5-11 C2

Author: manojampalam

contrib/win32/win32compat/ssh-agent/agent-main.c

@@ -100,13 +100,15 @@ int main(int argc, char **argv) {
 				/* console app - start in debug mode*/
 				SetConsoleCtrlHandler(ctrl_c_handler, TRUE);
 				log_init("ssh-agent", 7, 1, 1);
-				return agent_start(TRUE, FALSE, 0, 0);
+				agent_start(TRUE, FALSE, 0, 0);
+				return 0;
 			}
 			else {
 				char* h = 0;
 				h += atoi(*(argv + 1));
 				log_init("ssh-agent", config_log_level(), 1, 0);
-				return agent_start(FALSE, TRUE, h, atoi(*(argv+2)));
+				agent_start(FALSE, TRUE, h, atoi(*(argv+2)));
+				return 0;
 			}
 		}
 		else
@@ -122,6 +124,7 @@ int scm_start_servie(DWORD num, LPWSTR* args) {
 	ReportSvcStatus(SERVICE_START_PENDING, NO_ERROR, 300);
 	ReportSvcStatus(SERVICE_RUNNING, NO_ERROR, 0);
 	log_init("ssh-agent", config_log_level(), 1, 0);
-	return agent_start(FALSE, FALSE, 0, 0);
+	agent_start(FALSE, FALSE, 0, 0);
+	return 0;
 }
 

contrib/win32/win32compat/ssh-agent/agent.c

@@ -112,18 +112,19 @@ iocp_work(LPVOID lpParam) {
 }
 
 
-static int
+static void
 process_connection(HANDLE pipe, int type) {
 	struct agent_connection* con;
 
-	if ((con = malloc(sizeof(struct agent_connection))) == NULL) {
-		debug("out of memory");
-		return ERROR_OUTOFMEMORY;
-	}
+	if ((con = malloc(sizeof(struct agent_connection))) == NULL)
+		fatal("failed to alloc");
+
 	memset(con, 0, sizeof(struct agent_connection));
 	con->connection = pipe;
 	con->type = type;
-	CreateIoCompletionPort(pipe, ioc_port, (ULONG_PTR)con, 0);
+	if (CreateIoCompletionPort(pipe, ioc_port, (ULONG_PTR)con, 0) != ioc_port)
+		fatal("failed to assign pipe to ioc_port");
+	
 	agent_connection_on_io(con, 0, &con->ol);
 	return iocp_work(NULL);
 }
@@ -153,16 +154,18 @@ agent_listen_loop() {
 					&listeners[i].sa);
 
 				if (listeners[i].pipe == INVALID_HANDLE_VALUE) {
-					debug("cannot create listener pipe ERROR:%d", GetLastError());
+					verbose("cannot create listener pipe ERROR:%d", GetLastError());
 					SetEvent(event_stop_agent);
 				}
 				else if (ConnectNamedPipe(listeners[i].pipe, &listeners[i].ol) != FALSE) {
-					debug("ConnectNamedPipe returned unexpectedly");
+					verbose("ConnectNamedPipe returned TRUE unexpectedly ");
 					SetEvent(event_stop_agent);
 				}
 
-				if (GetLastError() == ERROR_PIPE_CONNECTED)
+				if (GetLastError() == ERROR_PIPE_CONNECTED) {
+					debug("Client has already connection to %d", i);
 					SetEvent(listeners[i].ol.hEvent);
+				}
 
 				if (GetLastError() != ERROR_IO_PENDING) {
 					debug("ConnectNamedPipe failed ERROR: %d", GetLastError());
@@ -183,7 +186,7 @@ agent_listen_loop() {
 			/* process incoming connection */
 			HANDLE con = listeners[r - 1].pipe;
 			listeners[r - 1].pipe = INVALID_HANDLE_VALUE;
-
+			verbose("client connected on %ls", pipe_ids[r-1]);
 			if (debug_mode) {
 				process_connection(con, listeners[r - 1].type);
 				agent_cleanup();
@@ -198,25 +201,23 @@ agent_listen_loop() {
 				si.cb = sizeof(STARTUPINFOW);
 				memset(&si, 0, sizeof(STARTUPINFOW));
 				GetModuleFileNameW(NULL, module_path, MAX_PATH);
-				swprintf_s(path, MAX_PATH, L"%s %d %d", module_path, con, listeners[r - 1].type);
-				if (CreateProcessW(NULL, path, NULL, NULL, TRUE,
+				if ((swprintf_s(path, MAX_PATH, L"%s %d %d", module_path, con, listeners[r - 1].type) == -1 ) ||
+				    (CreateProcessW(NULL, path, NULL, NULL, TRUE,
 					DETACHED_PROCESS, NULL, NULL,
-					&si, &pi) == FALSE) {
-					debug("CreateProcess failure: %d", GetLastError());
-					CloseHandle(con);
-					agent_cleanup();
-					return;
+					&si, &pi) == FALSE)) {
+					verbose("Failed to create child process %ls ERROR:%d", module_path, GetLastError());
 				}
-
-				CloseHandle(con);
-				
+				else {
+					debug("spawned child %d to process %d", pi.dwProcessId, i);
+					CloseHandle(pi.hProcess);
+					CloseHandle(pi.hThread);
+				}
+				CloseHandle(con);				
 			}
 
 		}
 		else {
-			debug("wait on events ended with %d ERROR:%d", r, GetLastError());
-			agent_cleanup();
-			return;
+			fatal("wait on events ended with %d ERROR:%d", r, GetLastError());
 		}
 
 	}
@@ -231,33 +232,35 @@ void agent_cleanup_connection(struct agent_connection* con) {
 }
 
 void agent_shutdown() {
+	verbose("shutdown");
 	SetEvent(event_stop_agent);
 }
 
-int agent_start(BOOL dbg_mode, BOOL child, HANDLE pipe, enum agent_type type) {
+void
+agent_start(BOOL dbg_mode, BOOL child, HANDLE pipe, enum agent_type type) {
 	int i, r;
-	HKEY agent_root;
+	HKEY agent_root = NULL;
 	DWORD process_id = GetCurrentProcessId();
 
-	debug("agent_start pid:%d, dbg:%d, child:%d, pipe:%d", process_id, dbg_mode, child, pipe);
+	verbose("agent_start pid:%d, dbg:%d, child:%d, pipe:%d", process_id, dbg_mode, child, pipe);
 	debug_mode = dbg_mode;
 
-	if ((ioc_port = CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, (ULONG_PTR)NULL, 0)) == NULL) {
-		debug("cannot create ioc port ERROR:%d", GetLastError());
-		return GetLastError();
-	}
+	if ((ioc_port = CreateIoCompletionPort(INVALID_HANDLE_VALUE, NULL, (ULONG_PTR)NULL, 0)) == NULL)
+		fatal("cannot create ioc port ERROR:%d", GetLastError());
 
 	if (child == FALSE) {
-		RegCreateKeyExW(HKEY_LOCAL_MACHINE, SSH_AGENT_ROOT, 0, 0, 0, KEY_WRITE, 0, &agent_root, 0);
-		RegSetValueExW(agent_root, L"ProcessID", 0, REG_DWORD, (BYTE*)&process_id, 4);
+		if ((r = RegCreateKeyExW(HKEY_LOCAL_MACHINE, SSH_AGENT_ROOT, 0, 0, 0, KEY_WRITE, 0, &agent_root, 0)) != ERROR_SUCCESS)
+			fatal("cannot create agent root reg key, ERROR:%d", r);
+		if ((r = RegSetValueExW(agent_root, L"ProcessID", 0, REG_DWORD, (BYTE*)&process_id, 4)) != ERROR_SUCCESS)
+			fatal("cannot publish agent master process id ERROR:%d", r);
 		if ((event_stop_agent = CreateEvent(NULL, TRUE, FALSE, NULL)) == NULL)
-			return GetLastError();
+			fatal("cannot create global stop event ERROR:%d", GetLastError());
 		if ((r = init_listeners()) != 0)
-			return r;
+			fatal("failed to create server pipes ERROR:%d", r);
 		agent_listen_loop();
 	}
-	else {
-		return process_connection(pipe, type);
+	else { /* this is a child process that processes one connection */
+		process_connection(pipe, type);
 	}
 
 	return 0;

contrib/win32/win32compat/ssh-agent/agent.h

@@ -1,6 +1,6 @@
 #include <Windows.h>
 #include <stdio.h>
-#define MAX_MESSAGE_SIZE 5 * 1024
+#define MAX_MESSAGE_SIZE 256 * 1024
 
 #define SSH_ROOT L"SOFTWARE\\SSH"
 #define SSH_AGENT_ROOT SSH_ROOT L"\\Agent"
@@ -37,7 +37,7 @@ void agent_connection_on_io(struct agent_connection*, DWORD, OVERLAPPED*);
 void agent_connection_on_error(struct agent_connection* , DWORD );
 void agent_connection_disconnect(struct agent_connection*);
 
-int agent_start(BOOL, BOOL, HANDLE, enum agent_type);
+void agent_start(BOOL, BOOL, HANDLE, enum agent_type);
 void agent_shutdown();
 void agent_cleanup_connection(struct agent_connection*);
 

contrib/win32/win32compat/ssh-agent/connection.c

@@ -53,7 +53,6 @@ void agent_connection_on_io(struct agent_connection* con, DWORD bytes, OVERLAPPE
 	if (con->state == DONE)
 		DebugBreak();
 
-	//while (1) 
 	{
 		switch (con->state) {		
 		case LISTENING: