21.03.2013 Views

Problem - Kevin Tafuro

Problem - Kevin Tafuro

Problem - Kevin Tafuro

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

On Windows, you can use the standard EDIT control with ES_PASSWORD specified as a<br />

style flag to mask the characters typed by a user.<br />

Discussion<br />

In the following subsections we’ll look at several different approaches to prompting<br />

for passwords.<br />

Prompting for a password on Unix using getpass( ) or readpassphrase( )<br />

The standard C runtime function getpass( ) is the most portable way to obtain a<br />

password from a user interactively. Unfortunately, it does have several limitations<br />

that you may find unacceptable. The first is that only up to _PASSWORD_LEN (typically<br />

128) characters may be entered; any characters after that are simply discarded. The<br />

second is that the password is stored in a statically defined buffer, so it is not threadsafe,<br />

but ordinarily this is not much of a problem because there is fundamentally no<br />

way to read from the terminal in a thread-safe manner anyway.<br />

The getpass( ) function has the following signature:<br />

#include <br />

#include <br />

char *getpass(const char *prompt);<br />

The text passed as the function’s only argument is displayed on the terminal, terminal<br />

echo is disabled, and input is gathered in a buffer internal to the function until<br />

the user presses Enter. The return value from the function is a pointer to the internal<br />

buffer, which will be at most _PASSWORD_LEN + 1 bytes in size, with the additional<br />

byte left to hold the NULL terminator.<br />

FreeBSD and OpenBSD both support an alternative function, readpassphrase( ), that<br />

provides the underlying implementation for getpass( ). It is more flexible than<br />

getpass( ), allowing the caller to preallocate a buffer to hold a password or passphrase<br />

of any size. In addition, it also supports a variety of control flags that control<br />

its behavior.<br />

The readpassphrase( ) function has the following signature:<br />

#include <br />

#include <br />

char *readpassphrase(const char *prompt, char *buf, size_t bufsiz, int flags);<br />

This function has the following arguments:<br />

prompt<br />

String that will be displayed to the user before accepting input.<br />

buf<br />

Buffer into which the input read from the interactive user will be placed.<br />

This is the Title of the Book, eMatter Edition<br />

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.<br />

Prompting for a Password | 393

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!