Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SCardListReadersW failed with error -2146435043 #5791

Closed
ondrejholy opened this issue Dec 18, 2019 · 11 comments · Fixed by #5884
Closed

SCardListReadersW failed with error -2146435043 #5791

ondrejholy opened this issue Dec 18, 2019 · 11 comments · Fixed by #5884
Labels
fixed-waiting-test
Milestone
2.0.0

Comments

@ondrejholy
Copy link
Contributor

Describe the bug
Smartcard redirection seems to work properly with #5499, however one of our customers see [15:21:32:565] [18068:18191] [ERROR][com.freerdp.channels.smartcard.client] - SCardListReadersW failed with error -2146435043 in the log every 2 ms anyway when connecting to Windows 10. Any idea what is wrong?

To Reproduce
Steps to reproduce the behavior:

  1. Connect to Windows 10 using --no-nla --plugin rdpsnd --plugin rdpdr --data scard: -- options. (They use an old syntax for some reason, but it seems that it is correctly translated to -no-nla and /smartcard options).
  2. SCardListReadersW failed with error -2146435043 is printed every 2 ms.

Application details
It has been tested on RHEL 7/8 with rc4 including #5499. It has been tried with several other smartcard fixes from master, but without any success.
@ondrejholy ondrejholy mentioned this issue Dec 18, 2019
Closed
@akallabeth
Copy link
Member

@ondrejholy just stumbled over this:
[MS-RDPESC] 1.7 Versioning and Capability Negotiation
you might want to try to increase the number sent in settings->ClientBuild

@bmiklautz
Copy link
Member

@akallabeth interesting that they use the build number exactly for this as this must not be set at all. It's something the client chooses. Definitely worth a try.

@ondrejholy
Copy link
Contributor Author

That sounds promising, I will pass build with the modified ClientBuild number (6482a63) to our customers for testing and let you know...

This was referenced Jan 9, 2020
Merged
Merged
@akallabeth
Copy link
Member

@ondrejholy ok, was able to reproduce it when uninstalling pcscd on my ubuntu test machine.
Without it the smartcard channel can not create a context with system scope and returns this failure.
If it is running the error disappears.

@akallabeth
Copy link
Member

@ondrejholy as for the ClientBuild I´ve run some tests and I think I found the core issue.
See [MS-RDPESC] 1.7 Versioning and Capability Negotiation for version limits, but if you keep the number < 7865 the service should be working.
If it is larger the channel assumes SCREDIR_VERSION_WINDOWS_8 capabilities and requires a few more calls to be implemented SCardGetDeviceTypeId et al.

@ondrejholy
Copy link
Contributor Author

@ondrejholy ok, was able to reproduce it when uninstalling pcscd on my ubuntu test machine.
Without it the smartcard channel can not create a context with system scope and returns this failure.
If it is running the error disappears.

Hmm, I would think that without pcscd the smartcard redirection would not work at all, but it works for them, just they see those errors. But I will ask them to check whether pcscd is running.

@ondrejholy
Copy link
Contributor Author

@ondrejholy as for the ClientBuild I´ve run some tests and I think I found the core issue.
See [MS-RDPESC] 1.7 Versioning and Capability Negotiation for version limits, but if you keep the number < 7865 the service should be working.
If it is larger the channel assumes SCREDIR_VERSION_WINDOWS_8 capabilities and requires a few more calls to be implemented SCardGetDeviceTypeId et al.

Yay, that's it, but it also seems that SCREDIR_VERSION_LONGHORN requires functions that are not implemented like SCARD_IOCTL_GETTRANSMITCOUNT, SCARD_IOCTL_READCACHEW, SCARD_IOCTL_READCACHEA, SCARD_IOCTL_WRITECACHEW, and SCARD_IOCTL_WRITECACHEA... or does it work to you?

@akallabeth
Copy link
Member

@ondrejholy works with basic stuff, but needs another pr. (the functions you mentioned)

@akallabeth
Copy link
Member

@ondrejholy ok, added all the required stuff in #5830 which allows

  1. Setting the ClientBuild from command line
  2. Implements the required functions for newer protocol versions (still needs some testing though)

@akallabeth
Copy link
Member

I´ve created #5884 to improve smartcard data read/write.
Tested through all functions so far (with the small test program and a few real applications) and the new functions are working so far.

@akallabeth akallabeth added this to the 2.0.0 milestone Feb 24, 2020
@ondrejholy
Copy link
Contributor Author

@akallabeth, thanks for your work on this. I will provide a testing build to our customer and let you know.

antenore pushed a commit to FreeRDP/Remmina that referenced this issue Feb 29, 2020
@mskalski
Adds ClientBuild settings to RDP plugin to specify client version bui…
16619c0 
…ld number

Corresponds to xfreerdp /client-build-number:<number> option

This parameter is used by Windows server i.a. as simple feature negotiation
in Smartcard Reader channel. There is no other way to client to signal smartcard
features supported. If not specified, server assumes support for all functions
but is prepared for these functions to fail.

See Chapter 1.7 in [RDPESC] specification.

ClientBuild less than 4034 means Windows XP (also 64-bit) and older client
with basic set of redirected smartcard functions

Values 4034-7064 mean Windows Vista/7/2008 client and signals support for:
- SCARD_IOCTL_GETTRANSMITCOUNT
- SCARD_IOCTL_READCACHEA, SCARD_IOCTL_READCACHEW
- SCARD_IOCTL_WRITECACHEA, SCARD_IOCTL_WRITECACHEW

Values larger or equal 7065 mean Windows 8 and newer and signals support for
- SCARD_IOCTL_GETREADERICON
- SCARD_IOCTL_GETDEVICETYPEID

See also FreeRDP/FreeRDP#5791 (comment).
@akallabeth akallabeth linked a pull request Mar 9, 2020 that will close this issue
Smartcard tighter input validation #5884
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
fixed-waiting-test
Projects
None yet
Milestone
2.0.0
Development

Successfully merging a pull request may close this issue.

Smartcard tighter input validation akallabeth/FreeRDP
3 participants
@bmiklautz @ondrejholy @akallabeth