_free(message); 339 340 return (result); 341 } 342