1 /*
2  * Copyright (c) 2000-2002 Damien Miller.  All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23  */
24 
25 /* GTK2 support by Nalin Dahyabhai <nalin@redhat.com> */
26 
27 /*
28  * This is a simple GNOME SSH passphrase grabber. To use it, set the
29  * environment variable SSH_ASKPASS to point to the location of
30  * gnome-ssh-askpass before calling "ssh-add < /dev/null".
31  *
32  * There is only two run-time options: if you set the environment variable
33  * "GNOME_SSH_ASKPASS_GRAB_SERVER=true" then gnome-ssh-askpass will grab
34  * the X server. If you set "GNOME_SSH_ASKPASS_GRAB_POINTER=true", then the
35  * pointer will be grabbed too. These may have some benefit to security if
36  * you don't trust your X server. We grab the keyboard always.
37  */
38 
39 #define GRAB_TRIES	16
40 #define GRAB_WAIT	250 /* milliseconds */
41 
42 #define PROMPT_ENTRY	0
43 #define PROMPT_CONFIRM	1
44 #define PROMPT_NONE	2
45 
46 /*
47  * Compile with:
48  *
49  * cc -Wall `pkg-config --cflags gtk+-2.0` \
50  *    gnome-ssh-askpass2.c -o gnome-ssh-askpass \
51  *    `pkg-config --libs gtk+-2.0`
52  *
53  */
54 
55 #include <stdlib.h>
56 #include <stdio.h>
57 #include <string.h>
58 #include <unistd.h>
59 
60 #include <X11/Xlib.h>
61 #include <gtk/gtk.h>
62 #include <gdk/gdkx.h>
63 #include <gdk/gdkkeysyms.h>
64 
65 static void
report_failed_grab(GtkWidget * parent_window,const char * what)66 report_failed_grab (GtkWidget *parent_window, const char *what)
67 {
68 	GtkWidget *err;
69 
70 	err = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0,
71 	    GTK_MESSAGE_ERROR, GTK_BUTTONS_CLOSE,
72 	    "Could not grab %s. A malicious client may be eavesdropping "
73 	    "on your session.", what);
74 	gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER);
75 
76 	gtk_dialog_run(GTK_DIALOG(err));
77 
78 	gtk_widget_destroy(err);
79 }
80 
81 static void
ok_dialog(GtkWidget * entry,gpointer dialog)82 ok_dialog(GtkWidget *entry, gpointer dialog)
83 {
84 	g_return_if_fail(GTK_IS_DIALOG(dialog));
85 	gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_OK);
86 }
87 
88 static gboolean
check_none(GtkWidget * widget,GdkEventKey * event,gpointer dialog)89 check_none(GtkWidget *widget, GdkEventKey *event, gpointer dialog)
90 {
91 	switch (event->keyval) {
92 	case GDK_KEY_Escape:
93 		/* esc -> close dialog */
94 		gtk_dialog_response(GTK_DIALOG(dialog), GTK_RESPONSE_CLOSE);
95 		return TRUE;
96 	case GDK_KEY_Tab:
97 		/* tab -> focus close button */
98 		gtk_widget_grab_focus(gtk_dialog_get_widget_for_response(
99 		    dialog, GTK_RESPONSE_CLOSE));
100 		return TRUE;
101 	default:
102 		/* eat all other key events */
103 		return TRUE;
104 	}
105 }
106 
107 static int
parse_env_hex_color(const char * env,GdkColor * c)108 parse_env_hex_color(const char *env, GdkColor *c)
109 {
110 	const char *s;
111 	unsigned long ul;
112 	char *ep;
113 	size_t n;
114 
115 	if ((s = getenv(env)) == NULL)
116 		return 0;
117 
118 	memset(c, 0, sizeof(*c));
119 
120 	/* Permit hex rgb or rrggbb optionally prefixed by '#' or '0x' */
121 	if (*s == '#')
122 		s++;
123 	else if (strncmp(s, "0x", 2) == 0)
124 		s += 2;
125 	n = strlen(s);
126 	if (n != 3 && n != 6)
127 		goto bad;
128 	ul = strtoul(s, &ep, 16);
129 	if (*ep != '\0' || ul > 0xffffff) {
130  bad:
131 		fprintf(stderr, "Invalid $%s - invalid hex color code\n", env);
132 		return 0;
133 	}
134 	/* Valid hex sequence; expand into a GdkColor */
135 	if (n == 3) {
136 		/* 4-bit RGB */
137 		c->red = ((ul >> 8) & 0xf) << 12;
138 		c->green = ((ul >> 4) & 0xf) << 12;
139 		c->blue = (ul & 0xf) << 12;
140 	} else {
141 		/* 8-bit RGB */
142 		c->red = ((ul >> 16) & 0xff) << 8;
143 		c->green = ((ul >> 8) & 0xff) << 8;
144 		c->blue = (ul & 0xff) << 8;
145 	}
146 	return 1;
147 }
148 
149 static int
passphrase_dialog(char * message,int prompt_type)150 passphrase_dialog(char *message, int prompt_type)
151 {
152 	const char *failed;
153 	char *passphrase, *local;
154 	int result, grab_tries, grab_server, grab_pointer;
155 	int buttons, default_response;
156 	GtkWidget *parent_window, *dialog, *entry;
157 	GdkGrabStatus status;
158 	GdkColor fg, bg;
159 	int fg_set = 0, bg_set = 0;
160 
161 	grab_server = (getenv("GNOME_SSH_ASKPASS_GRAB_SERVER") != NULL);
162 	grab_pointer = (getenv("GNOME_SSH_ASKPASS_GRAB_POINTER") != NULL);
163 	grab_tries = 0;
164 
165 	fg_set = parse_env_hex_color("GNOME_SSH_ASKPASS_FG_COLOR", &fg);
166 	bg_set = parse_env_hex_color("GNOME_SSH_ASKPASS_BG_COLOR", &bg);
167 
168 	/* Create an invisible parent window so that GtkDialog doesn't
169 	 * complain.  */
170 	parent_window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
171 
172 	switch (prompt_type) {
173 	case PROMPT_CONFIRM:
174 		buttons = GTK_BUTTONS_YES_NO;
175 		default_response = GTK_RESPONSE_YES;
176 		break;
177 	case PROMPT_NONE:
178 		buttons = GTK_BUTTONS_CLOSE;
179 		default_response = GTK_RESPONSE_CLOSE;
180 		break;
181 	default:
182 		buttons = GTK_BUTTONS_OK_CANCEL;
183 		default_response = GTK_RESPONSE_OK;
184 		break;
185 	}
186 
187 	dialog = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0,
188 	    GTK_MESSAGE_QUESTION, buttons, "%s", message);
189 
190 	gtk_window_set_title(GTK_WINDOW(dialog), "OpenSSH");
191 	gtk_window_set_position (GTK_WINDOW(dialog), GTK_WIN_POS_CENTER);
192 	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
193 	gtk_dialog_set_default_response(GTK_DIALOG(dialog), default_response);
194 	gtk_window_set_keep_above(GTK_WINDOW(dialog), TRUE);
195 
196 	if (fg_set)
197 		gtk_widget_modify_fg(dialog, GTK_STATE_NORMAL, &fg);
198 	if (bg_set)
199 		gtk_widget_modify_bg(dialog, GTK_STATE_NORMAL, &bg);
200 
201 	if (prompt_type == PROMPT_ENTRY || prompt_type == PROMPT_NONE) {
202 		entry = gtk_entry_new();
203 		if (fg_set)
204 			gtk_widget_modify_fg(entry, GTK_STATE_NORMAL, &fg);
205 		if (bg_set)
206 			gtk_widget_modify_bg(entry, GTK_STATE_NORMAL, &bg);
207 		gtk_box_pack_start(
208 		    GTK_BOX(gtk_dialog_get_content_area(GTK_DIALOG(dialog))),
209 		    entry, FALSE, FALSE, 0);
210 		gtk_entry_set_visibility(GTK_ENTRY(entry), FALSE);
211 		gtk_widget_grab_focus(entry);
212 		if (prompt_type == PROMPT_ENTRY) {
213 			gtk_widget_show(entry);
214 			/* Make <enter> close dialog */
215 			g_signal_connect(G_OBJECT(entry), "activate",
216 					 G_CALLBACK(ok_dialog), dialog);
217 		} else {
218 			/*
219 			 * Ensure the 'close' button is not focused by default
220 			 * but is still reachable via tab. This is a bit of a
221 			 * hack - it uses a hidden entry that responds to a
222 			 * couple of keypress events (escape and tab only).
223 			 */
224 			gtk_widget_realize(entry);
225 			g_signal_connect(G_OBJECT(entry), "key_press_event",
226 			    G_CALLBACK(check_none), dialog);
227 		}
228 	}
229 
230 	/* Grab focus */
231 	gtk_widget_show_now(dialog);
232 	if (grab_pointer) {
233 		for(;;) {
234 			status = gdk_pointer_grab(
235 			    (gtk_widget_get_window(GTK_WIDGET(dialog))), TRUE,
236 			    0, NULL, NULL, GDK_CURRENT_TIME);
237 			if (status == GDK_GRAB_SUCCESS)
238 				break;
239 			usleep(GRAB_WAIT * 1000);
240 			if (++grab_tries > GRAB_TRIES) {
241 				failed = "mouse";
242 				goto nograb;
243 			}
244 		}
245 	}
246 	for(;;) {
247 		status = gdk_keyboard_grab(
248 		    gtk_widget_get_window(GTK_WIDGET(dialog)), FALSE,
249 		    GDK_CURRENT_TIME);
250 		if (status == GDK_GRAB_SUCCESS)
251 			break;
252 		usleep(GRAB_WAIT * 1000);
253 		if (++grab_tries > GRAB_TRIES) {
254 			failed = "keyboard";
255 			goto nograbkb;
256 		}
257 	}
258 	if (grab_server) {
259 		gdk_x11_grab_server();
260 	}
261 
262 	result = gtk_dialog_run(GTK_DIALOG(dialog));
263 
264 	/* Ungrab */
265 	if (grab_server)
266 		XUngrabServer(gdk_x11_get_default_xdisplay());
267 	if (grab_pointer)
268 		gdk_pointer_ungrab(GDK_CURRENT_TIME);
269 	gdk_keyboard_ungrab(GDK_CURRENT_TIME);
270 	gdk_flush();
271 
272 	/* Report passphrase if user selected OK */
273 	if (prompt_type == PROMPT_ENTRY) {
274 		passphrase = g_strdup(gtk_entry_get_text(GTK_ENTRY(entry)));
275 		if (result == GTK_RESPONSE_OK) {
276 			local = g_locale_from_utf8(passphrase,
277 			    strlen(passphrase), NULL, NULL, NULL);
278 			if (local != NULL) {
279 				puts(local);
280 				memset(local, '\0', strlen(local));
281 				g_free(local);
282 			} else {
283 				puts(passphrase);
284 			}
285 		}
286 		/* Zero passphrase in memory */
287 		memset(passphrase, '\b', strlen(passphrase));
288 		gtk_entry_set_text(GTK_ENTRY(entry), passphrase);
289 		memset(passphrase, '\0', strlen(passphrase));
290 		g_free(passphrase);
291 	}
292 
293 	gtk_widget_destroy(dialog);
294 	if (result != GTK_RESPONSE_OK && result != GTK_RESPONSE_YES)
295 		return -1;
296 	return 0;
297 
298  nograbkb:
299 	/*
300 	 * At least one grab failed - ungrab what we got, and report
301 	 * the failure to the user.  Note that XGrabServer() cannot
302 	 * fail.
303 	 */
304 	gdk_pointer_ungrab(GDK_CURRENT_TIME);
305  nograb:
306 	if (grab_server)
307 		XUngrabServer(gdk_x11_get_default_xdisplay());
308 	gtk_widget_destroy(dialog);
309 
310 	report_failed_grab(parent_window, failed);
311 
312 	return (-1);
313 }
314 
315 int
main(int argc,char ** argv)316 main(int argc, char **argv)
317 {
318 	char *message, *prompt_mode;
319 	int result, prompt_type = PROMPT_ENTRY;
320 
321 	gtk_init(&argc, &argv);
322 
323 	if (argc > 1) {
324 		message = g_strjoinv(" ", argv + 1);
325 	} else {
326 		message = g_strdup("Enter your OpenSSH passphrase:");
327 	}
328 
329 	if ((prompt_mode = getenv("SSH_ASKPASS_PROMPT")) != NULL) {
330 		if (strcasecmp(prompt_mode, "confirm") == 0)
331 			prompt_type = PROMPT_CONFIRM;
332 		else if (strcasecmp(prompt_mode, "none") == 0)
333 			prompt_type = PROMPT_NONE;
334 	}
335 
336 	setvbuf(stdout, 0, _IONBF, 0);
337 	result = passphrase_dialog(message, prompt_type);
338 	g_free(message);
339 
340 	return (result);
341 }
342