nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-25 01:02:24 +00:00
Code Issues Projects Releases Wiki Activity
109df9f46b
putty-source/windows/wincons.c

489 lines
14 KiB
C
Raw Normal View History

Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
/*
Sprinkle some header comments in various files in an attempt to explain what they're for. [originally from svn r6639]
2006-04-23 18:26:03 +00:00
* wincons.c - various interactive-prompt routines shared between
Various tweaks to header comments to remind me which bits are meant to be platform-independent, etc. [originally from svn r4148]
2004-04-27 12:31:57 +00:00
* the Windows console PuTTY tools
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
*/
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include "putty.h"
#include "storage.h"
#include "ssh.h"
int console_batch_mode = FALSE;
Ensure our network layer is properly cleaned up before PuTTY exits. Specifically, we explicitly closesocket() all open sockets, which appears to be necessary since otherwise Windows sends RST rather than FIN. I'm _sure_ that's a Windows bug, but there we go. [originally from svn r1574]
2002-03-06 20:13:22 +00:00
/*
* Clean up and exit.
*/
void cleanup_exit(int code)
{
/*
* Clean up.
*/
sk_cleanup();
Each platform's implementation of askappend() is no longer required to consult cfg.logxfovr, because it gets done once in logging.c. askappend() is now called only when a question _really_ needs to be asked of the user. Also in this checkin, cleanup_exit() in console.c no longer consults cfg.protocol to decide whether to save the random seed, because random_save_seed() can make that decision for itself and do it better. [originally from svn r2552]
2003-01-12 13:44:35 +00:00
random_save_seed();
Ensure our network layer is properly cleaned up before PuTTY exits. Specifically, we explicitly closesocket() all open sockets, which appears to be necessary since otherwise Windows sends RST rather than FIN. I'm _sure_ that's a Windows bug, but there we go. [originally from svn r1574]
2002-03-06 20:13:22 +00:00
exit(code);
}
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
void set_busy_status(Frontend *frontend, int status)
The terminal window can now indicate that PuTTY is busy in various ways, by changing its mouse pointer. Currently this is only used in the (slightly- arbitrarily-defined) "heavy" bits of SSH-2 key exchange. We override pointer hiding while PuTTY is busy, but preserve pointer-hiding state. Not yet implemented on the Mac. Also switch to frobbing window-class cursor in Windows rather than relying on SetCursor(). [originally from svn r5303]
2005-02-15 17:05:58 +00:00
{
}
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
void notify_remote_exit(Frontend *frontend)
New timing infrastructure. There's a new function schedule_timer() which pretty much any module can call to request a call-back in the future. So terminal.c can do its own handling of blinking, visual bells and deferred screen updates, without having to rely on term_update() being called 50 times a second (fixes: pterm-timer); and ssh.c and telnet.c both invoke a new module pinger.c which takes care of sending keepalives, so they get sent uniformly in all front ends (fixes: plink-keepalives, unix-keepalives). [originally from svn r4906] [this svn revision also touched putty-wishlist]
2004-11-27 13:20:21 +00:00
{
}
Two related changes to timing code: First, make absolute times unsigned. This means that it's safe to depend on their overflow behaviour (which is undefined for signed integers). This requires a little extra care in handling comparisons, but I think I've correctly adjusted them all. Second, functions registered with schedule_timer() are guaranteed to be called with precisely the time that was returned by schedule_timer(). Thus, it's only necessary to check these values for equality rather than doing risky range checks, so do that. The timing code still does lots that's undefined, unnecessary, or just wrong, but this is a good start. [originally from svn r9667]
2012-09-18 21:42:48 +00:00
void timer_change_notify(unsigned long next)
New timing infrastructure. There's a new function schedule_timer() which pretty much any module can call to request a call-back in the future. So terminal.c can do its own handling of blinking, visual bells and deferred screen updates, without having to rely on term_update() being called 50 times a second (fixes: pterm-timer); and ssh.c and telnet.c both invoke a new module pinger.c which takes care of sending keepalives, so they get sent uniformly in all front ends (fixes: plink-keepalives, unix-keepalives). [originally from svn r4906] [this svn revision also touched putty-wishlist]
2004-11-27 13:20:21 +00:00
{
}
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
int verify_ssh_host_key(Frontend *frontend, char *host, int port,
Const-correctness of name fields in struct ssh_*. All the name strings in ssh_cipher, ssh_mac, ssh_hash, ssh_signkey point to compile-time string literals, hence should obviously be const char *. Most of these const-correctness patches are just a mechanical job of adding a 'const' in the one place you need it right now, and then chasing the implications through the code adding further consts until it compiles. But this one has actually shown up a bug: the 'algorithm' output parameter in ssh2_userkey_loadpub was sometimes returning a pointer to a string literal, and sometimes a pointer to dynamically allocated memory, so callers were forced to either sometimes leak memory or sometimes free a bad thing. Now it's consistently dynamically allocated, and should be freed everywhere too.
2015-05-15 09:12:06 +00:00
const char *keytype, char *keystr, char *fingerprint,
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
void (*callback)(void *ctx, int result), void *ctx)
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
{
int ret;
HANDLE hin;
DWORD savemode, i;
static const char absentmsg_batch[] =
"The server's host key is not cached in the registry. You\n"
"have no guarantee that the server is the computer you\n"
"think it is.\n"
Implement hostkey-prompt-type everywhere except Macintosh. [originally from svn r3307]
2003-06-26 14:19:33 +00:00
"The server's %s key fingerprint is:\n"
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
"%s\n"
"Connection abandoned.\n";
static const char absentmsg[] =
"The server's host key is not cached in the registry. You\n"
"have no guarantee that the server is the computer you\n"
"think it is.\n"
Implement hostkey-prompt-type everywhere except Macintosh. [originally from svn r3307]
2003-06-26 14:19:33 +00:00
"The server's %s key fingerprint is:\n"
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
"%s\n"
"If you trust this host, enter \"y\" to add the key to\n"
"PuTTY's cache and carry on connecting.\n"
"If you want to carry on connecting just once, without\n"
"adding the key to the cache, enter \"n\".\n"
"If you do not trust this host, press Return to abandon the\n"
"connection.\n"
"Store key in cache? (y/n) ";
static const char wrongmsg_batch[] =
"WARNING - POTENTIAL SECURITY BREACH!\n"
"The server's host key does not match the one PuTTY has\n"
"cached in the registry. This means that either the\n"
"server administrator has changed the host key, or you\n"
"have actually connected to another computer pretending\n"
"to be the server.\n"
Implement hostkey-prompt-type everywhere except Macintosh. [originally from svn r3307]
2003-06-26 14:19:33 +00:00
"The new %s key fingerprint is:\n"
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
"%s\n"
"Connection abandoned.\n";
static const char wrongmsg[] =
"WARNING - POTENTIAL SECURITY BREACH!\n"
"The server's host key does not match the one PuTTY has\n"
"cached in the registry. This means that either the\n"
"server administrator has changed the host key, or you\n"
"have actually connected to another computer pretending\n"
"to be the server.\n"
Implement hostkey-prompt-type everywhere except Macintosh. [originally from svn r3307]
2003-06-26 14:19:33 +00:00
"The new %s key fingerprint is:\n"
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
"%s\n"
"If you were expecting this change and trust the new key,\n"
"enter \"y\" to update PuTTY's cache and continue connecting.\n"
"If you want to carry on connecting but without updating\n"
"the cache, enter \"n\".\n"
"If you want to abandon the connection completely, press\n"
"Return to cancel. Pressing Return is the ONLY guaranteed\n"
"safe choice.\n"
"Update cached key? (y/n, Return cancels connection) ";
static const char abandoned[] = "Connection abandoned.\n";
char line[32];
/*
* Verify the key against the registry.
*/
ret = verify_host_key(host, port, keytype, keystr);
if (ret == 0) /* success - key matched OK */
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
return 1;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
if (ret == 2) { /* key was different */
if (console_batch_mode) {
Implement hostkey-prompt-type everywhere except Macintosh. [originally from svn r3307]
2003-06-26 14:19:33 +00:00
fprintf(stderr, wrongmsg_batch, keytype, fingerprint);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
return 0;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
}
Implement hostkey-prompt-type everywhere except Macintosh. [originally from svn r3307]
2003-06-26 14:19:33 +00:00
fprintf(stderr, wrongmsg, keytype, fingerprint);
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
fflush(stderr);
}
if (ret == 1) { /* key was absent */
if (console_batch_mode) {
Implement hostkey-prompt-type everywhere except Macintosh. [originally from svn r3307]
2003-06-26 14:19:33 +00:00
fprintf(stderr, absentmsg_batch, keytype, fingerprint);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
return 0;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
}
Implement hostkey-prompt-type everywhere except Macintosh. [originally from svn r3307]
2003-06-26 14:19:33 +00:00
fprintf(stderr, absentmsg, keytype, fingerprint);
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
fflush(stderr);
}
Windows Plink: treat EOF at host key prompt as 'abort connection'. Thanks to Didrik Nordström for pointing out that we currently treated it as 'whatever happened to be in line[0] before ReadFile didn't get any data'.
2017-02-15 06:03:50 +00:00
line[0] = '\0'; /* fail safe if ReadFile returns no data */
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
hin = GetStdHandle(STD_INPUT_HANDLE);
GetConsoleMode(hin, &savemode);
SetConsoleMode(hin, (savemode | ENABLE_ECHO_INPUT |
ENABLE_PROCESSED_INPUT | ENABLE_LINE_INPUT));
ReadFile(hin, line, sizeof(line) - 1, &i, NULL);
SetConsoleMode(hin, savemode);
if (line[0] != '\0' && line[0] != '\r' && line[0] != '\n') {
if (line[0] == 'y' || line[0] == 'Y')
store_host_key(host, port, keytype, keystr);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
return 1;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
} else {
fprintf(stderr, abandoned);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
return 0;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
}
}
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
void update_specials_menu(Frontend *frontend)
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
{
}
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
/*
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
* Ask whether the selected algorithm is acceptable (since it was
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
* below the configured 'warn' threshold).
*/
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
int askalg(Frontend *frontend, const char *algtype, const char *algname,
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
void (*callback)(void *ctx, int result), void *ctx)
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
{
HANDLE hin;
DWORD savemode, i;
static const char msg[] =
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
"The first %s supported by the server is\n"
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
"%s, which is below the configured warning threshold.\n"
"Continue with connection? (y/n) ";
static const char msg_batch[] =
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
"The first %s supported by the server is\n"
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
"%s, which is below the configured warning threshold.\n"
"Connection abandoned.\n";
static const char abandoned[] = "Connection abandoned.\n";
char line[32];
if (console_batch_mode) {
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
fprintf(stderr, msg_batch, algtype, algname);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
return 0;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
}
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
fprintf(stderr, msg, algtype, algname);
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
fflush(stderr);
hin = GetStdHandle(STD_INPUT_HANDLE);
GetConsoleMode(hin, &savemode);
SetConsoleMode(hin, (savemode | ENABLE_ECHO_INPUT |
ENABLE_PROCESSED_INPUT | ENABLE_LINE_INPUT));
ReadFile(hin, line, sizeof(line) - 1, &i, NULL);
SetConsoleMode(hin, savemode);
if (line[0] == 'y' || line[0] == 'Y') {
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
return 1;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
} else {
fprintf(stderr, abandoned);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
return 0;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
}
}
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
int askhk(Frontend *frontend, const char *algname, const char *betteralgs,
Special host key warning when a better key exists. If you're connecting to a new server and it _only_ provides host key types you've configured to be below the warning threshold, it's OK to give the standard askalg() message. But if you've newly demoted a host key type and now reconnect to some server for which that type was the best key you had cached, the askalg() wording isn't really appropriate (it's not that the key we've settled on is the first type _supported by the server_, it's that it's the first type _cached by us_), and also it's potentially helpful to list the better algorithms so that the user can pick one to cross-certify.
2016-03-27 17:08:49 +00:00
void (*callback)(void *ctx, int result), void *ctx)
{
HANDLE hin;
DWORD savemode, i;
static const char msg[] =
"The first host key type we have stored for this server\n"
"is %s, which is below the configured warning threshold.\n"
"The server also provides the following types of host key\n"
"above the threshold, which we do not have stored:\n"
"%s\n"
"Continue with connection? (y/n) ";
static const char msg_batch[] =
"The first host key type we have stored for this server\n"
"is %s, which is below the configured warning threshold.\n"
"The server also provides the following types of host key\n"
"above the threshold, which we do not have stored:\n"
"%s\n"
"Connection abandoned.\n";
static const char abandoned[] = "Connection abandoned.\n";
char line[32];
if (console_batch_mode) {
fprintf(stderr, msg_batch, algname, betteralgs);
return 0;
}
fprintf(stderr, msg, algname, betteralgs);
fflush(stderr);
hin = GetStdHandle(STD_INPUT_HANDLE);
GetConsoleMode(hin, &savemode);
SetConsoleMode(hin, (savemode | ENABLE_ECHO_INPUT |
ENABLE_PROCESSED_INPUT | ENABLE_LINE_INPUT));
ReadFile(hin, line, sizeof(line) - 1, &i, NULL);
SetConsoleMode(hin, savemode);
if (line[0] == 'y' || line[0] == 'Y') {
return 1;
} else {
fprintf(stderr, abandoned);
return 0;
}
}
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
/*
* Ask whether to wipe a session log file before writing to it.
* Returns 2 for wipe, 1 for append, 0 for cancel (don't log).
*/
Refactor the LogContext type. LogContext is now the owner of the logevent() function that back ends and so forth are constantly calling. Previously, logevent was owned by the Frontend, which would store the message into its list for the GUI Event Log dialog (or print it to standard error, or whatever) and then pass it _back_ to LogContext to write to the currently open log file. Now it's the other way round: LogContext gets the message from the back end first, writes it to its log file if it feels so inclined, and communicates it back to the front end. This means that lots of parts of the back end system no longer need to have a pointer to a full-on Frontend; the only thing they needed it for was logging, so now they just have a LogContext (which many of them had to have anyway, e.g. for logging SSH packets or session traffic). LogContext itself also doesn't get a full Frontend pointer any more: it now talks back to the front end via a little vtable of its own called LogPolicy, which contains the method that passes Event Log entries through, the old askappend() function that decides whether to truncate a pre-existing log file, and an emergency function for printing an especially prominent message if the log file can't be created. One minor nice effect of this is that console and GUI apps can implement that last function subtly differently, so that Unix console apps can write it with a plain \n instead of the \r\n (harmless but inelegant) that the old centralised implementation generated. One other consequence of this is that the LogContext has to be provided to backend_init() so that it's available to backends from the instant of creation, rather than being provided via a separate API call a couple of function calls later, because backends have typically started doing things that need logging (like making network connections) before the call to backend_provide_logctx. Fortunately, there's no case in the whole code base where we don't already have logctx by the time we make a backend (so I don't actually remember why I ever delayed providing one). So that shortens the backend API by one function, which is always nice. While I'm tidying up, I've also moved the printf-style logeventf() and the handy logevent_and_free() into logging.c, instead of having copies of them scattered around other places. This has also let me remove some stub functions from a couple of outlying applications like Pageant. Finally, I've removed the pointless "_tag" at the end of LogContext's official struct name.
2018-10-10 18:26:18 +00:00
static int console_askappend(LogPolicy *lp, Filename *filename,
void (*callback)(void *ctx, int result),
void *ctx)
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
{
HANDLE hin;
DWORD savemode, i;
static const char msgtemplate[] =
"The session log file \"%.*s\" already exists.\n"
"You can overwrite it with a new session log,\n"
"append your session log to the end of it,\n"
"or disable session logging for this session.\n"
"Enter \"y\" to wipe the file, \"n\" to append to it,\n"
"or just press Return to disable logging.\n"
"Wipe the log file? (y/n, Return cancels logging) ";
static const char msgtemplate_batch[] =
"The session log file \"%.*s\" already exists.\n"
"Logging will not be enabled.\n";
char line[32];
if (console_batch_mode) {
Turn 'Filename' into a dynamically allocated type with no arbitrary length limit, just as I did to FontSpec yesterday. [originally from svn r9316]
2011-10-02 11:01:57 +00:00
fprintf(stderr, msgtemplate_batch, FILENAME_MAX, filename->path);
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
fflush(stderr);
return 0;
}
Turn 'Filename' into a dynamically allocated type with no arbitrary length limit, just as I did to FontSpec yesterday. [originally from svn r9316]
2011-10-02 11:01:57 +00:00
fprintf(stderr, msgtemplate, FILENAME_MAX, filename->path);
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
fflush(stderr);
hin = GetStdHandle(STD_INPUT_HANDLE);
GetConsoleMode(hin, &savemode);
SetConsoleMode(hin, (savemode | ENABLE_ECHO_INPUT |
ENABLE_PROCESSED_INPUT | ENABLE_LINE_INPUT));
ReadFile(hin, line, sizeof(line) - 1, &i, NULL);
SetConsoleMode(hin, savemode);
if (line[0] == 'y' || line[0] == 'Y')
return 2;
else if (line[0] == 'n' || line[0] == 'N')
return 1;
else
return 0;
}
/*
* Warn about the obsolescent key file format.
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
*
* Uniquely among these functions, this one does _not_ expect a
* frontend handle. This means that if PuTTY is ported to a
* platform which requires frontend handles, this function will be
* an anomaly. Fortunately, the problem it addresses will not have
* been present on that platform, so it can plausibly be
* implemented as an empty function.
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
*/
void old_keyfile_warning(void)
{
static const char message[] =
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
"You are loading an SSH-2 private key which has an\n"
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
"old version of the file format. This means your key\n"
"file is not fully tamperproof. Future versions of\n"
"PuTTY may stop supporting this private key format,\n"
"so we recommend you convert your key to the new\n"
"format.\n"
"\n"
"Once the key is loaded into PuTTYgen, you can perform\n"
"this conversion simply by saving it again.\n";
fputs(message, stderr);
}
Try to make our PGP signing more useful: * All the PuTTY tools for Windows and Unix now contain the fingerprints of the Master Keys. The method for accessing them is crude but universal: a new "-pgpfp" command-line option. (Except Unix PuTTYgen, which takes "--pgpfp" just to be awkward.) * Move the key policy discussion from putty-website/keys.html to putty/doc/pgpkeys.but, and autogenerate the former from the latter. Also tweak the text somewhat and include the fingerprints of the Master Keys themselves. (I've merged the existing autogeneration scripts into a single new one; I've left the old scripts and keys.html around until such time as the webmonster reviews the changes and plumbs in the new script; he should remove the old files then.) [originally from svn r5524] [this svn revision also touched putty-website]
2005-03-19 02:26:58 +00:00
/*
* Display the fingerprints of the PGP Master Keys to the user.
*/
void pgp_fingerprints(void)
{
fputs("These are the fingerprints of the PuTTY PGP Master Keys. They can\n"
"be used to establish a trust path from this executable to another\n"
"one. See the manual for more information.\n"
"(Note: these fingerprints have nothing to do with SSH!)\n"
"\n"
GPG key rollover. This commit adds the new ids and fingerprints in the keys appendix of the manual, and moves the old ones down into the historic-keys section. I've tweaked a few pieces of wording for ongoing use, so that they don't imply a specific number of past key rollovers. The -pgpfp option in all the tools now shows the new Master Key fingerprint and the previous (2015) one. I've adjusted all the uses of the #defines in putty.h so that future rollovers should only have to modify the #defines themselves. Most importantly, sign.sh bakes in the ids of the current release and snapshot keys, so that snapshots will automatically be signed with the new snapshot key and the -r option will invoke the new release key.
2018-08-25 13:36:25 +00:00
"PuTTY Master Key as of " PGP_MASTER_KEY_YEAR
" (" PGP_MASTER_KEY_DETAILS "):\n"
Key rollover: put the new Master Key fingerprint in the tools. For the moment we're also retaining the old ones. Not sure when will be the best time to get rid of those; after the next release, perhaps?
2015-09-02 17:31:24 +00:00
" " PGP_MASTER_KEY_FP "\n\n"
GPG key rollover. This commit adds the new ids and fingerprints in the keys appendix of the manual, and moves the old ones down into the historic-keys section. I've tweaked a few pieces of wording for ongoing use, so that they don't imply a specific number of past key rollovers. The -pgpfp option in all the tools now shows the new Master Key fingerprint and the previous (2015) one. I've adjusted all the uses of the #defines in putty.h so that future rollovers should only have to modify the #defines themselves. Most importantly, sign.sh bakes in the ids of the current release and snapshot keys, so that snapshots will automatically be signed with the new snapshot key and the -r option will invoke the new release key.
2018-08-25 13:36:25 +00:00
"Previous Master Key (" PGP_PREV_MASTER_KEY_YEAR
", " PGP_PREV_MASTER_KEY_DETAILS "):\n"
" " PGP_PREV_MASTER_KEY_FP "\n", stdout);
Try to make our PGP signing more useful: * All the PuTTY tools for Windows and Unix now contain the fingerprints of the Master Keys. The method for accessing them is crude but universal: a new "-pgpfp" command-line option. (Except Unix PuTTYgen, which takes "--pgpfp" just to be awkward.) * Move the key policy discussion from putty-website/keys.html to putty/doc/pgpkeys.but, and autogenerate the former from the latter. Also tweak the text somewhat and include the fingerprints of the Master Keys themselves. (I've merged the existing autogeneration scripts into a single new one; I've left the old scripts and keys.html around until such time as the webmonster reviews the changes and plumbs in the new script; he should remove the old files then.) [originally from svn r5524] [this svn revision also touched putty-website]
2005-03-19 02:26:58 +00:00
}
Refactor the LogContext type. LogContext is now the owner of the logevent() function that back ends and so forth are constantly calling. Previously, logevent was owned by the Frontend, which would store the message into its list for the GUI Event Log dialog (or print it to standard error, or whatever) and then pass it _back_ to LogContext to write to the currently open log file. Now it's the other way round: LogContext gets the message from the back end first, writes it to its log file if it feels so inclined, and communicates it back to the front end. This means that lots of parts of the back end system no longer need to have a pointer to a full-on Frontend; the only thing they needed it for was logging, so now they just have a LogContext (which many of them had to have anyway, e.g. for logging SSH packets or session traffic). LogContext itself also doesn't get a full Frontend pointer any more: it now talks back to the front end via a little vtable of its own called LogPolicy, which contains the method that passes Event Log entries through, the old askappend() function that decides whether to truncate a pre-existing log file, and an emergency function for printing an especially prominent message if the log file can't be created. One minor nice effect of this is that console and GUI apps can implement that last function subtly differently, so that Unix console apps can write it with a plain \n instead of the \r\n (harmless but inelegant) that the old centralised implementation generated. One other consequence of this is that the LogContext has to be provided to backend_init() so that it's available to backends from the instant of creation, rather than being provided via a separate API call a couple of function calls later, because backends have typically started doing things that need logging (like making network connections) before the call to backend_provide_logctx. Fortunately, there's no case in the whole code base where we don't already have logctx by the time we make a backend (so I don't actually remember why I ever delayed providing one). So that shortens the backend API by one function, which is always nice. While I'm tidying up, I've also moved the printf-style logeventf() and the handy logevent_and_free() into logging.c, instead of having copies of them scattered around other places. This has also let me remove some stub functions from a couple of outlying applications like Pageant. Finally, I've removed the pointless "_tag" at the end of LogContext's official struct name.
2018-10-10 18:26:18 +00:00
static void console_logging_error(LogPolicy *lp, const char *string)
Fix "-v" in the Windows console utilities (plink, pscp, psftp). I'm not convinced I've done this the right way (I've introduced a static for logctx in console.c) but it will do for now. [originally from svn r2674]
2003-01-21 19:18:06 +00:00
{
Refactor the LogContext type. LogContext is now the owner of the logevent() function that back ends and so forth are constantly calling. Previously, logevent was owned by the Frontend, which would store the message into its list for the GUI Event Log dialog (or print it to standard error, or whatever) and then pass it _back_ to LogContext to write to the currently open log file. Now it's the other way round: LogContext gets the message from the back end first, writes it to its log file if it feels so inclined, and communicates it back to the front end. This means that lots of parts of the back end system no longer need to have a pointer to a full-on Frontend; the only thing they needed it for was logging, so now they just have a LogContext (which many of them had to have anyway, e.g. for logging SSH packets or session traffic). LogContext itself also doesn't get a full Frontend pointer any more: it now talks back to the front end via a little vtable of its own called LogPolicy, which contains the method that passes Event Log entries through, the old askappend() function that decides whether to truncate a pre-existing log file, and an emergency function for printing an especially prominent message if the log file can't be created. One minor nice effect of this is that console and GUI apps can implement that last function subtly differently, so that Unix console apps can write it with a plain \n instead of the \r\n (harmless but inelegant) that the old centralised implementation generated. One other consequence of this is that the LogContext has to be provided to backend_init() so that it's available to backends from the instant of creation, rather than being provided via a separate API call a couple of function calls later, because backends have typically started doing things that need logging (like making network connections) before the call to backend_provide_logctx. Fortunately, there's no case in the whole code base where we don't already have logctx by the time we make a backend (so I don't actually remember why I ever delayed providing one). So that shortens the backend API by one function, which is always nice. While I'm tidying up, I've also moved the printf-style logeventf() and the handy logevent_and_free() into logging.c, instead of having copies of them scattered around other places. This has also let me remove some stub functions from a couple of outlying applications like Pageant. Finally, I've removed the pointless "_tag" at the end of LogContext's official struct name.
2018-10-10 18:26:18 +00:00
/* Ordinary Event Log entries are displayed in the same way as
* logging errors, but only in verbose mode */
fprintf(stderr, "%s\n", string);
fflush(stderr);
Fix "-v" in the Windows console utilities (plink, pscp, psftp). I'm not convinced I've done this the right way (I've introduced a static for logctx in console.c) but it will do for now. [originally from svn r2674]
2003-01-21 19:18:06 +00:00
}
Refactor the LogContext type. LogContext is now the owner of the logevent() function that back ends and so forth are constantly calling. Previously, logevent was owned by the Frontend, which would store the message into its list for the GUI Event Log dialog (or print it to standard error, or whatever) and then pass it _back_ to LogContext to write to the currently open log file. Now it's the other way round: LogContext gets the message from the back end first, writes it to its log file if it feels so inclined, and communicates it back to the front end. This means that lots of parts of the back end system no longer need to have a pointer to a full-on Frontend; the only thing they needed it for was logging, so now they just have a LogContext (which many of them had to have anyway, e.g. for logging SSH packets or session traffic). LogContext itself also doesn't get a full Frontend pointer any more: it now talks back to the front end via a little vtable of its own called LogPolicy, which contains the method that passes Event Log entries through, the old askappend() function that decides whether to truncate a pre-existing log file, and an emergency function for printing an especially prominent message if the log file can't be created. One minor nice effect of this is that console and GUI apps can implement that last function subtly differently, so that Unix console apps can write it with a plain \n instead of the \r\n (harmless but inelegant) that the old centralised implementation generated. One other consequence of this is that the LogContext has to be provided to backend_init() so that it's available to backends from the instant of creation, rather than being provided via a separate API call a couple of function calls later, because backends have typically started doing things that need logging (like making network connections) before the call to backend_provide_logctx. Fortunately, there's no case in the whole code base where we don't already have logctx by the time we make a backend (so I don't actually remember why I ever delayed providing one). So that shortens the backend API by one function, which is always nice. While I'm tidying up, I've also moved the printf-style logeventf() and the handy logevent_and_free() into logging.c, instead of having copies of them scattered around other places. This has also let me remove some stub functions from a couple of outlying applications like Pageant. Finally, I've removed the pointless "_tag" at the end of LogContext's official struct name.
2018-10-10 18:26:18 +00:00
static void console_eventlog(LogPolicy *lp, const char *string)
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
{
Refactor the LogContext type. LogContext is now the owner of the logevent() function that back ends and so forth are constantly calling. Previously, logevent was owned by the Frontend, which would store the message into its list for the GUI Event Log dialog (or print it to standard error, or whatever) and then pass it _back_ to LogContext to write to the currently open log file. Now it's the other way round: LogContext gets the message from the back end first, writes it to its log file if it feels so inclined, and communicates it back to the front end. This means that lots of parts of the back end system no longer need to have a pointer to a full-on Frontend; the only thing they needed it for was logging, so now they just have a LogContext (which many of them had to have anyway, e.g. for logging SSH packets or session traffic). LogContext itself also doesn't get a full Frontend pointer any more: it now talks back to the front end via a little vtable of its own called LogPolicy, which contains the method that passes Event Log entries through, the old askappend() function that decides whether to truncate a pre-existing log file, and an emergency function for printing an especially prominent message if the log file can't be created. One minor nice effect of this is that console and GUI apps can implement that last function subtly differently, so that Unix console apps can write it with a plain \n instead of the \r\n (harmless but inelegant) that the old centralised implementation generated. One other consequence of this is that the LogContext has to be provided to backend_init() so that it's available to backends from the instant of creation, rather than being provided via a separate API call a couple of function calls later, because backends have typically started doing things that need logging (like making network connections) before the call to backend_provide_logctx. Fortunately, there's no case in the whole code base where we don't already have logctx by the time we make a backend (so I don't actually remember why I ever delayed providing one). So that shortens the backend API by one function, which is always nice. While I'm tidying up, I've also moved the printf-style logeventf() and the handy logevent_and_free() into logging.c, instead of having copies of them scattered around other places. This has also let me remove some stub functions from a couple of outlying applications like Pageant. Finally, I've removed the pointless "_tag" at the end of LogContext's official struct name.
2018-10-10 18:26:18 +00:00
/* Ordinary Event Log entries are displayed in the same way as
* logging errors, but only in verbose mode */
if (flags & FLAG_VERBOSE)
console_logging_error(lp, string);
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
static void console_data_untrusted(HANDLE hout, const char *data, int len)
{
DWORD dummy;
Rework handling of untrusted terminal data. Now there's a centralised routine in misc.c to do the sanitisation, which copies data on to an outgoing bufchain. This allows me to remove from_backend_untrusted() completely from the frontend API, simplifying code in several places. Two use cases for untrusted-terminal-data sanitisation were in the terminal.c prompts handler, and in the collection of SSH-2 userauth banners. Both of those were writing output to a bufchain anyway, so it was very convenient to just replace a bufchain_add with sanitise_term_data and then not have to worry about it again. There was also a simplistic sanitiser in uxcons.c, which I've now replaced with a call to the good one - and in wincons.c there was a FIXME saying I ought to get round to that, which now I have!
2018-09-19 17:22:36 +00:00
bufchain sanitised;
void *vdata;
bufchain_init(&sanitised);
sanitise_term_data(&sanitised, data, len);
while (bufchain_size(&sanitised) > 0) {
bufchain_prefix(&sanitised, &vdata, &len);
WriteFile(hout, vdata, len, &dummy, NULL);
bufchain_consume(&sanitised, len);
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
Remove unused params from console_get_userpass_input. NFC: this is a preliminary refactoring, intended to make my life easier when I start changing around the APIs used to pass user keyboard input around. The fewer functions even _have_ such an API, the less I'll have to do at that point.
2018-05-18 06:22:56 +00:00
int console_get_userpass_input(prompts_t *p)
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
{
Fix a few compiler warnings from MinGW. A few variables that gcc couldn't tell I'd initialised on all the important paths, a variable that didn't really need to be there anyway, and yet another use of GET_WINDOWS_FUNCTION_NO_TYPECHECK.
2018-06-03 20:48:08 +00:00
HANDLE hin = INVALID_HANDLE_VALUE, hout = INVALID_HANDLE_VALUE;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
size_t curr_prompt;
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* Zero all the results, in case we abort half-way through.
*/
{
int i;
Get rid of all the MSVC warnings. [originally from svn r7086]
2007-01-09 18:24:07 +00:00
for (i = 0; i < (int)p->n_prompts; i++)
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
prompt_set_result(p->prompts[i], "");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
Handle more gracefully the possibility of a keyboard-interactive prompts packet containing no actual prompts (perhaps due to odd server organisation, or perhaps so it can print a banner message and do nothing else). Previously, the get_userpass_input functions always returned failure when in '-batch' mode, even in this case where no actual input would be required. [originally from svn r8490]
2009-03-03 18:35:53 +00:00
/*
* The prompts_t might contain a message to be displayed but no
* actual prompt. More usually, though, it will contain
* questions that the user needs to answer, in which case we
* need to ensure that we're able to get the answers.
*/
if (p->n_prompts) {
if (console_batch_mode)
return 0;
hin = GetStdHandle(STD_INPUT_HANDLE);
if (hin == INVALID_HANDLE_VALUE) {
fprintf(stderr, "Cannot get standard input handle\n");
cleanup_exit(1);
}
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Handle more gracefully the possibility of a keyboard-interactive prompts packet containing no actual prompts (perhaps due to odd server organisation, or perhaps so it can print a banner message and do nothing else). Previously, the get_userpass_input functions always returned failure when in '-batch' mode, even in this case where no actual input would be required. [originally from svn r8490]
2009-03-03 18:35:53 +00:00
/*
* And if we have anything to print, we need standard output.
*/
if ((p->name_reqd && p->name) || p->instruction || p->n_prompts) {
hout = GetStdHandle(STD_OUTPUT_HANDLE);
if (hout == INVALID_HANDLE_VALUE) {
fprintf(stderr, "Cannot get standard output handle\n");
cleanup_exit(1);
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
/*
* Preamble.
*/
/* We only print the `name' caption if we have to... */
if (p->name_reqd && p->name) {
size_t l = strlen(p->name);
console_data_untrusted(hout, p->name, l);
if (p->name[l-1] != '\n')
console_data_untrusted(hout, "\n", 1);
}
/* ...but we always print any `instruction'. */
if (p->instruction) {
size_t l = strlen(p->instruction);
console_data_untrusted(hout, p->instruction, l);
if (p->instruction[l-1] != '\n')
console_data_untrusted(hout, "\n", 1);
}
for (curr_prompt = 0; curr_prompt < p->n_prompts; curr_prompt++) {
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
DWORD savemode, newmode;
int len;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
prompt_t *pr = p->prompts[curr_prompt];
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
GetConsoleMode(hin, &savemode);
newmode = savemode | ENABLE_PROCESSED_INPUT | ENABLE_LINE_INPUT;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (!pr->echo)
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
newmode &= ~ENABLE_ECHO_INPUT;
else
newmode |= ENABLE_ECHO_INPUT;
SetConsoleMode(hin, newmode);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
console_data_untrusted(hout, pr->prompt, strlen(pr->prompt));
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
len = 0;
while (1) {
DWORD ret = 0;
BOOL r;
prompt_ensure_result_size(pr, len * 5 / 4 + 512);
r = ReadFile(hin, pr->result + len, pr->resultsize - len - 1,
&ret, NULL);
if (!r || ret == 0) {
len = -1;
break;
}
len += ret;
if (pr->result[len - 1] == '\n') {
len--;
if (pr->result[len - 1] == '\r')
len--;
break;
}
}
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
SetConsoleMode(hin, savemode);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (!pr->echo) {
DWORD dummy;
WriteFile(hout, "\r\n", 2, &dummy, NULL);
}
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
if (len < 0) {
return 0; /* failure due to read error */
}
pr->result[len] = '\0';
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
return 1; /* success */
Create the long-awaited console.c, and move the common routines out of scp.c, psftp.c and plink.c into it. Additionally, add `batch mode', in which all the interactive prompts (bad host key, log file exists, insecure cipher, password prompt) are disabled and safe responses are assumed. (The idea being that if you run PSCP, for example, in a cron job then you'd probably rather it failed and exited instead of leaving the cron job wedged while it waits for user input that will never arrive.) [originally from svn r1525]
2001-12-31 16:15:19 +00:00
}
Need to stub frontend_keypress() in console.c as well as window.c. [originally from svn r2126]
2002-10-24 14:48:08 +00:00
Refactor the LogContext type. LogContext is now the owner of the logevent() function that back ends and so forth are constantly calling. Previously, logevent was owned by the Frontend, which would store the message into its list for the GUI Event Log dialog (or print it to standard error, or whatever) and then pass it _back_ to LogContext to write to the currently open log file. Now it's the other way round: LogContext gets the message from the back end first, writes it to its log file if it feels so inclined, and communicates it back to the front end. This means that lots of parts of the back end system no longer need to have a pointer to a full-on Frontend; the only thing they needed it for was logging, so now they just have a LogContext (which many of them had to have anyway, e.g. for logging SSH packets or session traffic). LogContext itself also doesn't get a full Frontend pointer any more: it now talks back to the front end via a little vtable of its own called LogPolicy, which contains the method that passes Event Log entries through, the old askappend() function that decides whether to truncate a pre-existing log file, and an emergency function for printing an especially prominent message if the log file can't be created. One minor nice effect of this is that console and GUI apps can implement that last function subtly differently, so that Unix console apps can write it with a plain \n instead of the \r\n (harmless but inelegant) that the old centralised implementation generated. One other consequence of this is that the LogContext has to be provided to backend_init() so that it's available to backends from the instant of creation, rather than being provided via a separate API call a couple of function calls later, because backends have typically started doing things that need logging (like making network connections) before the call to backend_provide_logctx. Fortunately, there's no case in the whole code base where we don't already have logctx by the time we make a backend (so I don't actually remember why I ever delayed providing one). So that shortens the backend API by one function, which is always nice. While I'm tidying up, I've also moved the printf-style logeventf() and the handy logevent_and_free() into logging.c, instead of having copies of them scattered around other places. This has also let me remove some stub functions from a couple of outlying applications like Pageant. Finally, I've removed the pointless "_tag" at the end of LogContext's official struct name.
2018-10-10 18:26:18 +00:00
static const LogPolicyVtable default_logpolicy_vt = {
console_eventlog,
console_askappend,
console_logging_error,
};
LogPolicy default_logpolicy[1] = {{ &default_logpolicy_vt }};
Reference in New Issue Copy Permalink