Annotation of src/usr.bin/lock/lock.c, Revision 1.45
1.45 ! jca 1: /* $OpenBSD: lock.c,v 1.44 2019/07/21 14:39:32 jca Exp $ */
1.2 deraadt 2: /* $NetBSD: lock.c,v 1.8 1996/05/07 18:32:31 jtc Exp $ */
1.1 deraadt 3:
4: /*
5: * Copyright (c) 1980, 1987, 1993
6: * The Regents of the University of California. All rights reserved.
7: *
8: * This code is derived from software contributed to Berkeley by
9: * Bob Toxen.
10: *
11: * Redistribution and use in source and binary forms, with or without
12: * modification, are permitted provided that the following conditions
13: * are met:
14: * 1. Redistributions of source code must retain the above copyright
15: * notice, this list of conditions and the following disclaimer.
16: * 2. Redistributions in binary form must reproduce the above copyright
17: * notice, this list of conditions and the following disclaimer in the
18: * documentation and/or other materials provided with the distribution.
1.20 millert 19: * 3. Neither the name of the University nor the names of its contributors
1.1 deraadt 20: * may be used to endorse or promote products derived from this software
21: * without specific prior written permission.
22: *
23: * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25: * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26: * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27: * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28: * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29: * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32: * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33: * SUCH DAMAGE.
34: */
35:
36: /*
1.44 jca 37: * Lock a terminal up until the given key or user password is entered,
38: * or the given interval times out.
1.1 deraadt 39: */
40:
41: #include <sys/stat.h>
42: #include <sys/time.h>
43: #include <signal.h>
44:
45: #include <ctype.h>
46: #include <err.h>
47: #include <pwd.h>
1.13 millert 48: #include <readpassphrase.h>
1.1 deraadt 49: #include <stdio.h>
1.2 deraadt 50: #include <stdlib.h>
1.1 deraadt 51: #include <string.h>
52: #include <termios.h>
1.2 deraadt 53: #include <unistd.h>
1.28 deraadt 54: #include <limits.h>
1.1 deraadt 55:
1.13 millert 56: #include <login_cap.h>
57: #include <bsd_auth.h>
1.7 millert 58:
1.15 millert 59: void bye(int);
60: void hi(int);
1.42 cheloha 61: void usage(void);
1.1 deraadt 62:
1.43 cheloha 63: int no_timeout = 1; /* lock terminal forever */
1.1 deraadt 64:
1.9 millert 65: int
1.18 deraadt 66: main(int argc, char *argv[])
1.1 deraadt 67: {
1.28 deraadt 68: char hostname[HOST_NAME_MAX+1], s[BUFSIZ], s1[BUFSIZ], date[256];
1.38 tedu 69: char hash[_PASSWORD_LEN];
1.18 deraadt 70: char *p, *style, *nstyle, *ttynam;
71: struct itimerval ntimer, otimer;
1.37 tedu 72: struct timeval timeout;
1.24 martynas 73: int ch, sectimeout, usemine, cnt, tries = 10, backoff = 3;
1.22 deraadt 74: const char *errstr;
1.1 deraadt 75: struct passwd *pw;
76: struct tm *timp;
77: time_t curtime;
1.13 millert 78: login_cap_t *lc;
1.1 deraadt 79:
1.13 millert 80: style = NULL;
1.1 deraadt 81: usemine = 0;
1.37 tedu 82: memset(&timeout, 0, sizeof(timeout));
1.29 deraadt 83:
1.32 tedu 84: if (pledge("stdio rpath wpath getpw tty proc exec", NULL) == -1)
1.30 deraadt 85: err(1, "pledge");
1.1 deraadt 86:
87: if (!(pw = getpwuid(getuid())))
1.17 deraadt 88: errx(1, "unknown uid %u.", getuid());
1.13 millert 89:
90: lc = login_getclass(pw->pw_class);
1.24 martynas 91: if (lc != NULL) {
92: /*
93: * We allow "login-tries" attempts to login but start
94: * slowing down after "login-backoff" attempts.
95: */
1.40 tedu 96: tries = login_getcapnum(lc, "login-tries", 10, 10);
97: backoff = login_getcapnum(lc, "login-backoff", 3, 3);
1.24 martynas 98: }
99:
1.45 ! jca 100: while ((ch = getopt(argc, argv, "a:npt:")) != -1) {
1.19 deraadt 101: switch (ch) {
1.13 millert 102: case 'a':
103: if (lc) {
104: style = login_getstyle(lc, optarg, "auth-lock");
105: if (style == NULL)
106: errx(1,
107: "invalid authentication style: %s",
108: optarg);
109: }
110: usemine = 1;
111: break;
1.1 deraadt 112: case 't':
1.40 tedu 113: sectimeout = strtonum(optarg, 1, INT_MAX, &errstr);
1.22 deraadt 114: if (errstr)
115: errx(1, "timeout %s: %s", errstr, optarg);
1.43 cheloha 116: no_timeout = 0;
1.1 deraadt 117: break;
118: case 'p':
119: usemine = 1;
1.45 ! jca 120: break;
! 121: case 'n':
! 122: /* backward compatibility, -n meant "lock forever" */
1.1 deraadt 123: break;
124: default:
1.42 cheloha 125: usage();
1.33 tedu 126: }
1.1 deraadt 127: }
128:
129: gethostname(hostname, sizeof(hostname));
1.26 tobias 130: if (usemine && lc == NULL)
131: errx(1, "login class not found");
1.13 millert 132: if (!(ttynam = ttyname(STDIN_FILENO)))
1.1 deraadt 133: errx(1, "not a terminal?");
1.13 millert 134: curtime = time(NULL);
1.1 deraadt 135: timp = localtime(&curtime);
1.13 millert 136: strftime(date, sizeof(date), "%c", timp);
1.1 deraadt 137:
1.13 millert 138: if (!usemine) {
1.1 deraadt 139: /* get key and check again */
1.13 millert 140: if (!readpassphrase("Key: ", s, sizeof(s), RPP_ECHO_OFF) ||
141: *s == '\0')
142: exit(0);
1.1 deraadt 143: /*
144: * Don't need EOF test here, if we get EOF, then s1 != s
145: * and the right things will happen.
146: */
1.40 tedu 147: readpassphrase("Again: ", s1, sizeof(s1), RPP_ECHO_OFF);
1.1 deraadt 148: if (strcmp(s1, s)) {
1.13 millert 149: warnx("\apasswords didn't match.");
1.1 deraadt 150: exit(1);
151: }
1.38 tedu 152: crypt_newhash(s, "bcrypt", hash, sizeof(hash));
1.34 mestre 153: explicit_bzero(s, sizeof(s));
1.38 tedu 154: explicit_bzero(s1, sizeof(s1));
1.1 deraadt 155: }
156:
157: /* set signal handlers */
1.40 tedu 158: signal(SIGINT, hi);
159: signal(SIGQUIT, hi);
160: signal(SIGTSTP, hi);
161: signal(SIGALRM, bye);
1.1 deraadt 162:
1.43 cheloha 163: if (!no_timeout) {
164: timeout.tv_sec = (time_t)sectimeout * 60;
165: memset(&ntimer, 0, sizeof(ntimer));
166: ntimer.it_value = timeout;
1.6 downsj 167: setitimer(ITIMER_REAL, &ntimer, &otimer);
1.43 cheloha 168: }
1.1 deraadt 169:
170: /* header info */
1.6 downsj 171: if (no_timeout) {
1.40 tedu 172: fprintf(stderr,
1.13 millert 173: "%s: %s on %s. no timeout\ntime now is %s\n",
1.39 tedu 174: getprogname(), ttynam, hostname, date);
1.6 downsj 175: } else {
1.40 tedu 176: fprintf(stderr,
1.13 millert 177: "%s: %s on %s. timeout in %d minutes\ntime now is %s\n",
1.39 tedu 178: getprogname(), ttynam, hostname, sectimeout, date);
1.6 downsj 179: }
1.1 deraadt 180:
1.24 martynas 181: for (cnt = 0;;) {
1.35 tedu 182: if (!readpassphrase("Key: ", s, sizeof(s), RPP_ECHO_OFF))
183: continue;
184: if (strlen(s) == 0) {
1.9 millert 185: hi(0);
1.1 deraadt 186: continue;
187: }
188: if (usemine) {
1.13 millert 189: /*
190: * If user entered 's/key' or the style specified via
191: * the '-a' argument, auth_userokay() will prompt
192: * for a new password. Otherwise, use what we have.
193: */
194: if ((strcmp(s, "s/key") == 0 &&
195: (nstyle = login_getstyle(lc, "skey", "auth-lock")))
196: || ((nstyle = style) && strcmp(s, nstyle) == 0))
197: p = NULL;
198: else
199: p = s;
1.34 mestre 200: if (auth_userokay(pw->pw_name, nstyle, "auth-lock",
201: p)) {
202: explicit_bzero(s, sizeof(s));
1.1 deraadt 203: break;
1.34 mestre 204: }
1.38 tedu 205: } else if (crypt_checkpass(s, hash) == 0) {
1.34 mestre 206: explicit_bzero(s, sizeof(s));
1.41 tb 207: explicit_bzero(hash, sizeof(hash));
1.1 deraadt 208: break;
1.34 mestre 209: }
1.40 tedu 210: putc('\a', stderr);
1.24 martynas 211: cnt %= tries;
212: if (++cnt > backoff) {
213: sigset_t set, oset;
214: sigfillset(&set);
215: sigprocmask(SIG_BLOCK, &set, &oset);
216: sleep((u_int)((cnt - backoff) * tries / 2));
217: sigprocmask(SIG_SETMASK, &oset, NULL);
218: }
1.1 deraadt 219: }
1.9 millert 220:
1.13 millert 221: exit(0);
1.1 deraadt 222: }
223:
224: void
1.23 deraadt 225: hi(int signo)
1.1 deraadt 226: {
1.36 tedu 227: struct itimerval left;
1.1 deraadt 228:
1.40 tedu 229: dprintf(STDERR_FILENO, "%s: type in the unlock key.",
1.39 tedu 230: getprogname());
1.36 tedu 231: if (!no_timeout) {
1.40 tedu 232: getitimer(ITIMER_REAL, &left);
233: dprintf(STDERR_FILENO, " timeout in %lld:%02d minutes",
1.36 tedu 234: (long long)(left.it_value.tv_sec / 60),
235: (int)(left.it_value.tv_sec % 60));
236: }
1.40 tedu 237: dprintf(STDERR_FILENO, "\n");
1.1 deraadt 238: }
239:
240: void
1.23 deraadt 241: bye(int signo)
1.1 deraadt 242: {
243:
1.13 millert 244: if (!no_timeout)
1.16 millert 245: warnx("timeout");
246: _exit(1);
1.42 cheloha 247: }
248:
249: void
250: usage(void)
251: {
1.43 cheloha 252: fprintf(stderr, "usage: %s [-p] [-a style] [-t timeout]\n",
1.42 cheloha 253: getprogname());
254: exit(1);
1.1 deraadt 255: }
![[BACK]](/icons/back.gif){kind=icon}
Return to lock.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / lock