windows-nt/Source/XPSP1/NT/ds/security/authz/test/mailrm/mailrmp.h

/*++

Copyright (c) 2000  Microsoft Corporation

Module Name:

    mailrmp.h

Abstract:

	Private header file for the resource manager

Author:

    t-eugenz - August 2000

Environment:

    User mode only.

Revision History:

    Created - August 2000

--*/


#pragma once

#include "pch.h"




//
// Statically initialize the SIDs used
// We only need our own identifier authority (so as not to collide with 
// NT's accounts if we eventually allow the use of NT domain SIDs) and
// a single relative ID (the last number) identifying the user/group,
// since we are not using multiple domains. Mail domains could be added
// by adding a domain GUID to the user's SIDs before the user's RID.
//

#define MAILRM_IDENTIFIER_AUTHORITY { 0, 0, 0, 0, 0, 42 }

SID sInsecureSid = 		 { SID_REVISION, 1, MAILRM_IDENTIFIER_AUTHORITY, 1 };
SID sBobSid = 			 { SID_REVISION, 1, MAILRM_IDENTIFIER_AUTHORITY, 2 };
SID sMarthaSid= 		 { SID_REVISION, 1, MAILRM_IDENTIFIER_AUTHORITY, 3 };
SID sJoeSid = 			 { SID_REVISION, 1, MAILRM_IDENTIFIER_AUTHORITY, 4 };
SID sJaneSid = 			 { SID_REVISION, 1, MAILRM_IDENTIFIER_AUTHORITY, 5 };
SID sMailAdminsSid = 	 { SID_REVISION, 1, MAILRM_IDENTIFIER_AUTHORITY, 6 };

PSID InsecureSid = 	&sInsecureSid;
PSID BobSid = &sBobSid;
PSID MarthaSid= &sMarthaSid;
PSID JoeSid = &sJoeSid;
PSID JaneSid = &sJaneSid;
PSID MailAdminsSid = &sMailAdminsSid;

//
// Principal self SID. When used in an ACE, the Authz access check replaces it
// by the passed in PrincipalSelfSid parameter during the access check. In this
// case, it is replaced by the owner's SID retrieved from the mailbox.
//

SID sPrincipalSelfSid =   { 
							SID_REVISION,
							1,
							SECURITY_NT_AUTHORITY,
							SECURITY_PRINCIPAL_SELF_RID
						  };

PSID PrincipalSelfSid = &sPrincipalSelfSid;

//
// A callback ACE can contain additional policy data after the regular ACE
// fields. This structure is appended to the end of every callback ACE used
// by the mail resource manager, enabling the access check algorithm to make
// policy-based access decisions, instead of the solely identity-based decisions
// used in standard ACE types. If the SID in a callback ACE matches the SID
// in the user's AuthZ context, verification is done whether this policy applies
// (verification done by the AccessCheck callback function in the MailRM class)
// Therefore, an ACE applies if and only if the ACE SID matches a SID in the 
// user's context AND the policy below applies
//

typedef struct
{
    //
    // Whether this ACE should apply to sensitive mailboxes
    // set to MAILRM_SENSITIVE if it shoult apply, 0 if not
	//
	
	BYTE bIsSensitive;

	//
	// Whether the Sensitive and Time conditions should be treated
	// with a logical AND or OR. If AND, both conditions have to be satisfied
	// for the ACE to apply. If OR, one or both conditions satisfied will
	// result in the ACE being applied
	//
	
	BYTE bLogicType;
	
	//
	// Start hour of time range to use (in the 24-hour format) to decide
	// whether the ACE should apply. Valid values are from 0 to 23. The
	// actual time must be within the defined time range for the time condition
	// to apply. In other words, bStartHour <= CurrentHour < EndHour
	//

	BYTE bStartHour;

	//
	// End hour of the time range
	//

	BYTE bEndHour;
} MAILRM_OPTIONAL_DATA, *PMAILRM_OPTIONAL_DATA;


//
// Flags used in the optional data structure for the callback ACEs
//


//
// If the sensitive field in the optional data is set with this, and the
// mailbox contains sensitive data, this condition applies
//

#define MAILRM_SENSITIVE 1

//
// Type of boolean logic to use on the time and sensitive conditions
// time applies AND sensitive applies
// time applies OR sensitive applies
//

#define MAILRM_USE_AND 0

#define MAILRM_USE_OR 1

//
// Default starting time for the callback ACEs: 11pm
//

#define MAILRM_DEFAULT_START_TIME 23

//
// Default end time for the callback ACEs: 5am
//

#define MAILRM_DEFAULT_END_TIME 5


//
// Macro to determine whether a time falls within a given time range
//

#define WITHIN_TIMERANGE(HOUR, START_HOUR, END_HOUR) \
	( ( (START_HOUR) > (END_HOUR) ) ^ \
	( (HOUR) >= min((START_HOUR), (END_HOUR)) && \
	  (HOUR) <  max((START_HOUR), (END_HOUR))))