1687 lines
45 KiB
C++
1687 lines
45 KiB
C++
//+-------------------------------------------------------------------------
|
|
//
|
|
// Microsoft Windows
|
|
//
|
|
// Copyright (C) Microsoft Corporation, 1996 - 1999
|
|
//
|
|
// File: misc.cpp
|
|
//
|
|
// This file contains miscellaneous helper functions.
|
|
//
|
|
//--------------------------------------------------------------------------
|
|
|
|
#include "aclpriv.h"
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: GetAceSid
|
|
|
|
SYNOPSIS: Gets pointer to SID from an ACE
|
|
|
|
ENTRY: pAce - pointer to ACE
|
|
|
|
EXIT:
|
|
|
|
RETURNS: Pointer to SID if successful, NULL otherwise
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 08-Oct-1996 Created
|
|
|
|
********************************************************************/
|
|
|
|
PSID
|
|
GetAceSid(PACE_HEADER pAce)
|
|
{
|
|
switch (pAce->AceType)
|
|
{
|
|
case ACCESS_ALLOWED_ACE_TYPE:
|
|
case ACCESS_DENIED_ACE_TYPE:
|
|
case SYSTEM_AUDIT_ACE_TYPE:
|
|
case SYSTEM_ALARM_ACE_TYPE:
|
|
return (PSID)&((PKNOWN_ACE)pAce)->SidStart;
|
|
|
|
case ACCESS_ALLOWED_COMPOUND_ACE_TYPE:
|
|
return (PSID)&((PKNOWN_COMPOUND_ACE)pAce)->SidStart;
|
|
|
|
case ACCESS_ALLOWED_OBJECT_ACE_TYPE:
|
|
case ACCESS_DENIED_OBJECT_ACE_TYPE:
|
|
case SYSTEM_AUDIT_OBJECT_ACE_TYPE:
|
|
case SYSTEM_ALARM_OBJECT_ACE_TYPE:
|
|
return RtlObjectAceSid(pAce);
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: LocalAllocSid
|
|
|
|
SYNOPSIS: Copies a SID
|
|
|
|
ENTRY: pOriginal - pointer to SID to copy
|
|
|
|
EXIT:
|
|
|
|
RETURNS: Pointer to SID if successful, NULL otherwise
|
|
|
|
NOTES: Caller must free the returned SID with LocalFree
|
|
|
|
HISTORY:
|
|
JeffreyS 12-Apr-1999 Created
|
|
|
|
********************************************************************/
|
|
|
|
PSID
|
|
LocalAllocSid(PSID pOriginal)
|
|
{
|
|
PSID pCopy = NULL;
|
|
if (pOriginal && IsValidSid(pOriginal))
|
|
{
|
|
DWORD dwLength = GetLengthSid(pOriginal);
|
|
pCopy = (PSID)LocalAlloc(LMEM_FIXED, dwLength);
|
|
if (NULL != pCopy)
|
|
CopyMemory(pCopy, pOriginal, dwLength);
|
|
}
|
|
return pCopy;
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: DestroyDPA
|
|
|
|
SYNOPSIS: LocalFree's all pointers in a Dynamic Pointer
|
|
Array and then frees the DPA.
|
|
|
|
ENTRY: hList - handle of list to destroy
|
|
|
|
EXIT:
|
|
|
|
RETURNS: nothing
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 08-Oct-1996 Created
|
|
|
|
********************************************************************/
|
|
|
|
int CALLBACK
|
|
_LocalFreeCB(LPVOID pVoid, LPVOID /*pData*/)
|
|
{
|
|
if (pVoid)
|
|
LocalFree(pVoid);
|
|
return 1;
|
|
}
|
|
|
|
void
|
|
DestroyDPA(HDPA hList)
|
|
{
|
|
if (hList != NULL)
|
|
DPA_DestroyCallback(hList, _LocalFreeCB, 0);
|
|
}
|
|
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: GetLSAConnection
|
|
|
|
SYNOPSIS: Wrapper for LsaOpenPolicy
|
|
|
|
ENTRY: pszServer - the server on which to make the connection
|
|
|
|
EXIT:
|
|
|
|
RETURNS: LSA_HANDLE if successful, NULL otherwise
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 08-Oct-1996 Created
|
|
|
|
********************************************************************/
|
|
|
|
LSA_HANDLE
|
|
GetLSAConnection(LPCTSTR pszServer, DWORD dwAccessDesired)
|
|
{
|
|
LSA_HANDLE hPolicy = NULL;
|
|
LSA_UNICODE_STRING uszServer = {0};
|
|
LSA_UNICODE_STRING *puszServer = NULL;
|
|
LSA_OBJECT_ATTRIBUTES oa;
|
|
SECURITY_QUALITY_OF_SERVICE sqos;
|
|
|
|
sqos.Length = SIZEOF(sqos);
|
|
sqos.ImpersonationLevel = SecurityImpersonation;
|
|
sqos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
|
|
sqos.EffectiveOnly = FALSE;
|
|
|
|
InitializeObjectAttributes(&oa, NULL, 0, NULL, NULL);
|
|
oa.SecurityQualityOfService = &sqos;
|
|
|
|
if (pszServer &&
|
|
*pszServer &&
|
|
RtlCreateUnicodeString(&uszServer, pszServer))
|
|
{
|
|
puszServer = &uszServer;
|
|
}
|
|
|
|
LsaOpenPolicy(puszServer, &oa, dwAccessDesired, &hPolicy);
|
|
|
|
if (puszServer)
|
|
RtlFreeUnicodeString(puszServer);
|
|
|
|
return hPolicy;
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: LookupSid
|
|
|
|
SYNOPSIS: Gets the qualified account name for a given SID
|
|
|
|
ENTRY: pszServer - the server on which to do the lookup
|
|
pSid - the SID to lookup
|
|
|
|
EXIT: *ppszName contains the account name. This buffer
|
|
must be freed by the caller with LocalFree.
|
|
|
|
*pSidType contains the SID type. pSidType is optional.
|
|
|
|
RETURNS: TRUE if successful, FALSE otherwise
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 08-Oct-1996 Created
|
|
JeffreyS 16-Jan-1998 Converted to HDPA (multiple lookup)
|
|
|
|
********************************************************************/
|
|
|
|
BOOL
|
|
LookupSids(HDPA hSids, LPCTSTR pszServer, LPSECURITYINFO2 psi2, PUSER_LIST *ppUserList)
|
|
{
|
|
PSIDCACHE pSidCache;
|
|
|
|
if (NULL == hSids)
|
|
return FALSE;
|
|
|
|
if (ppUserList != NULL)
|
|
*ppUserList = NULL;
|
|
|
|
pSidCache = GetSidCache();
|
|
|
|
if (NULL != pSidCache)
|
|
{
|
|
BOOL bRet = pSidCache->LookupSids(hSids, pszServer, psi2, ppUserList);
|
|
pSidCache->Release();
|
|
return bRet;
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
BOOL
|
|
LookupSid(PSID pSid, LPCTSTR pszServer, LPSECURITYINFO2 psi2, PUSER_LIST *ppUserList)
|
|
{
|
|
BOOL fResult;
|
|
HDPA hSids = NULL;
|
|
|
|
if (NULL == pSid)
|
|
return FALSE;
|
|
|
|
hSids = DPA_Create(1);
|
|
|
|
if (NULL == hSids)
|
|
return FALSE;
|
|
|
|
DPA_AppendPtr(hSids, pSid);
|
|
|
|
fResult = LookupSids(hSids, pszServer, psi2, ppUserList);
|
|
|
|
if (NULL != hSids)
|
|
DPA_Destroy(hSids);
|
|
|
|
return fResult;
|
|
}
|
|
|
|
// Private data structure used by LookupSidsAsync to pass
|
|
// data needed by the thread
|
|
typedef struct _LOOKUPSIDSDATA
|
|
{
|
|
HDPA hSids;
|
|
LPTSTR pszServer;
|
|
HWND hWndNotify;
|
|
UINT uMsgNotify;
|
|
} LOOKUPSIDSDATA, *PLOOKUPSIDSDATA;
|
|
|
|
|
|
DWORD WINAPI
|
|
_LookupSidsAsyncProc(LPVOID pv)
|
|
{
|
|
PLOOKUPSIDSDATA pdata = (PLOOKUPSIDSDATA)pv;
|
|
|
|
if (pdata)
|
|
{
|
|
PSIDCACHE pSidCache = GetSidCache();
|
|
|
|
if (NULL != pSidCache)
|
|
{
|
|
pSidCache->LookupSidsAsync(pdata->hSids,
|
|
pdata->pszServer,
|
|
NULL,
|
|
pdata->hWndNotify,
|
|
pdata->uMsgNotify);
|
|
pSidCache->Release();
|
|
}
|
|
|
|
PostMessage(pdata->hWndNotify, pdata->uMsgNotify, 0, 0);
|
|
|
|
DestroyDPA(pdata->hSids);
|
|
LocalFreeString(&pdata->pszServer);
|
|
LocalFree(pdata);
|
|
}
|
|
|
|
FreeLibraryAndExitThread(GetModuleHandle(c_szDllName), 0);
|
|
return 0;
|
|
}
|
|
|
|
BOOL
|
|
LookupSidsAsync(HDPA hSids,
|
|
LPCTSTR pszServer,
|
|
LPSECURITYINFO2 psi2,
|
|
HWND hWndNotify,
|
|
UINT uMsgNotify,
|
|
PHANDLE phThread)
|
|
{
|
|
PLOOKUPSIDSDATA pdata;
|
|
|
|
if (phThread)
|
|
*phThread = NULL;
|
|
|
|
if (NULL == hSids)
|
|
return FALSE;
|
|
|
|
if (psi2)
|
|
{
|
|
// Should marshal psi2 into a stream and do this on the
|
|
// other thread. Well No one has implemented psi2 so its fine.
|
|
BOOL bResult = LookupSids(hSids, pszServer, psi2, NULL);
|
|
PostMessage(hWndNotify, uMsgNotify, 0, 0);
|
|
return bResult;
|
|
}
|
|
|
|
//
|
|
// Copy all of the data so the thread can be abandoned if necessary
|
|
//
|
|
pdata = (PLOOKUPSIDSDATA)LocalAlloc(LPTR, SIZEOF(LOOKUPSIDSDATA));
|
|
if (pdata)
|
|
{
|
|
int cSids;
|
|
int i;
|
|
HINSTANCE hInstThisDll;
|
|
DWORD dwThreadId;
|
|
HANDLE hThread;
|
|
|
|
cSids = DPA_GetPtrCount(hSids);
|
|
pdata->hSids = DPA_Create(cSids);
|
|
|
|
if (!pdata->hSids)
|
|
{
|
|
LocalFree(pdata);
|
|
return FALSE;
|
|
}
|
|
|
|
for (i = 0; i < cSids; i++)
|
|
{
|
|
PSID p2 = LocalAllocSid((PSID)DPA_FastGetPtr(hSids, i));
|
|
if (p2)
|
|
{
|
|
DPA_AppendPtr(pdata->hSids, p2);
|
|
}
|
|
}
|
|
|
|
if (pszServer)
|
|
LocalAllocString(&pdata->pszServer, pszServer);
|
|
|
|
pdata->hWndNotify = hWndNotify;
|
|
pdata->uMsgNotify = uMsgNotify;
|
|
|
|
// Give the thread we are about to create a ref to the dll,
|
|
// so that the dll will remain for the lifetime of the thread
|
|
hInstThisDll = LoadLibrary(c_szDllName);
|
|
|
|
hThread = CreateThread(NULL,
|
|
0,
|
|
_LookupSidsAsyncProc,
|
|
pdata,
|
|
NULL,
|
|
&dwThreadId);
|
|
if (hThread != NULL)
|
|
{
|
|
if (phThread)
|
|
*phThread = hThread;
|
|
else
|
|
CloseHandle(hThread);
|
|
return TRUE;
|
|
}
|
|
else
|
|
{
|
|
// Thread creation has failed; clean up
|
|
DestroyDPA(pdata->hSids);
|
|
LocalFreeString(&pdata->pszServer);
|
|
LocalFree(pdata);
|
|
FreeLibrary(hInstThisDll);
|
|
}
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
BOOL
|
|
BuildUserDisplayName(LPTSTR *ppszDisplayName,
|
|
LPCTSTR pszName,
|
|
LPCTSTR pszLogonName)
|
|
{
|
|
TCHAR szDisplayName[MAX_PATH];
|
|
|
|
if (NULL == ppszDisplayName || NULL == pszName)
|
|
return FALSE;
|
|
|
|
*ppszDisplayName = NULL;
|
|
|
|
if (NULL != pszLogonName && *pszLogonName)
|
|
{
|
|
return (BOOL)FormatStringID(ppszDisplayName,
|
|
::hModule,
|
|
IDS_FMT_USER_DISPLAY,
|
|
pszName,
|
|
pszLogonName);
|
|
}
|
|
|
|
return SUCCEEDED(LocalAllocString(ppszDisplayName, pszName));
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: LoadImageList
|
|
|
|
SYNOPSIS: Creates an image list from a bitmap resource
|
|
|
|
ENTRY: hInstance - the bitmap lives here
|
|
pszBitmapID - resource ID of the bitmap
|
|
|
|
EXIT:
|
|
|
|
RETURNS: HIMAGELIST if successful, NULL otherwise
|
|
|
|
NOTES:
|
|
In order to calculate the number of images, it is assumed
|
|
that the width and height of a single image are the same.
|
|
|
|
HISTORY:
|
|
JeffreyS 08-Oct-1996 Created
|
|
|
|
********************************************************************/
|
|
|
|
HIMAGELIST
|
|
LoadImageList(HINSTANCE hInstance, LPCTSTR pszBitmapID)
|
|
{
|
|
HIMAGELIST himl = NULL;
|
|
HBITMAP hbm = LoadBitmap(hInstance, pszBitmapID);
|
|
|
|
if (hbm != NULL)
|
|
{
|
|
BITMAP bm;
|
|
GetObject(hbm, SIZEOF(bm), &bm);
|
|
|
|
himl = ImageList_Create(bm.bmHeight, // height == width
|
|
bm.bmHeight,
|
|
ILC_COLOR | ILC_MASK,
|
|
bm.bmWidth / bm.bmHeight,
|
|
0); // don't need to grow
|
|
if (himl != NULL)
|
|
ImageList_AddMasked(himl, hbm, CLR_DEFAULT);
|
|
|
|
DeleteObject(hbm);
|
|
}
|
|
|
|
return himl;
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: GetSidImageIndex
|
|
|
|
SYNOPSIS: Gets the image index for the given SID type
|
|
|
|
ENTRY: sidType - type of SID
|
|
sidSys - well-known group type
|
|
fRemoteUser - TRUE if SID is a user on a remote system
|
|
|
|
EXIT:
|
|
|
|
RETURNS: index into image list
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 08-Oct-1996 Created
|
|
|
|
********************************************************************/
|
|
|
|
SID_IMAGE_INDEX
|
|
GetSidImageIndex(PSID psid,
|
|
SID_NAME_USE sidType)
|
|
{
|
|
SID_IMAGE_INDEX idBitmap;
|
|
|
|
switch (sidType)
|
|
{
|
|
case SidTypeUser:
|
|
idBitmap = SID_IMAGE_USER;
|
|
break;
|
|
|
|
case SidTypeAlias:
|
|
case SidTypeGroup:
|
|
case SidTypeWellKnownGroup:
|
|
idBitmap = SID_IMAGE_GROUP;
|
|
break;
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
case SidTypeComputer:
|
|
idBitmap = SID_IMAGE_COMPUTER;
|
|
break;
|
|
#endif
|
|
|
|
default:
|
|
idBitmap = SID_IMAGE_UNKNOWN;
|
|
break;
|
|
}
|
|
|
|
return idBitmap;
|
|
}
|
|
|
|
#if(_WIN32_WINNT >= 0x0500)
|
|
|
|
#include <dsrole.h>
|
|
BOOL IsStandalone(LPCTSTR pszMachine, PBOOL pbIsDC)
|
|
{
|
|
BOOL bStandalone = TRUE;
|
|
PDSROLE_PRIMARY_DOMAIN_INFO_BASIC pDsRole = NULL;
|
|
|
|
//
|
|
// Find out if target machine is a standalone machine or joined to
|
|
// an NT domain.
|
|
//
|
|
|
|
__try
|
|
{
|
|
if (pbIsDC)
|
|
*pbIsDC = FALSE;
|
|
|
|
DsRoleGetPrimaryDomainInformation(pszMachine,
|
|
DsRolePrimaryDomainInfoBasic,
|
|
(PBYTE*)&pDsRole);
|
|
}
|
|
__finally
|
|
{
|
|
}
|
|
|
|
if (NULL != pDsRole)
|
|
{
|
|
if (pDsRole->MachineRole == DsRole_RoleStandaloneWorkstation ||
|
|
pDsRole->MachineRole == DsRole_RoleStandaloneServer)
|
|
{
|
|
bStandalone = TRUE;
|
|
}
|
|
else
|
|
bStandalone = FALSE;
|
|
|
|
if (pbIsDC)
|
|
{
|
|
if (pDsRole->MachineRole == DsRole_RolePrimaryDomainController ||
|
|
pDsRole->MachineRole == DsRole_RoleBackupDomainController)
|
|
{
|
|
*pbIsDC = TRUE;
|
|
}
|
|
}
|
|
|
|
DsRoleFreeMemory(pDsRole);
|
|
}
|
|
|
|
return bStandalone;
|
|
}
|
|
|
|
#else // _WIN32_WINNT < 0x0500
|
|
|
|
BOOL IsStandalone(LPCTSTR pszMachine, PBOOL pbIsDC)
|
|
{
|
|
BOOL bStandalone = FALSE;
|
|
|
|
//implement an NT4 version of this? There is no request for this
|
|
//so no need.
|
|
if (pbIsDC)
|
|
*pbIsDC = FALSE;
|
|
|
|
return bStandalone;
|
|
}
|
|
|
|
|
|
//
|
|
// Stuff used by GetUserGroup below
|
|
//
|
|
#include <getuser.h>
|
|
|
|
const TCHAR c_szGetUserLib[] = TEXT("netui2.dll");
|
|
const char c_szOpenUB[] = "OpenUserBrowser";
|
|
const char c_szEnumUBSelection[] = "EnumUserBrowserSelection";
|
|
const char c_szCloseUB[] = "CloseUserBrowser";
|
|
|
|
typedef HUSERBROW (WINAPI *PFN_UB_OPEN)(LPUSERBROWSER);
|
|
typedef BOOL (WINAPI *PFN_UB_ENUM)(HUSERBROW, LPUSERDETAILS, LPDWORD);
|
|
typedef BOOL (WINAPI *PFN_UB_CLOSE)(HUSERBROW);
|
|
|
|
PFN_UB_OPEN pfnUBOpen;
|
|
PFN_UB_ENUM pfnUBEnum;
|
|
PFN_UB_CLOSE pfnUBClose;
|
|
|
|
#ifndef HC_SED_USER_BROWSER_DIALOG
|
|
#define HC_SED_USER_BROWSER_DIALOG 4300
|
|
#define HC_SED_USER_BROWSER_AUDIT_DLG 4325
|
|
#endif
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: GetUserGroup
|
|
|
|
SYNOPSIS: Invokes the old NT4 user/group picker dialog
|
|
|
|
ENTRY: hwndOwner - owner window
|
|
dwFlags - indicate multi-select, etc.
|
|
pszServer - initial focus of dialog
|
|
ppUserList - out parameter
|
|
|
|
EXIT: *ppUserList contains a list of USER_INFO structures
|
|
|
|
RETURNS: HRESULT
|
|
|
|
NOTES: *ppUserList must be LocalFree'd by the caller.
|
|
|
|
HISTORY:
|
|
JeffreyS 16-Jan-1998 Created
|
|
|
|
********************************************************************/
|
|
|
|
HRESULT
|
|
GetUserGroup(HWND hwndOwner,
|
|
DWORD dwFlags,
|
|
LPCTSTR pszServer,
|
|
BOOL /*bStandalone*/,
|
|
PUSER_LIST *ppUserList)
|
|
{
|
|
HRESULT hr = S_OK;
|
|
HUSERBROW hUserBrowser = NULL;
|
|
USERBROWSER ub;
|
|
DWORD dwUDLength = 1024;
|
|
PUSERDETAILS pUserDetails = NULL;
|
|
PSID_CACHE_ENTRY pEntry;
|
|
HDPA hEntryList = NULL;
|
|
PSIDCACHE pSidCache = NULL;
|
|
|
|
TraceEnter(TRACE_MISC, "GetUserGroup");
|
|
TraceAssert(ppUserList != NULL);
|
|
|
|
if (!ppUserList)
|
|
TraceLeaveResult(E_INVALIDARG);
|
|
|
|
*ppUserList = NULL;
|
|
|
|
if (!g_hGetUserLib)
|
|
{
|
|
g_hGetUserLib = LoadLibrary(c_szGetUserLib);
|
|
if (g_hGetUserLib == NULL)
|
|
ExitGracefully(hr, E_FAIL, "Unable to load netui2.dll");
|
|
|
|
pfnUBOpen = (PFN_UB_OPEN)GetProcAddress(g_hGetUserLib, c_szOpenUB);
|
|
pfnUBEnum = (PFN_UB_ENUM)GetProcAddress(g_hGetUserLib, c_szEnumUBSelection);
|
|
pfnUBClose = (PFN_UB_CLOSE)GetProcAddress(g_hGetUserLib, c_szCloseUB);
|
|
|
|
if (!pfnUBOpen || !pfnUBEnum || !pfnUBClose)
|
|
{
|
|
FreeLibrary(g_hGetUserLib);
|
|
g_hGetUserLib = NULL;
|
|
ExitGracefully(hr, E_FAIL, "Unable to link to netui2.dll");
|
|
}
|
|
}
|
|
|
|
//
|
|
// Create the global sid cache object, if necessary
|
|
//
|
|
pSidCache = GetSidCache();
|
|
|
|
if (pSidCache == NULL)
|
|
ExitGracefully(hr, E_OUTOFMEMORY, "Unable to create SID cache");
|
|
|
|
ub.ulStructSize = sizeof(ub);
|
|
ub.fUserCancelled = FALSE;
|
|
ub.fExpandNames = TRUE;
|
|
ub.hwndOwner = hwndOwner;
|
|
ub.pszTitle = NULL;
|
|
ub.pszInitialDomain = (LPTSTR)pszServer;
|
|
ub.Flags = USRBROWS_SHOW_ALL | USRBROWS_INCL_ALL;
|
|
ub.ulHelpContext = HC_SED_USER_BROWSER_DIALOG;
|
|
ub.pszHelpFileName = (LPWSTR)c_szAcluiHelpFile;
|
|
|
|
#ifdef USRBROWS_INCL_RESTRICTED
|
|
ub.Flags &= ~USRBROWS_INCL_RESTRICTED; // NT5 only
|
|
#endif
|
|
|
|
if (!(dwFlags & GU_CONTAINER))
|
|
ub.Flags &= ~USRBROWS_INCL_CREATOR;
|
|
|
|
if (!(dwFlags & GU_MULTI_SELECT))
|
|
ub.Flags |= USRBROWS_SINGLE_SELECT;
|
|
|
|
if (dwFlags & GU_AUDIT_HLP)
|
|
ub.ulHelpContext = HC_SED_USER_BROWSER_AUDIT_DLG;
|
|
|
|
//
|
|
// Open the dialog
|
|
//
|
|
hUserBrowser = (*pfnUBOpen)(&ub);
|
|
if (hUserBrowser == NULL)
|
|
ExitGracefully(hr, E_FAIL, "OpenUserBrowser returned false");
|
|
|
|
pUserDetails = (PUSERDETAILS)LocalAlloc(LPTR, dwUDLength);
|
|
if (!pUserDetails)
|
|
ExitGracefully(hr, E_OUTOFMEMORY, "Unable to allocate UserDetails buffer");
|
|
|
|
hEntryList = DPA_Create(4);
|
|
if (!hEntryList)
|
|
ExitGracefully(hr, E_OUTOFMEMORY, "Unable to create SID cache entry list");
|
|
|
|
//
|
|
// Enumerate the results
|
|
//
|
|
for (;;)
|
|
{
|
|
if (!(*pfnUBEnum)(hUserBrowser, pUserDetails, &dwUDLength))
|
|
{
|
|
if (ERROR_INSUFFICIENT_BUFFER == GetLastError())
|
|
{
|
|
// The details buffer wasn't big enough, reallocate it
|
|
LocalFree(pUserDetails);
|
|
pUserDetails = (PUSERDETAILS)LocalAlloc(LPTR, dwUDLength);
|
|
if (pUserDetails == NULL)
|
|
break;
|
|
|
|
if (!(*pfnUBEnum)(hUserBrowser, pUserDetails, &dwUDLength))
|
|
break;
|
|
}
|
|
else // probably ERROR_NO_MORE_ITEMS
|
|
break;
|
|
}
|
|
|
|
//
|
|
// See if it's already in the cache
|
|
//
|
|
pEntry = pSidCache->FindSid(pUserDetails->psidUser);
|
|
|
|
if (NULL == pEntry)
|
|
{
|
|
//
|
|
// Not in the cache, add it
|
|
//
|
|
TCHAR szAccountName[MAX_PATH];
|
|
TCHAR szDomainName[MAX_PATH];
|
|
ULONG nAccountLength;
|
|
|
|
lstrcpy(szAccountName, pUserDetails->pszAccountName);
|
|
lstrcpy(szDomainName, pUserDetails->pszDomainName);
|
|
|
|
switch (pUserDetails->UserType)
|
|
{
|
|
case SidTypeUnknown:
|
|
case SidTypeInvalid:
|
|
// Load unknown account string
|
|
LoadString(::hModule, IDS_SID_UNKNOWN, szAccountName, ARRAYSIZE(szAccountName));
|
|
break;
|
|
|
|
case SidTypeAlias:
|
|
//if (IsAliasSid(pSid))
|
|
// szDomainName[0] = TEXT('\0'); // The domain is "BUILTIN"
|
|
break;
|
|
|
|
case SidTypeDeletedAccount:
|
|
// Load deleted account string
|
|
LoadString(::hModule, IDS_SID_DELETED, szAccountName, ARRAYSIZE(szAccountName));
|
|
break;
|
|
|
|
case SidTypeWellKnownGroup:
|
|
// Don't include the domain for a well-known group
|
|
szDomainName[0] = TEXT('\0');
|
|
break;
|
|
}
|
|
|
|
//
|
|
// Build NT4 "domain\user" style name (logon name)
|
|
//
|
|
if (szDomainName[0] != TEXT('\0'))
|
|
{
|
|
lstrcat(szDomainName, TEXT("\\"));
|
|
lstrcat(szDomainName, szAccountName);
|
|
}
|
|
|
|
LPCTSTR pszCommonName = pUserDetails->pszFullName;
|
|
if (!pszCommonName || !*pszCommonName)
|
|
pszCommonName = pUserDetails->pszAccountName;
|
|
|
|
pEntry = pSidCache->MakeEntry(pUserDetails->psidUser,
|
|
pUserDetails->UserType,
|
|
pszCommonName,
|
|
szDomainName);
|
|
if (NULL != pEntry)
|
|
pSidCache->AddEntry(pEntry);
|
|
}
|
|
|
|
if (NULL != pEntry)
|
|
DPA_AppendPtr(hEntryList, pEntry);
|
|
}
|
|
|
|
//
|
|
// Build return list
|
|
//
|
|
if (DPA_GetPtrCount(hEntryList))
|
|
pSidCache->BuildUserList(hEntryList, pszServer, ppUserList);
|
|
|
|
if (NULL == *ppUserList)
|
|
hr = E_FAIL;
|
|
|
|
exit_gracefully:
|
|
|
|
if (pSidCache)
|
|
pSidCache->Release();
|
|
|
|
if (NULL != hUserBrowser)
|
|
(*pfnUBClose)(hUserBrowser);
|
|
|
|
if (pUserDetails != NULL)
|
|
LocalFree(pUserDetails);
|
|
|
|
DPA_Destroy(hEntryList);
|
|
|
|
TraceLeaveResult(hr);
|
|
}
|
|
|
|
#endif // _WIN32_WINNT < 0x0500
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: IsDACLCanonical
|
|
|
|
SYNOPSIS: Checks a DACL for canonical ordering
|
|
|
|
ENTRY: pDacl - points to DACL to check
|
|
|
|
EXIT:
|
|
|
|
RETURNS: Nonzero if DACL is in canonical order, zero otherwise
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 08-Oct-1996 Created
|
|
JeffreyS 03-Oct-1997 Make object aces same as non-object aces
|
|
|
|
********************************************************************/
|
|
|
|
enum ACELEVEL
|
|
{
|
|
alNonInheritAccessDenied,
|
|
alNonInheritAccessAllowed,
|
|
alInheritedAces,
|
|
};
|
|
|
|
BOOL
|
|
IsDACLCanonical(PACL pDacl)
|
|
{
|
|
PACE_HEADER pAce;
|
|
ACELEVEL currentAceLevel;
|
|
DWORD dwAceCount;
|
|
|
|
if (pDacl == NULL)
|
|
return TRUE;
|
|
|
|
currentAceLevel = alNonInheritAccessDenied;
|
|
dwAceCount = pDacl->AceCount;
|
|
|
|
if (dwAceCount == 0)
|
|
return TRUE;
|
|
|
|
for (pAce = (PACE_HEADER)FirstAce(pDacl);
|
|
dwAceCount > 0;
|
|
--dwAceCount, pAce = (PACE_HEADER)NextAce(pAce))
|
|
{
|
|
ACELEVEL aceLevel;
|
|
|
|
//
|
|
// NOTE: We do not skip INHERIT_ONLY aces because we want them in
|
|
// canonical order too.
|
|
//
|
|
|
|
if (pAce->AceFlags & INHERITED_ACE)
|
|
{
|
|
aceLevel = alInheritedAces; // don't check order here
|
|
}
|
|
else
|
|
{
|
|
switch(pAce->AceType)
|
|
{
|
|
case ACCESS_DENIED_ACE_TYPE:
|
|
case ACCESS_DENIED_OBJECT_ACE_TYPE:
|
|
aceLevel = alNonInheritAccessDenied;
|
|
break;
|
|
|
|
case ACCESS_ALLOWED_ACE_TYPE:
|
|
case ACCESS_ALLOWED_COMPOUND_ACE_TYPE:
|
|
case ACCESS_ALLOWED_OBJECT_ACE_TYPE:
|
|
aceLevel = alNonInheritAccessAllowed;
|
|
break;
|
|
|
|
default:
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// If the ace type is less than the level we are currently at,
|
|
// then it is not canonical.
|
|
//
|
|
if (aceLevel < currentAceLevel)
|
|
return FALSE;
|
|
|
|
//
|
|
// Update the current ace level.
|
|
//
|
|
currentAceLevel = aceLevel;
|
|
}
|
|
|
|
//
|
|
// If we get here, then the DACL is in canonical order.
|
|
//
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: IsDenyACL
|
|
|
|
SYNOPSIS: Checks a DACL for Deny ACEs. Also looks for "Deny
|
|
All" ACEs.
|
|
|
|
ENTRY: pDacl - points to DACL to check
|
|
|
|
EXIT: *pdwWarning is 0, IDS_PERM_DENY, or IDS_PERM_DENY_ALL
|
|
|
|
RETURNS: Nonzero if DACL contains any Deny ACEs, zero otherwise
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 05-Sep-1997 Created
|
|
|
|
********************************************************************/
|
|
|
|
BOOL
|
|
IsDenyACL(PACL pDacl,
|
|
BOOL fProtected,
|
|
DWORD dwFullControlMask,
|
|
LPDWORD pdwWarning)
|
|
{
|
|
DWORD dwWarning = 0;
|
|
|
|
TraceEnter(TRACE_MISC, "IsDenyACL");
|
|
|
|
// NULL DACL implies "Allow Everyone Full Control"
|
|
if (pDacl == NULL)
|
|
goto exit_gracefully;
|
|
|
|
// Check for empty DACL (no access to anyone)
|
|
if (pDacl->AceCount == 0)
|
|
{
|
|
if (fProtected)
|
|
dwWarning = IDS_PERM_DENY_ALL;
|
|
// else the object will inherit permissions from the parent.
|
|
}
|
|
else
|
|
{
|
|
PACE_HEADER pAce;
|
|
int iEntry;
|
|
|
|
// Iterate through the ACL looking for "Deny All"
|
|
for (iEntry = 0, pAce = (PACE_HEADER)FirstAce(pDacl);
|
|
iEntry < pDacl->AceCount;
|
|
iEntry++, pAce = (PACE_HEADER)NextAce(pAce))
|
|
{
|
|
if (pAce->AceType != ACCESS_DENIED_ACE_TYPE &&
|
|
pAce->AceType != ACCESS_DENIED_OBJECT_ACE_TYPE)
|
|
{
|
|
// Assuming the ACL is in canonical order, we can
|
|
// stop as soon as we find something that isn't
|
|
// a Deny ACE. (Deny ACEs come first)
|
|
break;
|
|
}
|
|
|
|
// Found a Deny ACE
|
|
dwWarning = IDS_PERM_DENY;
|
|
|
|
// Check for "Deny Everyone Full Control". Don't look
|
|
// for ACCESS_DENIED_OBJECT_ACE_TYPE here since Object
|
|
// aces don't have as wide an effect as normal aces.
|
|
if (pAce->AceType == ACCESS_DENIED_ACE_TYPE &&
|
|
((PKNOWN_ACE)pAce)->Mask == dwFullControlMask &&
|
|
EqualSid(GetAceSid(pAce), QuerySystemSid(UI_SID_World)))
|
|
{
|
|
// Found "Deny All"
|
|
dwWarning = IDS_PERM_DENY_ALL;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
exit_gracefully:
|
|
|
|
if (pdwWarning != NULL)
|
|
*pdwWarning = dwWarning;
|
|
|
|
TraceLeaveValue(dwWarning != 0);
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: QuerySystemSid
|
|
|
|
SYNOPSIS: Retrieves the requested SID
|
|
|
|
ENTRY: SystemSidType - Which SID to retrieve
|
|
|
|
EXIT:
|
|
|
|
RETURNS: PSID if successful, NULL otherwise
|
|
|
|
HISTORY:
|
|
JeffreyS 08-Oct-1996 Created
|
|
|
|
********************************************************************/
|
|
|
|
//
|
|
// Global array of static system SIDs, corresponding to UI_SystemSid
|
|
//
|
|
const struct
|
|
{
|
|
SID sid; // contains 1 subauthority
|
|
DWORD dwSubAuth[1]; // we currently need at most 2 subauthorities
|
|
} g_StaticSids[COUNT_SYSTEM_SID_TYPES] =
|
|
{
|
|
{{SID_REVISION,1,SECURITY_WORLD_SID_AUTHORITY, {SECURITY_WORLD_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_CREATOR_SID_AUTHORITY,{SECURITY_CREATOR_OWNER_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_CREATOR_SID_AUTHORITY,{SECURITY_CREATOR_GROUP_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_DIALUP_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_NETWORK_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_BATCH_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_INTERACTIVE_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_SERVICE_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_ANONYMOUS_LOGON_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_PROXY_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_ENTERPRISE_CONTROLLERS_RID}},{0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_PRINCIPAL_SELF_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_AUTHENTICATED_USER_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_RESTRICTED_CODE_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_TERMINAL_SERVER_RID}}, {0} },
|
|
{{SID_REVISION,1,SECURITY_NT_AUTHORITY, {SECURITY_LOCAL_SYSTEM_RID}}, {0} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_ADMINS} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_USERS} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_GUESTS} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_POWER_USERS} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_ACCOUNT_OPS} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_SYSTEM_OPS} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_PRINT_OPS} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_BACKUP_OPS} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_REPLICATOR} },
|
|
{{SID_REVISION,2,SECURITY_NT_AUTHORITY, {SECURITY_BUILTIN_DOMAIN_RID}}, {DOMAIN_ALIAS_RID_RAS_SERVERS} },
|
|
};
|
|
|
|
PSID
|
|
QuerySystemSid(UI_SystemSid SystemSidType)
|
|
{
|
|
if (SystemSidType == UI_SID_Invalid || SystemSidType >= UI_SID_Count)
|
|
return NULL;
|
|
|
|
return (PSID)&g_StaticSids[SystemSidType];
|
|
}
|
|
|
|
|
|
//
|
|
// Global array of cached token SIDs
|
|
//
|
|
struct
|
|
{
|
|
SID sid; // SID contains 1 subauthority
|
|
DWORD dwSubAuth[SID_MAX_SUB_AUTHORITIES - 1];
|
|
} g_TokenSids[COUNT_TOKEN_SID_TYPES] = {0};
|
|
|
|
PSID
|
|
QueryTokenSid(UI_TokenSid TokenSidType)
|
|
{
|
|
if (TokenSidType == UI_TSID_Invalid || TokenSidType >= UI_TSID_Count)
|
|
return NULL;
|
|
|
|
if (0 == *GetSidSubAuthorityCount((PSID)&g_TokenSids[TokenSidType]))
|
|
{
|
|
HANDLE hProcessToken;
|
|
|
|
// Get the current process's user's SID
|
|
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hProcessToken))
|
|
{
|
|
BYTE buffer[sizeof(TOKEN_USER) + sizeof(g_TokenSids[0])];
|
|
ULONG cbBuffer = sizeof(buffer);
|
|
|
|
switch (TokenSidType)
|
|
{
|
|
case UI_TSID_CurrentProcessUser:
|
|
if (GetTokenInformation(hProcessToken,
|
|
TokenUser,
|
|
buffer,
|
|
cbBuffer,
|
|
&cbBuffer))
|
|
{
|
|
PTOKEN_USER ptu = (PTOKEN_USER)buffer;
|
|
CopyMemory(&g_TokenSids[UI_TSID_CurrentProcessUser],
|
|
ptu->User.Sid,
|
|
GetLengthSid(ptu->User.Sid));
|
|
}
|
|
break;
|
|
|
|
case UI_TSID_CurrentProcessOwner:
|
|
if (GetTokenInformation(hProcessToken,
|
|
TokenOwner,
|
|
buffer,
|
|
cbBuffer,
|
|
&cbBuffer))
|
|
{
|
|
PTOKEN_OWNER pto = (PTOKEN_OWNER)buffer;
|
|
CopyMemory(&g_TokenSids[UI_TSID_CurrentProcessOwner],
|
|
pto->Owner,
|
|
GetLengthSid(pto->Owner));
|
|
}
|
|
break;
|
|
|
|
case UI_TSID_CurrentProcessPrimaryGroup:
|
|
if (GetTokenInformation(hProcessToken,
|
|
TokenPrimaryGroup,
|
|
buffer,
|
|
cbBuffer,
|
|
&cbBuffer))
|
|
{
|
|
PTOKEN_PRIMARY_GROUP ptg = (PTOKEN_PRIMARY_GROUP)buffer;
|
|
CopyMemory(&g_TokenSids[UI_TSID_CurrentProcessPrimaryGroup],
|
|
ptg->PrimaryGroup,
|
|
GetLengthSid(ptg->PrimaryGroup));
|
|
}
|
|
break;
|
|
}
|
|
CloseHandle(hProcessToken);
|
|
}
|
|
|
|
if (0 == *GetSidSubAuthorityCount((PSID)&g_TokenSids[TokenSidType]))
|
|
return NULL;
|
|
}
|
|
|
|
return (PSID)&g_TokenSids[TokenSidType];
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: GetAuthenticationID
|
|
|
|
SYNOPSIS: Retrieves the SID associated with the credentials
|
|
currently being used for network access.
|
|
(runas /netonly credentials)
|
|
|
|
ENTRY: pszServer = server on which to lookup the account.
|
|
NULL indicates local system.
|
|
|
|
EXIT:
|
|
|
|
RETURNS: PSID if successful, NULL otherwise. Caller must
|
|
free with LocalFree.
|
|
|
|
HISTORY:
|
|
JeffreyS 05-Aug-1999 Created
|
|
|
|
********************************************************************/
|
|
PSID
|
|
GetAuthenticationID(LPCWSTR pszServer)
|
|
{
|
|
PSID pSid = NULL;
|
|
HANDLE hLsa;
|
|
NTSTATUS Status;
|
|
|
|
//
|
|
// These LSA calls are delay-loaded from secur32.dll using the linker's
|
|
// delay-load mechanism. Therefore, wrap with an exception handler.
|
|
//
|
|
__try
|
|
{
|
|
Status = LsaConnectUntrusted(&hLsa);
|
|
|
|
if (Status == 0)
|
|
{
|
|
NEGOTIATE_CALLER_NAME_REQUEST Req = {0};
|
|
PNEGOTIATE_CALLER_NAME_RESPONSE pResp;
|
|
ULONG cbSize;
|
|
NTSTATUS SubStatus;
|
|
|
|
Req.MessageType = NegGetCallerName;
|
|
|
|
Status = LsaCallAuthenticationPackage(
|
|
hLsa,
|
|
0,
|
|
&Req,
|
|
sizeof(Req),
|
|
(void**)&pResp,
|
|
&cbSize,
|
|
&SubStatus);
|
|
|
|
if ((Status == 0) && (SubStatus == 0))
|
|
{
|
|
BYTE sid[sizeof(SID) + (SID_MAX_SUB_AUTHORITIES - 1)*sizeof(DWORD)];
|
|
PSID psid = (PSID)sid;
|
|
DWORD cbSid = sizeof(sid);
|
|
WCHAR szDomain[MAX_PATH];
|
|
DWORD cchDomain = ARRAYSIZE(szDomain);
|
|
SID_NAME_USE sidType;
|
|
|
|
if (LookupAccountNameW(pszServer,
|
|
pResp->CallerName,
|
|
psid,
|
|
&cbSid,
|
|
szDomain,
|
|
&cchDomain,
|
|
&sidType))
|
|
{
|
|
pSid = LocalAllocSid(psid);
|
|
}
|
|
|
|
LsaFreeReturnBuffer(pResp);
|
|
}
|
|
|
|
LsaDeregisterLogonProcess(hLsa);
|
|
}
|
|
}
|
|
__except(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
}
|
|
|
|
return pSid;
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: CopyUnicodeString
|
|
|
|
SYNOPSIS: Allocates a buffer and copies a string from
|
|
a UNICODE_STRING sources.
|
|
|
|
ENTRY: pszDest - pointer to destination buffer
|
|
cchDest - # of chars in pszDest (bytes for MBCS)
|
|
pSrc - pointer to UNICODE_STRING to copy
|
|
|
|
EXIT: pszDest - containing copy of string
|
|
|
|
RETURNS: # of chars copied, or 0 if not successful.
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 22-Jan-1998 Created
|
|
|
|
********************************************************************/
|
|
|
|
int
|
|
CopyUnicodeString(LPTSTR pszDest, ULONG cchDest, PLSA_UNICODE_STRING pSrc)
|
|
{
|
|
int nResult;
|
|
ULONG cchSrc;
|
|
|
|
// If UNICODE, cchDest is size of destination buffer in chars
|
|
// Else (MBCS) cchDest is size of destination buffer in bytes
|
|
|
|
if (pszDest == NULL || 0 == cchDest)
|
|
return 0;
|
|
|
|
*pszDest = TEXT('\0');
|
|
|
|
if (pSrc == NULL || pSrc->Buffer == NULL)
|
|
return 0;
|
|
|
|
// Get # of chars in source (not including NULL)
|
|
cchSrc = pSrc->Length/sizeof(WCHAR);
|
|
|
|
#ifdef UNICODE
|
|
//
|
|
// Note that pSrc->Buffer may not be NULL terminated so we can't just
|
|
// call lstrcpynW with cchDest. Also, if we call lstrcpynW with cchSrc,
|
|
// it copies the correct # of chars, but then overwrites the last char
|
|
// with NULL giving an incorrect result. If we call lstrcpynW with
|
|
// (cchSrc+1) it reads past the end of the buffer, which may fault (360251)
|
|
// causing lstrcpynW's exception handler to return 0 without NULL-
|
|
// terminating the resulting string.
|
|
//
|
|
// So let's just copy the bits.
|
|
//
|
|
nResult = min(cchSrc, cchDest);
|
|
CopyMemory(pszDest, pSrc->Buffer, sizeof(WCHAR)*nResult);
|
|
if (nResult == (int)cchDest)
|
|
--nResult;
|
|
pszDest[nResult] = L'\0';
|
|
#else
|
|
nResult = WideCharToMultiByte(CP_ACP,
|
|
0,
|
|
pSrc->Buffer,
|
|
cchSrc,
|
|
pszDest,
|
|
cchDest,
|
|
NULL,
|
|
NULL);
|
|
#endif
|
|
|
|
return nResult;
|
|
}
|
|
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: CopyUnicodeString
|
|
|
|
SYNOPSIS: Allocates a buffer and copies a string from
|
|
a UNICODE_STRING sources.
|
|
|
|
ENTRY: pSrc - pointer to UNICODE_STRING to copy
|
|
|
|
EXIT: *ppszResult - points to LocalAlloc'd buffer containing copy.
|
|
|
|
RETURNS: # of chars copied, or 0 if not successful.
|
|
|
|
NOTES:
|
|
|
|
HISTORY:
|
|
JeffreyS 22-Jan-1998 Created
|
|
|
|
********************************************************************/
|
|
|
|
int
|
|
CopyUnicodeString(LPTSTR *ppszResult, PLSA_UNICODE_STRING pSrc)
|
|
{
|
|
int nResult = 0;
|
|
|
|
if (NULL == ppszResult)
|
|
return 0;
|
|
|
|
*ppszResult = NULL;
|
|
|
|
if (NULL != pSrc)
|
|
{
|
|
ULONG cchResult;
|
|
|
|
*ppszResult = NULL;
|
|
|
|
// Get # of chars in source (including NULL)
|
|
cchResult = pSrc->Length/SIZEOF(WCHAR) + 1;
|
|
|
|
// Allocate buffer big enough for either UNICODE or MBCS result
|
|
*ppszResult = (LPTSTR)LocalAlloc(LPTR, cchResult * 2);
|
|
|
|
if (*ppszResult)
|
|
{
|
|
nResult = CopyUnicodeString(*ppszResult, cchResult, pSrc);
|
|
|
|
if (0 == nResult)
|
|
{
|
|
LocalFree(*ppszResult);
|
|
*ppszResult = NULL;
|
|
}
|
|
}
|
|
}
|
|
|
|
return nResult;
|
|
}
|
|
|
|
|
|
//
|
|
// Test GUIDs safely
|
|
//
|
|
BOOL IsSameGUID(const GUID *p1, const GUID *p2)
|
|
{
|
|
BOOL bResult = FALSE;
|
|
|
|
if (!p1) p1 = &GUID_NULL;
|
|
if (!p2) p2 = &GUID_NULL;
|
|
|
|
__try
|
|
{
|
|
bResult = InlineIsEqualGUID(*p1, *p2);
|
|
}
|
|
__except(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
}
|
|
|
|
return bResult;
|
|
}
|
|
|
|
/*******************************************************************
|
|
|
|
NAME: GetCountOfInheritableAces
|
|
|
|
SYNOPSIS: Get the count of aces in ACL which can be
|
|
inherited to child objects
|
|
|
|
RETURNS: Count of Aces
|
|
|
|
********************************************************************/
|
|
DWORD GetCountOfInheritableAces(PACL pAcl)
|
|
{
|
|
if(!pAcl)
|
|
return 0;
|
|
|
|
DWORD dwCount = 0;
|
|
PACE_HEADER pAce = NULL;
|
|
int iEntry = 0;
|
|
for (iEntry = 0, pAce = (PACE_HEADER)FirstAce(pAcl);
|
|
iEntry < pAcl->AceCount;
|
|
iEntry++, pAce = (PACE_HEADER)NextAce(pAce))
|
|
{
|
|
//
|
|
//Consider only explicit aces
|
|
//
|
|
if((!(pAce->AceFlags & INHERITED_ACE))&&(pAce->AceFlags & (OBJECT_INHERIT_ACE|CONTAINER_INHERIT_ACE)))
|
|
dwCount++;
|
|
}
|
|
|
|
return dwCount;
|
|
}
|
|
/*******************************************************************
|
|
|
|
NAME: GetCountOfInheritableAces
|
|
|
|
SYNOPSIS: Get the count of aces in SACL or DACL which can be
|
|
inherited to child objects
|
|
|
|
RETURNS: Count of Aces
|
|
|
|
********************************************************************/
|
|
DWORD GetCountOfInheritableAces(SECURITY_INFORMATION si, PSECURITY_DESCRIPTOR pSD)
|
|
{
|
|
if(!pSD)
|
|
return 0;
|
|
|
|
PACL pAcl = NULL;
|
|
BOOL bPresent;
|
|
BOOL bDefault;
|
|
|
|
if(si & DACL_SECURITY_INFORMATION)
|
|
{
|
|
if(GetSecurityDescriptorDacl(pSD, &bPresent, &pAcl, &bDefault))
|
|
{
|
|
return GetCountOfInheritableAces(pAcl);
|
|
}
|
|
}
|
|
else if(si & SACL_SECURITY_INFORMATION)
|
|
{
|
|
if(GetSecurityDescriptorSacl(pSD, &bPresent, &pAcl, &bDefault))
|
|
{
|
|
return GetCountOfInheritableAces(pAcl);
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
typedef struct AclBloatInfo{
|
|
DWORD dwInheriteAceCount;
|
|
SECURITY_INFORMATION si;
|
|
HFONT hFont;
|
|
BOOL bShowHelp;
|
|
}ACL_BLOAT_INFO;
|
|
|
|
INT_PTR CALLBACK
|
|
AclBloatDialogProc(HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
|
|
{
|
|
switch (uMsg)
|
|
{
|
|
case WM_INITDIALOG:
|
|
{
|
|
ACL_BLOAT_INFO * pInfo= (ACL_BLOAT_INFO*)lParam;
|
|
ASSERT(pInfo);
|
|
SetWindowLongPtr(hDlg, DWLP_USER, (LONG_PTR)pInfo);
|
|
|
|
//
|
|
//Add a warning icon
|
|
//
|
|
// add the warning icon
|
|
HICON hWarn = LoadIcon(NULL, IDI_WARNING);
|
|
SendDlgItemMessage(hDlg, // dialog box window handle
|
|
IDC_BLOAT_WARN_ICON, // icon identifier
|
|
STM_SETIMAGE, // message to send
|
|
(WPARAM) IMAGE_ICON, // image type
|
|
(LPARAM) hWarn); // icon handle
|
|
|
|
|
|
//
|
|
//Set the title of dialog box
|
|
//
|
|
LPTSTR pszCaption = NULL;
|
|
if(FormatStringID(&pszCaption,
|
|
::hModule,
|
|
pInfo->si & DACL_SECURITY_INFORMATION ? IDS_PERMISSIONS : IDS_AUDITING))
|
|
{
|
|
SetWindowText(hDlg, pszCaption);
|
|
LocalFreeString(&pszCaption);
|
|
}
|
|
|
|
//
|
|
//Set the warning message
|
|
//
|
|
UINT cItem = pInfo->dwInheriteAceCount;
|
|
WCHAR buffer[34];
|
|
_itow(cItem,buffer,10);
|
|
if(FormatStringID(&pszCaption,
|
|
::hModule,
|
|
pInfo->si & DACL_SECURITY_INFORMATION ? IDS_ACLBLOAT_NO_LIST_LINE1:IDS_ACLBLOAT_NO_LIST_SACL_LINE1,
|
|
buffer))
|
|
{
|
|
SetDlgItemText(hDlg, IDC_ACLBLOAT_LINE1, pszCaption);
|
|
LocalFreeString(&pszCaption);
|
|
}
|
|
|
|
//
|
|
//make warning bold
|
|
//
|
|
MakeBold(GetDlgItem(hDlg,IDC_ACLB_WARNING), &(pInfo->hFont));
|
|
|
|
//
|
|
//Set the line2, hide the Help button and move other buttons.
|
|
//
|
|
if(!pInfo->bShowHelp)
|
|
{
|
|
if(FormatStringID(&pszCaption,
|
|
::hModule,
|
|
pInfo->si & DACL_SECURITY_INFORMATION ? IDS_BLOAT_PERM_LINE2_NOHELP : IDS_BLOAT_AUDIT_LINE2_NOHELP))
|
|
{
|
|
SetDlgItemText(hDlg, IDC_ACLB_LINE3, pszCaption);
|
|
LocalFreeString(&pszCaption);
|
|
}
|
|
|
|
RECT rcHelp, rcCancel;
|
|
GetWindowRect(GetDlgItem(hDlg, IDHELP), &rcHelp);
|
|
MapWindowPoints(NULL, hDlg, (LPPOINT)&rcHelp, 2);
|
|
GetWindowRect(GetDlgItem(hDlg, IDCANCEL), &rcCancel);
|
|
MapWindowPoints(NULL, hDlg, (LPPOINT)&rcCancel, 2);
|
|
|
|
//
|
|
//Hide the Help button, Move Cancel to help position
|
|
//and Ok to Cancel positon.
|
|
//
|
|
ShowWindow(GetDlgItem(hDlg, IDHELP),FALSE);
|
|
SetWindowPos(GetDlgItem(hDlg, IDCANCEL),
|
|
NULL,
|
|
rcHelp.left,
|
|
rcHelp.top,
|
|
0,
|
|
0,
|
|
SWP_NOACTIVATE | SWP_NOSIZE | SWP_NOZORDER);
|
|
|
|
SetWindowPos(GetDlgItem(hDlg, IDOK),
|
|
NULL,
|
|
rcCancel.left,
|
|
rcCancel.top,
|
|
0,
|
|
0,
|
|
SWP_NOACTIVATE | SWP_NOSIZE | SWP_NOZORDER);
|
|
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
case WM_COMMAND:
|
|
{
|
|
WORD wControlID = GET_WM_COMMAND_ID(wParam, lParam);
|
|
switch (wControlID)
|
|
{
|
|
case IDOK:
|
|
{
|
|
ACL_BLOAT_INFO * pInfo = (ACL_BLOAT_INFO *)GetWindowLongPtr(hDlg, DWLP_USER);
|
|
if(pInfo->hFont)
|
|
DeleteObject(pInfo->hFont);
|
|
pInfo->hFont = NULL;
|
|
EndDialog(hDlg, FALSE);
|
|
break;
|
|
}
|
|
case IDCANCEL:
|
|
{
|
|
ACL_BLOAT_INFO * pInfo = (ACL_BLOAT_INFO *)GetWindowLongPtr(hDlg, DWLP_USER);
|
|
if(pInfo->hFont)
|
|
DeleteObject(pInfo->hFont);
|
|
pInfo->hFont = NULL;
|
|
|
|
EndDialog(hDlg, TRUE);
|
|
break;
|
|
}
|
|
|
|
case IDHELP:
|
|
HtmlHelp(NULL,
|
|
L"aclui.chm::/ACLUI_acl_BP.htm",
|
|
HH_DISPLAY_TOPIC,
|
|
0);
|
|
return TRUE;
|
|
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// This function displays the "An error has occured [Continue] [Cancel]" message
|
|
//
|
|
// Returns IDOK or IDCANCEL
|
|
//
|
|
BOOL
|
|
IsAclBloated(HWND hWndParent, SECURITY_INFORMATION si, DWORD dwInheritAceCount, int idd, BOOL bShowHelp)
|
|
{
|
|
AclBloatInfo info;
|
|
info.dwInheriteAceCount = dwInheritAceCount;
|
|
info.si = si;
|
|
info.hFont = NULL;
|
|
info.bShowHelp = bShowHelp;
|
|
return (BOOL)DialogBoxParam(::hModule,
|
|
MAKEINTRESOURCE(idd),
|
|
hWndParent,
|
|
AclBloatDialogProc,
|
|
(LPARAM)(&info));
|
|
}
|
|
|
|
BOOL IsAclBloated(HWND hDlg, SECURITY_INFORMATION si, PSECURITY_DESCRIPTOR pSD, DWORD dwOrgInheritAceCount, BOOL bShowHelp)
|
|
{
|
|
ASSERT(pSD);
|
|
BOOL fReturn = FALSE;
|
|
|
|
DWORD dwNewInheritAceCount = GetCountOfInheritableAces(si, pSD);
|
|
if( ((int)dwNewInheritAceCount - (int)dwOrgInheritAceCount) > ACL_BLOAT_LIMIT )
|
|
fReturn = IsAclBloated(hDlg,
|
|
si,
|
|
dwNewInheritAceCount - dwOrgInheritAceCount,
|
|
si & DACL_SECURITY_INFORMATION ? IDD_BLOAT_NO_LIST : IDD_BLOAT_NO_LIST_SACL,
|
|
bShowHelp);
|
|
|
|
return fReturn;
|
|
}
|
|
|
|
//
|
|
//Sets the font style to bold for the hwnd.
|
|
//phNewFont gets handle to newFont which
|
|
//is to freed after hwnd is destroyed.
|
|
//
|
|
HRESULT MakeBold (HWND hwnd, HFONT *phNewFont)
|
|
{
|
|
HRESULT hr = S_OK;
|
|
HFONT hFont = NULL;
|
|
*phNewFont = NULL;
|
|
LOGFONT LogFont;
|
|
|
|
if(!hwnd || !phNewFont)
|
|
return E_POINTER;
|
|
|
|
|
|
hFont = (HFONT)SendMessage(hwnd,WM_GETFONT,0,0);
|
|
if (!hFont)
|
|
{
|
|
hr = HRESULT_FROM_WIN32(GetLastError());
|
|
return hr;
|
|
}
|
|
|
|
|
|
if (!GetObject(hFont,sizeof(LOGFONT),(LPVOID)(&LogFont)))
|
|
{
|
|
hr = HRESULT_FROM_WIN32(GetLastError());
|
|
return hr;
|
|
}
|
|
|
|
LogFont.lfWeight = FW_BOLD;
|
|
|
|
if (!(*phNewFont = CreateFontIndirect(&LogFont)))
|
|
{
|
|
hr = HRESULT_FROM_WIN32(GetLastError());
|
|
return hr;
|
|
}
|
|
|
|
SendMessage(hwnd,WM_SETFONT,(WPARAM)(*phNewFont),MAKELPARAM(FALSE,0));
|
|
|
|
return S_OK;
|
|
}
|