/// <summary>
/// Removes an HTTP.SYS prefix registration if it is present.
/// </summary>
/// <param name="uriPrefix">The URI prefix with optional wildcards.</param>
/// <param name="account">The Windows account name.</param>
public static void RemovePrefixReservation(string uriPrefix, string account)
{
string sddl;
HTTP_SERVICE_CONFIG_URLACL_SET configInfo;
HTTPAPI_VERSION httpApiVersion;
int errorCode;
uriPrefix = ValidateUriPrefix(uriPrefix);
sddl = CreateSDDL(account);
configInfo.Key.UrlPrefix = uriPrefix;
configInfo.Param.Sddl = sddl;
httpApiVersion = new HTTPAPI_VERSION(1, 0);
errorCode = HttpInitialize(httpApiVersion, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
if (errorCode != 0)
{
throw GetException("HttpInitialize", errorCode);
}
try
{
// Do our best to delete any existing ACL
HttpDeleteServiceConfigurationAcl(IntPtr.Zero, HttpServiceConfigUrlAclInfo,
ref configInfo, Marshal.SizeOf(typeof(HTTP_SERVICE_CONFIG_URLACL_SET)), IntPtr.Zero);
}
finally
{
errorCode = HttpTerminate(HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
if (errorCode != 0)
{
throw GetException("HttpTerminate", errorCode);
}
}
}
public static void ModifyReservation(string urlPrefix,
string accountName,
bool removeReservation)
{
string sddl = createSddl(accountName);
HTTP_SERVICE_CONFIG_URLACL_SET configInfo;
configInfo.Key.UrlPrefix = urlPrefix;
configInfo.Param.Sddl = sddl;
HTTPAPI_VERSION httpApiVersion =
new HTTPAPI_VERSION(1, 0);
int errorCode = HttpInitialize(httpApiVersion,
HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
if (0 != errorCode) throw getException(
"HttpInitialize",
errorCode);
try
{
// do our best to delete any existing ACL
errorCode = HttpDeleteServiceConfigurationAcl(
IntPtr.Zero,
HttpServiceConfigUrlAclInfo,
ref configInfo,
Marshal.SizeOf(
typeof(HTTP_SERVICE_CONFIG_URLACL_SET)),
IntPtr.Zero);
if (removeReservation)
{
if (0 != errorCode) throw getException(
"HttpDeleteServiceConfigurationAcl",
errorCode);
return;
}
errorCode = HttpSetServiceConfigurationAcl(
IntPtr.Zero,
HttpServiceConfigUrlAclInfo,
ref configInfo,
Marshal.SizeOf(
typeof(HTTP_SERVICE_CONFIG_URLACL_SET)),
IntPtr.Zero);
if (0 != errorCode) throw getException(
"HttpSetServiceConfigurationAcl",
errorCode);
}
finally
{
errorCode = HttpTerminate(
HTTP_INITIALIZE_CONFIG,
IntPtr.Zero);
if (0 != errorCode) throw getException(
"HttpTerminate",
errorCode);
}
}
static AclHelper()
{
HTTPAPI_VERSION version = new HTTPAPI_VERSION();
version.HttpApiMajorVersion = 1;
version.HttpApiMinorVersion = 0;
HttpInitialize(version, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
}
private static void InitializeHttp()
{
var httpApiVersion = new HTTPAPI_VERSION(1, 0);
var retVal = HttpInitialize(httpApiVersion, HttpInitializeConfig, IntPtr.Zero);
if (Win32ErrorCodes.Ok != retVal)
{
throw new Win32Exception();
}
}
static HttpApi()
{
// Given the scope and lifetime of the tool, just rely on HTTP.SYS to clean this up on process exit
HTTPAPI_VERSION version = new HTTPAPI_VERSION(1, 0);
ErrorCode errorCode = HttpInitialize(version, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
if (errorCode != ErrorCode.ERROR_SUCCESS)
{
throw new Win32Exception((int)errorCode);
}
}
/// <summary>
/// Adds or removes an entry in the HTTP ACLs for a given prefix.
/// </summary>
/// <param name="urlPrefix">the prefix whose ACL should be modified</param>
/// <param name="accountName">the account name to be added or removed from the ACL</param>
/// <param name="removeReservation">whether access should be granted or denied</param>
public static void ModifyReservation(
string urlPrefix,
string accountName,
bool removeReservation)
{
string sddl = CreateSddl(accountName);
HTTP_SERVICE_CONFIG_URLACL_SET configInfo;
configInfo.Key.UrlPrefix = urlPrefix;
configInfo.Param.Sddl = sddl;
HTTPAPI_VERSION httpApiVersion = new HTTPAPI_VERSION(1, 0);
int errorCode = HttpInitialize(httpApiVersion, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
CheckResult("HttpInitialize", errorCode);
try
{
// do our best to delete any existing ACL
errorCode = HttpDeleteServiceConfigurationAcl(
IntPtr.Zero,
HttpServiceConfigUrlAclInfo,
ref configInfo,
Marshal.SizeOf(typeof(HTTP_SERVICE_CONFIG_URLACL_SET)),
IntPtr.Zero);
if (removeReservation)
{
CheckResult(
"HttpDeleteServiceConfigurationAcl",
errorCode);
return;
}
errorCode = HttpSetServiceConfigurationAcl(
IntPtr.Zero,
HttpServiceConfigUrlAclInfo,
ref configInfo,
Marshal.SizeOf(typeof(HTTP_SERVICE_CONFIG_URLACL_SET)),
IntPtr.Zero);
CheckResult(
"HttpSetServiceConfigurationAcl",
errorCode);
}
finally
{
errorCode = HttpTerminate(
HTTP_INITIALIZE_CONFIG,
IntPtr.Zero);
CheckResult(
"HttpTerminate",
errorCode);
}
}
public void SetHttpNamespaceAcl(string urlPrefix, string acl)
{
HTTPAPI_VERSION version = new HTTPAPI_VERSION();
version.HttpApiMajorVersion = 1;
version.HttpApiMinorVersion = 0;
HttpInitialize(version, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
HTTP_SERVICE_CONFIG_URLACL_SET urlAclConfig = new HTTP_SERVICE_CONFIG_URLACL_SET();
urlAclConfig.KeyDesc.pUrlPrefix = urlPrefix;
urlAclConfig.ParamDesc.pStringSecurityDescriptor = acl;
IntPtr UrlAclConfig = Marshal.AllocHGlobal(Marshal.SizeOf(urlAclConfig));
Marshal.StructureToPtr(urlAclConfig, UrlAclConfig, false);
try
{
uint retval = HttpSetServiceConfiguration(IntPtr.Zero, HTTP_SERVICE_CONFIG_ID.HttpServiceConfigUrlAclInfo, UrlAclConfig, (uint)Marshal.SizeOf(urlAclConfig), IntPtr.Zero);
if (retval != 0 && retval != 183)
{
throw new ExternalException("Error Setting Configuration: " + SecurityIdentity.GetErrorMessage(retval));
}
}
catch (Exception e)
{
Debug.WriteLine(e);
}
finally
{
if (UrlAclConfig != IntPtr.Zero)
{
Marshal.DestroyStructure(UrlAclConfig, typeof(HTTP_SERVICE_CONFIG_URLACL_SET));
Marshal.FreeHGlobal(UrlAclConfig);
}
}
}
/// <summary>
/// Remove a certificate binding
/// </summary>
public static void RemoveCertificate(IPAddress ipAddress, int port, byte[] hash, StoreName store, StoreLocation location)
{
uint retVal = (uint)NOERROR; // NOERROR = 0
HTTPAPI_VERSION httpApiVersion = new HTTPAPI_VERSION(1, 0);
retVal = HttpInitialize(httpApiVersion, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
if ((uint)NOERROR == retVal)
{
var configSslSet = CreateParameter(ipAddress, port, hash, store);
IntPtr pInputConfigInfo = Marshal.AllocCoTaskMem(Marshal.SizeOf(typeof(HTTP_SERVICE_CONFIG_SSL_SET)));
Marshal.StructureToPtr(configSslSet, pInputConfigInfo, false);
retVal = HttpDeleteServiceConfiguration(IntPtr.Zero, HTTP_SERVICE_CONFIG_ID.HttpServiceConfigSSLCertInfo, pInputConfigInfo, Marshal.SizeOf(configSslSet), IntPtr.Zero);
Marshal.FreeCoTaskMem(pInputConfigInfo);
HttpTerminate(HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
}
if ((uint)NOERROR != retVal)
{
throw new Win32Exception(Convert.ToInt32(retVal));
}
}
internal static extern HttpApi.Error HttpInitialize( HTTPAPI_VERSION version, InitFlag flags, IntPtr reserved);
static WinSecurityHelpers()
{
HTTPAPI_VERSION version = new HTTPAPI_VERSION(1, 0);
HttpInitialize(version, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
}
private static extern ulong HttpInitialize(HTTPAPI_VERSION Version, uint Flags, IntPtr pReserved);
internal static extern Win32Error HttpInitialize(HTTPAPI_VERSION version, uint flags, IntPtr pReserved);
internal static extern uint HttpCreateServerSession(HTTPAPI_VERSION version, ulong* serverSessionId, uint reserved);
public static extern uint HttpInitialize(
HTTPAPI_VERSION version,
uint flags,
IntPtr pReserved);
static extern int HttpInitialize(
HTTPAPI_VERSION version,
int flags, IntPtr mustBeZero);
internal static extern unsafe uint HttpCreateRequestQueue(HTTPAPI_VERSION version, string pName,
Interop.Kernel32.SECURITY_ATTRIBUTES* pSecurityAttributes, uint flags, out HttpRequestQueueV2Handle pReqQueueHandle);
private unsafe static bool InitHttpApi(HTTPAPI_VERSION version)
{
uint statusCode = HttpInitialize(version, (uint)HTTP_FLAGS.HTTP_INITIALIZE_SERVER, null);
return statusCode == ERROR_SUCCESS;
}
public static void BindCertificate(string ipAddress, int port, byte[] hash)
{
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"Started to Bind certificate to port. ipAddress: {0}, port: {1}, hash: {2}. Current thread identity: {3}",
ipAddress,
port,
BitConverter.ToString(hash),
Thread.CurrentPrincipal.Identity.Name);
uint retVal = (uint)NOERROR; // NOERROR = 0
HTTPAPI_VERSION httpApiVersion = new HTTPAPI_VERSION(1, 0);
retVal = HttpInitialize(httpApiVersion, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"HttpInitialize completed with return value: {0}.",
retVal);
if ((uint)NOERROR == retVal)
{
HTTP_SERVICE_CONFIG_SSL_SET configSslSet = new HTTP_SERVICE_CONFIG_SSL_SET();
HTTP_SERVICE_CONFIG_SSL_KEY httpServiceConfigSslKey = new HTTP_SERVICE_CONFIG_SSL_KEY();
HTTP_SERVICE_CONFIG_SSL_PARAM configSslParam = new HTTP_SERVICE_CONFIG_SSL_PARAM();
IPAddress ip = IPAddress.Any; //IPAddress.Parse("0.0.0.0");
IPEndPoint ipEndPoint = new IPEndPoint(ip, port);
// serialize the endpoint to a SocketAddress and create an array to hold the values. Pin the array.
SocketAddress socketAddress = ipEndPoint.Serialize();
byte[] socketBytes = new byte[socketAddress.Size];
GCHandle handleSocketAddress = GCHandle.Alloc(socketBytes, GCHandleType.Pinned);
// Should copy the first 16 bytes (the SocketAddress has a 32 byte buffer, the size will only be 16,
//which is what the SOCKADDR accepts
for (int i = 0; i < socketAddress.Size; ++i)
{
socketBytes[i] = socketAddress[i];
}
httpServiceConfigSslKey.pIpPort = handleSocketAddress.AddrOfPinnedObject();
GCHandle handleHash = GCHandle.Alloc(hash, GCHandleType.Pinned);
configSslParam.AppId = Guid.NewGuid();
configSslParam.DefaultCertCheckMode = 0;
configSslParam.DefaultFlags = HTTP_SERVICE_CONFIG_SSL_FLAG_NEGOTIATE_CLIENT_CERT;
configSslParam.DefaultRevocationFreshnessTime = 0;
configSslParam.DefaultRevocationUrlRetrievalTimeout = 0;
configSslParam.pSslCertStoreName = StoreName.My.ToString();
configSslParam.pSslHash = handleHash.AddrOfPinnedObject();
configSslParam.SslHashLength = hash.Length;
configSslSet.ParamDesc = configSslParam;
configSslSet.KeyDesc = httpServiceConfigSslKey;
IntPtr pInputConfigInfo = Marshal.AllocCoTaskMem(Marshal.SizeOf(typeof(HTTP_SERVICE_CONFIG_SSL_SET)));
Marshal.StructureToPtr(configSslSet, pInputConfigInfo, false);
retVal = HttpSetServiceConfiguration(IntPtr.Zero,
HTTP_SERVICE_CONFIG_ID.HttpServiceConfigSSLCertInfo,
pInputConfigInfo,
Marshal.SizeOf(configSslSet),
IntPtr.Zero);
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"HttpSetServiceConfiguration completed with return value: {0}.",
retVal);
if ((uint)ERROR_ALREADY_EXISTS == retVal) // ERROR_ALREADY_EXISTS = 183
{
retVal = HttpDeleteServiceConfiguration(IntPtr.Zero,
HTTP_SERVICE_CONFIG_ID.HttpServiceConfigSSLCertInfo,
pInputConfigInfo,
Marshal.SizeOf(configSslSet),
IntPtr.Zero);
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"HttpDeleteServiceConfiguration completed with return value: {0}.",
retVal);
if ((uint)NOERROR == retVal)
{
retVal = HttpSetServiceConfiguration(IntPtr.Zero,
HTTP_SERVICE_CONFIG_ID.HttpServiceConfigSSLCertInfo,
pInputConfigInfo,
Marshal.SizeOf(configSslSet),
IntPtr.Zero);
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"HttpSetServiceConfiguration completed with return value: {0}.",
retVal);
}
}
handleSocketAddress.Free();
handleHash.Free();
Marshal.FreeCoTaskMem(pInputConfigInfo);
HttpTerminate(HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
}
if ((uint)NOERROR != retVal)
{
TraceSource.WriteError(
PortAclUtility.TraceType,
"BindCertificate failed with error: {0}.",
retVal);
throw new Win32Exception(Convert.ToInt32(retVal));
}
}
public static void ReserveUrl(string networkUrl, string securityDescriptor)
{
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"Started to Reserve Url. networkUrl: {0}, securityDescriptor: {1}.",
networkUrl,
securityDescriptor);
uint retVal = (uint)NOERROR; // NOERROR = 0
HTTPAPI_VERSION httpApiVersion = new HTTPAPI_VERSION(1, 0);
retVal = HttpInitialize(httpApiVersion, HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"HttpInitialize completed with return value: {0}.",
retVal);
if ((uint)NOERROR == retVal)
{
HTTP_SERVICE_CONFIG_URLACL_KEY keyDesc = new HTTP_SERVICE_CONFIG_URLACL_KEY(networkUrl);
HTTP_SERVICE_CONFIG_URLACL_PARAM paramDesc = new HTTP_SERVICE_CONFIG_URLACL_PARAM(securityDescriptor);
HTTP_SERVICE_CONFIG_URLACL_SET inputConfigInfoSet = new HTTP_SERVICE_CONFIG_URLACL_SET
{
KeyDesc = keyDesc,
ParamDesc = paramDesc
};
IntPtr pInputConfigInfo = Marshal.AllocCoTaskMem(Marshal.SizeOf(typeof(HTTP_SERVICE_CONFIG_URLACL_SET)));
Marshal.StructureToPtr(inputConfigInfoSet, pInputConfigInfo, false);
retVal = HttpSetServiceConfiguration(IntPtr.Zero,
HTTP_SERVICE_CONFIG_ID.HttpServiceConfigUrlAclInfo,
pInputConfigInfo,
Marshal.SizeOf(inputConfigInfoSet),
IntPtr.Zero);
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"HttpSetServiceConfiguration completed with return value: {0}.",
retVal);
if ((uint)ERROR_ALREADY_EXISTS == retVal) // ERROR_ALREADY_EXISTS = 183
{
retVal = HttpDeleteServiceConfiguration(IntPtr.Zero,
HTTP_SERVICE_CONFIG_ID.HttpServiceConfigUrlAclInfo,
pInputConfigInfo,
Marshal.SizeOf(inputConfigInfoSet),
IntPtr.Zero);
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"HttpDeleteServiceConfiguration(outer) completed with return value: {0}.",
retVal);
if ((uint)ERROR_FILE_NOT_FOUND == retVal)
{
// This means its possible that the URL is ACLed for the same port but different protocol (http/https)
// Try deleting ACL using the other protocol
var networkUrlInner = networkUrl.ToLower();
if (networkUrlInner.Contains("https"))
{
networkUrlInner = networkUrlInner.Replace("https", "http");
}
else
{
networkUrlInner = networkUrlInner.Replace("http", "https");
}
HTTP_SERVICE_CONFIG_URLACL_KEY keyDescInner = new HTTP_SERVICE_CONFIG_URLACL_KEY(networkUrlInner);
HTTP_SERVICE_CONFIG_URLACL_SET inputConfigInfoSetInner = new HTTP_SERVICE_CONFIG_URLACL_SET
{
KeyDesc = keyDescInner
};
IntPtr pInputConfigInfoInner = IntPtr.Zero;
try
{
pInputConfigInfoInner = Marshal.AllocCoTaskMem(Marshal.SizeOf(typeof(HTTP_SERVICE_CONFIG_URLACL_SET)));
Marshal.StructureToPtr(inputConfigInfoSetInner, pInputConfigInfoInner, false);
retVal = HttpDeleteServiceConfiguration(IntPtr.Zero,
HTTP_SERVICE_CONFIG_ID.HttpServiceConfigUrlAclInfo,
pInputConfigInfoInner,
Marshal.SizeOf(inputConfigInfoSetInner),
IntPtr.Zero);
TraceSource.WriteWarning(
PortAclUtility.TraceType,
"HttpDeleteServiceConfiguration(Inner) completed with return value: {0}.",
retVal);
}
finally
{
if (IntPtr.Zero != pInputConfigInfoInner)
{
Marshal.FreeCoTaskMem(pInputConfigInfoInner);
}
}
}
if ((uint)NOERROR == retVal)
{
retVal = HttpSetServiceConfiguration(IntPtr.Zero,
HTTP_SERVICE_CONFIG_ID.HttpServiceConfigUrlAclInfo,
pInputConfigInfo,
Marshal.SizeOf(inputConfigInfoSet),
IntPtr.Zero);
TraceSource.WriteInfo(
PortAclUtility.TraceType,
"HttpSetServiceConfiguration completed with return value: {0}.",
retVal);
}
}
Marshal.FreeCoTaskMem(pInputConfigInfo);
HttpTerminate(HTTP_INITIALIZE_CONFIG, IntPtr.Zero);
}
if ((uint)NOERROR != retVal)
{
TraceSource.WriteError(
PortAclUtility.TraceType,
"ReserveUrl failed with error: {0}.",
retVal);
throw new Win32Exception(Convert.ToInt32(retVal));
}
}
private static unsafe bool InitHttpApi(HTTPAPI_VERSION version)
{
uint statusCode = HttpInitialize(version, (uint)HTTP_FLAGS.HTTP_INITIALIZE_SERVER, null);
return(statusCode == ERROR_SUCCESS);
}
internal static extern unsafe uint HttpCreateRequestQueue(HTTPAPI_VERSION version, string pName,
Interop.Kernel32.SECURITY_ATTRIBUTES *pSecurityAttributes, uint flags, out HttpRequestQueueV2Handle pReqQueueHandle);
private static extern uint HttpInitialize(
HTTPAPI_VERSION version,
uint flags,
IntPtr pReserved);
internal static extern uint HttpInitialize(HTTPAPI_VERSION version, uint flags, void* pReserved);
static extern ErrorCode HttpInitialize(HTTPAPI_VERSION version, int flags, IntPtr pReserved);
internal static extern uint HttpInitialize(HTTPAPI_VERSION Version, uint Flags, IntPtr pReserved);
internal static extern uint HttpInitialize(HTTPAPI_VERSION version, uint flags, void *pReserved);
internal static partial uint HttpInitialize(HTTPAPI_VERSION version, uint flags, IntPtr pReserved);
internal static extern unsafe uint HttpCreateRequestQueue(HTTPAPI_VERSION version, string pName,
UnsafeNclNativeMethods.SECURITY_ATTRIBUTES pSecurityAttributes, HTTP_CREATE_REQUEST_QUEUE_FLAG flags, out HttpRequestQueueV2Handle pReqQueueHandle);
public static extern HttpError HttpInitialize(
HTTPAPI_VERSION version,
HttpInitFlag flags,
IntPtr reserved);
internal static unsafe partial uint HttpCreateServerSession(HTTPAPI_VERSION version, ulong *serverSessionId, uint reserved);
internal static extern uint HttpCreateServerSession(HTTPAPI_VERSION version, ulong *serverSessionId, uint reserved);
static extern int HttpInitialize(
HTTPAPI_VERSION version,
int flags, IntPtr mustBeZero);
public static extern HttpError HttpInitialize(
HTTPAPI_VERSION version,
HttpInitFlag flags,
IntPtr reserved);
internal static unsafe partial uint HttpCreateRequestQueue(HTTPAPI_VERSION version, string?pName,
IntPtr pSecurityAttributes, HTTP_CREATE_REQUEST_QUEUE_FLAG flags, out HttpRequestQueueV2Handle pReqQueueHandle);
