agent-client.c 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294
  1. /*
  2. * Pageant client code.
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <assert.h>
  7. #include "putty.h"
  8. #include "pageant.h" /* for AGENT_MAX_MSGLEN */
  9. #include "security-api.h"
  10. #include "cryptoapi.h"
  11. static bool wm_copydata_agent_exists(void)
  12. {
  13. HWND hwnd;
  14. hwnd = FindWindow("Pageant", "Pageant");
  15. if (!hwnd)
  16. return false;
  17. else
  18. return true;
  19. }
  20. static void wm_copydata_agent_query(strbuf *query, void **out, int *outlen)
  21. {
  22. HWND hwnd;
  23. char *mapname;
  24. HANDLE filemap;
  25. unsigned char *p, *ret;
  26. int id, retlen;
  27. COPYDATASTRUCT cds;
  28. SECURITY_ATTRIBUTES sa, *psa;
  29. PSECURITY_DESCRIPTOR psd = NULL;
  30. PSID usersid = NULL;
  31. *out = NULL;
  32. *outlen = 0;
  33. if (query->len > AGENT_MAX_MSGLEN)
  34. return; /* query too large */
  35. hwnd = FindWindow("Pageant", "Pageant");
  36. if (!hwnd)
  37. return; /* *out == NULL, so failure */
  38. mapname = dupprintf("PageantRequest%08x", (unsigned)GetCurrentThreadId());
  39. psa = NULL;
  40. if (got_advapi()) {
  41. /*
  42. * Make the file mapping we create for communication with
  43. * Pageant owned by the user SID rather than the default. This
  44. * should make communication between processes with slightly
  45. * different contexts more reliable: in particular, command
  46. * prompts launched as administrator should still be able to
  47. * run PSFTPs which refer back to the owning user's
  48. * unprivileged Pageant.
  49. */
  50. usersid = get_user_sid();
  51. if (usersid) {
  52. psd = (PSECURITY_DESCRIPTOR)
  53. LocalAlloc(LPTR, SECURITY_DESCRIPTOR_MIN_LENGTH);
  54. if (psd) {
  55. if (p_InitializeSecurityDescriptor(
  56. psd, SECURITY_DESCRIPTOR_REVISION) &&
  57. p_SetSecurityDescriptorOwner(psd, usersid, false)) {
  58. sa.nLength = sizeof(sa);
  59. sa.bInheritHandle = true;
  60. sa.lpSecurityDescriptor = psd;
  61. psa = &sa;
  62. } else {
  63. LocalFree(psd);
  64. psd = NULL;
  65. }
  66. }
  67. }
  68. }
  69. filemap = CreateFileMapping(INVALID_HANDLE_VALUE, psa, PAGE_READWRITE,
  70. 0, AGENT_MAX_MSGLEN, mapname);
  71. if (filemap == NULL || filemap == INVALID_HANDLE_VALUE) {
  72. sfree(mapname);
  73. return; /* *out == NULL, so failure */
  74. }
  75. p = MapViewOfFile(filemap, FILE_MAP_WRITE, 0, 0, 0);
  76. strbuf_finalise_agent_query(query);
  77. memcpy(p, query->s, query->len);
  78. cds.dwData = AGENT_COPYDATA_ID;
  79. cds.cbData = 1 + strlen(mapname);
  80. cds.lpData = mapname;
  81. /*
  82. * The user either passed a null callback (indicating that the
  83. * query is required to be synchronous) or CreateThread failed.
  84. * Either way, we need a synchronous request.
  85. */
  86. id = SendMessage(hwnd, WM_COPYDATA, (WPARAM) NULL, (LPARAM) &cds);
  87. if (id > 0) {
  88. uint32_t length_field = GET_32BIT_MSB_FIRST(p);
  89. if (length_field > 0 && length_field <= AGENT_MAX_MSGLEN - 4) {
  90. retlen = length_field + 4;
  91. ret = snewn(retlen, unsigned char);
  92. memcpy(ret, p, retlen);
  93. *out = ret;
  94. *outlen = retlen;
  95. } else {
  96. /*
  97. * If we get here, we received an out-of-range length
  98. * field, either without space for a message type code or
  99. * overflowing the FileMapping.
  100. *
  101. * Treat this as if Pageant didn't answer at all - which
  102. * actually means we do nothing, and just don't fill in
  103. * out and outlen.
  104. */
  105. }
  106. }
  107. UnmapViewOfFile(p);
  108. CloseHandle(filemap);
  109. sfree(mapname);
  110. if (psd)
  111. LocalFree(psd);
  112. }
  113. Socket *agent_connect(Plug *plug)
  114. {
  115. char *pipename = agent_named_pipe_name();
  116. Socket *s = new_named_pipe_client(pipename, plug);
  117. sfree(pipename);
  118. return s;
  119. }
  120. static bool named_pipe_agent_exists(void)
  121. {
  122. char *pipename = agent_named_pipe_name();
  123. WIN32_FIND_DATA data;
  124. HANDLE ffh = FindFirstFile(pipename, &data);
  125. sfree(pipename);
  126. if (ffh == INVALID_HANDLE_VALUE)
  127. return false;
  128. FindClose(ffh);
  129. return true;
  130. }
  131. bool agent_exists(void)
  132. {
  133. return named_pipe_agent_exists() || wm_copydata_agent_exists();
  134. }
  135. struct agent_pending_query {
  136. struct handle *handle;
  137. HANDLE os_handle;
  138. strbuf *response;
  139. void (*callback)(void *, void *, int);
  140. void *callback_ctx;
  141. };
  142. static int named_pipe_agent_accumulate_response(
  143. strbuf *sb, const void *data, size_t len)
  144. {
  145. put_data(sb, data, len);
  146. if (sb->len >= 4) {
  147. uint32_t length_field = GET_32BIT_MSB_FIRST(sb->u);
  148. if (length_field > AGENT_MAX_MSGLEN)
  149. return -1; /* badly formatted message */
  150. int overall_length = length_field + 4;
  151. if (sb->len >= overall_length)
  152. return overall_length;
  153. }
  154. return 0; /* not done yet */
  155. }
  156. static size_t named_pipe_agent_gotdata(
  157. struct handle *h, const void *data, size_t len, int err)
  158. {
  159. agent_pending_query *pq = handle_get_privdata(h);
  160. if (err || len == 0) {
  161. pq->callback(pq->callback_ctx, NULL, 0);
  162. agent_cancel_query(pq);
  163. return 0;
  164. }
  165. int status = named_pipe_agent_accumulate_response(pq->response, data, len);
  166. if (status == -1) {
  167. pq->callback(pq->callback_ctx, NULL, 0);
  168. agent_cancel_query(pq);
  169. } else if (status > 0) {
  170. void *response_buf = strbuf_to_str(pq->response);
  171. pq->response = NULL;
  172. pq->callback(pq->callback_ctx, response_buf, status);
  173. agent_cancel_query(pq);
  174. }
  175. return 0;
  176. }
  177. static agent_pending_query *named_pipe_agent_query(
  178. strbuf *query, void **out, int *outlen,
  179. void (*callback)(void *, void *, int), void *callback_ctx)
  180. {
  181. agent_pending_query *pq = NULL;
  182. char *err = NULL, *pipename = NULL;
  183. strbuf *sb = NULL;
  184. HANDLE pipehandle;
  185. pipename = agent_named_pipe_name();
  186. pipehandle = connect_to_named_pipe(pipename, &err);
  187. if (pipehandle == INVALID_HANDLE_VALUE)
  188. goto failure;
  189. strbuf_finalise_agent_query(query);
  190. for (DWORD done = 0; done < query->len ;) {
  191. DWORD nwritten;
  192. bool ret = WriteFile(pipehandle, query->s + done, query->len - done,
  193. &nwritten, NULL);
  194. if (!ret)
  195. goto failure;
  196. done += nwritten;
  197. }
  198. if (!callback) {
  199. int status;
  200. sb = strbuf_new_nm();
  201. do {
  202. char buf[1024];
  203. DWORD nread;
  204. bool ret = ReadFile(pipehandle, buf, sizeof(buf), &nread, NULL);
  205. if (!ret)
  206. goto failure;
  207. status = named_pipe_agent_accumulate_response(sb, buf, nread);
  208. } while (status == 0);
  209. if (status == -1)
  210. goto failure;
  211. *out = strbuf_to_str(sb);
  212. *outlen = status;
  213. sb = NULL;
  214. pq = NULL;
  215. goto out;
  216. }
  217. pq = snew(agent_pending_query);
  218. pq->handle = handle_input_new(pipehandle, named_pipe_agent_gotdata, pq, 0);
  219. pq->os_handle = pipehandle;
  220. pipehandle = INVALID_HANDLE_VALUE; /* prevent it being closed below */
  221. pq->response = strbuf_new_nm();
  222. pq->callback = callback;
  223. pq->callback_ctx = callback_ctx;
  224. goto out;
  225. failure:
  226. *out = NULL;
  227. *outlen = 0;
  228. pq = NULL;
  229. out:
  230. sfree(err);
  231. sfree(pipename);
  232. if (pipehandle != INVALID_HANDLE_VALUE)
  233. CloseHandle(pipehandle);
  234. if (sb)
  235. strbuf_free(sb);
  236. return pq;
  237. }
  238. void agent_cancel_query(agent_pending_query *pq)
  239. {
  240. handle_free(pq->handle);
  241. CloseHandle(pq->os_handle);
  242. if (pq->response)
  243. strbuf_free(pq->response);
  244. sfree(pq);
  245. }
  246. agent_pending_query *agent_query(
  247. strbuf *query, void **out, int *outlen,
  248. void (*callback)(void *, void *, int), void *callback_ctx)
  249. {
  250. agent_pending_query *pq = named_pipe_agent_query(
  251. query, out, outlen, callback, callback_ctx);
  252. if (pq || *out)
  253. return pq;
  254. wm_copydata_agent_query(query, out, outlen);
  255. return NULL;
  256. }