[PATCH] Avoid crippled getpass function on Solaris

[PATCH] Avoid crippled getpass function on Solaris

[Ben Walton]

On Solaris getpass() returns at most 8 characters which cripples the
credential reading for accounts using longer passwords.  The alternate
function getpassphrase() was introduced in SunOS 5.6 and will return
up to 256 characters.

Ensure that git_terminal_prompt uses the more able function when
building on Solaris.

Signed-off-by: Ben Walton <bwalton@artsci.utoronto.ca>
---

Hi Jeff and Junio,

I considered making this minor change a few different ways but settled
on this as it seemed (to my eye) to most closely adhere to the way
other such things were done in the compatibility code. I'm entirely
open to modifying this if it's felt that there is a clearer/cleaner
way to do it.

I'd even considered making the function swap generic enough to be
driven by the build system.  That seemed over the top though, given
that most systems either have a decent getpass() or don't use this
code path at all.

I've also briefly dabbled with getting Solaris to simply use the
HAVE_DEV_TTY code path but the terminal echo stuff hasn't worked
nicely for me just yet.  (It reads the password with nothing echoed
but then displays the string after reading the newline.)  This might
still be a better approach in the future, but for now, having long
password reading capability will still be a benefit to users on this
platform.

Thanks
-Ben

 compat/terminal.c |    2 +-
 compat/terminal.h |    9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/compat/terminal.c b/compat/terminal.c
index 6d16c8f..e1ab536 100644
--- a/compat/terminal.c
+++ b/compat/terminal.c
@@ -75,7 +75,7 @@ char *git_terminal_prompt(const char *prompt, int echo)
 
 char *git_terminal_prompt(const char *prompt, int echo)
 {
-	return getpass(prompt);
+	return GETPASS(prompt);
 }
 
 #endif
diff --git a/compat/terminal.h b/compat/terminal.h
index 97db7cd..8d7b3f9 100644
--- a/compat/terminal.h
+++ b/compat/terminal.h
@@ -3,4 +3,13 @@
 
 char *git_terminal_prompt(const char *prompt, int echo);
 
+/* getpass() returns at most 8 characters on solaris so use
+   getpassphrase() which returns up to 256. */
+# if defined (__SVR4) && defined (__sun) /* solaris */
+#define GETPASS getpassphrase
+#else
+#define GETPASS getpass
+#endif
+
+
 #endif /* COMPAT_TERMINAL_H */
-- 
1.7.10.3

Re: [PATCH] Avoid crippled getpass function on Solaris

[Tay Ray Chuan]

On Mon, Aug 6, 2012 at 7:17 AM, Ben Walton <bwalton@artsci.utoronto.ca> wrote:
> I've also briefly dabbled with getting Solaris to simply use the
> HAVE_DEV_TTY code path but the terminal echo stuff hasn't worked
> nicely for me just yet.  (It reads the password with nothing echoed
> but then displays the string after reading the newline.)  This might
> still be a better approach in the future, but for now, having long
> password reading capability will still be a benefit to users on this
> platform.

Replacing

	if (!echo) {
		putc('\n', fh);
		fflush(fh);
	}

with

	if (!echo)
		write(term_fd, "\n", 1);

fixed that. Using fd's instead of FILE* was mentioned at [1]. Perhaps
that is the direction to go in.

[1] http://mid.gmane.org/<7vsjc12j5o.fsf@alter.siamese.dyndns.org>

-- 
Cheers,
Ray Chuan

Re: [PATCH] Avoid crippled getpass function on Solaris

[Junio C Hamano]

Ben Walton <bwalton@artsci.utoronto.ca> writes:

> diff --git a/compat/terminal.h b/compat/terminal.h
> index 97db7cd..8d7b3f9 100644
> --- a/compat/terminal.h
> +++ b/compat/terminal.h
> @@ -3,4 +3,13 @@
>  
>  char *git_terminal_prompt(const char *prompt, int echo);
>  
> +/* getpass() returns at most 8 characters on solaris so use
> +   getpassphrase() which returns up to 256. */
> +# if defined (__SVR4) && defined (__sun) /* solaris */
> +#define GETPASS getpassphrase
> +#else
> +#define GETPASS getpass
> +#endif
> +
> +
>  #endif /* COMPAT_TERMINAL_H */

Wouldn't

	#if solaris
        #define getpass getpassphrase
        #endif

without anything else be more than sufficient?

Re: [PATCH] Avoid crippled getpass function on Solaris

[Ben Walton]

Excerpts from Junio C Hamano's message of Sun Aug 05 21:59:48 -0400 2012:
> Wouldn't
> 
>     #if solaris
>         #define getpass getpassphrase
>         #endif
> 
> without anything else be more than sufficient?

Yes, it would, but I was hoping to make it more explicit that the
function getpass may be substituted with something else.

Thanks
-Ben
--
Ben Walton
Systems Programmer - CHASS
University of Toronto
C:416.407.5610 | W:416.978.4302

Re: [PATCH] Avoid crippled getpass function on Solaris

[Ben Walton]

Excerpts from Tay Ray Chuan's message of Sun Aug 05 21:56:55 -0400 2012:

> > I've also briefly dabbled with getting Solaris to simply use the
> > HAVE_DEV_TTY code path but the terminal echo stuff hasn't worked
> > nicely for me just yet.  (It reads the password with nothing
> > echoed but then displays the string after reading the newline.)
> > This might still be a better approach in the future, but for now,
> > having long password reading capability will still be a benefit to
> > users on this platform.
> 
> Replacing
> 
>     if (!echo) {
>         putc('\n', fh);
>         fflush(fh);
>     }
> 
> with
> 
>     if (!echo)
>         write(term_fd, "\n", 1);
> 
> fixed that. Using fd's instead of FILE* was mentioned at [1]. Perhaps
> that is the direction to go in.

Oh, interesting.  I'd missed your update of this thread earlier
today.  It may make sense to do everything via file descriptors
directly as you suggested in your comments on that patch.

Thanks
-Ben
--
Ben Walton
Systems Programmer - CHASS
University of Toronto
C:416.407.5610 | W:416.978.4302

Re: [PATCH] Avoid crippled getpass function on Solaris

[Jeff King]

On Sun, Aug 05, 2012 at 10:35:06PM -0400, Ben Walton wrote:

> Excerpts from Junio C Hamano's message of Sun Aug 05 21:59:48 -0400 2012:
> > Wouldn't
> > 
> >     #if solaris
> >         #define getpass getpassphrase
> >         #endif
> > 
> > without anything else be more than sufficient?
> 
> Yes, it would, but I was hoping to make it more explicit that the
> function getpass may be substituted with something else.

I don't think that's important. Either the thing is a drop-in replica of
getpass, or it is not. In the former case, it's OK for it to be
transparent that it has been replaced. In the latter case, it should not
be a #define replacement at all, but should be its own alternative in
compat/terminal.c (just like HAVE_DEV_TTY is).  From my reading of
getpassphrase, it does seem to be a drop-in replacement.

So I'm OK conceptually with the patch if we can't do any better. But
getpass still sucks. It doesn't handle echoing, and it may or may not
fall back to reading from stdin if the tty isn't available (which is
disastrous for remote-curl, whose stdin is speaking the remote-helper
protocol to git). So I'd really prefer to make HAVE_DEV_TTY work with
Solaris if we can.

I'm happy to spend a few cycles on it.  I don't have access to any real
Solaris boxes these days, but I imagine I can get OpenSolaris running
under VirtualBox without too much trouble...

-Peff

PS If we do go the getpassphrase route, does it make sense to introduce
   HAVE_GETPASSPHRASE? We usually try to provide one layer of
   indirection by naming our #defines after features, and then
   connecting systems to the feature defines via the Makefile. But maybe
   Solaris is the only system that has getpassphrase.

Re: [PATCH] Avoid crippled getpass function on Solaris

[Junio C Hamano]

Jeff King <peff@peff.net> writes:

> ....  From my reading of
> getpassphrase, it does seem to be a drop-in replacement.
>
> So I'm OK conceptually with the patch if we can't do any better. But
> getpass still sucks. It doesn't handle echoing, and it may or may not
> fall back to reading from stdin if the tty isn't available (which is
> disastrous for remote-curl, whose stdin is speaking the remote-helper
> protocol to git). So I'd really prefer to make HAVE_DEV_TTY work with
> Solaris if we can.

Tay Ray Chuan mentioned in the thread near-by that HAVE_DEV_TTY
codepath worked for him with "FILE *" to fd conversion, I think.

Re: [PATCH] Avoid crippled getpass function on Solaris

[Ben Walton]

Excerpts from Jeff King's message of Mon Aug 06 15:39:58 -0400 2012:
> On Sun, Aug 05, 2012 at 10:35:06PM -0400, Ben Walton wrote:
> 
> > Excerpts from Junio C Hamano's message of Sun Aug 05 21:59:48 -0400 2012:
> > > Wouldn't
> > > 
> > >     #if solaris
> > >         #define getpass getpassphrase
> > >         #endif
> > > 
> > > without anything else be more than sufficient?
> > 
> > Yes, it would, but I was hoping to make it more explicit that the
> > function getpass may be substituted with something else.
> 
> I don't think that's important. Either the thing is a drop-in replica of
> getpass, or it is not. In the former case, it's OK for it to be
> transparent that it has been replaced. In the latter case, it should not
> be a #define replacement at all, but should be its own alternative in
> compat/terminal.c (just like HAVE_DEV_TTY is).  From my reading of
> getpassphrase, it does seem to be a drop-in replacement.

It is a drop in replacement (identical signature) so that's no issue.
I can simplify this to the form suggested by Junio if that's
preferrable.  My idea of explicitness was for the programmer though.
I think it's easier for someone else reading this code later to
realize that the GETPASS function may change depending on conditions.

But, as I said, I'm not adverse to changing this in any way, I simply
want the improved functionality and am not married to the approach.
(I considered about three different ways of doing this before
submitting.)

> So I'm OK conceptually with the patch if we can't do any better. But
> getpass still sucks. It doesn't handle echoing, and it may or may
> not fall back to reading from stdin if the tty isn't available
> (which is disastrous for remote-curl, whose stdin is speaking the
> remote-helper protocol to git). So I'd really prefer to make
> HAVE_DEV_TTY work with Solaris if we can.

I poked through getpass in the opensolaris code and it did fall back
to reading from stdin[1] if there were issues opening /dev/tty so
there is room for trouble here.  That doesn't mean that other versions
of Solaris did it this way, but it's fairly likely that they did given
the culture.

> I'm happy to spend a few cycles on it.  I don't have access to any
> real Solaris boxes these days, but I imagine I can get OpenSolaris
> running under VirtualBox without too much trouble...

I'm also happy to do this work and have ready access to Solaris 8-11.
Would it be reasonable to support using getpassphrase() if
!HAVE_DEV_TTY in addition to making the HAVE_DEV_TTY code function on
Solaris too?  That would provide a harm reduction for Solaris users
that (for some reason) disabled the nicer interface...but maybe it's
too much?

> PS If we do go the getpassphrase route, does it make sense to
>    introduce HAVE_GETPASSPHRASE? We usually try to provide one layer
>    of indirection by naming our #defines after features, and then
>    connecting systems to the feature defines via the Makefile. But
>    maybe Solaris is the only system that has getpassphrase.

I had considered this but thought that it was too heavy weight given
that I'm not aware of other platforms that have this naming split
depending on desired buffer size and that getpass on most platforms
won't have this crippling size limitation.

If it's worth improving both paths for the HAVE_DEV_TTY code on
Solaris, I can add this support if that's considered the better
approach.

Thanks
-Ben

[1] http://src.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/lib/libbc/libc/gen/common/getpass.c#65
--
Ben Walton
Systems Programmer - CHASS
University of Toronto
C:416.407.5610 | W:416.978.4302

Re: [PATCH] Avoid crippled getpass function on Solaris

[Jeff King]

On Mon, Aug 06, 2012 at 05:31:00PM -0400, Ben Walton wrote:

> > I'm happy to spend a few cycles on it.  I don't have access to any
> > real Solaris boxes these days, but I imagine I can get OpenSolaris
> > running under VirtualBox without too much trouble...
> 
> I'm also happy to do this work and have ready access to Solaris 8-11.

I'm currently in pkgutil hell trying to remember how to get a working
gcc on Solaris. Bleh. What kind of OS doesn't ship with a compiler by
default? :)

> Would it be reasonable to support using getpassphrase() if
> !HAVE_DEV_TTY in addition to making the HAVE_DEV_TTY code function on
> Solaris too?  That would provide a harm reduction for Solaris users
> that (for some reason) disabled the nicer interface...but maybe it's
> too much?

If you think there is a reason that somebody on Solaris might not want
to use HAVE_DEV_TTY, then I guess it makes sense. But I can't really
think of one, so I'd be just as happy to leave it until somebody does.

-Peff

Re: [PATCH] Avoid crippled getpass function on Solaris

[Ben Walton]

Excerpts from Jeff King's message of Mon Aug 06 17:34:04 -0400 2012:
> On Mon, Aug 06, 2012 at 05:31:00PM -0400, Ben Walton wrote:
> 
> > > I'm happy to spend a few cycles on it.  I don't have access to any
> > > real Solaris boxes these days, but I imagine I can get OpenSolaris
> > > running under VirtualBox without too much trouble...
> > 
> > I'm also happy to do this work and have ready access to Solaris 8-11.
> 
> I'm currently in pkgutil hell trying to remember how to get a working
> gcc on Solaris. Bleh. What kind of OS doesn't ship with a compiler by
> default? :)

One that's losing mindshare and isn't gaining traction? *g*  Feel free
to message me offline if you need a hand with that.

> > Would it be reasonable to support using getpassphrase() if
> > !HAVE_DEV_TTY in addition to making the HAVE_DEV_TTY code function
> > on Solaris too?  That would provide a harm reduction for Solaris
> > users that (for some reason) disabled the nicer interface...but
> > maybe it's too much?
> 
> If you think there is a reason that somebody on Solaris might not
> want to use HAVE_DEV_TTY, then I guess it makes sense. But I can't
> really think of one, so I'd be just as happy to leave it until
> somebody does.

No, I can't think of a _good_ reason to do that either.

Thanks
-Ben
--
Ben Walton
Systems Programmer - CHASS
University of Toronto
C:416.407.5610 | W:416.978.4302

Re: [PATCH] Avoid crippled getpass function on Solaris

[Jeff King]

On Mon, Aug 06, 2012 at 06:09:08PM -0400, Ben Walton wrote:

> > I'm currently in pkgutil hell trying to remember how to get a working
> > gcc on Solaris. Bleh. What kind of OS doesn't ship with a compiler by
> > default? :)
> 
> One that's losing mindshare and isn't gaining traction? *g*  Feel free
> to message me offline if you need a hand with that.

Thanks, I figured it out (I installed opencsw's gcc, but I had no
standard include files. Turns out that I needed the system/header
package from upstream).

The stdio behavior on Solaris is weird. If I run this sample program:

  #include <stdio.h>
  int main(void)
  {
    FILE *fh = fopen("/dev/tty", "w+");
    char buf[32] = {0};
    fgets(buf, sizeof(buf), fh);
    fprintf(fh, "got %s\n", buf);
    return 0;
  }

on Linux, I get:

  $ ./a.out
  foo        <-- me typing
  got foo    <-- program output

On Solaris, I get:

  $ ./a.out
  foo        <-- me typing
  foo        <-- ???
  got foo    <-- program output

If you step it through the debugger, the mystery output comes as part of
the fprintf, as if it is in the buffer waiting to be flushed. And
indeed, if you dump the FILE handle via gdb, there is only a single
buffer, and it contains "foo\n". Whereas with glibc, there are separate
read/write buffers.

I suspect the single buffer is enough to handle normal files, but not
bidirectional pipes where the input and output content are unrelated. I
don't think Solaris is _buggy_ per se, as we have probably stepped
outside the realm of what the standard promises, but it's certainly a
quality-of-implementation issue.

So I think it could be solved by opening /dev/tty twice (or fdopen()ing
the same descriptor twice). Or by just doing away with stdio entirely.

Looking over the code, I recall now why I used stdio: strbuf_getline
requires it. These days we have strbuf_getwholeline_fd. It's slightly
less efficient (it has to read() a character at a time), but since we
are talking about a few characters of keyboard input, it should be OK.

-Peff

Re: [PATCH] Avoid crippled getpass function on Solaris

[Ben Walton]

Excerpts from Jeff King's message of Mon Aug 06 18:31:13 -0400 2012:

> Looking over the code, I recall now why I used stdio: strbuf_getline
> requires it. These days we have strbuf_getwholeline_fd. It's
> slightly less efficient (it has to read() a character at a time),
> but since we are talking about a few characters of keyboard input,
> it should be OK.

I noticed the same requirement.  I'm currently building/testing a
patch that switches from FILE -> fd and also to
strbuf_getwholeline_fd.  Personally, I like this approach more than
calling an open function multiple times.

Thanks
-Ben
--
Ben Walton
Systems Programmer - CHASS
University of Toronto
C:416.407.5610 | W:416.978.4302

Re: [PATCH] Avoid crippled getpass function on Solaris

[Jeff King]

On Mon, Aug 06, 2012 at 06:39:55PM -0400, Ben Walton wrote:

> Excerpts from Jeff King's message of Mon Aug 06 18:31:13 -0400 2012:
> 
> > Looking over the code, I recall now why I used stdio: strbuf_getline
> > requires it. These days we have strbuf_getwholeline_fd. It's
> > slightly less efficient (it has to read() a character at a time),
> > but since we are talking about a few characters of keyboard input,
> > it should be OK.
> 
> I noticed the same requirement.  I'm currently building/testing a
> patch that switches from FILE -> fd and also to
> strbuf_getwholeline_fd.  Personally, I like this approach more than
> calling an open function multiple times.

OK, I'll stop working on the same thing, then. :)

We might want to do this to factor out the extra chomp you'll need by
using strbuf_getwholeline_fd:

-- >8 --
Subject: [PATCH] strbuf: implement strbuf_getline_fd

When reading a line into a strbuf, we have two options:

  1. Read from stdio, or from a descriptor

  2. Chomp the terminator, or leave it in

We already have:

  strbuf_getwholeline:    stdio, nochomp
  strbuf_getline:         stdio,   chomp
  strbuf_getwholeline_fd:    fd, nochomp

This patch adds the missing orthogonal function:

  strbuf_getline_fd:         fd,   chomp
---
 strbuf.c | 8 ++++++++
 strbuf.h | 1 +
 2 files changed, 9 insertions(+)

diff --git a/strbuf.c b/strbuf.c
index ec88266..a6dffcc 100644
--- a/strbuf.c
+++ b/strbuf.c
@@ -399,6 +399,14 @@ int strbuf_getwholeline_fd(struct strbuf *sb, int fd, int term)
 	return 0;
 }
 
+int strbuf_getline_fd(struct strbuf *sb, int fd, int term)
+{
+	if (strbuf_getwholeline(sb, fd, term))
+		return EOF;
+	if (sb->buf[sb->len-1] == term)
+		strbuf_setlen(sb, sb->len-1);
+}
+
 int strbuf_read_file(struct strbuf *sb, const char *path, size_t hint)
 {
 	int fd, len;
diff --git a/strbuf.h b/strbuf.h
index b888d40..cc1abb2 100644
--- a/strbuf.h
+++ b/strbuf.h
@@ -119,6 +119,7 @@ extern int strbuf_readlink(struct strbuf *sb, const char *path, size_t hint);
 extern int strbuf_getwholeline(struct strbuf *, FILE *, int);
 extern int strbuf_getline(struct strbuf *, FILE *, int);
 extern int strbuf_getwholeline_fd(struct strbuf *, int, int);
+extern int strbuf_getline_fd(struct strbuf *, int, int);
 
 extern void stripspace(struct strbuf *buf, int skip_comments);
 extern int launch_editor(const char *path, struct strbuf *buffer, const char *const *env);

Re: [PATCH] Avoid crippled getpass function on Solaris

[Andreas Schwab]

Jeff King <peff@peff.net> writes:

> The stdio behavior on Solaris is weird. If I run this sample program:
>
>   #include <stdio.h>
>   int main(void)
>   {
>     FILE *fh = fopen("/dev/tty", "w+");
>     char buf[32] = {0};
>     fgets(buf, sizeof(buf), fh);
>     fprintf(fh, "got %s\n", buf);
>     return 0;
>   }
>
> on Linux, I get:
>
>   $ ./a.out
>   foo        <-- me typing
>   got foo    <-- program output
>
> On Solaris, I get:
>
>   $ ./a.out
>   foo        <-- me typing
>   foo        <-- ???
>   got foo    <-- program output

That's not a bug, you need to flush or seek when you want to switch
between read to write.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Re: [PATCH] Avoid crippled getpass function on Solaris

[Ben Walton]

Excerpts from Jeff King's message of Mon Aug 06 18:42:22 -0400 2012:

> +    if (strbuf_getwholeline(sb, fd, term))

Shouldn't this be strbuf_getwholeline_fd though?

Otherwise, I think this is a good addition.

Thanks
-Ben
--
Ben Walton
Systems Programmer - CHASS
University of Toronto
C:416.407.5610 | W:416.978.4302

Re: [PATCH] Avoid crippled getpass function on Solaris

[Jeff King]

On Mon, Aug 06, 2012 at 07:31:30PM -0400, Ben Walton wrote:

> Excerpts from Jeff King's message of Mon Aug 06 18:42:22 -0400 2012:
> 
> > +    if (strbuf_getwholeline(sb, fd, term))
> 
> Shouldn't this be strbuf_getwholeline_fd though?

Whoops, yes. When I got your email, I had just finished the patch but
had not yet written the follow-on patch that would actually exercise it.

-Peff

Re: [PATCH] Avoid crippled getpass function on Solaris

[Jeff King]

On Tue, Aug 07, 2012 at 01:05:45AM +0200, Andreas Schwab wrote:

> > The stdio behavior on Solaris is weird. If I run this sample program:
> >
> >   #include <stdio.h>
> >   int main(void)
> >   {
> >     FILE *fh = fopen("/dev/tty", "w+");
> >     char buf[32] = {0};
> >     fgets(buf, sizeof(buf), fh);
> >     fprintf(fh, "got %s\n", buf);
> >     return 0;
> >   }
> >
> > on Linux, I get:
> >
> >   $ ./a.out
> >   foo        <-- me typing
> >   got foo    <-- program output
> >
> > On Solaris, I get:
> >
> >   $ ./a.out
> >   foo        <-- me typing
> >   foo        <-- ???
> >   got foo    <-- program output
> 
> That's not a bug, you need to flush or seek when you want to switch
> between read to write.

Thanks. Inserting an fflush() before the fprintf does fix it, but I
think that a flush is disallowed by the standard in this case. From C99,
7.19.5.2 (fflush):

  If stream points to an output stream or an update stream in which the
  most recent operation was not input, the fflush function causes any
  unwritten data for that stream to be delivered to the host environment
  to be written to the file; otherwise, the behavior is undefined.

And later, from 7.19.5.3 (fopen):

  When a file is opened with update mode ('+' as the second or third
  character in the above list of mode argument values), both input and
  output may be performed on the associated stream. However, output
  shall not be directly followed by input without an intervening call to
  the fflush function or to a file positioning function (fseek, fsetpos,
  or rewind), and input shall not be directly followed by output without
  an intervening call to a file positioning function, unless the input
  operation encounters end-of-file.

I don't know if any implementation actually cares in practice, of
course, but probably the sane thing would be to call
"fseek(fh, SEEK_CUR, 0)" before the fprintf.

This is all moot if we end up ripping stdio out of this code for other
reasons, but it does give us another option for a fix.

Thanks for the pointer.

-Peff

Re: [PATCH] Avoid crippled getpass function on Solaris

[Jeff King]

On Mon, Aug 06, 2012 at 08:23:18PM -0400, Jeff King wrote:

> This is all moot if we end up ripping stdio out of this code for other
> reasons, but it does give us another option for a fix.

And here is what that patch would look like:

-- >8 --
Subject: [PATCH] terminal: seek when switching between reading and writing

When a stdio stream is opened in update mode (e.g., "w+"),
the C standard forbids switching between reading or writing
without an intervening positioning function. Many
implementations are lenient about this, but Solaris libc
will flush the recently-read contents to the output buffer.
In this instance, that meant writing the non-echoed password
that the user just typed to the terminal.

Fix it by inserting a no-op fseek between the read and
write.

The opposite direction (writing immediately followed by
reading) is also disallowed, but our fflush immediately
after printing the prompt is sufficient to satisfy the
standard.
---
 compat/terminal.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/compat/terminal.c b/compat/terminal.c
index 6d16c8f..bbb038d 100644
--- a/compat/terminal.c
+++ b/compat/terminal.c
@@ -59,6 +59,7 @@ char *git_terminal_prompt(const char *prompt, int echo)
 
 	r = strbuf_getline(&buf, fh, '\n');
 	if (!echo) {
+		fseek(fh, SEEK_CUR, 0);
 		putc('\n', fh);
 		fflush(fh);
 	}

Re: [PATCH] Avoid crippled getpass function on Solaris

[Tay Ray Chuan]

On Tue, Aug 7, 2012 at 8:35 AM, Jeff King <peff@peff.net> wrote:
> Subject: [PATCH] terminal: seek when switching between reading and writing
>
> When a stdio stream is opened in update mode (e.g., "w+"),
> the C standard forbids switching between reading or writing
> without an intervening positioning function. Many
> implementations are lenient about this, but Solaris libc
> will flush the recently-read contents to the output buffer.
> In this instance, that meant writing the non-echoed password
> that the user just typed to the terminal.
>
> Fix it by inserting a no-op fseek between the read and
> write.
>
> The opposite direction (writing immediately followed by
> reading) is also disallowed, but our fflush immediately
> after printing the prompt is sufficient to satisfy the
> standard.
> ---
>  compat/terminal.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/compat/terminal.c b/compat/terminal.c
> index 6d16c8f..bbb038d 100644
> --- a/compat/terminal.c
> +++ b/compat/terminal.c
> @@ -59,6 +59,7 @@ char *git_terminal_prompt(const char *prompt, int echo)
>
>         r = strbuf_getline(&buf, fh, '\n');
>         if (!echo) {
> +               fseek(fh, SEEK_CUR, 0);
>                 putc('\n', fh);
>                 fflush(fh);
>         }

This works. Ben, does this work for you too?

-- 
Cheers,
Ray Chuan

Re: [PATCH] Avoid crippled getpass function on Solaris

[Ben Walton]

Excerpts from Jeff King's message of Mon Aug 06 20:35:41 -0400 2012:

> ---
>  compat/terminal.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/compat/terminal.c b/compat/terminal.c
> index 6d16c8f..bbb038d 100644
> --- a/compat/terminal.c
> +++ b/compat/terminal.c
> @@ -59,6 +59,7 @@ char *git_terminal_prompt(const char *prompt, int echo)
>  
>      r = strbuf_getline(&buf, fh, '\n');
>      if (!echo) {
> +        fseek(fh, SEEK_CUR, 0);
>          putc('\n', fh);
>          fflush(fh);
>      }

Acked-by: Ben Walton <bwalton@artsci.utoronto.ca>

That looks good to me.  I'm able to clone a password protected https
repository and the prompting works as I'd expect.

Thanks
-Ben
--
Ben Walton
Systems Programmer - CHASS
University of Toronto
C:416.407.5610 | W:416.978.4302

[PATCH] Enable HAVE_DEV_TTY for Solaris

[Ben Walton]

Now that git_terminal_prompt can cleanly interact with /dev/tty on
Solaris, enable HAVE_DEV_TTY so that this code path is used for
credential reading instead of relying on the crippled getpass().

Signed-off-by: Ben Walton <bwalton@artsci.utoronto.ca>
---

This is a follow up to Jeff's patch that fixes git_terminal_prompt on
Solaris.  I don't have 5.6 or 5.7 for testing but I believe this
should be valid for both of those releases as well.


 Makefile |    1 +
 1 file changed, 1 insertion(+)

diff --git a/Makefile b/Makefile
index 15d1319..6b0c961 100644
--- a/Makefile
+++ b/Makefile
@@ -1014,6 +1014,7 @@ ifeq ($(uname_S),SunOS)
 	NO_REGEX = YesPlease
 	NO_FNMATCH_CASEFOLD = YesPlease
 	NO_MSGFMT_EXTENDED_OPTIONS = YesPlease
+	HAVE_DEV_TTY = YesPlease
 	ifeq ($(uname_R),5.6)
 		SOCKLEN_T = int
 		NO_HSTRERROR = YesPlease
-- 
1.7.10.3

Re: [PATCH] Enable HAVE_DEV_TTY for Solaris

[Junio C Hamano]

Ben Walton <bwalton@artsci.utoronto.ca> writes:

> Now that git_terminal_prompt can cleanly interact with /dev/tty on
> Solaris, enable HAVE_DEV_TTY so that this code path is used for
> credential reading instead of relying on the crippled getpass().
>
> Signed-off-by: Ben Walton <bwalton@artsci.utoronto.ca>
> ---
>
> This is a follow up to Jeff's patch that fixes git_terminal_prompt on
> Solaris.  I don't have 5.6 or 5.7 for testing but I believe this
> should be valid for both of those releases as well.

So which direction do you guys want to go?  Use the "bidirectional
stdio with fseek()" for now, with the expectation that Tay's other
series will rewrite it to fd based one?

>
>  Makefile |    1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/Makefile b/Makefile
> index 15d1319..6b0c961 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -1014,6 +1014,7 @@ ifeq ($(uname_S),SunOS)
>  	NO_REGEX = YesPlease
>  	NO_FNMATCH_CASEFOLD = YesPlease
>  	NO_MSGFMT_EXTENDED_OPTIONS = YesPlease
> +	HAVE_DEV_TTY = YesPlease
>  	ifeq ($(uname_R),5.6)
>  		SOCKLEN_T = int
>  		NO_HSTRERROR = YesPlease

Re: [PATCH] Enable HAVE_DEV_TTY for Solaris

[Jeff King]

On Mon, Aug 06, 2012 at 08:43:02PM -0700, Junio C Hamano wrote:

> Ben Walton <bwalton@artsci.utoronto.ca> writes:
> 
> > Now that git_terminal_prompt can cleanly interact with /dev/tty on
> > Solaris, enable HAVE_DEV_TTY so that this code path is used for
> > credential reading instead of relying on the crippled getpass().
> >
> > Signed-off-by: Ben Walton <bwalton@artsci.utoronto.ca>
> > ---
> >
> > This is a follow up to Jeff's patch that fixes git_terminal_prompt on
> > Solaris.  I don't have 5.6 or 5.7 for testing but I believe this
> > should be valid for both of those releases as well.
> 
> So which direction do you guys want to go?  Use the "bidirectional
> stdio with fseek()" for now, with the expectation that Tay's other
> series will rewrite it to fd based one?

I think so. The stdio fix is short and obviously correct, and then Tay
can either refactor or not as he sees fit for his topic (although if we
do switch to just a terminal_can_prompt() interface and get rid of the
term_t ugliness, then there is not even any need to do the rewrite).

-Peff

Re: [PATCH] Enable HAVE_DEV_TTY for Solaris

[Jeff King]

On Tue, Aug 07, 2012 at 12:03:26AM -0400, Jeff King wrote:

> > So which direction do you guys want to go?  Use the "bidirectional
> > stdio with fseek()" for now, with the expectation that Tay's other
> > series will rewrite it to fd based one?
> 
> I think so. The stdio fix is short and obviously correct, and then Tay
> can either refactor or not as he sees fit for his topic (although if we
> do switch to just a terminal_can_prompt() interface and get rid of the
> term_t ugliness, then there is not even any need to do the rewrite).

And here it is again, this time with a signed-off-by (I fixed my script
after our last discussion, but accidentally copied an old version to the
Solaris VM I just installed. ;) ).

-- >8 --
Subject: [PATCH] terminal: seek when switching between reading and writing

When a stdio stream is opened in update mode (e.g., "w+"),
the C standard forbids switching between reading or writing
without an intervening positioning function. Many
implementations are lenient about this, but Solaris libc
will flush the recently-read contents to the output buffer.
In this instance, that meant writing the non-echoed password
that the user just typed to the terminal.

Fix it by inserting a no-op fseek between the read and
write.

The opposite direction (writing followed by reading) is also
disallowed, but our intervening fflush is an acceptable
positioning function for that alternative.

Signed-off-by: Jeff King <peff@peff.net>
---
 compat/terminal.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/compat/terminal.c b/compat/terminal.c
index 6d16c8f..bbb038d 100644
--- a/compat/terminal.c
+++ b/compat/terminal.c
@@ -59,6 +59,7 @@ char *git_terminal_prompt(const char *prompt, int echo)
 
 	r = strbuf_getline(&buf, fh, '\n');
 	if (!echo) {
+		fseek(fh, SEEK_CUR, 0);
 		putc('\n', fh);
 		fflush(fh);
 	}

Re: [PATCH] Enable HAVE_DEV_TTY for Solaris

[Ben Walton]

Excerpts from Jeff King's message of Tue Aug 07 00:10:26 -0400 2012:

> Signed-off-by: Jeff King <peff@peff.net>

Acked-by: Ben Walton <bwalton@artsci.utoronto.ca>

I agree with your assesment that this is the right way to go (vs
migrating out of stdio) for now.  If the changes Tay needs to make
require the migration then it can become part of that series.
Otherwise those changes would just be change for change's sake at this
time.

If my HAVE_DEV_TTY enabling patch for Solaris is added on top of this,
I'm a happy camper.

Thanks
-Ben
--
Ben Walton
Systems Programmer - CHASS
University of Toronto
C:416.407.5610 | W:416.978.4302

Re: [PATCH] Enable HAVE_DEV_TTY for Solaris

[Erik Faye-Lund]

On Tue, Aug 7, 2012 at 6:10 AM, Jeff King <peff@peff.net> wrote:
> Subject: [PATCH] terminal: seek when switching between reading and writing
>
> When a stdio stream is opened in update mode (e.g., "w+"),
> the C standard forbids switching between reading or writing
> without an intervening positioning function. Many
> implementations are lenient about this, but Solaris libc
> will flush the recently-read contents to the output buffer.
> In this instance, that meant writing the non-echoed password
> that the user just typed to the terminal.
>
> Fix it by inserting a no-op fseek between the read and
> write.

My Windows-patches for git_terminal_prompt would probably also solve
this problem. Instead of opening a read-write handle to /dev/tty, they
open two handles to the terminal instead; one for reading and one for
writing. This is because the terminal cannot be opened in read-write
mode on Windows (we need to open "CONIN$" and "CONOUT$" separately).

You can have a look at the series here if you're interested:
https://github.com/kusma/git/tree/work/terminal-cleanup

That last patch is the reason why I haven't submitted the series yet,
but perhaps some of the preparatory patches could be worth-while for
other platforms in the mean time?

Re: [PATCH] Enable HAVE_DEV_TTY for Solaris

[Jeff King]

On Wed, Aug 08, 2012 at 04:13:03PM +0200, Erik Faye-Lund wrote:

> On Tue, Aug 7, 2012 at 6:10 AM, Jeff King <peff@peff.net> wrote:
> > Subject: [PATCH] terminal: seek when switching between reading and writing
> >
> > When a stdio stream is opened in update mode (e.g., "w+"),
> > the C standard forbids switching between reading or writing
> > without an intervening positioning function. Many
> > implementations are lenient about this, but Solaris libc
> > will flush the recently-read contents to the output buffer.
> > In this instance, that meant writing the non-echoed password
> > that the user just typed to the terminal.
> >
> > Fix it by inserting a no-op fseek between the read and
> > write.
> 
> My Windows-patches for git_terminal_prompt would probably also solve
> this problem. Instead of opening a read-write handle to /dev/tty, they
> open two handles to the terminal instead; one for reading and one for
> writing. This is because the terminal cannot be opened in read-write
> mode on Windows (we need to open "CONIN$" and "CONOUT$" separately).

Yeah, it would solve it, although it means opening /dev/tty twice (which
is probably not a big deal, though). I'm fine if we go that way in the
long run to share implementations, but let's treat it as a separate
topic.  This fix is an obvious one-liner, and is just fixing me being
stupid about actually following the C standard. So it's a no-brainer for
as a maintenance fix.

> You can have a look at the series here if you're interested:
> https://github.com/kusma/git/tree/work/terminal-cleanup
> 
> That last patch is the reason why I haven't submitted the series yet,
> but perhaps some of the preparatory patches could be worth-while for
> other platforms in the mean time?

Yeah, that last patch is really gross. There's no explanation of the
race issue, so I'll refrain from thinking about it until you are ready
to post a series. :)

-Peff