Revamp SSH authentication code so that user interaction is more

abstracted out; replace loops structured around a single interaction
per loop with less tortuous code (fixes: `ki-multiprompt-crash',
`ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and
`proxy-password-prompt' easier).

The new interaction abstraction has a lot of fields that are unused in
the current code (things like window captions); this is groundwork for
`gui-auth'. However, ssh.c still writes directly to stderr; that may
want to be fixed.

In the GUI apps, user interaction is moved to terminal.c. This should
make it easier to fix things like UTF-8 username entry, although I
haven't attempted to do so. Also, control character filtering can be
tailored to be appropriate for individual front-ends; so far I don't
promise anything other than not having made it any worse.

I've tried to test this fairly exhaustively (although Mac stuff is
untested, as usual). It all seems to basically work, but I bet there
are new bugs. (One I know about is that you can no longer make the
PuTTY window go away with a ^D at the password prompt; this should be
fixed.)

[originally from svn r6437]
[this svn revision also touched putty-wishlist]

unix/gtkwin.c

@@ -189,6 +189,22 @@ int from_backend(void *frontend, int is_stderr, const char *data, int len)
     return term_data(inst->term, is_stderr, data, len);
 }
 
+int from_backend_untrusted(void *frontend, const char *data, int len)
+{
+    struct gui_data *inst = (struct gui_data *)frontend;
+    return term_data_untrusted(inst->term, data, len);
+}
+
+int get_userpass_input(prompts_t *p, unsigned char *in, int inlen)
+{
+    struct gui_data *inst = (struct gui_data *)p->frontend;
+    int ret;
+    ret = cmdline_get_passwd_input(p, in, inlen);
+    if (ret == -1)
+	ret = term_get_userpass_input(inst->term, p, in, inlen);
+    return ret;
+}
+
 void logevent(void *frontend, const char *string)
 {
     struct gui_data *inst = (struct gui_data *)frontend;

unix/uxcons.c

@@ -280,41 +280,81 @@ void logevent(void *frontend, const char *string)
 	log_eventlog(console_logctx, string);
 }
 
-int console_get_line(const char *prompt, char *str,
-		     int maxlen, int is_pw)
+static void console_data_untrusted(const char *data, int len)
 {
-    struct termios oldmode, newmode;
     int i;
+    for (i = 0; i < len; i++)
+	if ((data[i] & 0x60) || (data[i] == '\n'))
+	    fputc(data[i], stdout);
+    fflush(stdout);
+}
 
-    if (console_batch_mode) {
-	if (maxlen > 0)
-	    str[0] = '\0';
+int console_get_userpass_input(prompts_t *p, unsigned char *in, int inlen)
+{
+    size_t curr_prompt;
+
+    /*
+     * Zero all the results, in case we abort half-way through.
+     */
+    {
+	int i;
+	for (i = 0; i < p->n_prompts; i++)
+	    memset(p->prompts[i]->result, 0, p->prompts[i]->result_len);
+    }
+
+    if (console_batch_mode)
 	return 0;
-    } else {
+
+    /*
+     * Preamble.
+     */
+    /* We only print the `name' caption if we have to... */
+    if (p->name_reqd && p->name) {
+	size_t l = strlen(p->name);
+	console_data_untrusted(p->name, l);
+	if (p->name[l-1] != '\n')
+	    console_data_untrusted("\n", 1);
+    }
+    /* ...but we always print any `instruction'. */
+    if (p->instruction) {
+	size_t l = strlen(p->instruction);
+	console_data_untrusted(p->instruction, l);
+	if (p->instruction[l-1] != '\n')
+	    console_data_untrusted("\n", 1);
+    }
+
+    for (curr_prompt = 0; curr_prompt < p->n_prompts; curr_prompt++) {
+
+	struct termios oldmode, newmode;
+	int i;
+	prompt_t *pr = p->prompts[curr_prompt];
+
 	tcgetattr(0, &oldmode);
 	newmode = oldmode;
 	newmode.c_lflag |= ISIG | ICANON;
-	if (is_pw)
+	if (!pr->echo)
 	    newmode.c_lflag &= ~ECHO;
 	else
 	    newmode.c_lflag |= ECHO;
 	tcsetattr(0, TCSANOW, &newmode);
 
-	fputs(prompt, stdout);
-	fflush(stdout);
-	i = read(0, str, maxlen - 1);
+	console_data_untrusted(pr->prompt, strlen(pr->prompt));
+
+	i = read(0, pr->result, pr->result_len - 1);
 
 	tcsetattr(0, TCSANOW, &oldmode);
 
-	if (i > 0 && str[i-1] == '\n')
+	if (i > 0 && pr->result[i-1] == '\n')
 	    i--;
-	str[i] = '\0';
+	pr->result[i] = '\0';
 
-	if (is_pw)
+	if (!pr->echo)
 	    fputs("\n", stdout);
 
-	return 1;
     }
+
+    return 1; /* success */
+
 }
 
 void frontend_keypress(void *handle)

unix/uxplink.c

@@ -394,6 +394,25 @@ int from_backend(void *frontend_handle, int is_stderr,
     return osize + esize;
 }
 
+int from_backend_untrusted(void *frontend_handle, const char *data, int len)
+{
+    /*
+     * No "untrusted" output should get here (the way the code is
+     * currently, it's all diverted by FLAG_STDERR).
+     */
+    assert(!"Unexpected call to from_backend_untrusted()");
+    return 0; /* not reached */
+}
+
+int get_userpass_input(prompts_t *p, unsigned char *in, int inlen)
+{
+    int ret;
+    ret = cmdline_get_passwd_input(p, in, inlen);
+    if (ret == -1)
+	ret = console_get_userpass_input(p, in, inlen);
+    return ret;
+}
+
 /*
  * Handle data from a local tty in PARMRK format.
  */
@@ -534,8 +553,6 @@ int main(int argc, char **argv)
     void *ldisc, *logctx;
     long now;
 
-    ssh_get_line = console_get_line;
-
     fdlist = NULL;
     fdcount = fdsize = 0;
     /*

unix/uxsftp.c

@@ -70,6 +70,15 @@ Filename platform_default_filename(const char *name)
 
 char *get_ttymode(void *frontend, const char *mode) { return NULL; }
 
+int get_userpass_input(prompts_t *p, unsigned char *in, int inlen)
+{
+    int ret;
+    ret = cmdline_get_passwd_input(p, in, inlen);
+    if (ret == -1)
+	ret = console_get_userpass_input(p, in, inlen);
+    return ret;
+}
+
 /*
  * Stubs for the GUI feedback mechanism in Windows PSCP.
  */