| | | 1 | | // Licensed to the .NET Foundation under one or more agreements. |
| | | 2 | | // The .NET Foundation licenses this file to you under the MIT license. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.ComponentModel; |
| | | 6 | | using System.Runtime.InteropServices; |
| | | 7 | | using System.Runtime.Versioning; |
| | | 8 | | using System.Security.Principal; |
| | | 9 | | using CoreWCF.Runtime; |
| | | 10 | | using Microsoft.Win32.SafeHandles; |
| | | 11 | | |
| | | 12 | | namespace CoreWCF.Security |
| | | 13 | | { |
| | | 14 | | [SupportedOSPlatform("windows")] |
| | | 15 | | internal static class SecurityUtils |
| | | 16 | | { |
| | | 17 | | // The logon sid is generated on process start up so it is unique to this process. |
| | | 18 | | internal static SecurityIdentifier GetProcessLogonSid() |
| | | 19 | | { |
| | 0 | 20 | | if (WindowsIdentity.GetCurrent().ImpersonationLevel == TokenImpersonationLevel.None) |
| | | 21 | | { |
| | | 22 | | // We're not impersonating so we can use WindowsIdentity.GetCurrent().AccessToken to |
| | | 23 | | // get the process logon SID. |
| | 0 | 24 | | return GetProcessLogonSidCore(); |
| | | 25 | | } |
| | | 26 | | |
| | | 27 | | // We're running impersonated which means WindowsIdentity.AccessToken won't provide us with |
| | | 28 | | // the process logon sid. Runing impersonated with a an invalid access token causes WindowIdentity |
| | | 29 | | // to call the Win32 api RevertToSelf before running the code. |
| | 0 | 30 | | return WindowsIdentity.RunImpersonated(SafeAccessTokenHandle.InvalidHandle, () => |
| | 0 | 31 | | { |
| | 0 | 32 | | // We're using the undocumented feature of passing an invalid handle to unimpersonate, so validate this |
| | 0 | 33 | | Fx.Assert(WindowsIdentity.GetCurrent().ImpersonationLevel == TokenImpersonationLevel.None, "RunImpersona |
| | 0 | 34 | | return GetProcessLogonSidCore(); |
| | 0 | 35 | | }); |
| | | 36 | | } |
| | | 37 | | |
| | | 38 | | private static SecurityIdentifier GetProcessLogonSidCore() |
| | | 39 | | { |
| | 0 | 40 | | var processIdentity = WindowsIdentity.GetCurrent(TokenAccessLevels.Query); |
| | 0 | 41 | | GCHandle pinnedArrayHandle = default; |
| | 0 | 42 | | SafeAccessTokenHandle token = processIdentity.AccessToken; |
| | | 43 | | try |
| | | 44 | | { |
| | 0 | 45 | | uint lengthToken = GetTokenInformationLength(token, UnsafeNativeMethods.TOKEN_INFORMATION_CLASS.TokenGro |
| | 0 | 46 | | byte[] tokenInformation = new byte[lengthToken]; |
| | | 47 | | // tokenInformation needs to be pinned as it will be populated with structures that have pointers to oth |
| | | 48 | | // within the same buffer. If GC moves it, those pointers will be invalid. |
| | 0 | 49 | | pinnedArrayHandle = GCHandle.Alloc(tokenInformation, GCHandleType.Pinned); |
| | 0 | 50 | | GetTokenInformation(token, UnsafeNativeMethods.TOKEN_INFORMATION_CLASS.TokenGroups, tokenInformation); |
| | 0 | 51 | | Span<byte> tokenInfoSpan = tokenInformation; |
| | | 52 | | // Need to know the size of TOKEN_GROUPS to slice the Span so it will only end up with a single instance |
| | 0 | 53 | | int tokenGroupSize = Marshal.SizeOf<UnsafeNativeMethods.TOKEN_GROUPS>(); |
| | 0 | 54 | | var tokenGroups = MemoryMarshal.Cast<byte, UnsafeNativeMethods.TOKEN_GROUPS>(tokenInfoSpan.Slice(0, toke |
| | 0 | 55 | | UnsafeNativeMethods.TOKEN_GROUPS tg = tokenGroups[0]; |
| | | 56 | | // Need the offset of Groups as that's where the array of SID_AND_ATTRIBUTES starts. There is more data |
| | | 57 | | // slice the Span to start at the start of the array, and end after TOKEN_GROUPS.GroupCount number of SI |
| | 0 | 58 | | int offsetOfSids = Marshal.OffsetOf<UnsafeNativeMethods.TOKEN_GROUPS>("Groups").ToInt32(); // Offset of |
| | 0 | 59 | | var sidsSpan = MemoryMarshal.Cast<byte, UnsafeNativeMethods.SID_AND_ATTRIBUTES>(tokenInfoSpan.Slice(offs |
| | | 60 | | Fx.Assert(sidsSpan.Length == tg.GroupCount, "sidsSpan slice is the wrong size"); |
| | 0 | 61 | | for (int i = 0; i < tg.GroupCount; i++) |
| | | 62 | | { |
| | 0 | 63 | | if ((sidsSpan[i].Attributes & UnsafeNativeMethods.SidAttribute.SE_GROUP_LOGON_ID) == UnsafeNativeMet |
| | | 64 | | { |
| | 0 | 65 | | return new SecurityIdentifier(sidsSpan[i].Sid); |
| | | 66 | | } |
| | | 67 | | } |
| | 0 | 68 | | return new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null); |
| | | 69 | | } |
| | | 70 | | finally |
| | | 71 | | { |
| | 0 | 72 | | pinnedArrayHandle.Free(); |
| | 0 | 73 | | processIdentity.Dispose(); |
| | 0 | 74 | | } |
| | 0 | 75 | | } |
| | | 76 | | |
| | | 77 | | private static void GetTokenInformation(SafeAccessTokenHandle token, UnsafeNativeMethods.TOKEN_INFORMATION_CLASS |
| | | 78 | | { |
| | 0 | 79 | | if (!UnsafeNativeMethods.GetTokenInformation(token.DangerousGetHandle(), tic, tokenInformation, (uint)tokenI |
| | | 80 | | { |
| | 0 | 81 | | int error = Marshal.GetLastWin32Error(); |
| | 0 | 82 | | throw new Win32Exception(error); |
| | | 83 | | } |
| | 0 | 84 | | } |
| | | 85 | | |
| | | 86 | | private static uint GetTokenInformationLength(SafeAccessTokenHandle token, UnsafeNativeMethods.TOKEN_INFORMATION |
| | | 87 | | { |
| | | 88 | | uint lengthNeeded; |
| | 0 | 89 | | bool success = UnsafeNativeMethods.GetTokenInformation(token.DangerousGetHandle(), tic, null, 0, out lengthN |
| | 0 | 90 | | if (!success) |
| | | 91 | | { |
| | 0 | 92 | | int error = Marshal.GetLastWin32Error(); |
| | 0 | 93 | | if (error != UnsafeNativeMethods.ERROR_INSUFFICIENT_BUFFER) |
| | | 94 | | { |
| | 0 | 95 | | throw new Win32Exception(error); |
| | | 96 | | } |
| | | 97 | | } |
| | | 98 | | |
| | 0 | 99 | | return lengthNeeded; |
| | | 100 | | } |
| | | 101 | | } |
| | | 102 | | } |