Don't loop forever if fscrypt unlock doesn't have a tty

This fixes the bug in two places:
1. Don't retry passwords if stdin isn't a tty.
2. Notice and error out when no input is available when reading a passphrase. Technically this isn't necessary now that we're retrying, but it avoids needlessly spending time trying to unlock the protector.

This still retries empty passwords when interactive.

Author: jyn514

actions/callback.go

@@ -88,6 +88,11 @@ func unwrapProtectorKey(info ProtectorInfo, keyFn KeyFunc) (*crypto.Key, error)
 	retry := false
 	for {
 		wrappingKey, err := getWrappingKey(info, keyFn, retry)
+		if errors.Cause(err) == crypto.ErrEmptyKey {
+			log.Printf("empty key for protector %s", info.Descriptor())
+			retry = true
+			continue
+		}
 		if err != nil {
 			return nil, err
 		}

cli-tests/t_unlock.out

@@ -62,6 +62,44 @@ Protected with 1 protector:
 PROTECTOR         LINKED  DESCRIPTION
 desc2  No      custom protector "prot"
 
+# Try to unlock with no stdin
+[ERROR] fscrypt unlock: empty password
+"MNT/dir" is encrypted with fscrypt.
+
+Policy:   desc1
+Options:  padding:32 contents:AES_256_XTS filenames:AES_256_CTS policy_version:2
+Unlocked: No
+
+Protected with 1 protector:
+PROTECTOR         LINKED  DESCRIPTION
+desc2  No      custom protector "prot"
+
+# Try to unlock with only a newline
+[ERROR] fscrypt unlock: empty password
+"MNT/dir" is encrypted with fscrypt.
+
+Policy:   desc1
+Options:  padding:32 contents:AES_256_XTS filenames:AES_256_CTS policy_version:2
+Unlocked: No
+
+Protected with 1 protector:
+PROTECTOR         LINKED  DESCRIPTION
+desc2  No      custom protector "prot"
+
+# Try infinitely many wrong passwords
+Enter custom passphrase for protector "prot": Incorrect Passphrase
+Enter custom passphrase for protector "prot": Incorrect Passphrase
+Enter custom passphrase for protector "prot": [ERROR] fscrypt unlock: giving up after 3 incorrect password attempts
+"MNT/dir" is encrypted with fscrypt.
+
+Policy:   desc1
+Options:  padding:32 contents:AES_256_XTS filenames:AES_256_CTS policy_version:2
+Unlocked: No
+
+Protected with 1 protector:
+PROTECTOR         LINKED  DESCRIPTION
+desc2  No      custom protector "prot"
+
 # Unlock directory
 Enter custom passphrase for protector "prot": "MNT/dir" is now unlocked and ready for use.
 
@@ -90,7 +128,7 @@ desc1  Yes       desc2
                         the policy metadata for "MNT/dir".
                         This directory has either been encrypted with another
                         tool (such as e4crypt), or the file
-                        "MNT/.fscrypt/policies/desc20"
+                        "MNT/.fscrypt/policies/desc26"
                         has been deleted.
 
 # Try to unlock with missing protector metadata
@@ -103,14 +141,14 @@ information.
 [ERROR] fscrypt unlock: inconsistent metadata between encrypted directory
                         "MNT/dir1" and its corresponding
                         metadata file
-                        "MNT/.fscrypt/policies/desc21".
+                        "MNT/.fscrypt/policies/desc27".
 
                         Directory has
-                        descriptor:desc21 padding:32
+                        descriptor:desc27 padding:32
                         contents:AES_256_XTS filenames:AES_256_CTS
                         policy_version:2
 
                         Metadata file has
-                        descriptor:desc23 padding:32
+                        descriptor:desc29 padding:32
                         contents:AES_256_XTS filenames:AES_256_CTS
                         policy_version:2

cli-tests/t_unlock.sh

@@ -38,6 +38,18 @@ _print_header "Try to unlock with wrong passphrase"
 _expect_failure "echo bad | fscrypt unlock --quiet '$dir'"
 fscrypt status "$dir"
 
+_print_header "Try to unlock with no stdin"
+_expect_failure "fscrypt unlock --quiet '$dir' </dev/null"
+fscrypt status "$dir"
+
+_print_header "Try to unlock with only a newline"
+_expect_failure "echo | fscrypt unlock --quiet '$dir'"
+fscrypt status "$dir"
+
+_print_header "Try infinitely many wrong passwords"
+_expect_failure "yes wrong | fscrypt unlock '$dir'"
+fscrypt status "$dir"
+
 _print_header "Unlock directory"
 echo hunter2 | fscrypt unlock "$dir"
 _print_header "=> Check dir status"

cmd/fscrypt/keys.go

@@ -145,7 +145,7 @@ func makeKeyFunc(supportRetry, shouldConfirm bool, prefix string) actions.KeyFun
 				panic("this KeyFunc does not support retrying")
 			}
 			// Don't retry for non-interactive sessions
-			if quietFlag.Value {
+			if !term.IsTerminal(stdinFd) {
 				return nil, ErrWrongKey
 			}
 			fmt.Println("Incorrect Passphrase")

crypto/crypto.go

@@ -51,6 +51,7 @@ import (
 // Crypto error values
 var (
 	ErrBadAuth      = errors.New("key authentication check failed")
+	ErrEmptyKey     = errors.New("empty password")
 	ErrRecoveryCode = errors.New("invalid recovery code")
 	ErrMlockUlimit  = errors.New("could not lock key in memory")
 )

crypto/key.go

@@ -242,7 +242,12 @@ func NewKeyFromReader(reader io.Reader) (*Key, error) {
 				}
 			}
 		case io.EOF:
-			// Getting the EOF error means we are done
+			// We got EOF without reading a password.
+			// We don't support empty passwords, so something is wrong (likely we don't have a tty).
+			if totalBytesRead == 0 {
+				return nil, ErrEmptyKey
+			}
+			// Getting the EOF error means we are done.
 			return key.resize(totalBytesRead)
 		default:
 			// Fail if Read() has a failure