fix(auth): add Windows session storage bridge

2026-08-16 21:43:03 +02:00
parent 6bf8218fea
commit c9b02fc57e
14 changed files with 1630 additions and 8 deletions
@@ -0,0 +1,210 @@
+//go:build windows
+
+package safeio
+
+import (
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+
+	"golang.org/x/sys/windows"
+)
+
+type windowsPrivateRegular struct {
+	parents *windowsParentHandles
+	handle  windows.Handle
+	path    string
+	info    windows.ByHandleFileInformation
+}
+
+func (value *windowsPrivateRegular) Close() {
+	if value.handle != 0 {
+		_ = windows.CloseHandle(value.handle)
+		value.handle = 0
+	}
+	if value.parents != nil {
+		value.parents.Close()
+		value.parents = nil
+	}
+}
+
+func openWindowsPrivateRegular(path string, links uint32) (*windowsPrivateRegular, error) {
+	parents, target, err := openCanonicalWindowsParent(path)
+	if err != nil || len(parents.handles) == 0 || validateOwnerOnlyDACL(parents.handles[len(parents.handles)-1]) != nil {
+		if parents != nil {
+			parents.Close()
+		}
+		return nil, ErrUnsafeFile
+	}
+	fullPath := filepath.Join(parents.directory, target)
+	handle, err := windows.CreateFile(
+		windows.StringToUTF16Ptr(fullPath),
+		windows.GENERIC_READ,
+		windowsRetainedHandleShareMode,
+		nil,
+		windows.OPEN_EXISTING,
+		windows.FILE_FLAG_OPEN_REPARSE_POINT|windows.FILE_ATTRIBUTE_NORMAL,
+		0,
+	)
+	if err != nil {
+		parents.Close()
+		return nil, err
+	}
+	var info windows.ByHandleFileInformation
+	if err := windows.GetFileInformationByHandle(handle, &info); err != nil || info.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 || info.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY != 0 || info.NumberOfLinks != links || validateOwnerOnlyDACL(handle) != nil {
+		_ = windows.CloseHandle(handle)
+		parents.Close()
+		return nil, ErrUnsafeFile
+	}
+	return &windowsPrivateRegular{parents: parents, handle: handle, path: fullPath, info: info}, nil
+}
+
+func claimCanonicalPrivateRegular(source, claim string) (bool, error) {
+	sourceFile, err := openWindowsPrivateRegular(source, 1)
+	if err != nil {
+		if windowsPrivateClaimPairExists(source, claim) {
+			return false, nil
+		}
+		if isWindowsNotFound(err) && windowsPrivateClaimAbsentOrOrphan(claim) {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	defer sourceFile.Close()
+	if err := windows.CreateHardLink(windows.StringToUTF16Ptr(claim), windows.StringToUTF16Ptr(sourceFile.path), 0); err != nil {
+		if errors.Is(err, windows.ERROR_FILE_EXISTS) || errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
+			if existing, existingErr := openWindowsPrivateRegularWithAllowedLinks(claim, 1, 2); existingErr == nil {
+				existing.Close()
+				return false, nil
+			}
+		}
+		return false, ErrUnsafeFile
+	}
+	if err := windows.GetFileInformationByHandle(sourceFile.handle, &sourceFile.info); err != nil || sourceFile.info.NumberOfLinks != 2 {
+		return false, ErrUnsafeFile
+	}
+	claimFile, err := openWindowsPrivateRegular(claim, 2)
+	if err != nil {
+		return false, ErrUnsafeFile
+	}
+	defer claimFile.Close()
+	if !sameWindowsPrivateFile(sourceFile.info, claimFile.info) {
+		return false, ErrUnsafeFile
+	}
+	return true, nil
+}
+
+func readCanonicalPrivateClaim(source, claim string, maximum int64) ([]byte, bool, error) {
+	sourceFile, err := openWindowsPrivateRegular(source, 2)
+	if err != nil {
+		if isWindowsNotFound(err) && windowsPrivateClaimAbsentOrOrphan(claim) {
+			return nil, false, nil
+		}
+		return nil, false, ErrUnsafeFile
+	}
+	defer sourceFile.Close()
+	claimFile, err := openWindowsPrivateRegular(claim, 2)
+	if err != nil {
+		if isWindowsNotFound(err) {
+			return nil, false, nil
+		}
+		return nil, false, ErrUnsafeFile
+	}
+	defer claimFile.Close()
+	if !sameWindowsPrivateFile(sourceFile.info, claimFile.info) {
+		return nil, false, ErrUnsafeFile
+	}
+	file := os.NewFile(uintptr(sourceFile.handle), "tht-safeio-oidc-claim")
+	if file == nil {
+		return nil, false, ErrUnsafeFile
+	}
+	contents, readErr := io.ReadAll(io.LimitReader(file, maximum+1))
+	file.Close()
+	sourceFile.handle = 0
+	if readErr != nil || int64(len(contents)) > maximum {
+		return nil, false, ErrUnsafeFile
+	}
+	if err := windows.GetFileInformationByHandle(claimFile.handle, &claimFile.info); err != nil || claimFile.info.NumberOfLinks != 2 || !sameWindowsPrivateFile(sourceFile.info, claimFile.info) {
+		return nil, false, ErrUnsafeFile
+	}
+	return contents, true, nil
+}
+
+func removeCanonicalPrivateClaim(source, claim string) (bool, error) {
+	sourceFile, err := openWindowsPrivateRegular(source, 2)
+	if err != nil {
+		if isWindowsNotFound(err) && windowsPrivateClaimAbsentOrOrphan(claim) {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	claimFile, err := openWindowsPrivateRegular(claim, 2)
+	if err != nil {
+		sourceFile.Close()
+		if isWindowsNotFound(err) {
+			return false, nil
+		}
+		return false, ErrUnsafeFile
+	}
+	if !sameWindowsPrivateFile(sourceFile.info, claimFile.info) {
+		sourceFile.Close()
+		claimFile.Close()
+		return false, ErrUnsafeFile
+	}
+	sourceFile.Close()
+	claimFile.Close()
+	if err := windows.DeleteFile(windows.StringToUTF16Ptr(source)); err != nil {
+		return false, ErrUnsafeFile
+	}
+	remaining, err := openWindowsPrivateRegular(claim, 1)
+	if err != nil {
+		return false, ErrUnsafeFile
+	}
+	remaining.Close()
+	if err := windows.DeleteFile(windows.StringToUTF16Ptr(claim)); err != nil {
+		return false, ErrUnsafeFile
+	}
+	return true, nil
+}
+
+func openWindowsPrivateRegularWithAllowedLinks(path string, allowed ...uint32) (*windowsPrivateRegular, error) {
+	for _, links := range allowed {
+		value, err := openWindowsPrivateRegular(path, links)
+		if err == nil {
+			return value, nil
+		}
+	}
+	return nil, ErrUnsafeFile
+}
+
+func windowsPrivateClaimAbsentOrOrphan(claim string) bool {
+	claimFile, err := openWindowsPrivateRegular(claim, 1)
+	if err != nil {
+		return isWindowsNotFound(err)
+	}
+	claimFile.Close()
+	return true
+}
+
+func windowsPrivateClaimPairExists(source, claim string) bool {
+	sourceFile, sourceErr := openWindowsPrivateRegular(source, 2)
+	if sourceErr != nil {
+		return false
+	}
+	defer sourceFile.Close()
+	claimFile, claimErr := openWindowsPrivateRegular(claim, 2)
+	if claimErr != nil {
+		return false
+	}
+	defer claimFile.Close()
+	return sameWindowsPrivateFile(sourceFile.info, claimFile.info)
+}
+
+func isWindowsNotFound(err error) bool {
+	return errors.Is(err, windows.ERROR_FILE_NOT_FOUND) || errors.Is(err, windows.ERROR_PATH_NOT_FOUND)
+}
+
+func sameWindowsPrivateFile(left, right windows.ByHandleFileInformation) bool {
+	return left.VolumeSerialNumber == right.VolumeSerialNumber && left.FileIndexHigh == right.FileIndexHigh && left.FileIndexLow == right.FileIndexLow && left.FileSizeHigh == right.FileSizeHigh && left.FileSizeLow == right.FileSizeLow && left.LastWriteTime == right.LastWriteTime
+}