RolesAnywhere-V996803711: Attempt to silence UIs displayed by provide…

…rs when signing

aws_signing_helper/windows_cert_store_signer.go

@@ -76,6 +76,9 @@ const (
 	// NTE_BAD_ALGID — Invalid algorithm specified
 	NTE_BAD_ALGID = 0x80090008
 
+	// NTE_SILENT_CONTEXT - KSP must display UI to operate
+	NTE_SILENT_CONTEXT = 0x80090022
+
 	// WIN_API_FLAG specifies the flags that should be passed to
 	// CryptAcquireCertificatePrivateKey. This impacts whether the CryptoAPI or CNG
 	// API will be used.
@@ -89,6 +92,12 @@ const (
 	WIN_API_FLAG = windows.CRYPT_ACQUIRE_PREFER_NCRYPT_KEY_FLAG
 )
 
+var (
+	// ErrRequiresUI is used when providers are required to display
+	// UI to perform signing operations.
+	ErrRequiresUI = errors.New("provider requries UI to operate")
+)
+
 // Error codes for Windows APIs - implements the error interface
 type errCode uint64
 
@@ -441,9 +450,16 @@ func (signer *WindowsCertStoreSigner) cngSignHash(digest []byte, hash crypto.Has
 	// Get signature
 	sig := make([]byte, sigLen)
 	sigPtr := (*C.BYTE)(&sig[0])
-	if err := checkStatus(C.NCryptSignHash(*cngKeyHandle, padPtr, digestPtr, digestLen, sigPtr, sigLen, &sigLen, flags)); err != nil {
+	if err := checkStatus(C.NCryptSignHash(*cngKeyHandle, padPtr, digestPtr, digestLen, sigPtr, sigLen, &sigLen, flags|C.NCRYPT_SILENT_FLAG)); err != nil {
+		if err == ErrRequiresUI {
+			if err = checkStatus(C.NCryptSignHash(*cngKeyHandle, padPtr, digestPtr, digestLen, sigPtr, sigLen, &sigLen, flags)); err == nil {
+				goto got_signature
+			}
+		}
+
 		return nil, fmt.Errorf("failed to sign digest: %w", err)
 	}
+got_signature:
 
 	// CNG returns a raw ECDSA signature, but we want ASN.1 DER encoding
 	if _, isEC := privateKey.publicKey.(*ecdsa.PublicKey); isEC {
@@ -618,6 +634,10 @@ func checkStatus(s C.SECURITY_STATUS) error {
 		return ErrUnsupportedHash
 	}
 
+	if secStatus == NTE_SILENT_CONTEXT {
+		return ErrRequiresUI
+	}
+
 	return secStatus
 }