windows-xp/Source/XPSP1/NT/inetsrv/iis/svcs/wam/object/ooptoken.cpp

/*++

   Copyright    (c)    1999    Microsoft Corporation

   Module  Name :
       ooptoken.cpp

   Abstract:
       Implementation of the CWamOopTokenInfo object

   Author:
       Taylor Weiss    ( TaylorW )     15-Feb-1999

   Environment:
       User Mode - Win32

   Project:
       iis\svcs\wam\object

--*/

#include <isapip.hxx>
#include "ooptoken.h"

/************************ CWamOopTokenInfo ****************************/

CWamOopTokenInfo * CWamOopTokenInfo::ms_pInstance = NULL;

HRESULT
CWamOopTokenInfo::Create( VOID )
/*++
Routine Description:

    Create and initialize ms_pInstance. Get the wam and system SIDs.

    The IWAM_* user sid is obtained from the process token. This
    only works if we are running OOP. The alternative is to put this
    in w3svc or infocomm and get the SID from the metabase. The downside
    to that is the account for the application package is exposed
    through the com+ UI, so it can be changed without a metabase update.

Parameters

Return Value

    HRESULT

--*/
{
    DBG_ASSERT( CWamOopTokenInfo::ms_pInstance == NULL );
    
    HRESULT             hr = NOERROR;
    HANDLE              hProcessToken = NULL;
    LPVOID              pvUserBuffer = NULL;
    PSID                pSidSys = NULL;
    CWamOopTokenInfo *  pInstance = NULL;

    do
    {
        BOOL            fNoError = FALSE;
        DWORD           cbUserBuffer = 0;

        // Allocate instance
        pInstance = new CWamOopTokenInfo();

        DBG_ASSERT( pInstance != NULL );
        if( !pInstance )
        {
            DBG_ASSERT( pInstance );
            hr = E_OUTOFMEMORY;
            break;
        }

        //
        // Get a SID for the IWAM_* user.
        //
        fNoError = OpenProcessToken( GetCurrentProcess(), 
                                     TOKEN_QUERY, 
                                     &hProcessToken 
                                     );
        if( !fNoError )
        {
            DBG_ASSERT( fNoError );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        // Get buffer size
        fNoError = GetTokenInformation(  hProcessToken,
                                         TokenUser,
                                         NULL,
                                         0,
                                         &cbUserBuffer
                                         );
        DBG_ASSERT( fNoError == FALSE );

        pvUserBuffer = LocalAlloc( LPTR, cbUserBuffer );
        DBG_ASSERT( pvUserBuffer != NULL );
        if( !pvUserBuffer )
        {
            DBG_ASSERT( pvUserBuffer );
            hr = E_OUTOFMEMORY;
            break;
        }

        // Get user info
        fNoError = GetTokenInformation(  hProcessToken,
                                         TokenUser,
                                         pvUserBuffer,
                                         cbUserBuffer,
                                         &cbUserBuffer
                                         );
        if( !fNoError )
        {
            DBG_ASSERT( fNoError );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        hr = pInstance->SetIWAMUserSid( ((TOKEN_USER *)pvUserBuffer)->User.Sid );
        if( FAILED(hr) ) break;

        //
        // Create a SID for the local system
        //
        SID_IDENTIFIER_AUTHORITY    siaNtAuthority = SECURITY_NT_AUTHORITY; 
        fNoError = AllocateAndInitializeSid( &siaNtAuthority,
                                             1,
                                             SECURITY_LOCAL_SYSTEM_RID,
                                             0, 0, 0, 0, 0, 0, 0,
                                             &pSidSys
                                             );
        if( !fNoError )
        {
            DBG_ASSERT( fNoError );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        hr = pInstance->SetSystemSid( pSidSys );
        if( FAILED(hr) ) break;

        CWamOopTokenInfo::ms_pInstance = pInstance;
    
    } while( FALSE );

    if( hProcessToken )
    {
        CloseHandle( hProcessToken );
    }
    if( pvUserBuffer )
    {
        LocalFree( pvUserBuffer );
    }
    if( pSidSys )
    {
        FreeSid( pSidSys );
    }
    if( CWamOopTokenInfo::ms_pInstance == NULL )
    {
        // We hit some break, need to dealloc local pointer
        delete pInstance;
    }

    DBG_ASSERT( CWamOopTokenInfo::ms_pInstance != NULL );
    DBG_ASSERT( SUCCEEDED(hr) );

    return hr;
}

HRESULT
CWamOopTokenInfo::SetIWAMUserSid( PSID pSid )
/*++
Routine Description:

    Make a local copy of the SID. Called during instance create.
    
    Probably should avoid the extra duplication.

Parameters

    pSid        - The IWAM_* user sid.

Return Value

    HRESULT

--*/
{
    DBG_ASSERT( pSid );
    DBG_ASSERT( m_pIWAMUserSid == NULL );
    DBG_ASSERT( m_cbIWAMUserSid == 0 );

    HRESULT hr = NOERROR;

    m_cbIWAMUserSid = GetLengthSid( pSid );
    
    m_pIWAMUserSid = LocalAlloc( LPTR, m_cbIWAMUserSid );

    if( m_pIWAMUserSid )
    {
        if( !CopySid( m_cbIWAMUserSid, m_pIWAMUserSid, pSid ) )
        {
            hr = HRESULT_FROM_WIN32( GetLastError() );
        }
    }
    else
    {
        hr = E_OUTOFMEMORY;
        m_cbIWAMUserSid = 0;
    }

    DBG_ASSERT( m_pIWAMUserSid );
    DBG_ASSERT( m_cbIWAMUserSid > 0 );
    DBG_ASSERT( SUCCEEDED(hr) );

    return hr;
}

HRESULT
CWamOopTokenInfo::SetSystemSid( PSID pSid )
/*++
Routine Description:

    Make a local copy of the SID. Called during instance create.
    
    Probably should avoid the extra duplication.

Parameters

    pSid        - The system sid.

Return Value

    HRESULT

--*/
{
    DBG_ASSERT( pSid );
    DBG_ASSERT( m_pSystemSid == NULL );
    DBG_ASSERT( m_cbSystemSid == 0 );

    HRESULT hr = NOERROR;

    m_cbSystemSid = GetLengthSid( pSid );
    
    m_pSystemSid = LocalAlloc( LPTR, m_cbSystemSid );

    if( m_pSystemSid )
    {
        if( !CopySid( m_cbSystemSid, m_pSystemSid, pSid ) )
        {
            hr = HRESULT_FROM_WIN32( GetLastError() );
        }
    }
    else
    {
        hr = E_OUTOFMEMORY;
        m_cbSystemSid = 0;
    }

    DBG_ASSERT( m_pSystemSid );
    DBG_ASSERT( m_cbSystemSid > 0 );
    DBG_ASSERT( SUCCEEDED(hr) );

    return hr;
}


HRESULT
CWamOopTokenInfo::ModifyTokenForOop
( 
HANDLE hThreadToken
)
/*++
Routine Description

    Add the IWAM_* ace to the token.

Prameters

    HANDLE hThreadToken         - The token to modify.

Return Value

    HRESULT

--*/
{
    DBG_ASSERT( m_pIWAMUserSid );
    DBG_ASSERT( m_pSystemSid );

    HRESULT     hr = NOERROR;

    DWORD       cbTokenUserBuffer = 0;
    LPVOID      pvTokenUserBuffer = NULL;
    
    DWORD       cbNewAcl = 0;
    PACL        pNewAcl = NULL;

    do
    {
        BOOL    bRet;

        //
        // Get the User SID from the token
        //

        // Get buffer size
        bRet = GetTokenInformation(  hThreadToken,
                                     TokenUser,
                                     NULL,
                                     0,
                                     &cbTokenUserBuffer
                                     );
        DBG_ASSERT( bRet == FALSE );

        pvTokenUserBuffer = LocalAlloc( LPTR, cbTokenUserBuffer );
        if( !pvTokenUserBuffer )
        {
            DBG_ASSERT( pvTokenUserBuffer );
            hr = E_OUTOFMEMORY;
            break;
        }

        // Get TokenUser
        bRet = GetTokenInformation(  hThreadToken,
                                     TokenUser,
                                     pvTokenUserBuffer,
                                     cbTokenUserBuffer,
                                     &cbTokenUserBuffer
                                     );
        if( !bRet )
        {
            DBG_ASSERT( bRet );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        PSID pSidUser = ((TOKEN_USER *)pvTokenUserBuffer)->User.Sid;
        
        DBG_ASSERT( pSidUser );

        //
        // Allocate and init our new ACL
        //
        cbNewAcl = sizeof(ACL) +
                   sizeof(ACCESS_ALLOWED_ACE) + GetLengthSid(pSidUser) - sizeof(DWORD) +
                   sizeof(ACCESS_ALLOWED_ACE) + m_cbSystemSid - sizeof(DWORD) +
                   sizeof(ACCESS_ALLOWED_ACE) + m_cbIWAMUserSid - sizeof(DWORD);

        pNewAcl = (PACL)LocalAlloc( LPTR, cbNewAcl );
        if( !pNewAcl )
        {
            DBG_ASSERT( pNewAcl );
            hr = E_OUTOFMEMORY;
            break;
        }

        bRet = InitializeAcl( pNewAcl, cbNewAcl, ACL_REVISION );
        if( !bRet )
        {
            DBG_ASSERT( bRet );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        //
        // Add the aces
        //
        bRet = AddAccessAllowedAce( pNewAcl,
                                    ACL_REVISION,
                                    GENERIC_ALL | STANDARD_RIGHTS_ALL,
                                    pSidUser
                                    );
        if( !bRet )
        {
            DBG_ASSERT( bRet );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        bRet = AddAccessAllowedAce( pNewAcl,
                                    ACL_REVISION,
                                    GENERIC_ALL | STANDARD_RIGHTS_ALL,
                                    m_pSystemSid
                                    );
        if( !bRet )
        {
            DBG_ASSERT( bRet );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        bRet = AddAccessAllowedAce( pNewAcl,
                                    ACL_REVISION,
                                    GENERIC_ALL | STANDARD_RIGHTS_ALL,
                                    m_pIWAMUserSid
                                    );
        if( !bRet )
        {
            DBG_ASSERT( bRet );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

        // Blast the new DACL into our token
        TOKEN_DEFAULT_DACL tddNew;
        tddNew.DefaultDacl = pNewAcl;

        bRet = SetTokenInformation( hThreadToken,
                                    TokenDefaultDacl,
                                    &tddNew,
                                    cbNewAcl
                                    );
        if( !bRet )
        {
            DBG_ASSERT( bRet );
            hr = HRESULT_FROM_WIN32( GetLastError() );
            break;
        }

    }while(FALSE);

    if( pvTokenUserBuffer )
    {
        LocalFree( pvTokenUserBuffer );
    }
    if( pNewAcl )
    {
        LocalFree( pNewAcl );
    }

    DBG_ASSERT( SUCCEEDED(hr) );
    return hr;
}