1/*
2 * Copyright (c) 2000-2002 Damien Miller.  All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 *    notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 *    notice, this list of conditions and the following disclaimer in the
11 *    documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25/* GTK2 support by Nalin Dahyabhai <nalin@redhat.com> */
26
27/*
28 * This is a simple GNOME SSH passphrase grabber. To use it, set the
29 * environment variable SSH_ASKPASS to point to the location of
30 * gnome-ssh-askpass before calling "ssh-add < /dev/null".
31 *
32 * There is only two run-time options: if you set the environment variable
33 * "GNOME_SSH_ASKPASS_GRAB_SERVER=true" then gnome-ssh-askpass will grab
34 * the X server. If you set "GNOME_SSH_ASKPASS_GRAB_POINTER=true", then the
35 * pointer will be grabbed too. These may have some benefit to security if
36 * you don't trust your X server. We grab the keyboard always.
37 */
38
39#define GRAB_TRIES	16
40#define GRAB_WAIT	250 /* milliseconds */
41
42#define PROMPT_ENTRY	0
43#define PROMPT_CONFIRM	1
44#define PROMPT_NONE	2
45
46/*
47 * Compile with:
48 *
49 * cc -Wall `pkg-config --cflags gtk+-2.0` \
50 *    gnome-ssh-askpass2.c -o gnome-ssh-askpass \
51 *    `pkg-config --libs gtk+-2.0`
52 *
53 */
54
55#include <stdlib.h>
56#include <stdio.h>
57#include <string.h>
58#include <unistd.h>
59
60#include <X11/Xlib.h>
61#include <gtk/gtk.h>
62#include <gdk/gdkx.h>
63#include <gdk/gdkkeysyms.h>
64
65static void
66report_failed_grab (GtkWidget *parent_window, const char *what)
67{
68	GtkWidget *err;
69
70	err = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0,
71	    GTK_MESSAGE_ERROR, GTK_BUTTONS_CLOSE,
72	    "Could not grab %s. A malicious client may be eavesdropping "
73	    "on your session.", what);
74	gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER);
75
76	gtk_dialog_run(GTK_DIALOG(err));
77
78	gtk_widget_destroy(err);
79}
80
81static void
82ok_dialog(GtkWidget *entry, gpointer dialog)
83{
84	g_return_if_fail(GTK_IS_DIALOG(dialog));
85	gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK);
86}
87
88static gboolean
89check_none(GtkWidget *widget, GdkEventKey *event, gpointer dialog)
90{
91	switch (event->keyval) {
92	case GDK_KEY_Escape:
93		/* esc -> close dialog */
94		gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_CLOSE);
95		return TRUE;
96	case GDK_KEY_Tab:
97		/* tab -> focus close button */
98		gtk_widget_grab_focus(gtk_dialog_get_widget_for_response(
99		    dialog, GTK_RESPONSE_CLOSE));
100		return TRUE;
101	default:
102		/* eat all other key events */
103		return TRUE;
104	}
105}
106
107static int
108parse_env_hex_color(const char *env, GdkColor *c)
109{
110	const char *s;
111	unsigned long ul;
112	char *ep;
113	size_t n;
114
115	if ((s = getenv(env)) == NULL)
116		return 0;
117
118	memset(c, 0, sizeof(*c));
119
120	/* Permit hex rgb or rrggbb optionally prefixed by '#' or '0x' */
121	if (*s == '#')
122		s++;
123	else if (strncmp(s, "0x", 2) == 0)
124		s += 2;
125	n = strlen(s);
126	if (n != 3 && n != 6)
127		goto bad;
128	ul = strtoul(s, &ep, 16);
129	if (*ep != '\0' || ul > 0xffffff) {
130 bad:
131		fprintf(stderr, "Invalid $%s - invalid hex color code\n", env);
132		return 0;
133	}
134	/* Valid hex sequence; expand into a GdkColor */
135	if (n == 3) {
136		/* 4-bit RGB */
137		c->red = ((ul >> 8) & 0xf) << 12;
138		c->green = ((ul >> 4) & 0xf) << 12;
139		c->blue = (ul & 0xf) << 12;
140	} else {
141		/* 8-bit RGB */
142		c->red = ((ul >> 16) & 0xff) << 8;
143		c->green = ((ul >> 8) & 0xff) << 8;
144		c->blue = (ul & 0xff) << 8;
145	}
146	return 1;
147}
148
149static int
150passphrase_dialog(char *message, int prompt_type)
151{
152	const char *failed;
153	char *passphrase, *local;
154	int result, grab_tries, grab_server, grab_pointer;
155	int buttons, default_response;
156	GtkWidget *parent_window, *dialog, *entry;
157	GdkGrabStatus status;
158	GdkColor fg, bg;
159	int fg_set = 0, bg_set = 0;
160
161	grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL);
162	grab_pointer = (getenv("GNOME_SSH_ASKPASS_GRAB_POINTER") != NULL);
163	grab_tries = 0;
164
165	fg_set = parse_env_hex_color("GNOME_SSH_ASKPASS_FG_COLOR", &fg);
166	bg_set = parse_env_hex_color("GNOME_SSH_ASKPASS_BG_COLOR", &bg);
167
168	/* Create an invisible parent window so that GtkDialog doesn't
169	 * complain.  */
170	parent_window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
171
172	switch (prompt_type) {
173	case PROMPT_CONFIRM:
174		buttons = GTK_BUTTONS_YES_NO;
175		default_response = GTK_RESPONSE_YES;
176		break;
177	case PROMPT_NONE:
178		buttons = GTK_BUTTONS_CLOSE;
179		default_response = GTK_RESPONSE_CLOSE;
180		break;
181	default:
182		buttons = GTK_BUTTONS_OK_CANCEL;
183		default_response = GTK_RESPONSE_OK;
184		break;
185	}
186
187	dialog = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0,
188	    GTK_MESSAGE_QUESTION, buttons, "%s", message);
189
190	gtk_window_set_title(GTK_WINDOW(dialog), "OpenSSH");
191	gtk_window_set_position (GTK_WINDOW(dialog), GTK_WIN_POS_CENTER);
192	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
193	gtk_dialog_set_default_response(GTK_DIALOG(dialog), default_response);
194	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
195
196	if (fg_set)
197		gtk_widget_modify_fg(dialog, GTK_STATE_NORMAL, &fg);
198	if (bg_set)
199		gtk_widget_modify_bg(dialog, GTK_STATE_NORMAL, &bg);
200
201	if (prompt_type == PROMPT_ENTRY || prompt_type == PROMPT_NONE) {
202		entry = gtk_entry_new();
203		if (fg_set)
204			gtk_widget_modify_fg(entry, GTK_STATE_NORMAL, &fg);
205		if (bg_set)
206			gtk_widget_modify_bg(entry, GTK_STATE_NORMAL, &bg);
207		gtk_box_pack_start(
208		    GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))),
209		    entry, FALSE, FALSE, 0);
210		gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE);
211		gtk_widget_grab_focus(entry);
212		if (prompt_type == PROMPT_ENTRY) {
213			gtk_widget_show(entry);
214			/* Make <enter> close dialog */
215			g_signal_connect(G_OBJECT(entry), "activate",
216					 G_CALLBACK(ok_dialog), dialog);
217		} else {
218			/*
219			 * Ensure the 'close' button is not focused by default
220			 * but is still reachable via tab. This is a bit of a
221			 * hack - it uses a hidden entry that responds to a
222			 * couple of keypress events (escape and tab only).
223			 */
224			gtk_widget_realize(entry);
225			g_signal_connect(G_OBJECT(entry), "key_press_event",
226			    G_CALLBACK(check_none), dialog);
227		}
228	}
229
230	/* Grab focus */
231	gtk_widget_show_now(dialog);
232	if (grab_pointer) {
233		for(;;) {
234			status = gdk_pointer_grab(
235			    (gtk_widget_get_window(GTK_WIDGET(dialog))), TRUE,
236			    0, NULL, NULL, GDK_CURRENT_TIME);
237			if (status == GDK_GRAB_SUCCESS)
238				break;
239			usleep(GRAB_WAIT * 1000);
240			if (++grab_tries > GRAB_TRIES) {
241				failed = "mouse";
242				goto nograb;
243			}
244		}
245	}
246	for(;;) {
247		status = gdk_keyboard_grab(
248		    gtk_widget_get_window(GTK_WIDGET(dialog)), FALSE,
249		    GDK_CURRENT_TIME);
250		if (status == GDK_GRAB_SUCCESS)
251			break;
252		usleep(GRAB_WAIT * 1000);
253		if (++grab_tries > GRAB_TRIES) {
254			failed = "keyboard";
255			goto nograbkb;
256		}
257	}
258	if (grab_server) {
259		gdk_x11_grab_server();
260	}
261
262	result = gtk_dialog_run(GTK_DIALOG(dialog));
263
264	/* Ungrab */
265	if (grab_server)
266		XUngrabServer(gdk_x11_get_default_xdisplay());
267	if (grab_pointer)
268		gdk_pointer_ungrab(GDK_CURRENT_TIME);
269	gdk_keyboard_ungrab(GDK_CURRENT_TIME);
270	gdk_flush();
271
272	/* Report passphrase if user selected OK */
273	if (prompt_type == PROMPT_ENTRY) {
274		passphrase = g_strdup(gtk_entry_get_text(GTK_ENTRY(entry)));
275		if (result == GTK_RESPONSE_OK) {
276			local = g_locale_from_utf8(passphrase,
277			    strlen(passphrase), NULL, NULL, NULL);
278			if (local != NULL) {
279				puts(local);
280				memset(local, '\0', strlen(local));
281				g_free(local);
282			} else {
283				puts(passphrase);
284			}
285		}
286		/* Zero passphrase in memory */
287		memset(passphrase, '\b', strlen(passphrase));
288		gtk_entry_set_text(GTK_ENTRY(entry), passphrase);
289		memset(passphrase, '\0', strlen(passphrase));
290		g_free(passphrase);
291	}
292
293	gtk_widget_destroy(dialog);
294	if (result != GTK_RESPONSE_OK && result != GTK_RESPONSE_YES)
295		return -1;
296	return 0;
297
298 nograbkb:
299	/*
300	 * At least one grab failed - ungrab what we got, and report
301	 * the failure to the user.  Note that XGrabServer() cannot
302	 * fail.
303	 */
304	gdk_pointer_ungrab(GDK_CURRENT_TIME);
305 nograb:
306	if (grab_server)
307		XUngrabServer(gdk_x11_get_default_xdisplay());
308	gtk_widget_destroy(dialog);
309
310	report_failed_grab(parent_window, failed);
311
312	return (-1);
313}
314
315int
316main(int argc, char **argv)
317{
318	char *message, *prompt_mode;
319	int result, prompt_type = PROMPT_ENTRY;
320
321	gtk_init(&argc, &argv);
322
323	if (argc > 1) {
324		message = g_strjoinv(" ", argv + 1);
325	} else {
326		message = g_strdup("Enter your OpenSSH passphrase:");
327	}
328
329	if ((prompt_mode = getenv("SSH_ASKPASS_PROMPT")) != NULL) {
330		if (strcasecmp(prompt_mode, "confirm") == 0)
331			prompt_type = PROMPT_CONFIRM;
332		else if (strcasecmp(prompt_mode, "none") == 0)
333			prompt_type = PROMPT_NONE;
334	}
335
336	setvbuf(stdout, 0, _IONBF, 0);
337	result = passphrase_dialog(message, prompt_type);
338	g_free(message);
339
340	return (result);
341}
342