[openssh-commits] [openssh] 07/08: upstream: allow some additional control over the use of ssh-askpass
git+noreply at mindrot.org
git+noreply at mindrot.org
Wed Jul 15 15:09:08 AEST 2020
This is an automated email from the git hooks/post-receive script.
dtucker pushed a commit to branch master
in repository openssh.
commit aaa8b609a7b332be836cd9a3b782422254972777
Author: djm at openbsd.org <djm at openbsd.org>
Date: Tue Jul 14 23:57:01 2020 +0000
upstream: allow some additional control over the use of ssh-askpass
via $SSH_ASKPASS_REQUIRE, including force-enable/disable. bz#69 ok markus@
OpenBSD-Commit-ID: 3a1e6cbbf6241ddc4405c4246caa2c249f149eb2
---
readpass.c | 25 ++++++++++++++++++++-----
ssh-add.1 | 30 +++++++++++++++++++++++-------
ssh.1 | 23 +++++++++++++++++++++--
ssh.h | 7 ++++++-
4 files changed, 70 insertions(+), 15 deletions(-)
diff --git a/readpass.c b/readpass.c
index 974d67f0..69edce30 100644
--- a/readpass.c
+++ b/readpass.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readpass.c,v 1.61 2020/01/23 07:10:22 dtucker Exp $ */
+/* $OpenBSD: readpass.c,v 1.62 2020/07/14 23:57:01 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -123,11 +123,26 @@ char *
read_passphrase(const char *prompt, int flags)
{
char cr = '\r', *askpass = NULL, *ret, buf[1024];
- int rppflags, use_askpass = 0, ttyfd;
+ int rppflags, ttyfd, use_askpass = 0, allow_askpass = 0;
const char *askpass_hint = NULL;
+ const char *s;
+
+ if ((s = getenv("DISPLAY")) != NULL)
+ allow_askpass = *s != '\0';
+ if ((s = getenv(SSH_ASKPASS_REQUIRE_ENV)) != NULL) {
+ if (strcasecmp(s, "force") == 0) {
+ use_askpass = 1;
+ allow_askpass = 1;
+ } else if (strcasecmp(s, "prefer") == 0)
+ use_askpass = allow_askpass;
+ else if (strcasecmp(s, "never") == 0)
+ allow_askpass = 0;
+ }
rppflags = (flags & RP_ECHO) ? RPP_ECHO_ON : RPP_ECHO_OFF;
- if (flags & RP_USE_ASKPASS)
+ if (use_askpass)
+ debug("%s: requested to askpass", __func__);
+ else if (flags & RP_USE_ASKPASS)
use_askpass = 1;
else if (flags & RP_ALLOW_STDIN) {
if (!isatty(STDIN_FILENO)) {
@@ -153,10 +168,10 @@ read_passphrase(const char *prompt, int flags)
}
}
- if ((flags & RP_USE_ASKPASS) && getenv("DISPLAY") == NULL)
+ if ((flags & RP_USE_ASKPASS) && !allow_askpass)
return (flags & RP_ALLOW_EOF) ? NULL : xstrdup("");
- if (use_askpass && getenv("DISPLAY")) {
+ if (use_askpass && allow_askpass) {
if (getenv(SSH_ASKPASS_ENV))
askpass = getenv(SSH_ASKPASS_ENV);
else
diff --git a/ssh-add.1 b/ssh-add.1
index f3db1956..2786df51 100644
--- a/ssh-add.1
+++ b/ssh-add.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-add.1,v 1.80 2020/06/26 05:04:07 djm Exp $
+.\" $OpenBSD: ssh-add.1,v 1.81 2020/07/14 23:57:01 djm Exp $
.\"
.\" Author: Tatu Ylonen <ylo at cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd $Mdocdate: June 26 2020 $
+.Dd $Mdocdate: July 14 2020 $
.Dt SSH-ADD 1
.Os
.Sh NAME
@@ -174,7 +174,7 @@ Lock the agent with a password.
.El
.Sh ENVIRONMENT
.Bl -tag -width Ds
-.It Ev "DISPLAY" and "SSH_ASKPASS"
+.It Ev "DISPLAY", "SSH_ASKPASS" and "SSH_ASKPASS_REQUIRE"
If
.Nm
needs a passphrase, it will read the passphrase from the current
@@ -195,10 +195,26 @@ This is particularly useful when calling
from a
.Pa .xsession
or related script.
-(Note that on some machines it
-may be necessary to redirect the input from
-.Pa /dev/null
-to make this work.)
+.Pp
+.Ev SSH_ASKPASS_REQUIRE
+allows further control over the use of an askpass program.
+If this variable is set to
+.Dq never
+then
+.Nm
+will never attempt to use one.
+If it is set to
+.Dq prefer ,
+then
+.Nm
+will prefer to use the askpass program instead of the TTY when requesting
+passwords.
+Finally, if the variable is set to
+.Dq force ,
+then the askpass program will be used for all passphrase input regardless
+of whether
+.Ev DISPLAY
+is set.
.It Ev SSH_AUTH_SOCK
Identifies the path of a
.Ux Ns -domain
diff --git a/ssh.1 b/ssh.1
index dce5f404..7b9d3422 100644
--- a/ssh.1
+++ b/ssh.1
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh.1,v 1.412 2020/04/17 03:34:42 djm Exp $
-.Dd $Mdocdate: April 17 2020 $
+.\" $OpenBSD: ssh.1,v 1.413 2020/07/14 23:57:01 djm Exp $
+.Dd $Mdocdate: July 14 2020 $
.Dt SSH 1
.Os
.Sh NAME
@@ -1409,6 +1409,25 @@ or related script.
may be necessary to redirect the input from
.Pa /dev/null
to make this work.)
+.It Ev SSH_ASKPASS_REQUIRE
+allows further control over the use of an askpass program.
+If this variable is set to
+.Dq never
+then
+.Nm
+will never attempt to use one.
+If it is set to
+.Dq prefer ,
+then
+.Nm
+will prefer to use the askpass program instead of the TTY when requesting
+passwords.
+Finally, if the variable is set to
+.Dq force ,
+then the askpass program will be used for all passphrase input regardless
+of whether
+.Ev DISPLAY
+is set.
.It Ev SSH_AUTH_SOCK
Identifies the path of a
.Ux Ns -domain
diff --git a/ssh.h b/ssh.h
index dda6f617..8110c060 100644
--- a/ssh.h
+++ b/ssh.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.h,v 1.89 2018/12/27 03:25:25 djm Exp $ */
+/* $OpenBSD: ssh.h,v 1.90 2020/07/14 23:57:01 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -67,6 +67,11 @@
*/
#define SSH_ASKPASS_ENV "SSH_ASKPASS"
+/*
+ * Environment variable to control whether or not askpass is used.
+ */
+#define SSH_ASKPASS_REQUIRE_ENV "SSH_ASKPASS_REQUIRE"
+
/*
* Force host key length and server key length to differ by at least this
* many bits. This is to make double encryption with rsaref work.
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list