tyler.durden/Win32-OpenSSH
1
0
Fork 0
mirror of https://github.com/PowerShell/Win32-OpenSSH.git synced 2025-07-24 22:45:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

agent updates

Browse Source
This commit is contained in:
Manoj Ampalam 2016-09-14 23:34:59 -07:00
parent 367476c953
commit 87b27d8631
8 changed files with 89 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -278,3 +278,4 @@ d2utmpa*
configure configure
contrib/win32/openssh/Win32-OpenSSH.VC.opendb contrib/win32/openssh/Win32-OpenSSH.VC.opendb
*.opendb *.opendb
*.db

2
authfd.c
View File

@ -107,7 +107,7 @@ ssh_get_authentication_socket(int *fdp)
} }
h = CreateFile( h = CreateFile(
"\\\\.\\pipe\\ssh-keyagent", // pipe name "\\\\.\\pipe\\ssh-agent", // pipe name
GENERIC_READ | // read and write access GENERIC_READ | // read and write access
GENERIC_WRITE, GENERIC_WRITE,
0, // no sharing 0, // no sharing

10
contrib/win32/win32compat/ssh-agent/agent-main.c
View File

@ -98,20 +98,20 @@ int main(int argc, char **argv) {
if (GetLastError() == ERROR_FAILED_SERVICE_CONTROLLER_CONNECT) { if (GetLastError() == ERROR_FAILED_SERVICE_CONTROLLER_CONNECT) {
/*todo - support debug mode*/ /*todo - support debug mode*/
/* /*
if (debugmode) { if (debugMode) {
SetConsoleCtrlHandler(ctrl_c_handler, TRUE); SetConsoleCtrlHandler(ctrl_c_handler, TRUE);
log_init("ssh-agent", 7, 1, 1); log_init("ssh-agent", 7, 1, 1);
agent_start(TRUE, FALSE, 0, 0); agent_start(TRUE, FALSE, 0);
return 0; return 0;
} }
*/ */
if (argc == 3) { if (argc == 2) {
/*agent process is likely a spawned child*/ /*agent process is likely a spawned child*/
char* h = 0; char* h = 0;
h += atoi(*(argv + 1)); h += atoi(*(argv + 1));
if (h != 0) { if (h != 0) {
log_init("ssh-agent", config_log_level(), 1, 0); log_init("ssh-agent", config_log_level(), 1, 0);
agent_start(FALSE, TRUE, h, atoi(*(argv + 2))); agent_start(FALSE, TRUE, h);
return 0; return 0;
} }
} }
@ -148,7 +148,7 @@ int scm_start_servie(DWORD num, LPWSTR* args) {
ReportSvcStatus(SERVICE_START_PENDING, NO_ERROR, 300); ReportSvcStatus(SERVICE_START_PENDING, NO_ERROR, 300);
ReportSvcStatus(SERVICE_RUNNING, NO_ERROR, 0); ReportSvcStatus(SERVICE_RUNNING, NO_ERROR, 0);
log_init("ssh-agent", config_log_level(), 1, 0); log_init("ssh-agent", config_log_level(), 1, 0);
agent_start(FALSE, FALSE, 0, 0); agent_start(FALSE, FALSE, 0);
return 0; return 0;
} }

12
contrib/win32/win32compat/ssh-agent/agent-request.h
View File

@ -10,6 +10,12 @@ typedef unsigned __int64 u_int64_t;
#include "digest.h" #include "digest.h"
int process_keyagent_request(struct sshbuf*, struct sshbuf*, struct agent_connection*); /* key management */
int process_pubkeyagent_request(struct sshbuf*, struct sshbuf*, struct agent_connection*); int process_add_identity(struct sshbuf*, struct sshbuf*, struct agent_connection*);
int process_authagent_request(struct sshbuf*, struct sshbuf*, struct agent_connection*); int process_request_identities(struct sshbuf*, struct sshbuf*, struct agent_connection*);
int process_sign_request(struct sshbuf*, struct sshbuf*, struct agent_connection*);
int process_remove_key(struct sshbuf*, struct sshbuf*, struct agent_connection*);
int process_remove_all(struct sshbuf*, struct sshbuf*, struct agent_connection*);
int process_authagent_request(struct sshbuf*, struct sshbuf*, struct agent_connection*);
/* auth */

101
contrib/win32/win32compat/ssh-agent/agent.c
View File

@ -35,39 +35,24 @@
static HANDLE ioc_port = NULL; static HANDLE ioc_port = NULL;
static BOOL debug_mode = FALSE; static BOOL debug_mode = FALSE;
#define NUM_LISTENERS 3 #define AGENT_PIPE_ID L"\\\\.\\pipe\\ssh-agent"
#define KEY_AGENT_PIPE_ID L"\\\\.\\pipe\\ssh-keyagent"
#define PUBKEY_AGENT_PIPE_ID L"\\\\.\\pipe\\ssh-pubkeyagent"
#define AUTH_AGENT_PIPE_ID L"\\\\.\\pipe\\ssh-authagent"
static wchar_t *pipe_ids[NUM_LISTENERS] = { KEY_AGENT_PIPE_ID, PUBKEY_AGENT_PIPE_ID, AUTH_AGENT_PIPE_ID }; static HANDLE event_stop_agent;
static enum agent_type pipe_types[NUM_LISTENERS] = { KEY_AGENT, PUBKEY_AGENT, PUBKEY_AUTH_AGENT}; static OVERLAPPED ol;
static wchar_t *pipe_sddls[NUM_LISTENERS] = { L"D:P(A;; GA;;; AU)", L"D:P(A;; GA;;; AU)", L"D:P(A;; GA;;; AU)" }; static HANDLE pipe;
HANDLE event_stop_agent; static SECURITY_ATTRIBUTES sa;
struct listener {
OVERLAPPED ol;
HANDLE pipe;
wchar_t *pipe_id;
enum agent_type type;
SECURITY_ATTRIBUTES sa;
} listeners[NUM_LISTENERS];
static int static int
init_listeners() { init_listener() {
int i; {
memset(listeners, 0, sizeof(listeners)); if ((ol.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL)) == NULL) {
for (i = 0; i < NUM_LISTENERS; i++) {
if ((listeners[i].ol.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL)) == NULL) {
debug("cannot create event ERROR:%d", GetLastError()); debug("cannot create event ERROR:%d", GetLastError());
return GetLastError(); return GetLastError();
} }
listeners[i].pipe_id = pipe_ids[i]; pipe = INVALID_HANDLE_VALUE;
listeners[i].type = pipe_types[i]; sa.bInheritHandle = FALSE;
listeners[i].pipe = INVALID_HANDLE_VALUE; if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(L"D:P(A;; GA;;; AU)", SDDL_REVISION_1,
listeners[i].sa.bInheritHandle = FALSE; &sa.lpSecurityDescriptor, &sa.nLength)) {
if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(pipe_sddls[i], SDDL_REVISION_1,
&listeners[i].sa.lpSecurityDescriptor, &listeners[i].sa.nLength)) {
debug("cannot convert sddl ERROR:%d", GetLastError()); debug("cannot convert sddl ERROR:%d", GetLastError());
return GetLastError(); return GetLastError();
} }
@ -78,12 +63,11 @@ init_listeners() {
static void static void
agent_cleanup() { agent_cleanup() {
int i; {
for (i = 0; i < NUM_LISTENERS; i++) { if (ol.hEvent != NULL)
if (listeners[i].ol.hEvent != NULL) CloseHandle(ol.hEvent);
CloseHandle(listeners[i].ol.hEvent); if (pipe != INVALID_HANDLE_VALUE)
if (listeners[i].pipe != INVALID_HANDLE_VALUE) CloseHandle(pipe);
CloseHandle(listeners[i].pipe);
} }
if (ioc_port) if (ioc_port)
CloseHandle(ioc_port); CloseHandle(ioc_port);
@ -112,7 +96,7 @@ iocp_work(LPVOID lpParam) {
} }
static void static void
process_connection(HANDLE pipe, int type) { process_connection(HANDLE pipe) {
struct agent_connection* con; struct agent_connection* con;
if ((con = malloc(sizeof(struct agent_connection))) == NULL) if ((con = malloc(sizeof(struct agent_connection))) == NULL)
@ -120,7 +104,6 @@ process_connection(HANDLE pipe, int type) {
memset(con, 0, sizeof(struct agent_connection)); memset(con, 0, sizeof(struct agent_connection));
con->connection = pipe; con->connection = pipe;
con->type = type;
if (CreateIoCompletionPort(pipe, ioc_port, (ULONG_PTR)con, 0) != ioc_port) if (CreateIoCompletionPort(pipe, ioc_port, (ULONG_PTR)con, 0) != ioc_port)
fatal("failed to assign pipe to ioc_port"); fatal("failed to assign pipe to ioc_port");
@ -130,18 +113,18 @@ process_connection(HANDLE pipe, int type) {
static void static void
agent_listen_loop() { agent_listen_loop() {
DWORD i, r; DWORD r;
HANDLE wait_events[NUM_LISTENERS + 1]; HANDLE wait_events[2];
wait_events[0] = event_stop_agent; wait_events[0] = event_stop_agent;
for (i = 0; i < NUM_LISTENERS; i++)
wait_events[i + 1] = listeners[i].ol.hEvent; wait_events[1] = ol.hEvent;
while (1) { while (1) {
for (i = 0; i < NUM_LISTENERS; i++) { {
if (listeners[i].pipe == INVALID_HANDLE_VALUE) { {
listeners[i].pipe = CreateNamedPipeW( pipe = CreateNamedPipeW(
listeners[i].pipe_id, // pipe name AGENT_PIPE_ID, // pipe name
PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED, // read/write access PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED, // read/write access
PIPE_TYPE_BYTE | // message type pipe PIPE_TYPE_BYTE | // message type pipe
PIPE_READMODE_BYTE | // message-read mode PIPE_READMODE_BYTE | // message-read mode
@ -150,20 +133,20 @@ agent_listen_loop() {
BUFSIZE, // output buffer size BUFSIZE, // output buffer size
BUFSIZE, // input buffer size BUFSIZE, // input buffer size
0, // client time-out 0, // client time-out
&listeners[i].sa); &sa);
if (listeners[i].pipe == INVALID_HANDLE_VALUE) { if (pipe == INVALID_HANDLE_VALUE) {
verbose("cannot create listener pipe ERROR:%d", GetLastError()); verbose("cannot create listener pipe ERROR:%d", GetLastError());
SetEvent(event_stop_agent); SetEvent(event_stop_agent);
} }
else if (ConnectNamedPipe(listeners[i].pipe, &listeners[i].ol) != FALSE) { else if (ConnectNamedPipe(pipe, &ol) != FALSE) {
verbose("ConnectNamedPipe returned TRUE unexpectedly "); verbose("ConnectNamedPipe returned TRUE unexpectedly ");
SetEvent(event_stop_agent); SetEvent(event_stop_agent);
} }
if (GetLastError() == ERROR_PIPE_CONNECTED) { if (GetLastError() == ERROR_PIPE_CONNECTED) {
debug("Client has already connection to %d", i); debug("Client has already connected");
SetEvent(listeners[i].ol.hEvent); SetEvent(ol.hEvent);
} }
if (GetLastError() != ERROR_IO_PENDING) { if (GetLastError() != ERROR_IO_PENDING) {
@ -174,22 +157,22 @@ agent_listen_loop() {
} }
} }
r = WaitForMultipleObjects(NUM_LISTENERS + 1, wait_events, FALSE, INFINITE); r = WaitForMultipleObjects(2, wait_events, FALSE, INFINITE);
if (r == WAIT_OBJECT_0) { if (r == WAIT_OBJECT_0) {
//received signal to shutdown //received signal to shutdown
debug("shutting down"); debug("shutting down");
agent_cleanup(); agent_cleanup();
return; return;
} }
else if ((r > WAIT_OBJECT_0) && (r <= (WAIT_OBJECT_0 + NUM_LISTENERS))) { else if ((r > WAIT_OBJECT_0) && (r <= (WAIT_OBJECT_0 + 1))) {
/* process incoming connection */ /* process incoming connection */
HANDLE con = listeners[r - 1].pipe; HANDLE con = pipe;
DWORD client_pid = 0; DWORD client_pid = 0;
listeners[r - 1].pipe = INVALID_HANDLE_VALUE; pipe = INVALID_HANDLE_VALUE;
GetNamedPipeClientProcessId(con, &client_pid); GetNamedPipeClientProcessId(con, &client_pid);
verbose("client pid %d connected on %ls", client_pid, pipe_ids[r-1]); verbose("client pid %d connected", client_pid);
if (debug_mode) { if (debug_mode) {
process_connection(con, listeners[r - 1].type); process_connection(con);
agent_cleanup(); agent_cleanup();
return; return;
} }
@ -203,14 +186,14 @@ agent_listen_loop() {
memset(&si, 0, sizeof(STARTUPINFOW)); memset(&si, 0, sizeof(STARTUPINFOW));
GetModuleFileNameW(NULL, module_path, MAX_PATH); GetModuleFileNameW(NULL, module_path, MAX_PATH);
SetHandleInformation(con, HANDLE_FLAG_INHERIT, HANDLE_FLAG_INHERIT); SetHandleInformation(con, HANDLE_FLAG_INHERIT, HANDLE_FLAG_INHERIT);
if ((swprintf_s(path, MAX_PATH, L"%s %d %d", module_path, con, listeners[r - 1].type) == -1 ) || if ((swprintf_s(path, MAX_PATH, L"%s %d", module_path, con) == -1 ) ||
(CreateProcessW(NULL, path, NULL, NULL, TRUE, (CreateProcessW(NULL, path, NULL, NULL, TRUE,
DETACHED_PROCESS, NULL, NULL, DETACHED_PROCESS, NULL, NULL,
&si, &pi) == FALSE)) { &si, &pi) == FALSE)) {
verbose("Failed to create child process %ls ERROR:%d", module_path, GetLastError()); verbose("Failed to create child process %ls ERROR:%d", module_path, GetLastError());
} }
else { else {
debug("spawned child %d to process %d", pi.dwProcessId, i); debug("spawned child %d ", pi.dwProcessId);
CloseHandle(pi.hProcess); CloseHandle(pi.hProcess);
CloseHandle(pi.hThread); CloseHandle(pi.hThread);
} }
@ -242,7 +225,7 @@ void agent_shutdown() {
#define REG_AGENT_SDDL L"D:P(A;; GR;;; AU)(A;; GA;;; SY)(A;; GA;;; BA)" #define REG_AGENT_SDDL L"D:P(A;; GR;;; AU)(A;; GA;;; SY)(A;; GA;;; BA)"
void void
agent_start(BOOL dbg_mode, BOOL child, HANDLE pipe, enum agent_type type) { agent_start(BOOL dbg_mode, BOOL child, HANDLE pipe) {
int r; int r;
HKEY agent_root = NULL; HKEY agent_root = NULL;
DWORD process_id = GetCurrentProcessId(); DWORD process_id = GetCurrentProcessId();
@ -266,12 +249,12 @@ agent_start(BOOL dbg_mode, BOOL child, HANDLE pipe, enum agent_type type) {
fatal("cannot publish agent master process id ERROR:%d", r); fatal("cannot publish agent master process id ERROR:%d", r);
if ((event_stop_agent = CreateEvent(NULL, TRUE, FALSE, NULL)) == NULL) if ((event_stop_agent = CreateEvent(NULL, TRUE, FALSE, NULL)) == NULL)
fatal("cannot create global stop event ERROR:%d", GetLastError()); fatal("cannot create global stop event ERROR:%d", GetLastError());
if ((r = init_listeners()) != 0) if ((r = init_listener()) != 0)
fatal("failed to create server pipes ERROR:%d", r); fatal("failed to create server pipes ERROR:%d", r);
agent_listen_loop(); agent_listen_loop();
} }
else { /* this is a child process that processes one connection */ else { /* this is a child process that processes one connection */
process_connection(pipe, type); process_connection(pipe);
} }
} }

9
contrib/win32/win32compat/ssh-agent/agent.h
View File

@ -9,12 +9,6 @@
#define HEADER_SIZE 4 #define HEADER_SIZE 4
enum agent_type {
KEY_AGENT,
PUBKEY_AGENT,
PUBKEY_AUTH_AGENT
};
struct agent_connection { struct agent_connection {
OVERLAPPED ol; OVERLAPPED ol;
HANDLE connection; HANDLE connection;
@ -38,14 +32,13 @@ struct agent_connection {
SSHD, SSHD,
NETWORK_SERVICE NETWORK_SERVICE
} client_type; } client_type;
enum agent_type type;
}; };
void agent_connection_on_io(struct agent_connection*, DWORD, OVERLAPPED*); void agent_connection_on_io(struct agent_connection*, DWORD, OVERLAPPED*);
void agent_connection_on_error(struct agent_connection* , DWORD ); void agent_connection_on_error(struct agent_connection* , DWORD );
void agent_connection_disconnect(struct agent_connection*); void agent_connection_disconnect(struct agent_connection*);
void agent_start(BOOL, BOOL, HANDLE, enum agent_type); void agent_start(BOOL, BOOL, HANDLE);
void agent_shutdown(); void agent_shutdown();
void agent_cleanup_connection(struct agent_connection*); void agent_cleanup_connection(struct agent_connection*);

31
contrib/win32/win32compat/ssh-agent/connection.c
View File

@ -183,12 +183,31 @@ process_request(struct agent_connection* con) {
if ((request == NULL) || (response == NULL)) if ((request == NULL) || (response == NULL))
goto done; goto done;
if (con->type == KEY_AGENT) {
r = process_keyagent_request(request, response, con); u_char type;
else if (con->type == PUBKEY_AGENT)
r = process_pubkeyagent_request(request, response, con); if (sshbuf_get_u8(request, &type) != 0)
else if (con->type == PUBKEY_AUTH_AGENT) return -1;
r = process_authagent_request(request, response, con); debug2("process key agent request type %d", type);
switch (type) {
case SSH2_AGENTC_ADD_IDENTITY:
return process_add_identity(request, response, con);
case SSH2_AGENTC_REQUEST_IDENTITIES:
return process_request_identities(request, response, con);
case SSH2_AGENTC_SIGN_REQUEST:
return process_sign_request(request, response, con);
case SSH2_AGENTC_REMOVE_IDENTITY:
return process_remove_key(request, response, con);
case SSH2_AGENTC_REMOVE_ALL_IDENTITIES:
return process_remove_all(request, response, con);
case 100:
return process_authagent_request(request, response, con);
default:
debug("unknown agent request %d", type);
return -1;
}
}
done: done:
if (request) if (request)

10
contrib/win32/win32compat/ssh-agent/keyagent-request.c
View File

@ -98,7 +98,7 @@ done:
#define REG_KEY_SDDL L"D:P(A;; GA;;; SY)(A;; GA;;; BA)" #define REG_KEY_SDDL L"D:P(A;; GA;;; SY)(A;; GA;;; BA)"
static int int
process_add_identity(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) { process_add_identity(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) {
struct sshkey* key = NULL; struct sshkey* key = NULL;
int r = 0, blob_len, eblob_len, request_invalid = 0, success = 0; int r = 0, blob_len, eblob_len, request_invalid = 0, success = 0;
@ -224,7 +224,7 @@ done:
return success ? 0 : -1; return success ? 0 : -1;
} }
static int int
process_sign_request(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) { process_sign_request(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) {
u_char *blob, *data, *signature = NULL; u_char *blob, *data, *signature = NULL;
size_t blen, dlen, slen = 0; size_t blen, dlen, slen = 0;
@ -270,7 +270,7 @@ done:
return r; return r;
} }
static int int
process_remove_key(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) { process_remove_key(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) {
HKEY user_root = 0, root = 0; HKEY user_root = 0, root = 0;
char *blob, *thumbprint = NULL; char *blob, *thumbprint = NULL;
@ -308,7 +308,7 @@ done:
free(thumbprint); free(thumbprint);
return r; return r;
} }
static int int
process_remove_all(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) { process_remove_all(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) {
HKEY user_root = 0, root = 0; HKEY user_root = 0, root = 0;
int r = 0; int r = 0;
@ -332,7 +332,7 @@ done:
return r; return r;
} }
static int int
process_request_identities(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) { process_request_identities(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) {
int count = 0, index = 0, success = 0, r = 0; int count = 0, index = 0, success = 0, r = 0;
HKEY root = NULL, sub = NULL, user_root = 0; HKEY root = NULL, sub = NULL, user_root = 0;