[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Re: FreeBSD getpass "feature"
From:       Cy Schubert - ITSD Open Systems Group <cschuber () uumail ! gov ! bc ! ca>
Date:       1998-02-26 14:07:51
[Download RAW message or body]

>
> I just found some discouraging feature of the getpass(3) function,
> which affects the all programs which are using it: passwd, login, ...
> When you press ^C (send intr) at the password prompt, you... can enter
> then password visible (echoed). It does _not_ affect slogin/ssh
> package because it uses other password giving mechanism.
>
> I  don't know, if somebody consider this behaviour normal, but I'm
> not. So, after the few mail exchange with Guido, I've got the
> solution: install getpass v1.6 from the current CVS tree which is
> available from www.freebsd.org. Having problem with applying the
> fetched diff for getpass I patched it manually, rebuilt the diff and
> placed it to the
>
> ftp://ftp.agmar.ru/pub/unix/FreeBSD/getpass.c.1.5-1.6.diff

For some unknown reason I couldn't access your FTP site, some kind of
routing loop, so here are the diffs for anyone who wants them.

--- lib/libc/gen/getpass.c-225  Fri Jul 12 11:53:47 1996
+++ lib/libc/gen/getpass.c      Wed Feb 18 05:58:39 1998
@@ -44,38 +44,8 @@
 #include <unistd.h>

 static struct termios oterm, term;
-static sig_t ointhandler, oquithandler, otstphandler, oconthandler;
 static FILE *fp;

-static void
-sighandler(int signo)
-{
-       /* restore tty state */
-       (void)tcsetattr(fileno(fp), TCSAFLUSH|TCSASOFT, &oterm);
-
-       /* restore old sig handlers */
-       (void)signal(SIGINT, ointhandler);
-       (void)signal(SIGQUIT, oquithandler);
-       (void)signal(SIGTSTP, otstphandler);
-
-       /* resend us this signal */
-       (void)kill(getpid(), signo);
-}
-
-/* ARGSUSED */
-static void
-sigconthandler(int signo)
-{
-       /* re-install our signal handlers */
-       ointhandler = signal(SIGINT, sighandler);
-       oquithandler = signal(SIGQUIT, sighandler);
-       otstphandler = signal(SIGTSTP, sighandler);
-
-       /* turn off echo again */
-       (void)tcsetattr(fileno(fp), TCSAFLUSH|TCSASOFT, &term);
-}
-
-
 char *
 getpass(prompt)
        const char *prompt;
@@ -84,6 +54,7 @@
        register char *p;
        FILE *outfp;
        static char buf[_PASSWORD_LEN + 1];
+       sigset_t oset, nset;

        /*
         * read and write to /dev/tty if possible; else read from
@@ -94,11 +65,15 @@
                fp = stdin;
        }

-       ointhandler = signal(SIGINT, sighandler);
-       oquithandler = signal(SIGQUIT, sighandler);
-       otstphandler = signal(SIGTSTP, sighandler);
-       oconthandler = signal(SIGCONT, sigconthandler);
-
+       /*
+        * note - blocking signals isn't necessarily the
+        * right thing, but we leave it for now.
+        */
+       sigemptyset(&nset);
+       sigaddset(&nset, SIGINT);
+       sigaddset(&nset, SIGTSTP);
+       (void)sigprocmask(SIG_BLOCK, &nset, &oset);
+
        (void)tcgetattr(fileno(fp), &oterm);
        term = oterm;
        term.c_lflag &= ~ECHO;
@@ -112,11 +87,7 @@
        (void)write(fileno(outfp), "\n", 1);
        (void)tcsetattr(fileno(fp), TCSAFLUSH|TCSASOFT, &oterm);

-       /* restore old sig handlers */
-       (void)signal(SIGINT, ointhandler);
-       (void)signal(SIGQUIT, oquithandler);
-       (void)signal(SIGTSTP, otstphandler);
-       (void)signal(SIGCONT, oconthandler);
+       (void)sigprocmask(SIG_SETMASK, &oset, NULL);

        if (fp != stdin)
                (void)fclose(fp);


>
> So all those how think like me that's abnormal behaviour for the
> getpass can use it. Wish you well.
>
> SY, Seva Gluschenko, just stranger at the Road.
>
> --- IRC: erra
>  * Origin: gone to the Internet (gvs@agmar.ru) [http://www.agmar.ru/~gvs/]
>



Regards,                       Phone:  (250)387-8437
Cy Schubert                      Fax:  (250)387-5766
UNIX Support                   OV/VM:  BCSC02(CSCHUBER)
ITSD                          BITNET:  CSCHUBER@BCSC02.BITNET
Government of BC            Internet:  cschuber@uumail.gov.bc.ca
                                       Cy.Schubert@gems8.gov.bc.ca

[prev in list] [next in list] [prev in thread] [next in thread]