Update enable-wifi to read PSK input from stdin (#1870)

Resolves tiny-pilot/tinypilot-pro#1464

This change updates the enable-wifi script to read the PSK from stdin
instead of using an argument.

We also update the enable_wifi function in network.py to use the new
stdin interface.

<a data-ca-tag
href="https://codeapprove.com/pr/tiny-pilot/tinypilot/1870"><img
src="https://codeapprove.com/external/github-tag-allbg.png" alt="Review
on CodeApprove" /></a>

Author: db39

app/network.py

@@ -153,12 +153,16 @@ def enable_wifi(wifi_settings):
         'sudo', '/opt/tinypilot-privileged/scripts/enable-wifi', '--country',
         wifi_settings.country_code, '--ssid', wifi_settings.ssid
     ]
-    if wifi_settings.psk:
-        args.extend(['--psk', wifi_settings.psk])
     try:
         # Ignore pylint since we're not managing the child process.
         # pylint: disable=consider-using-with
-        subprocess.Popen(args)
+        if wifi_settings.psk:
+            args.append('--psk')
+            process = subprocess.Popen(args, stdin=subprocess.PIPE, text=True)
+            process.communicate(input=wifi_settings.psk)
+        else:
+            subprocess.Popen(args)
+
     except subprocess.CalledProcessError as e:
         raise NetworkError(str(e.output).strip()) from e
 

debian-pkg/opt/tinypilot-privileged/scripts/enable-wifi

@@ -7,13 +7,14 @@ set -e
 
 print_help() {
   cat <<EOF
-Usage: ${0##*/} [--help] --country COUNTRY --ssid SSID [--psk PSK]
+Usage: ${0##*/} [--help] --country COUNTRY --ssid SSID [--psk]
 Enables a WiFi network connection.
   --help              Optional. Display this help and exit.
   --country COUNTRY   A two-digit country code, as of ISO 3166-1 alpha-2.
   --ssid SSID         The name (SSID) of the WiFi network.
-  --psk PSK           Optional. The password for authenticating. If specified,
-                      it must be 8-63 characters in length.
+  --psk               Optional. Authenticate with the WiFi network using a
+                      password read from stdin. The password must be 8-63
+                      characters in length.
 
 Note: this script only stores the WiFi configuration and triggers its
 activation, but it doesn't (and cannot) verify whether the device can actually
@@ -49,13 +50,14 @@ while (( "$#" > 0 )); do
       shift # For flag value.
       ;;
     --psk)
-      if (( "$#" < 2 )); then
-        shift
-        break
+      # Read the password from stdin. Otherwise, prompt the user.
+      if [[ -p /dev/stdin ]]; then
+        WIFI_PSK="$(cat -)"
+      else
+        read -r -s -p 'Provide the WiFi password: ' WIFI_PSK
+        echo
       fi
-      WIFI_PSK="$2"
       shift # For flag name.
-      shift # For flag value.
       ;;
     *)
       >&2 echo "Unknown flag/argument: $1"
@@ -94,7 +96,7 @@ if [[ -n "${WIFI_PSK}" ]]; then
   PSK_LENGTH="$(echo -n "${WIFI_PSK}" | wc --bytes)"
   readonly PSK_LENGTH
   if (( "${PSK_LENGTH}" < 8 || "${PSK_LENGTH}" > 63 )); then
-    >&2 echo 'Invalid argument: PSK'
+    >&2 echo 'Invalid PSK.'
     >&2 echo "Use the '--help' flag for more information"
     exit 1
   fi
@@ -116,7 +118,10 @@ readonly CONFIG_FILE='/etc/wpa_supplicant/wpa_supplicant.conf'
 # Write out the new configuration.
 # shellcheck source=lib/markers.sh
 . "${SCRIPT_DIR}/lib/markers.sh"
-{
+(
+  # Avoid leaking passwords by disabling command tracing in subshell.
+  set +x
+
   echo "${MARKER_START}"
   echo "country=${WIFI_COUNTRY}"
 
@@ -138,7 +143,7 @@ readonly CONFIG_FILE='/etc/wpa_supplicant/wpa_supplicant.conf'
   fi
 
   echo "${MARKER_END}"
-} >> "${CONFIG_FILE}"
+) >> "${CONFIG_FILE}"
 
 # Effectuate changes.
 rfkill unblock wifi