Pass echo option to systemd-ask-password
PATCH 1/1 Pass echo option to systemd-ask-password
Do not mask input when echo is requested. Useful for username input and sometimes for challenge response.
--- src/openvpn/console.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
src/openvpn/console.c +4 -1
@@ -167,7 +167,10 @@ get_console_input_systemd (const char *prompt, const bool echo, char *input, conargv_init (&argv);argv_printf (&argv,SYSTEMD_ASK_PASSWORD_PATH ); -argv_printf_cat (&argv,"%s" , prompt); +if (echo) +argv_printf_cat (&argv,"--echo %s" , prompt); +else +argv_printf_cat (&argv,"%s" , prompt);if ((std_out =openvpn_popen (&argv,NULL )) <0 ) {return false;
Signature · 1 line
1.7.10.4
Quoted 15 lines · Selva Nair
Do not mask input when echo is requested. Useful for username input and sometimes for challenge response.
Signed-off-by Selva Nair <[email protected]...>--- src/openvpn/console.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)src/openvpn/console.c +0
-0@@ -167,7 +167,10 @@ get_console_input_systemd (const char *prompt, const bool echo, char *input, con
src/openvpn/console.c get_console_input_systemd (const char *prompt, const bool echo, char *input, con · line 176
Quoted 10 lines
src/openvpn/console.c +4
-1argv_init (&argv);argv_printf (&argv,SYSTEMD_ASK_PASSWORD_PATH ); -argv_printf_cat (&argv,"%s" , prompt); +if (echo) +argv_printf_cat (&argv,"--echo %s" , prompt); +else +argv_printf_cat (&argv,"%s" , prompt);if ((std_out =openvpn_popen (&argv,NULL )) <0 ) {return false;
Hi Selva,
Thanks a lot! This patch do make sense, feature wise. And we already have basically that in a patch queue already. The problem with this approach is that it may break systems with systemd older than version 216.
Gert also requested that this whole interface should be made less "linux specific" [1], so I started on a patchset which makes the query-user-input interface far more modular. But I need to get start hacking on a v4 of that patch set as Gert didn't like several things in the previous attempt [2].
[1] <http://thread.gmane.org/gmane.network.openvpn.devel/9085/focus=9091>
[2] <http://thread.gmane.org/gmane.network.openvpn.devel/10021/>
I've just changed employer, and OpenVPN is truly part of what I will be working on. So getting the query-user-input patches through is high up on my list. I just need to get settled with my new employer and I'll start hacking on it. But your patch is pretty much identical to what I've already proposed [3].
[3] <http://thread.gmane.org/gmane.network.openvpn.devel/10021/focus=10019>
Signature · 3 lines
kind regards, David Sommerseth
Quoted 4 lines · David Sommerseth
Quoted 3 lines · Selva Nair
Do not mask input when echo is requested. Useful for username input and sometimes for challenge response.
Quoted 8 lines
Quoted 1 line
Signed-off-by Selva Nair <[email protected]...>..
Hi Selva,
Thanks a lot! This patch do make sense, feature wise. And we already have basically that in a patch queue already.
Aha, I did not realize that those patches address the echo issue..
Quoted 3 lines
The problem with this
approach is that it may break systems with systemd older than version 216.
Dud.. I'm more of an irked systemd customer, rather than an aficionado..
Quoted 10 lines
Gert also requested that this whole interface should be made less "linux specific" [1], so I started on a patchset which makes the query-user-input interface far more modular. But I need to get start hacking on a v4 of that patch set as Gert didn't like several things in the previous attempt [2].
[1] <http://thread.gmane.org/gmane.network.openvpn.devel/9085/focus=9091>
[2] <http://thread.gmane.org/gmane.network.openvpn.devel/10021/>
Well, if a major rewrite of console input is planned, consider replacing getpass() as well. It has arbitrary password length limitations on some platforms. At the same time I'm not sure I understand the need for this overhaul.
Quoted 4 lines
I've just changed employer, and OpenVPN is truly part of what I will be working on. So getting the query-user-input patches through is high up on my list.
Good to hear.
Quoted 6 lines
I just need to get settled with my new employer and I'll start hacking on it. But your patch is pretty much identical to what I've already proposed [3].
[3] <http://thread.gmane.org/gmane.network.openvpn.devel/10021/focus=10019
Quoted 1 line
Your patch has
+#if SYSTEMD_VERSION > 216
+ if( echo )
+ {
+ argv_printf_cat(&argv, "--echo");
+ }
+#endif
How would such a compile time check be any useful -- the version will have to be checked at run-time, isn't it?
So, should I withdraw the patch or try to fix it by hacking up a run-time version check?
Selva
Quoted 5 lines · Selva Nair
Well, if a major rewrite of console input is planned, consider replacing
getpass()as well. It has arbitrary password length limitations on some platforms. At the same time I'm not sure I understand the need for this overhaul.
Currently the interface is basically stdio/stdout. But with a more modular API for querying user, you can enable more fancy ways of querying the user. In the systemd team, they're talking about moving away from systemd-tty-ask-password's API to a DBus oriented API (but it is dragging, as they can't do that without kdbus in place for querying users at boot time). The idea is that OpenVPN should be completely agnostic to if the user input is from a tty console or a fancy graphical GUI. The OS/distribution just needs to support a method through this API.
The other advantage this new API has is that it can be expanded to ask for all the information at once, instead of the current sequential approach (first username, then password, then key passphrase or PKCS11 PIN, etc, etc). I've barely started looking at that, but I would need to get the overall API in place first before starting to rearrange the code sections where OpenVPN needs user input.
So combined, it can support a more simpler interaction with the OpenVPN daemon.
In regards to the getpass() issues, that should be possible to improve though.
Quoted 9 lines
Your patch has
(quoted diff) +6
-0+#if SYSTEMD_VERSION > 216 + if( echo ) + { +argv_printf_cat(&argv, "--echo"); + } +#endif
Quoted 5 lines
How would such a compile time check be any useful -- the version will have to be checked at run-time, isn't it?
So, should I withdraw the patch or try to fix it by hacking up a run-time version check?
There exists no way to query at runtime which version systemd is running (or at least it didn't when I started poking at that). And it was considered that if you have version newer than 216 you would never downgrade systemd, so a compile time check would generally be good enough. This works at least very well in the RHEL/Fedora build environments where all builds happens in chroots managed by mock, where the buildroots have the same package versions installed as the distribution the build is targeted at.
Signature · 3 lines
kind regards, David Sommerseth
Hi David,
Quoted 7 lines · David Sommerseth
Quoted 5 lines · Selva Nair
Well, if a major rewrite of console input is planned, consider replacing
getpass()as well. It has arbitrary password length limitations on some platforms. At the same time I'm not sure I understand the need for this overhaul.
Quoted 9 lines
Currently the interface is basically stdio/stdout. But with a more modular API for querying user, you can enable more fancy ways of querying the user. In the systemd team, they're talking about moving away from systemd-tty-ask-password's API to a DBus oriented API (but it is dragging, as they can't do that without kdbus in place for querying users at boot time). The idea is that OpenVPN should be completely agnostic to if the user input is from a tty console or a fancy graphical GUI. The OS/distribution just needs to support a method through this API.
Thanks for the explanation. Could be useful if it works well... Centralized input facilities could have unwanted side effects -- for example, systemd sometimes blasts messages to all logged in users when a password is required which is kind of silly (probably there is a way to suppress it, I haven't investigated).
Quoted 13 lines
Quoted 13 lines
Your patch has
(quoted diff) +6
-0+#if SYSTEMD_VERSION > 216 + if( echo ) + { +argv_printf_cat(&argv, "--echo"); + } +#endifHow would such a compile time check be any useful -- the version will have to be checked at run-time, isn't it?
Quoted 11 lines
Quoted 2 lines
So, should I withdraw the patch or try to fix it by hacking up a run-time version check?
There exists no way to query at runtime which version systemd is running (or at least it didn't when I started poking at that). And it was considered that if you have version newer than 216 you would never downgrade systemd, so a compile time check would generally be good enough. This works at least very well in the RHEL/Fedora build environments where all builds happens in chroots managed by mock, where the buildroots have the same package versions installed as the distribution the build is targeted at.
Yeah, it looks good as most people install from distributions or build on the target machine. No need to support folks like me who sometimes copy binaries from one system to another at our own peril :)
I'll withdraw the patch.
Thanks,
Selva
Quoted 4 lines · Selva Nair
Do not mask input when echo is requested. Useful for username input and sometimes for challenge response.
Signed-off-by Selva Nair <[email protected]...>
Patch withdrawn in deference to David's pending patches that address this among other things..
Also this one lacks a necessary version check to ensure --echo is supported by systemd-ask-password
Selva