diff options
Diffstat (limited to 'conf/dpapi/dpapi_windows.go')
-rw-r--r-- | conf/dpapi/dpapi_windows.go | 59 |
1 files changed, 20 insertions, 39 deletions
diff --git a/conf/dpapi/dpapi_windows.go b/conf/dpapi/dpapi_windows.go index 778605e9..45ad950e 100644 --- a/conf/dpapi/dpapi_windows.go +++ b/conf/dpapi/dpapi_windows.go @@ -9,78 +9,59 @@ import ( "errors" "runtime" "unsafe" + "fmt" "golang.org/x/sys/windows" ) -const ( - dpCRYPTPROTECT_UI_FORBIDDEN uint32 = 0x1 - dpCRYPTPROTECT_LOCAL_MACHINE uint32 = 0x4 - dpCRYPTPROTECT_CRED_SYNC uint32 = 0x8 - dpCRYPTPROTECT_AUDIT uint32 = 0x10 - dpCRYPTPROTECT_NO_RECOVERY uint32 = 0x20 - dpCRYPTPROTECT_VERIFY_PROTECTION uint32 = 0x40 - dpCRYPTPROTECT_CRED_REGENERATE uint32 = 0x80 -) - -type dpBlob struct { - len uint32 - data uintptr +func bytesToBlob(bytes []byte) *windows.DataBlob { + blob := &windows.DataBlob{Size: uint32(len(bytes))} + if len(bytes) > 0 { + blob.Data = &bytes[0] + } + return blob } -func bytesToBlob(bytes []byte) *dpBlob { - blob := &dpBlob{} - blob.len = uint32(len(bytes)) - if len(bytes) > 0 { - blob.data = uintptr(unsafe.Pointer(&bytes[0])) - } - return blob -} - -//sys cryptProtectData(dataIn *dpBlob, name *uint16, optionalEntropy *dpBlob, reserved uintptr, promptStruct uintptr, flags uint32, dataOut *dpBlob) (err error) = crypt32.CryptProtectData - func Encrypt(data []byte, name string) ([]byte, error) { - out := dpBlob{} - err := cryptProtectData(bytesToBlob(data), windows.StringToUTF16Ptr(name), nil, 0, 0, dpCRYPTPROTECT_UI_FORBIDDEN, &out) + out := windows.DataBlob{} + err := windows.CryptProtectData(bytesToBlob(data), windows.StringToUTF16Ptr(name), nil, 0, nil, windows.CRYPTPROTECT_UI_FORBIDDEN, &out) if err != nil { - return nil, errors.New("Unable to encrypt DPAPI protected data: " + err.Error()) + return nil, fmt.Errorf("unable to encrypt DPAPI protected data: %w", err) } outSlice := *(*[]byte)(unsafe.Pointer(&(struct { - addr uintptr + addr *byte len int cap int - }{out.data, int(out.len), int(out.len)}))) + }{out.Data, int(out.Size), int(out.Size)}))) ret := make([]byte, len(outSlice)) copy(ret, outSlice) - windows.LocalFree(windows.Handle(out.data)) + windows.LocalFree(windows.Handle(unsafe.Pointer(out.Data))) return ret, nil } -//sys cryptUnprotectData(dataIn *dpBlob, name **uint16, optionalEntropy *dpBlob, reserved uintptr, promptStruct uintptr, flags uint32, dataOut *dpBlob) (err error) = crypt32.CryptUnprotectData - func Decrypt(data []byte, name string) ([]byte, error) { - out := dpBlob{} + out := windows.DataBlob{} var outName *uint16 utf16Name, err := windows.UTF16PtrFromString(name) if err != nil { return nil, err } - err = cryptUnprotectData(bytesToBlob(data), &outName, nil, 0, 0, dpCRYPTPROTECT_UI_FORBIDDEN, &out) + err = windows.CryptUnprotectData(bytesToBlob(data), &outName, nil, 0, nil, windows.CRYPTPROTECT_UI_FORBIDDEN, &out) if err != nil { - return nil, errors.New("Unable to decrypt DPAPI protected data: " + err.Error()) + return nil, fmt.Errorf("unable to decrypt DPAPI protected data: %w", err) } outSlice := *(*[]byte)(unsafe.Pointer(&(struct { - addr uintptr + addr *byte len int cap int - }{out.data, int(out.len), int(out.len)}))) + }{out.Data, int(out.Size), int(out.Size)}))) ret := make([]byte, len(outSlice)) copy(ret, outSlice) - windows.LocalFree(windows.Handle(out.data)) + windows.LocalFree(windows.Handle(unsafe.Pointer(out.Data))) // Note: this ridiculous open-coded strcmp is not constant time. different := false @@ -101,7 +82,7 @@ func Decrypt(data []byte, name string) ([]byte, error) { windows.LocalFree(windows.Handle(unsafe.Pointer(outName))) if different { - return nil, errors.New("The input name does not match the stored name") + return nil, errors.New("input name does not match the stored name") } return ret, nil |