Implement daemon auth on Windows

daemon/2serverWindows.go

@@ -3,12 +3,15 @@
 package daemon
 
 import (
+	"bytes"
 	"log"
 	"net"
 	"net/rpc"
 	"os"
 
 	"github.com/Microsoft/go-winio" // For Windows named pipes
+	"github.com/rwinkhart/peercred-mini"
+	"golang.org/x/sys/windows"
 )
 
 const (
@@ -63,7 +66,24 @@ func Run() {
 
 // handleConn verifies the identity of the client.
 // It gets the PID of the client process and verifies it's running the same binary
-// TODO ADD AUTHENTICATION
 func handleConn(conn net.Conn) {
-	rpc.ServeConn(conn)
+	ucred := peercred.Get(conn)
+
+	// get server SID (UID)
+	var token windows.Token
+	windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_QUERY, &token)
+	defer token.Close()
+	user, _ := token.GetTokenUser()
+
+	// check if the RPC call is coming from an identical binary and from the same user
+	callingBinPath := pidToPath(uint32(ucred.PID))
+	if ucred.UID == user.User.Sid.String() && bytes.Equal(getFileHash(callingBinPath), daemonHash) {
+		rpc.ServeConn(conn)
+	} else {
+		// invalid client; close the connection w/o a response,
+		// log the client's path, and kill the daemon
+		conn.Close()
+		log.Printf("Request received from invalid client: PID(%d), UID(%s), Path(%s)", ucred.PID, ucred.UID, callingBinPath) // TODO log to file
+		os.Exit(2)
+	}
 }

go.mod

@@ -2,7 +2,7 @@ module rcw
 
 go 1.24.2
 
-require github.com/rwinkhart/peercred-mini v0.0.0-20250405214620-93ccab17290b
+require github.com/rwinkhart/peercred-mini v0.0.0-20250407024456-ffe191394a3a
 
 require (
 	github.com/Microsoft/go-winio v0.6.2
@@ -10,5 +10,3 @@ require (
 )
 
 replace golang.org/x/sys => github.com/rwinkhart/sys-freebsd-13-xucred v0.0.0-20250405010723-99a5f0732c0e
-
-replace github.com/rwinkhart/peercred-mini => ../peercred

go.sum

@@ -1,6 +1,6 @@
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/rwinkhart/peercred-mini v0.0.0-20250405214620-93ccab17290b h1:AEeo+zR+ZupGNvUwvu0YZcIX2X2sN1/S5Qw0nPyns3k=
+github.com/rwinkhart/peercred-mini v0.0.0-20250407024456-ffe191394a3a h1:c0b2SXOaaDnfnWFH33mthkAJWzadwN6bDU0d7xp1lO0=
-github.com/rwinkhart/peercred-mini v0.0.0-20250405214620-93ccab17290b/go.mod h1:JNvJiNItSyk3JXfeDvdt1sPmY5NHqj7TJ2faTobtQHA=
+github.com/rwinkhart/peercred-mini v0.0.0-20250407024456-ffe191394a3a/go.mod h1:g1QgFJec8tuq5BAZ4bpPQggS0VcjaqnGu8pPls6eufE=
 github.com/rwinkhart/sys-freebsd-13-xucred v0.0.0-20250405010723-99a5f0732c0e h1:YRpZcbGU/LVLwK87IURH4Sfye6Fv0ri1IRZ27loWpHs=
 github.com/rwinkhart/sys-freebsd-13-xucred v0.0.0-20250405010723-99a5f0732c0e/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=