Skip to content

Commit adf15df

Browse files
manojampalammanojampalam
committed
5-14 C5
1 parent ead199c commit adf15df

File tree

3 files changed

+44
-27
lines changed

3 files changed

+44
-27
lines changed

‎contrib/win32/win32compat/ssh-agent/agent.c

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ process_connection(HANDLE pipe, int type) {
125125
fatal("failed to assign pipe to ioc_port");
126126

127127
agent_connection_on_io(con, 0, &con->ol);
128-
return iocp_work(NULL);
128+
iocp_work(NULL);
129129
}
130130

131131
static void
@@ -194,7 +194,7 @@ agent_listen_loop() {
194194
return;
195195
}
196196
else {
197-
/* todo - spawn a child to take care of this*/
197+
/* spawn a child to take care of this*/
198198
wchar_t path[MAX_PATH], module_path[MAX_PATH];
199199
PROCESS_INFORMATION pi;
200200
STARTUPINFOW si;
@@ -239,9 +239,11 @@ void agent_shutdown() {
239239
SetEvent(event_stop_agent);
240240
}
241241

242+
#define REG_AGENT_SDDL L"D:P(A;; GR;;; AU)(A;; GA;;; SY)(A;; GA;;; BA)"
243+
242244
void
243245
agent_start(BOOL dbg_mode, BOOL child, HANDLE pipe, enum agent_type type) {
244-
int i, r;
246+
int r;
245247
HKEY agent_root = NULL;
246248
DWORD process_id = GetCurrentProcessId();
247249

@@ -251,8 +253,14 @@ agent_start(BOOL dbg_mode, BOOL child, HANDLE pipe, enum agent_type type) {
251253
if ((ioc_port = CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, (ULONG_PTR)NULL, 0)) == NULL)
252254
fatal("cannot create ioc port ERROR:%d", GetLastError());
253255

256+
254257
if (child == FALSE) {
255-
if ((r = RegCreateKeyExW(HKEY_LOCAL_MACHINE, SSH_AGENT_ROOT, 0, 0, 0, KEY_WRITE, 0, &agent_root, 0)) != ERROR_SUCCESS)
258+
SECURITY_ATTRIBUTES sa;
259+
memset(&sa, 0, sizeof(SECURITY_ATTRIBUTES));
260+
sa.nLength = sizeof(sa);
261+
if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(REG_AGENT_SDDL, SDDL_REVISION_1, &sa.lpSecurityDescriptor, &sa.nLength))
262+
fatal("ConvertStringSecurityDescriptorToSecurityDescriptorW failed");
263+
if ((r = RegCreateKeyExW(HKEY_LOCAL_MACHINE, SSH_AGENT_ROOT, 0, 0, 0, KEY_WRITE, &sa, &agent_root, 0)) != ERROR_SUCCESS)
256264
fatal("cannot create agent root reg key, ERROR:%d", r);
257265
if ((r = RegSetValueExW(agent_root, L"ProcessID", 0, REG_DWORD, (BYTE*)&process_id, 4)) != ERROR_SUCCESS)
258266
fatal("cannot publish agent master process id ERROR:%d", r);
@@ -266,6 +274,5 @@ agent_start(BOOL dbg_mode, BOOL child, HANDLE pipe, enum agent_type type) {
266274
process_connection(pipe, type);
267275
}
268276

269-
return 0;
270277
}
271278

‎contrib/win32/win32compat/ssh-agent/authagent-request.c

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -138,10 +138,10 @@ generate_user_token(wchar_t* user) {
138138
}
139139

140140
#define AUTH_REQUEST "keyauthenticate"
141-
#define MAX_USER_NAME_LEN 255 + 255
141+
#define MAX_USER_NAME_LEN 256
142142

143143
int process_authagent_request(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) {
144-
int r = 0;
144+
int r = -1;
145145
char *opn, *key_blob, *user, *sig, *blob;
146146
size_t opn_len, key_blob_len, user_len, sig_len, blob_len;
147147
struct sshkey *key = NULL;
@@ -151,36 +151,44 @@ int process_authagent_request(struct sshbuf* request, struct sshbuf* response, s
151151
ULONG client_pid;
152152

153153
user = NULL;
154-
if ((r = sshbuf_get_string_direct(request, &opn, &opn_len)) != 0 ||
155-
(r = sshbuf_get_string_direct(request, &key_blob, &key_blob_len)) != 0 ||
156-
(r = sshbuf_get_cstring(request, &user, &user_len)) != 0 ||
157-
(r = sshbuf_get_string_direct(request, &sig, &sig_len)) != 0 ||
158-
(r = sshbuf_get_string_direct(request, &blob, &blob_len)) != 0 ||
159-
(r = sshkey_from_blob(key_blob, key_blob_len, &key)) != 0)
154+
if (sshbuf_get_string_direct(request, &opn, &opn_len) != 0 ||
155+
sshbuf_get_string_direct(request, &key_blob, &key_blob_len) != 0 ||
156+
sshbuf_get_cstring(request, &user, &user_len) != 0 ||
157+
sshbuf_get_string_direct(request, &sig, &sig_len) != 0 ||
158+
sshbuf_get_string_direct(request, &blob, &blob_len) != 0 ||
159+
sshkey_from_blob(key_blob, key_blob_len, &key) != 0 ||
160+
opn_len != strlen(AUTH_REQUEST) ||
161+
memcmp(opn, AUTH_REQUEST, opn_len) != 0) {
162+
debug("auth agent invalid request");
160163
goto done;
164+
}
161165

162-
if ((opn_len != strlen(AUTH_REQUEST)) || (memcmp(opn, AUTH_REQUEST, opn_len) != 0)) {
163-
r = EINVAL;
166+
if (MultiByteToWideChar(CP_UTF8, 0, user, user_len + 1, wuser, MAX_USER_NAME_LEN) == 0 ||
167+
(token = generate_user_token(wuser)) == 0) {
168+
debug("unable to generate user token");
164169
goto done;
165170
}
166171

167-
if (0 == MultiByteToWideChar(CP_UTF8, 0, user, user_len + 1, wuser, MAX_USER_NAME_LEN)) {
168-
r = GetLastError();
172+
if (SHGetKnownFolderPath(&FOLDERID_Profile, 0, token, &wuser_home) != S_OK ||
173+
pubkey_allowed(key, wuser, wuser_home) != 1) {
174+
debug("given public key is not mapped to user %ls", wuser);
169175
goto done;
170176
}
171177

172-
if (key_verify(key, sig, sig_len, blob, blob_len) != 1 ||
173-
(token = generate_user_token(wuser)) == 0 ||
174-
SHGetKnownFolderPath(&FOLDERID_Profile, 0, token, &wuser_home) != S_OK ||
175-
pubkey_allowed(key, wuser, wuser_home) != 1 ||
176-
(FALSE == GetNamedPipeClientProcessId(con->connection, &client_pid)) ||
178+
if (key_verify(key, sig, sig_len, blob, blob_len) != 1) {
179+
debug("signature verification failed");
180+
goto done;
181+
}
182+
183+
if ((FALSE == GetNamedPipeClientProcessId(con->connection, &client_pid)) ||
177184
( (client_proc = OpenProcess(PROCESS_DUP_HANDLE, FALSE, client_pid)) == NULL) ||
178185
(FALSE == DuplicateHandle(GetCurrentProcess(), token, client_proc, &dup_token, TOKEN_QUERY | TOKEN_IMPERSONATE, FALSE, DUPLICATE_SAME_ACCESS)) ||
179186
(sshbuf_put_u32(response, dup_token) != 0) ) {
180-
r = EINVAL;
187+
debug("failed to authorize user");
181188
goto done;
182189
}
183190

191+
r = 0;
184192
done:
185193
if (user)
186194
free(user);

‎contrib/win32/win32compat/ssh-agent/keyagent-request.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
static int
4040
get_user_root(struct agent_connection* con, HKEY *root){
4141
int r = 0;
42+
*root = NULL;
4243
if (ImpersonateNamedPipeClient(con->connection) == FALSE)
4344
return -1;
4445

@@ -47,6 +48,8 @@ get_user_root(struct agent_connection* con, HKEY *root){
4748
else if (RegOpenCurrentUser(KEY_ALL_ACCESS, root) != ERROR_SUCCESS)
4849
r = -1;
4950

51+
if (*root == NULL)
52+
debug("cannot connect to user's registry root");
5053
RevertToSelf();
5154
return r;
5255
}
@@ -411,11 +414,10 @@ process_request_identities(struct sshbuf* request, struct sshbuf* response, stru
411414

412415

413416
int process_keyagent_request(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) {
414-
int r;
415417
u_char type;
416418

417-
if ((r = sshbuf_get_u8(request, &type)) != 0)
418-
return r;
419+
if (sshbuf_get_u8(request, &type) != 0)
420+
return -1;
419421
debug2("process key agent request type %d", type);
420422

421423
switch (type) {
@@ -431,6 +433,6 @@ int process_keyagent_request(struct sshbuf* request, struct sshbuf* response, st
431433
return process_remove_all(request, response, con);
432434
default:
433435
debug("unknown key agent request %d", type);
434-
return EINVAL;
436+
return -1;
435437
}
436438
}

0 commit comments

Comments
 (0)