openpam_ttyconv.c revision 123394
1/*-
2 * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by ThinkSec AS and
6 * Network Associates Laboratories, the Security Research Division of
7 * Network Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
8 * ("CBOSS"), as part of the DARPA CHATS research program.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 * 3. The name of the author may not be used to endorse or promote
19 *    products derived from this software without specific prior written
20 *    permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * $P4: //depot/projects/openpam/lib/openpam_ttyconv.c#24 $
35 */
36
37#include <sys/types.h>
38
39#include <ctype.h>
40#include <errno.h>
41#include <setjmp.h>
42#include <signal.h>
43#include <stdio.h>
44#include <stdlib.h>
45#include <string.h>
46#include <termios.h>
47#include <unistd.h>
48
49#include <security/pam_appl.h>
50
51#include "openpam_impl.h"
52
53int openpam_ttyconv_timeout = 0;
54
55static void
56timeout(int sig)
57{
58
59	(void)sig;
60}
61
62static char *
63prompt(const char *msg)
64{
65	char buf[PAM_MAX_RESP_SIZE];
66	struct sigaction action, saved_action;
67	sigset_t saved_sigset, sigset;
68	unsigned int saved_alarm;
69	int eof, error, fd, timed_out;
70	size_t len;
71	char *retval;
72	char ch;
73
74	sigemptyset(&sigset);
75	sigaddset(&sigset, SIGINT);
76	sigaddset(&sigset, SIGTSTP);
77	sigprocmask(SIG_SETMASK, &sigset, &saved_sigset);
78	action.sa_handler = &timeout;
79	action.sa_flags = 0;
80	sigemptyset(&action.sa_mask);
81	sigaction(SIGALRM, &action, &saved_action);
82	fputs(msg, stdout);
83	fflush(stdout);
84#ifdef HAVE_FPURGE
85	fpurge(stdin);
86#endif
87	fd = fileno(stdin);
88	buf[0] = '\0';
89	timed_out = 0;
90	eof = error = timed_out = 0;
91	saved_alarm = alarm(openpam_ttyconv_timeout);
92	ch = '\0';
93	for (len = 0; ch != '\n' && !eof && !error; ++len) {
94		switch (read(fd, &ch, 1)) {
95		case 1:
96			if (len < PAM_MAX_RESP_SIZE - 1) {
97				buf[len + 1] = '\0';
98				buf[len] = ch;
99			}
100			break;
101		case 0:
102			eof = 1;
103			break;
104		default:
105			error = errno;
106			break;
107		}
108	}
109	alarm(0);
110	sigaction(SIGALRM, &saved_action, NULL);
111	sigprocmask(SIG_SETMASK, &saved_sigset, NULL);
112	alarm(saved_alarm);
113	if (error == EINTR)
114		fputs(" timeout!", stderr);
115	if (error || eof) {
116		fputs("\n", stderr);
117		memset(buf, 0, sizeof(buf));
118		return (NULL);
119	}
120	/* trim trailing whitespace */
121	for (len = strlen(buf); len > 0; --len)
122		if (buf[len - 1] != '\r' && buf[len - 1] != '\n')
123			break;
124	buf[len] = '\0';
125	retval = strdup(buf);
126	memset(buf, 0, sizeof(buf));
127	return (retval);
128}
129
130static char *
131prompt_echo_off(const char *msg)
132{
133	struct termios tattr;
134	tcflag_t lflag;
135	char *ret;
136	int fd;
137
138	fd = fileno(stdin);
139	if (tcgetattr(fd, &tattr) != 0) {
140		openpam_log(PAM_LOG_ERROR, "tcgetattr(): %m");
141		return (NULL);
142	}
143	lflag = tattr.c_lflag;
144	tattr.c_lflag &= ~ECHO;
145	if (tcsetattr(fd, TCSAFLUSH, &tattr) != 0) {
146		openpam_log(PAM_LOG_ERROR, "tcsetattr(): %m");
147		return (NULL);
148	}
149	ret = prompt(msg);
150	tattr.c_lflag = lflag;
151	(void)tcsetattr(fd, TCSANOW, &tattr);
152	if (ret != NULL)
153		fputs("\n", stdout);
154	return (ret);
155}
156
157/*
158 * OpenPAM extension
159 *
160 * Simple tty-based conversation function
161 */
162
163int
164openpam_ttyconv(int n,
165	 const struct pam_message **msg,
166	 struct pam_response **resp,
167	 void *data)
168{
169	struct pam_response *aresp;
170	int i;
171
172	ENTER();
173	(void)data;
174	if (n <= 0 || n > PAM_MAX_NUM_MSG)
175		RETURNC(PAM_CONV_ERR);
176	if ((aresp = calloc(n, sizeof *aresp)) == NULL)
177		RETURNC(PAM_BUF_ERR);
178	for (i = 0; i < n; ++i) {
179		aresp[i].resp_retcode = 0;
180		aresp[i].resp = NULL;
181		switch (msg[i]->msg_style) {
182		case PAM_PROMPT_ECHO_OFF:
183			aresp[i].resp = prompt_echo_off(msg[i]->msg);
184			if (aresp[i].resp == NULL)
185				goto fail;
186			break;
187		case PAM_PROMPT_ECHO_ON:
188			aresp[i].resp = prompt(msg[i]->msg);
189			if (aresp[i].resp == NULL)
190				goto fail;
191			break;
192		case PAM_ERROR_MSG:
193			fputs(msg[i]->msg, stderr);
194			if (strlen(msg[i]->msg) > 0 &&
195			    msg[i]->msg[strlen(msg[i]->msg) - 1] != '\n')
196				fputc('\n', stderr);
197			break;
198		case PAM_TEXT_INFO:
199			fputs(msg[i]->msg, stdout);
200			if (strlen(msg[i]->msg) > 0 &&
201			    msg[i]->msg[strlen(msg[i]->msg) - 1] != '\n')
202				fputc('\n', stdout);
203			break;
204		default:
205			goto fail;
206		}
207	}
208	*resp = aresp;
209	RETURNC(PAM_SUCCESS);
210 fail:
211	for (i = 0; i < n; ++i) {
212		if (aresp[i].resp != NULL) {
213			memset(aresp[i].resp, 0, strlen(aresp[i].resp));
214			FREE(aresp[i].resp);
215		}
216	}
217	memset(aresp, 0, n * sizeof *aresp);
218	FREE(aresp);
219	*resp = NULL;
220	RETURNC(PAM_CONV_ERR);
221}
222
223/*
224 * Error codes:
225 *
226 *	PAM_SYSTEM_ERR
227 *	PAM_BUF_ERR
228 *	PAM_CONV_ERR
229 */
230
231/**
232 * The =openpam_ttyconv function is a standard conversation function
233 * suitable for use on TTY devices.  It should be adequate for the needs
234 * of most text-based interactive programs.
235 *
236 * The =openpam_ttyconv function allows the application to specify a
237 * timeout for user input by setting the global integer variable
238 * :openpam_ttyconv_timeout to the length of the timeout in seconds.
239 *
240 * >openpam_nullconv
241 * >pam_prompt
242 * >pam_vprompt
243 */
244