tyler.durden/Win32-OpenSSH
1
0
Fork 0
mirror of https://github.com/PowerShell/Win32-OpenSSH.git synced 2025-07-23 05:55:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added unicode support in ssh-agent auth requests

Browse Source
This commit is contained in:
Manoj Ampalam 2016-09-17 00:54:29 -07:00
parent 3266df9a29
commit b1083276ca
5 changed files with 60 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
contrib/win32/win32compat/ssh-agent/agent.c
View File

@ -212,6 +212,10 @@ agent_listen_loop() {
void agent_cleanup_connection(struct agent_connection* con) { void agent_cleanup_connection(struct agent_connection* con) {
debug("connection %p clean up", con); debug("connection %p clean up", con);
CloseHandle(con->connection); CloseHandle(con->connection);
if (con->hProfile)
UnloadUserProfile(con->auth_token, con->hProfile);
if (con->auth_token)
CloseHandle(con->auth_token);
free(con); free(con);
CloseHandle(ioc_port); CloseHandle(ioc_port);
ioc_port = NULL; ioc_port = NULL;

4
contrib/win32/win32compat/ssh-agent/agent.h
View File

@ -31,7 +31,9 @@ struct agent_connection {
LOCAL_SYSTEM, LOCAL_SYSTEM,
SSHD, SSHD,
NETWORK_SERVICE NETWORK_SERVICE
} client_type; } client_process;
HANDLE auth_token;
HANDLE hProfile;
}; };
void agent_connection_on_io(struct agent_connection*, DWORD, OVERLAPPED*); void agent_connection_on_io(struct agent_connection*, DWORD, OVERLAPPED*);

83
contrib/win32/win32compat/ssh-agent/authagent-request.c
View File

@ -79,8 +79,8 @@ done:
void void
LoadProfile(HANDLE token, char* user, char* domain) { LoadProfile(struct agent_connection* con, wchar_t* user, wchar_t* domain) {
PROFILEINFOA profileInfo; PROFILEINFOW profileInfo;
profileInfo.dwFlags = PI_NOUI; profileInfo.dwFlags = PI_NOUI;
profileInfo.lpProfilePath = NULL; profileInfo.lpProfilePath = NULL;
profileInfo.lpUserName = user; profileInfo.lpUserName = user;
@ -91,11 +91,12 @@ LoadProfile(HANDLE token, char* user, char* domain) {
profileInfo.dwSize = sizeof(profileInfo); profileInfo.dwSize = sizeof(profileInfo);
EnablePrivilege("SeBackupPrivilege", 1); EnablePrivilege("SeBackupPrivilege", 1);
EnablePrivilege("SeRestorePrivilege", 1); EnablePrivilege("SeRestorePrivilege", 1);
if (LoadUserProfileA(token, &profileInfo) == FALSE) if (LoadUserProfileW(con->auth_token, &profileInfo) == FALSE)
debug("Loading user profile failed ERROR: %d", GetLastError()); debug("Loading user (%ls,%ls) profile failed ERROR: %d", user, domain, GetLastError());
else
con->hProfile = profileInfo.hProfile;
EnablePrivilege("SeBackupPrivilege", 0); EnablePrivilege("SeBackupPrivilege", 0);
EnablePrivilege("SeRestorePrivilege", 0); EnablePrivilege("SeRestorePrivilege", 0);
} }
#define MAX_USER_LEN 256 #define MAX_USER_LEN 256
@ -200,7 +201,7 @@ generate_user_token(wchar_t* user) {
&token, &token,
&quotas, &quotas,
&subStatus) != STATUS_SUCCESS) { &subStatus) != STATUS_SUCCESS) {
debug("LsaRegisterLogonProcess failed"); debug("LsaLogonUser failed");
goto done; goto done;
} }
@ -218,10 +219,12 @@ done:
#define PUBKEY_AUTH_REQUEST "pubkey" #define PUBKEY_AUTH_REQUEST "pubkey"
#define PASSWD_AUTH_REQUEST "password" #define PASSWD_AUTH_REQUEST "password"
#define MAX_USER_NAME_LEN 256 #define MAX_USER_NAME_LEN 256
#define MAX_PW_LEN 128
int process_passwordauth_request(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) { int process_passwordauth_request(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con) {
char *user = NULL, *pwd = NULL, *dom = NULL, *tmp; char *user = NULL, *pwd = NULL;
//wchar_t *userW = NULL, *domW = NULL, *pwdW = NULL; wchar_t userW_buf[MAX_USER_NAME_LEN], pwdW_buf[MAX_PW_LEN];
wchar_t *userW = userW_buf, *domW = NULL, *pwdW = pwdW_buf, *tmp;
size_t user_len = 0, pwd_len = 0, dom_len = 0; size_t user_len = 0, pwd_len = 0, dom_len = 0;
int r = -1; int r = -1;
HANDLE token = 0, dup_token, client_proc = 0; HANDLE token = 0, dup_token, client_proc = 0;
@ -235,20 +238,25 @@ int process_passwordauth_request(struct sshbuf* request, struct sshbuf* response
goto done; goto done;
} }
/*TODO - support Unicode*/ userW[0] = L'\0';
if (MultiByteToWideChar(CP_UTF8, 0, user, user_len + 1, userW, MAX_USER_NAME_LEN) == 0 ||
MultiByteToWideChar(CP_UTF8, 0, pwd, pwd_len + 1, pwdW, MAX_PW_LEN) == 0) {
debug("unable to convert user (%s) or password to UTF-16", user);
goto done;
}
if ((tmp = strchr(user, '\\')) != NULL) { if ((tmp = wcschr(userW, L'\\')) != NULL) {
dom = user; domW = userW;
user = tmp + 1; userW = tmp + 1;
*tmp = '\0'; *tmp = L'\0';
} }
else if ((tmp = strchr(user, '@')) != NULL) { else if ((tmp = wcschr(userW, L'@')) != NULL) {
dom = tmp + 1; domW = tmp + 1;
*tmp = '\0'; *tmp = L'\0';
} }
if (LogonUser(user, dom, pwd, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &token) == FALSE || if (LogonUserW(userW, domW, pwdW, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &token) == FALSE ||
(FALSE == GetNamedPipeClientProcessId(con->connection, &client_pid)) || (FALSE == GetNamedPipeClientProcessId(con->connection, &client_pid)) ||
((client_proc = OpenProcess(PROCESS_DUP_HANDLE, FALSE, client_pid)) == NULL) || ((client_proc = OpenProcess(PROCESS_DUP_HANDLE, FALSE, client_pid)) == NULL) ||
(FALSE == DuplicateHandle(GetCurrentProcess(), token, client_proc, &dup_token, TOKEN_QUERY | TOKEN_IMPERSONATE, FALSE, DUPLICATE_SAME_ACCESS)) || (FALSE == DuplicateHandle(GetCurrentProcess(), token, client_proc, &dup_token, TOKEN_QUERY | TOKEN_IMPERSONATE, FALSE, DUPLICATE_SAME_ACCESS)) ||
@ -257,7 +265,8 @@ int process_passwordauth_request(struct sshbuf* request, struct sshbuf* response
goto done; goto done;
} }
LoadProfile(token, user, dom); con->auth_token = token;
LoadProfile(con, userW, domW);
r = 0; r = 0;
done: done:
/* TODO Fix this hacky protocol*/ /* TODO Fix this hacky protocol*/
@ -268,8 +277,6 @@ done:
free(user); free(user);
if (pwd) if (pwd)
free(pwd); free(pwd);
if (token)
CloseHandle(token);
if (client_proc) if (client_proc)
CloseHandle(client_proc); CloseHandle(client_proc);
@ -296,12 +303,15 @@ int process_pubkeyauth_request(struct sshbuf* request, struct sshbuf* response,
goto done; goto done;
} }
wuser[0] = L'\0';
if (MultiByteToWideChar(CP_UTF8, 0, user, user_len + 1, wuser, MAX_USER_NAME_LEN) == 0 || if (MultiByteToWideChar(CP_UTF8, 0, user, user_len + 1, wuser, MAX_USER_NAME_LEN) == 0 ||
(token = generate_user_token(wuser)) == 0) { (token = generate_user_token(wuser)) == 0) {
debug("unable to generate token for user %ls", wuser); debug("unable to generate token for user %ls", wuser);
goto done; goto done;
} }
con->auth_token = token;
if (SHGetKnownFolderPath(&FOLDERID_Profile, 0, token, &wuser_home) != S_OK || if (SHGetKnownFolderPath(&FOLDERID_Profile, 0, token, &wuser_home) != S_OK ||
pubkey_allowed(key, wuser, wuser_home) != 1) { pubkey_allowed(key, wuser, wuser_home) != 1) {
debug("given public key is not mapped to user %ls (profile:%ls)", wuser, wuser_home); debug("given public key is not mapped to user %ls (profile:%ls)", wuser, wuser_home);
@ -320,30 +330,33 @@ int process_pubkeyauth_request(struct sshbuf* request, struct sshbuf* response,
debug("failed to authorize user"); debug("failed to authorize user");
goto done; goto done;
} }
{
/*TODO - support Unicode*/ {
char *tmp, *u = user, *d = NULL; wchar_t *tmp, *userW, *domW;
if ((tmp = strchr(user, '\\')) != NULL) { userW = wuser;
d = user; if ((tmp = wcschr(userW, L'\\')) != NULL) {
u = tmp + 1; domW = userW;
*tmp = '\0'; userW = tmp + 1;
*tmp = L'\0';
} }
else if ((tmp = strchr(user, '@')) != NULL) { else if ((tmp = wcschr(userW, L'@')) != NULL) {
d = tmp + 1; domW = tmp + 1;
*tmp = '\0'; *tmp = L'\0';
} }
LoadProfile(token, u, d); LoadProfile(con, userW, domW);
} }
r = 0; r = 0;
done: done:
/* TODO Fix this hacky protocol*/
if ((r == -1) && (sshbuf_put_u8(response, SSH_AGENT_FAILURE) == 0))
r = 0;
if (user) if (user)
free(user); free(user);
if (key) if (key)
sshkey_free(key); sshkey_free(key);
if (token)
CloseHandle(token);
if (wuser_home) if (wuser_home)
CoTaskMemFree(wuser_home); CoTaskMemFree(wuser_home);
if (client_proc) if (client_proc)

4
contrib/win32/win32compat/ssh-agent/connection.c
View File

@ -174,8 +174,8 @@ process_request(struct agent_connection* con) {
int r = -1; int r = -1;
struct sshbuf *request = NULL, *response = NULL; struct sshbuf *request = NULL, *response = NULL;
if (con->client_type == UNKNOWN) if (con->client_process == UNKNOWN)
if ((con->client_type = get_con_client_type(con->connection)) == -1) if ((con->client_process = get_con_client_type(con->connection)) == -1)
goto done; goto done;

6
contrib/win32/win32compat/ssh-agent/keyagent-request.c
View File

@ -43,7 +43,7 @@ get_user_root(struct agent_connection* con, HKEY *root){
if (ImpersonateNamedPipeClient(con->connection) == FALSE) if (ImpersonateNamedPipeClient(con->connection) == FALSE)
return -1; return -1;
if (con->client_type > OTHER) if (con->client_process > OTHER)
*root = HKEY_LOCAL_MACHINE; *root = HKEY_LOCAL_MACHINE;
else if (RegOpenCurrentUser(KEY_ALL_ACCESS, root) != ERROR_SUCCESS) else if (RegOpenCurrentUser(KEY_ALL_ACCESS, root) != ERROR_SUCCESS)
r = -1; r = -1;
@ -59,7 +59,7 @@ convert_blob(struct agent_connection* con, const char *blob, DWORD blen, char **
int success = 0; int success = 0;
DATA_BLOB in, out; DATA_BLOB in, out;
if (con->client_type == OTHER) if (con->client_process == OTHER)
if (ImpersonateNamedPipeClient(con->connection) == FALSE) if (ImpersonateNamedPipeClient(con->connection) == FALSE)
return -1; return -1;
@ -91,7 +91,7 @@ convert_blob(struct agent_connection* con, const char *blob, DWORD blen, char **
done: done:
if (out.pbData) if (out.pbData)
LocalFree(out.pbData); LocalFree(out.pbData);
if (con->client_type == OTHER) if (con->client_process == OTHER)
RevertToSelf(); RevertToSelf();
return success? 0: -1; return success? 0: -1;
} }