17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * passprompt.c - pppd plugin to invoke an external PAP password prompter
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * Copyright 1999 Paul Mackerras, Alan Curry.
57c478bd9Sstevel@tonic-gate *
67c478bd9Sstevel@tonic-gate * This program is free software; you can redistribute it and/or
77c478bd9Sstevel@tonic-gate * modify it under the terms of the GNU General Public License
87c478bd9Sstevel@tonic-gate * as published by the Free Software Foundation; either version
97c478bd9Sstevel@tonic-gate * 2 of the License, or (at your option) any later version.
107c478bd9Sstevel@tonic-gate */
11*cbf54fedSJohn Levon
12*cbf54fedSJohn Levon /*
13*cbf54fedSJohn Levon * Copyright (c) 2018, Joyent, Inc.
14*cbf54fedSJohn Levon */
15*cbf54fedSJohn Levon
167c478bd9Sstevel@tonic-gate #include <errno.h>
177c478bd9Sstevel@tonic-gate #include <unistd.h>
187c478bd9Sstevel@tonic-gate #include <fcntl.h>
197c478bd9Sstevel@tonic-gate #include <sys/wait.h>
207c478bd9Sstevel@tonic-gate #include <syslog.h>
217c478bd9Sstevel@tonic-gate #include "pppd.h"
227c478bd9Sstevel@tonic-gate
237c478bd9Sstevel@tonic-gate static char promptprog[PATH_MAX+1];
247c478bd9Sstevel@tonic-gate
257c478bd9Sstevel@tonic-gate static option_t options[] = {
267c478bd9Sstevel@tonic-gate { "promptprog", o_string, promptprog,
277c478bd9Sstevel@tonic-gate "External PAP password prompting program",
287c478bd9Sstevel@tonic-gate OPT_STATIC, NULL, PATH_MAX },
297c478bd9Sstevel@tonic-gate { NULL }
307c478bd9Sstevel@tonic-gate };
317c478bd9Sstevel@tonic-gate
promptpass(char * user,char * passwd)327c478bd9Sstevel@tonic-gate static int promptpass(char *user, char *passwd)
337c478bd9Sstevel@tonic-gate {
347c478bd9Sstevel@tonic-gate int p[2];
357c478bd9Sstevel@tonic-gate pid_t kid;
367c478bd9Sstevel@tonic-gate int readgood, wstat;
377c478bd9Sstevel@tonic-gate int red;
387c478bd9Sstevel@tonic-gate
397c478bd9Sstevel@tonic-gate if (promptprog[0] == 0 || access(promptprog, X_OK) < 0)
407c478bd9Sstevel@tonic-gate return -1; /* sorry, can't help */
417c478bd9Sstevel@tonic-gate
427c478bd9Sstevel@tonic-gate /* This occurs when we're probed for the ability to supply a password */
437c478bd9Sstevel@tonic-gate if (user != NULL && passwd == NULL)
447c478bd9Sstevel@tonic-gate return 1;
457c478bd9Sstevel@tonic-gate
467c478bd9Sstevel@tonic-gate if (pipe(p)) {
477c478bd9Sstevel@tonic-gate warn("Can't make a pipe for %s", promptprog);
487c478bd9Sstevel@tonic-gate return 0;
497c478bd9Sstevel@tonic-gate }
507c478bd9Sstevel@tonic-gate if ((kid = fork()) == (pid_t) -1) {
517c478bd9Sstevel@tonic-gate warn("Can't fork to run %s", promptprog);
527c478bd9Sstevel@tonic-gate (void) close(p[0]);
537c478bd9Sstevel@tonic-gate (void) close(p[1]);
547c478bd9Sstevel@tonic-gate return 0;
557c478bd9Sstevel@tonic-gate }
567c478bd9Sstevel@tonic-gate if (kid == (pid_t)0) {
577c478bd9Sstevel@tonic-gate /* we are the child, exec the program */
587c478bd9Sstevel@tonic-gate char *argv[5], fdstr[32];
597c478bd9Sstevel@tonic-gate
607c478bd9Sstevel@tonic-gate sys_close();
617c478bd9Sstevel@tonic-gate closelog();
627c478bd9Sstevel@tonic-gate if (detached && p[1] <= 2) {
637c478bd9Sstevel@tonic-gate (void) dup2(p[1], 3);
647c478bd9Sstevel@tonic-gate p[1] = 3;
657c478bd9Sstevel@tonic-gate }
667c478bd9Sstevel@tonic-gate (void) close(p[0]);
677c478bd9Sstevel@tonic-gate if (detached) {
687c478bd9Sstevel@tonic-gate red = open("/etc/ppp/prompt-errors", O_WRONLY | O_APPEND | O_CREAT,
697c478bd9Sstevel@tonic-gate 0600);
707c478bd9Sstevel@tonic-gate (void) dup2(red, 1);
717c478bd9Sstevel@tonic-gate (void) dup2(red, 2);
727c478bd9Sstevel@tonic-gate }
737c478bd9Sstevel@tonic-gate (void) seteuid(getuid());
747c478bd9Sstevel@tonic-gate (void) setegid(getgid());
757c478bd9Sstevel@tonic-gate argv[0] = promptprog;
767c478bd9Sstevel@tonic-gate argv[1] = user == NULL ? "" : user;
777c478bd9Sstevel@tonic-gate argv[2] = remote_name;
78*cbf54fedSJohn Levon (void) slprintf(fdstr, sizeof (fdstr), "%d", p[1]);
797c478bd9Sstevel@tonic-gate argv[3] = fdstr;
807c478bd9Sstevel@tonic-gate argv[4] = NULL;
817c478bd9Sstevel@tonic-gate (void) execv(*argv, argv);
827c478bd9Sstevel@tonic-gate _exit(127);
837c478bd9Sstevel@tonic-gate }
847c478bd9Sstevel@tonic-gate
857c478bd9Sstevel@tonic-gate /* we are the parent, read the password from the pipe */
867c478bd9Sstevel@tonic-gate (void) close(p[1]);
877c478bd9Sstevel@tonic-gate readgood = 0;
887c478bd9Sstevel@tonic-gate do {
897c478bd9Sstevel@tonic-gate red = read(p[0], passwd + readgood, MAXSECRETLEN-1 - readgood);
907c478bd9Sstevel@tonic-gate if (red == 0)
917c478bd9Sstevel@tonic-gate break;
927c478bd9Sstevel@tonic-gate if (red < 0) {
937c478bd9Sstevel@tonic-gate if (errno == EINTR)
947c478bd9Sstevel@tonic-gate continue;
957c478bd9Sstevel@tonic-gate error("Can't read secret from %s: %m", promptprog);
967c478bd9Sstevel@tonic-gate readgood = -1;
977c478bd9Sstevel@tonic-gate break;
987c478bd9Sstevel@tonic-gate }
997c478bd9Sstevel@tonic-gate readgood += red;
1007c478bd9Sstevel@tonic-gate } while (readgood < MAXSECRETLEN - 1);
1017c478bd9Sstevel@tonic-gate passwd[readgood] = 0;
1027c478bd9Sstevel@tonic-gate (void) close(p[0]);
1037c478bd9Sstevel@tonic-gate
1047c478bd9Sstevel@tonic-gate /* now wait for child to exit */
1057c478bd9Sstevel@tonic-gate while (waitpid(kid, &wstat, 0) < 0) {
1067c478bd9Sstevel@tonic-gate if (errno != EINTR) {
1077c478bd9Sstevel@tonic-gate warn("error waiting for %s: %m", promptprog);
1087c478bd9Sstevel@tonic-gate break;
1097c478bd9Sstevel@tonic-gate }
1107c478bd9Sstevel@tonic-gate }
1117c478bd9Sstevel@tonic-gate
1127c478bd9Sstevel@tonic-gate if (readgood < 0)
1137c478bd9Sstevel@tonic-gate return 0;
1147c478bd9Sstevel@tonic-gate if (readgood > 0 && passwd[--readgood] == '\n')
1157c478bd9Sstevel@tonic-gate passwd[readgood] = '\0';
1167c478bd9Sstevel@tonic-gate if (!WIFEXITED(wstat))
1177c478bd9Sstevel@tonic-gate warn("%s terminated abnormally", promptprog);
1187c478bd9Sstevel@tonic-gate if (WEXITSTATUS(wstat) != 0)
1197c478bd9Sstevel@tonic-gate warn("%s exited with code %d", promptprog, WEXITSTATUS(wstat));
1207c478bd9Sstevel@tonic-gate
1217c478bd9Sstevel@tonic-gate return 1;
1227c478bd9Sstevel@tonic-gate }
1237c478bd9Sstevel@tonic-gate
plugin_init(void)1247c478bd9Sstevel@tonic-gate void plugin_init(void)
1257c478bd9Sstevel@tonic-gate {
1267c478bd9Sstevel@tonic-gate add_options(options);
1277c478bd9Sstevel@tonic-gate pap_passwd_hook = promptpass;
1287c478bd9Sstevel@tonic-gate }
129