Extend ACL-restriction to all Windows tools.

Protecting our processes from outside interference need not be limited
to just PuTTY: there's no reason why the other SSH-speaking tools
shouldn't have the same treatment (PSFTP, PSCP, Plink), and PuTTYgen
and Pageant which handle private key material.

diff --git a/Recipe b/Recipe
index 59ac7d56155ed1efcfb3ec19de41d4152ba05062..39ab078ae254dc63da0cb4819dae6f25d2213311 100644 (file)
--- a/Recipe
+++ b/Recipe
@@ -296,7 +296,7 @@ puttygen : [G] winpgen sshrsag sshdssg sshprime sshdes sshbn sshmd5 version
          + sshrand winnoise sshsha winstore misc winctrls sshrsa sshdss winmisc
          + sshpubk sshaes sshsh256 sshsh512 IMPORT winutils puttygen.res
          + tree234 notiming winhelp winnojmp conf LIBS wintime sshecc
-         + sshecdsag
+         + sshecdsag winsecur
 
 pterm    : [X] GTKTERM uxmisc misc ldisc settings uxpty uxsel BE_NONE uxstore
          + uxsignal CHARSET cmdline uxpterm version time xpmpterm xpmptcfg

diff --git a/pscp.c b/pscp.c
index 61e6e1af0ef9a215a317d04f93a189e59ccc1965..6e1d0ff9a084576f8582d915cd63931a30f5c945 100644 (file)
--- a/pscp.c
+++ b/pscp.c
@@ -2349,6 +2349,8 @@ int psftp_main(int argc, char *argv[])
     argv += i;
     back = NULL;
 
+    platform_psftp_post_option_setup();
+
     if (list) {
        if (argc != 1)
            usage();

diff --git a/psftp.c b/psftp.c
index 92b57a2f363793b94b95aa9aa2128505dd13b6a0..784c81b1b88242871f5b76cd679f32adcbd757b1 100644 (file)
--- a/psftp.c
+++ b/psftp.c
@@ -2941,6 +2941,8 @@ int psftp_main(int argc, char *argv[])
     argv += i;
     back = NULL;
 
+    platform_psftp_post_option_setup();
+
     /*
      * If the loaded session provides a hostname, and a hostname has not
      * otherwise been specified, pop it in `userhost' so that

diff --git a/psftp.h b/psftp.h
index 57a821ab19da7522c773a19792423662a4f132b6..6f46bdcd3c9aef4fe6964ff84d237ce98ffc0587 100644 (file)
--- a/psftp.h
+++ b/psftp.h
@@ -47,6 +47,13 @@ int ssh_sftp_loop_iteration(void);
  */
 char *ssh_sftp_get_cmdline(const char *prompt, int backend_required);
 
+/*
+ * Platform-specific function called after the command line has been
+ * processed, so that any per-platform initialisation such as process
+ * ACL setup can be done.
+ */
+void platform_psftp_post_option_setup(void);
+
 /*
  * The main program in psftp.c. Called from main() in the platform-
  * specific code, after doing any platform-specific initialisation.

diff --git a/unix/uxsftp.c b/unix/uxsftp.c
index 3ac1d2c346470242955b96ff61825284e78126f0..6e39491010d7a04ef4d59ebd7366ac1e374929d9 100644 (file)
--- a/unix/uxsftp.c
+++ b/unix/uxsftp.c
@@ -618,6 +618,8 @@ char *ssh_sftp_get_cmdline(const char *prompt, int no_fds_ok)
 
 void frontend_net_error_pending(void) {}
 
+void platform_psftp_post_option_setup(void) {}
+
 /*
  * Main program: do platform-specific initialisation and then call
  * psftp_main().

diff --git a/windows/winpgen.c b/windows/winpgen.c
index 002070a561b4610cc773d7dcff8c6346306780ce..c4f3d57f9ca7e82bf016774944bf936e32774468 100644 (file)
--- a/windows/winpgen.c
+++ b/windows/winpgen.c
@@ -12,6 +12,7 @@
 #include "putty.h"
 #include "ssh.h"
 #include "licence.h"
+#include "winsecur.h"
 
 #include <commctrl.h>
 
@@ -1530,6 +1531,23 @@ int WINAPI WinMain(HINSTANCE inst, HINSTANCE prev, LPSTR cmdline, int show)
        }
     }
 
+#ifndef UNPROTECT
+    /*
+     * Protect our process.
+     */
+    {
+        char *error = NULL;
+        if (!setprocessacl(error)) {
+            char *message = dupprintf("Could not restrict process ACL: %s",
+                                      error);
+            MessageBox(NULL, message, "PuTTYgen Warning",
+                       MB_ICONWARNING | MB_OK);
+            sfree(message);
+            sfree(error);
+        }
+    }
+#endif
+
     random_ref();
     ret = DialogBox(hinst, MAKEINTRESOURCE(201), NULL, MainDlgProc) != IDOK;
 

diff --git a/windows/winpgnt.c b/windows/winpgnt.c
index ab0305246771851357be3196dfcb332385891cf8..3e47e6900e05d260db7d36b2be354694c47ec19c 100644 (file)
--- a/windows/winpgnt.c
+++ b/windows/winpgnt.c
@@ -1174,6 +1174,23 @@ int WINAPI WinMain(HINSTANCE inst, HINSTANCE prev, LPSTR cmdline, int show)
        }
     }
 
+#ifndef UNPROTECT
+    /*
+     * Protect our process.
+     */
+    {
+        char *error = NULL;
+        if (!setprocessacl(error)) {
+            char *message = dupprintf("Could not restrict process ACL: %s",
+                                      error);
+            MessageBox(NULL, message, "Pageant Warning",
+                       MB_ICONWARNING | MB_OK);
+            sfree(message);
+            sfree(error);
+        }
+    }
+#endif
+
     /*
      * Forget any passphrase that we retained while going over
      * command line keyfiles.

diff --git a/windows/winplink.c b/windows/winplink.c
index ac4dab299fe19ffb0bb5de3f268da1b904feab7f..759a71c08a29c93657d2f9e9690b6d85d445261d 100644 (file)
--- a/windows/winplink.c
+++ b/windows/winplink.c
@@ -11,6 +11,7 @@
 #include "putty.h"
 #include "storage.h"
 #include "tree234.h"
+#include "winsecur.h"
 
 #define WM_AGENT_CALLBACK (WM_APP + 4)
 
@@ -497,6 +498,22 @@ int main(int argc, char **argv)
        }
     }
 
+#ifndef UNPROTECT
+    /*
+     * Protect our process.
+     */
+    {
+        char *error = NULL;
+        if (!setprocessacl(error)) {
+            char *message = dupprintf("Could not restrict process ACL: %s",
+                                      error);
+            logevent(NULL, message);
+            sfree(message);
+            sfree(error);
+        }
+    }
+#endif
+
     if (errors)
        return 1;
 

diff --git a/windows/winsftp.c b/windows/winsftp.c
index 0776cba94bdc19f544814d26dd7e985611fcae42..a0341274f3637241d547278ff8a100606c470ec4 100644 (file)
--- a/windows/winsftp.c
+++ b/windows/winsftp.c
@@ -733,6 +733,25 @@ char *ssh_sftp_get_cmdline(const char *prompt, int no_fds_ok)
     return ctx->line;
 }
 
+void platform_psftp_post_option_setup(void)
+{
+#ifndef UNPROTECT
+    /*
+     * Protect our process.
+     */
+    {
+        char *error = NULL;
+        if (!setprocessacl(error)) {
+            char *message = dupprintf("Could not restrict process ACL: %s",
+                                      error);
+            logevent(NULL, message);
+            sfree(message);
+            sfree(error);
+        }
+    }
+#endif
+}
+
 /* ----------------------------------------------------------------------
  * Main program. Parse arguments etc.
  */