Skip to content

Update Agent To Differentiate Key Types #377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Update Agent To Differentiate Key Types #377

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 29 additions & 3 deletions contrib/win32/win32compat/ssh-agent/keyagent-request.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,26 @@ process_unsupported_request(struct sshbuf* request, struct sshbuf* response, str
return r;
}

char *
get_key_subkey_name(const struct sshkey * key)
{
const char * key_type_string = sshkey_type(key);
char * key_fingerprint = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT);
char * key_subkey_name = NULL;

/* concatenate the hash with the key type */
if (key_type_string != NULL && key_fingerprint != NULL) {
const size_t key_subkey_size = strlen(key_fingerprint) + 1 + strlen(key_type_string) + 1;
key_subkey_name = malloc(key_subkey_size);
sprintf_s(key_subkey_name, key_subkey_size, "%s:%s", key_fingerprint, key_type_string);
}

if (key_fingerprint)
free(key_fingerprint);

return key_subkey_name;
}

int
process_add_identity(struct sshbuf* request, struct sshbuf* response, struct agent_connection* con)
{
Expand Down Expand Up @@ -154,7 +174,7 @@ process_add_identity(struct sshbuf* request, struct sshbuf* response, struct age
if ((!ConvertStringSecurityDescriptorToSecurityDescriptorW(REG_KEY_SDDL, SDDL_REVISION_1, &sa.lpSecurityDescriptor, &sa.nLength)) ||
sshkey_to_blob(key, &pubkey_blob, &pubkey_blob_len) != 0 ||
convert_blob(con, blob, blob_len, &eblob, &eblob_len, 1) != 0 ||
((thumbprint = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL) ||
((thumbprint = get_key_subkey_name(key)) == NULL) ||
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the advantage of appending ":key_type_string"?
Don't we need the same logic when we read from the registry to remove the ":key_typ_string"?

get_user_root(con, &user_root) != 0 ||
RegCreateKeyExW(user_root, SSH_KEYS_ROOT, 0, 0, 0, KEY_WRITE | KEY_WOW64_64KEY, &sa, &reg, NULL) != 0 ||
RegCreateKeyExA(reg, thumbprint, 0, 0, 0, KEY_WRITE | KEY_WOW64_64KEY, &sa, &sub, NULL) != 0 ||
Expand All @@ -179,6 +199,12 @@ process_add_identity(struct sshbuf* request, struct sshbuf* response, struct age
if ((success == 0) && reg && thumbprint)
RegDeleteKeyExA(reg, thumbprint, KEY_WOW64_64KEY, 0);

/* delete previous version of thumbprint keys without type */
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't the logic should be before we create the thumbprint?

line 180 on the right hand side adds the thumbprint to registry.
Line 203 deletes the thumbprint added in line 180?

if (thumbprint) {
*strrchr(thumbprint, ':') = '\0';
RegDeleteKeyExA(reg, thumbprint, KEY_WOW64_64KEY, 0);
}

if (eblob)
free(eblob);
if (sa.lpSecurityDescriptor)
Expand Down Expand Up @@ -212,7 +238,7 @@ static int sign_blob(const struct sshkey *pubkey, u_char ** sig, size_t *siglen,
*sig = NULL;
*siglen = 0;

if ((thumbprint = sshkey_fingerprint(pubkey, SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL ||
if ((thumbprint = get_key_subkey_name(pubkey)) == NULL ||
get_user_root(con, &user_root) != 0 ||
RegOpenKeyExW(user_root, SSH_KEYS_ROOT,
0, STANDARD_RIGHTS_READ | KEY_QUERY_VALUE | KEY_WOW64_64KEY | KEY_ENUMERATE_SUB_KEYS, &reg) != 0 ||
Expand Down Expand Up @@ -318,7 +344,7 @@ process_remove_key(struct sshbuf* request, struct sshbuf* response, struct agent
goto done;
}

if ((thumbprint = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL ||
if ((thumbprint = get_key_subkey_name(key)) == NULL ||
get_user_root(con, &user_root) != 0 ||
RegOpenKeyExW(user_root, SSH_KEYS_ROOT, 0,
DELETE | KEY_ENUMERATE_SUB_KEYS | KEY_QUERY_VALUE | KEY_WOW64_64KEY, &root) != 0 ||
Expand Down