lsasrv.h File Reference

#include <stdarg.h>
#include <windef.h>
#include <winbase.h>
#include <winreg.h>
#include <ndk/cmfuncs.h>
#include <ndk/exfuncs.h>
#include <ndk/kefuncs.h>
#include <ndk/mmfuncs.h>
#include <ndk/obfuncs.h>
#include <ndk/psfuncs.h>
#include <ndk/rtlfuncs.h>
#include <ndk/sefuncs.h>
#include <ndk/ketypes.h>
#include <ndk/setypes.h>
#include <ntsam.h>
#include <ntlsa.h>
#include <sddl.h>
#include <srmp.h>
#include <lsass.h>
#include <lsa_s.h>
#include <wine/debug.h>

Include dependency graph for lsasrv.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	_LSA_DB_OBJECT
struct	_LSAP_POLICY_AUDIT_EVENTS_DATA
struct	_LSAP_LOGON_CONTEXT
struct	_SAMPR_ULONG_ARRAY

Macros
#define	WIN32_NO_STATUS
#define	_INC_WINDOWS
#define	COM_NO_WINDOWS_H
#define	NTOS_MODE_USER
#define	LSAP_DB_SIGNATURE   0x12345678
#define	POLICY_AUDIT_EVENT_TYPE_COUNT   (AuditCategoryAccountLogon - AuditCategorySystem + 1)

Typedefs
typedef enum _LSA_DB_OBJECT_TYPE	LSA_DB_OBJECT_TYPE
typedef enum _LSA_DB_OBJECT_TYPE *	PLSA_DB_OBJECT_TYPE
typedef struct _LSA_DB_OBJECT	LSA_DB_OBJECT
typedef struct _LSA_DB_OBJECT *	PLSA_DB_OBJECT
typedef struct _LSAP_POLICY_AUDIT_EVENTS_DATA	LSAP_POLICY_AUDIT_EVENTS_DATA
typedef struct _LSAP_POLICY_AUDIT_EVENTS_DATA *	PLSAP_POLICY_AUDIT_EVENTS_DATA
typedef struct _LSAP_LOGON_CONTEXT	LSAP_LOGON_CONTEXT
typedef struct _LSAP_LOGON_CONTEXT *	PLSAP_LOGON_CONTEXT
typedef struct _SAMPR_ULONG_ARRAY	SAMPR_ULONG_ARRAY
typedef struct _SAMPR_ULONG_ARRAY *	PSAMPR_ULONG_ARRAY

Enumerations
enum	_LSA_DB_OBJECT_TYPE {   LsaDbIgnoreObject , LsaDbPolicyObject , LsaDbAccountObject , LsaDbDomainObject ,   LsaDbSecretObject }

Functions
	WINE_DEFAULT_DEBUG_CHANNEL (lsasrv)
NTSTATUS	LsapInitAuthPackages (VOID)
NTSTATUS	LsapLookupAuthenticationPackage (PLSA_API_MSG RequestMsg, PLSAP_LOGON_CONTEXT LogonContext)
NTSTATUS	LsapCallAuthenticationPackage (PLSA_API_MSG RequestMsg, PLSAP_LOGON_CONTEXT LogonContext)
NTSTATUS	LsapLogonUser (PLSA_API_MSG RequestMsg, PLSAP_LOGON_CONTEXT LogonContext)
VOID	LsapTerminateLogon (_In_ PLUID LogonId)
NTSTATUS	StartAuthenticationPort (VOID)
NTSTATUS	LsapInitDatabase (VOID)
NTSTATUS	LsapCreateDbObject (IN PLSA_DB_OBJECT ParentObject, IN LPWSTR ContainerName, IN LPWSTR ObjectName, IN LSA_DB_OBJECT_TYPE HandleType, IN ACCESS_MASK DesiredAccess, IN BOOLEAN Trusted, OUT PLSA_DB_OBJECT *DbObject)
NTSTATUS	LsapOpenDbObject (IN PLSA_DB_OBJECT ParentObject, IN LPWSTR ContainerName, IN LPWSTR ObjectName, IN LSA_DB_OBJECT_TYPE ObjectType, IN ACCESS_MASK DesiredAccess, IN BOOLEAN Trusted, OUT PLSA_DB_OBJECT *DbObject)
NTSTATUS	LsapValidateDbObject (IN LSAPR_HANDLE Handle, IN LSA_DB_OBJECT_TYPE HandleType, IN ACCESS_MASK GrantedAccess, OUT PLSA_DB_OBJECT *DbObject)
NTSTATUS	LsapCloseDbObject (IN PLSA_DB_OBJECT DbObject)
NTSTATUS	LsapDeleteDbObject (IN PLSA_DB_OBJECT DbObject)
NTSTATUS	LsapGetObjectAttribute (PLSA_DB_OBJECT DbObject, LPWSTR AttributeName, LPVOID AttributeData, PULONG AttributeSize)
NTSTATUS	LsapSetObjectAttribute (PLSA_DB_OBJECT DbObject, LPWSTR AttributeName, LPVOID AttributeData, ULONG AttributeSize)
NTSTATUS	LsapDeleteObjectAttribute (PLSA_DB_OBJECT DbObject, LPWSTR AttributeName)
VOID	DsSetupInit (VOID)
NTSTATUS	LsapInitSids (VOID)
ULONG	LsapGetRelativeIdFromSid (PSID Sid)
NTSTATUS	LsapLookupNames (DWORD Count, PRPC_UNICODE_STRING Names, PLSAPR_REFERENCED_DOMAIN_LIST *ReferencedDomains, PLSAPR_TRANSLATED_SIDS_EX2 TranslatedSids, LSAP_LOOKUP_LEVEL LookupLevel, DWORD *MappedCount, DWORD LookupOptions, DWORD ClientRevision)
NTSTATUS	LsapLookupSids (PLSAPR_SID_ENUM_BUFFER SidEnumBuffer, PLSAPR_REFERENCED_DOMAIN_LIST *ReferencedDomains, PLSAPR_TRANSLATED_NAMES_EX TranslatedNames, LSAP_LOOKUP_LEVEL LookupLevel, DWORD *MappedCount, DWORD LookupOptions, DWORD ClientRevision)
NTSTATUS	LsarStartRpcServer (VOID)
VOID	LsapInitNotificationList (VOID)
NTSTATUS	LsapRegisterNotification (PLSA_API_MSG RequestMsg)
VOID	LsapNotifyPolicyChange (POLICY_NOTIFICATION_INFORMATION_CLASS InformationClass)
NTSTATUS	LsarQueryAuditLog (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryAuditEvents (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryPrimaryDomain (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryPdAccount (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryAccountDomain (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryServerRole (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryReplicaSource (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryDefaultQuota (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryModification (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryAuditFull (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryDnsDomain (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryDnsDomainInt (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarQueryLocalAccountDomain (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_INFORMATION *PolicyInformation)
NTSTATUS	LsarSetAuditLog (PLSA_DB_OBJECT PolicyObject, PPOLICY_AUDIT_LOG_INFO Info)
NTSTATUS	LsarSetAuditEvents (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_AUDIT_EVENTS_INFO Info)
NTSTATUS	LsarSetPrimaryDomain (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_PRIMARY_DOM_INFO Info)
NTSTATUS	LsarSetAccountDomain (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_ACCOUNT_DOM_INFO Info)
NTSTATUS	LsarSetServerRole (PLSA_DB_OBJECT PolicyObject, PPOLICY_LSA_SERVER_ROLE_INFO Info)
NTSTATUS	LsarSetReplicaSource (PLSA_DB_OBJECT PolicyObject, PPOLICY_LSA_REPLICA_SRCE_INFO Info)
NTSTATUS	LsarSetDefaultQuota (PLSA_DB_OBJECT PolicyObject, PPOLICY_DEFAULT_QUOTA_INFO Info)
NTSTATUS	LsarSetModification (PLSA_DB_OBJECT PolicyObject, PPOLICY_MODIFICATION_INFO Info)
NTSTATUS	LsarSetAuditFull (PLSA_DB_OBJECT PolicyObject, PPOLICY_AUDIT_FULL_QUERY_INFO Info)
NTSTATUS	LsarSetDnsDomain (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_DNS_DOMAIN_INFO Info)
NTSTATUS	LsarSetDnsDomainInt (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_DNS_DOMAIN_INFO Info)
NTSTATUS	LsarSetLocalAccountDomain (PLSA_DB_OBJECT PolicyObject, PLSAPR_POLICY_ACCOUNT_DOM_INFO Info)
NTSTATUS	LsarpLookupPrivilegeName (PLUID Value, PRPC_UNICODE_STRING *Name)
NTSTATUS	LsarpLookupPrivilegeDisplayName (PRPC_UNICODE_STRING Name, USHORT ClientLanguage, USHORT ClientSystemDefaultLanguage, PRPC_UNICODE_STRING *DisplayName, USHORT *LanguageReturned)
PLUID	LsarpLookupPrivilegeValue (IN PRPC_UNICODE_STRING Name)
NTSTATUS	LsarpEnumeratePrivileges (DWORD *EnumerationContext, PLSAPR_PRIVILEGE_ENUM_BUFFER EnumerationBuffer, DWORD PreferedMaximumLength)
NTSTATUS	LsapLookupAccountRightName (ULONG RightValue, PRPC_UNICODE_STRING *Name)
ACCESS_MASK	LsapLookupAccountRightValue (IN PRPC_UNICODE_STRING Name)
NTSTATUS	LsapRegCloseKey (IN HANDLE KeyHandle)
NTSTATUS	LsapRegCreateKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName, IN ACCESS_MASK DesiredAccess, OUT HANDLE KeyHandle)
NTSTATUS	LsapRegDeleteSubKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName)
NTSTATUS	LsapRegDeleteKey (IN HANDLE KeyHandle)
NTSTATUS	LsapRegEnumerateSubKey (IN HANDLE KeyHandle, IN ULONG Index, IN ULONG Length, OUT LPWSTR Buffer)
NTSTATUS	LsapRegOpenKey (IN HANDLE ParentKeyHandle, IN LPCWSTR KeyName, IN ACCESS_MASK DesiredAccess, OUT HANDLE KeyHandle)
NTSTATUS	LsapRegQueryKeyInfo (IN HANDLE KeyHandle, OUT PULONG SubKeyCount, OUT PULONG MaxSubKeyNameLength, OUT PULONG ValueCount)
NTSTATUS	LsapRegDeleteValue (IN HANDLE KeyHandle, IN LPWSTR ValueName)
NTSTATUS	LsapRegEnumerateValue (IN HANDLE KeyHandle, IN ULONG Index, OUT LPWSTR Name, IN OUT PULONG NameLength, OUT PULONG Type OPTIONAL, OUT PVOID Data OPTIONAL, IN OUT PULONG DataLength OPTIONAL)
NTSTATUS	LsapRegQueryValue (IN HANDLE KeyHandle, IN LPWSTR ValueName, OUT PULONG Type OPTIONAL, OUT LPVOID Data OPTIONAL, IN OUT PULONG DataLength OPTIONAL)
NTSTATUS	LsapRegSetValue (IN HANDLE KeyHandle, IN LPWSTR ValueName, IN ULONG Type, IN LPVOID Data, IN ULONG DataLength)
NTSTATUS	LsapCreatePolicySd (PSECURITY_DESCRIPTOR *PolicySd, PULONG PolicySdSize)
NTSTATUS	LsapCreateAccountSd (PSECURITY_DESCRIPTOR *AccountSd, PULONG AccountSdSize)
NTSTATUS	LsapCreateSecretSd (PSECURITY_DESCRIPTOR *SecretSd, PULONG SecretSdSize)
NTSTATUS	LsapCreateTokenSd (_In_ const TOKEN_USER *User, _Outptr_ PSECURITY_DESCRIPTOR *TokenSd, _Out_ PULONG TokenSdSize)
	Creates a security descriptor for the token object.
VOID	LsapInitLogonSessions (VOID)
NTSTATUS NTAPI	LsapCreateLogonSession (IN PLUID LogonId)
NTSTATUS NTAPI	LsapDeleteLogonSession (IN PLUID LogonId)
NTSTATUS NTAPI	LsapAddCredential (_In_ PLUID LogonId, _In_ ULONG AuthenticationPackage, _In_ PLSA_STRING PrimaryKeyValue, _In_ PLSA_STRING Credential)
NTSTATUS NTAPI	LsapGetCredentials (_In_ PLUID LogonId, _In_ ULONG AuthenticationPackage, _Inout_ PULONG QueryContext, _In_ BOOLEAN RetrieveAllCredentials, _Inout_ PLSA_STRING PrimaryKeyValue, _Out_ PULONG PrimaryKeyLength, _Out_ PLSA_STRING Credentials)
NTSTATUS NTAPI	LsapDeleteCredential (_In_ PLUID LogonId, _In_ ULONG AuthenticationPackage, _In_ PLSA_STRING PrimaryKeyValue)
NTSTATUS	LsapSetLogonSessionData (_In_ PLUID LogonId, _In_ ULONG LogonType, _In_ PUNICODE_STRING UserName, _In_ PUNICODE_STRING LogonDomain, _In_ PSID Sid)
NTSTATUS	LsapEnumLogonSessions (IN OUT PLSA_API_MSG RequestMsg)
NTSTATUS	LsapGetLogonSessionData (IN OUT PLSA_API_MSG RequestMsg)
NTSTATUS	LsapRmInitializeServer (VOID)
NTSTATUS	LsapRmCreateLogonSession (PLUID LogonId)
NTSTATUS	LsapRmDeleteLogonSession (PLUID LogonId)
INT	LsapLoadString (HINSTANCE hInstance, UINT uId, LPWSTR lpBuffer, INT nBufferMax)
INT	LsapGetResourceStringLengthEx (_In_ HINSTANCE hInstance, _In_ UINT uId, _In_ USHORT usLanguage)
INT	LsapLoadStringEx (_In_ HINSTANCE hInstance, _In_ UINT uId, _In_ USHORT usLanguage, _Out_ LPWSTR lpBuffer, _Out_ INT nBufferMax)
PSID	LsapAppendRidToSid (PSID SrcSid, ULONG Rid)

Variables
NT_PRODUCT_TYPE	LsapProductType
SID_IDENTIFIER_AUTHORITY	NullSidAuthority
SID_IDENTIFIER_AUTHORITY	WorldSidAuthority
SID_IDENTIFIER_AUTHORITY	LocalSidAuthority
SID_IDENTIFIER_AUTHORITY	CreatorSidAuthority
SID_IDENTIFIER_AUTHORITY	NtAuthority
PSID	BuiltinDomainSid
UNICODE_STRING	BuiltinDomainName
PSID	AccountDomainSid
UNICODE_STRING	AccountDomainName
PSID	LsapWorldSid
PSID	LsapNetworkSid
PSID	LsapBatchSid
PSID	LsapInteractiveSid
PSID	LsapServiceSid
PSID	LsapLocalSystemSid
PSID	LsapAdministratorsSid

Macro Definition Documentation

_INC_WINDOWS

#define _INC_WINDOWS

Definition at line 16 of file lsasrv.h.

COM_NO_WINDOWS_H

#define COM_NO_WINDOWS_H

Definition at line 17 of file lsasrv.h.

LSAP_DB_SIGNATURE

#define LSAP_DB_SIGNATURE   0x12345678

Definition at line 67 of file lsasrv.h.

NTOS_MODE_USER

#define NTOS_MODE_USER

Definition at line 23 of file lsasrv.h.

POLICY_AUDIT_EVENT_TYPE_COUNT

#define POLICY_AUDIT_EVENT_TYPE_COUNT   (AuditCategoryAccountLogon - AuditCategorySystem + 1)

Definition at line 69 of file lsasrv.h.

WIN32_NO_STATUS

#define WIN32_NO_STATUS

Definition at line 15 of file lsasrv.h.

Typedef Documentation

LSA_DB_OBJECT

typedef struct _LSA_DB_OBJECT LSA_DB_OBJECT

LSA_DB_OBJECT_TYPE

typedef enum _LSA_DB_OBJECT_TYPE LSA_DB_OBJECT_TYPE

LSAP_LOGON_CONTEXT

typedef struct _LSAP_LOGON_CONTEXT LSAP_LOGON_CONTEXT

LSAP_POLICY_AUDIT_EVENTS_DATA

typedef struct _LSAP_POLICY_AUDIT_EVENTS_DATA LSAP_POLICY_AUDIT_EVENTS_DATA

PLSA_DB_OBJECT

typedef struct _LSA_DB_OBJECT * PLSA_DB_OBJECT

PLSA_DB_OBJECT_TYPE

typedef enum _LSA_DB_OBJECT_TYPE * PLSA_DB_OBJECT_TYPE

PLSAP_LOGON_CONTEXT

typedef struct _LSAP_LOGON_CONTEXT * PLSAP_LOGON_CONTEXT

PLSAP_POLICY_AUDIT_EVENTS_DATA

typedef struct _LSAP_POLICY_AUDIT_EVENTS_DATA * PLSAP_POLICY_AUDIT_EVENTS_DATA

PSAMPR_ULONG_ARRAY

typedef struct _SAMPR_ULONG_ARRAY * PSAMPR_ULONG_ARRAY

SAMPR_ULONG_ARRAY

typedef struct _SAMPR_ULONG_ARRAY SAMPR_ULONG_ARRAY

Enumeration Type Documentation

_LSA_DB_OBJECT_TYPE

enum _LSA_DB_OBJECT_TYPE

Enumerator
LsaDbIgnoreObject
LsaDbPolicyObject
LsaDbAccountObject
LsaDbDomainObject
LsaDbSecretObject

Definition at line 47 of file lsasrv.h.

{
    LsaDbIgnoreObject,
    LsaDbPolicyObject,
    LsaDbAccountObject,
    LsaDbDomainObject,
    LsaDbSecretObject
} LSA_DB_OBJECT_TYPE, *PLSA_DB_OBJECT_TYPE;

Function Documentation

DsSetupInit()

VOID DsSetupInit

(

VOID

)

Definition at line 22 of file dssetup.c.

{
    RPC_STATUS Status;
 
    Status = RpcServerRegisterIf(dssetup_v0_0_s_ifspec,
                                 NULL,
                                 NULL);
    if (Status != RPC_S_OK)
    {
        WARN("RpcServerRegisterIf() failed (Status %lx)\n", Status);
        return;
    }
}

Referenced by LsarStartRpcServer().

LsapAddCredential()

NTSTATUS NTAPI LsapAddCredential	(	_In_ PLUID	LogonId,
		_In_ ULONG	AuthenticationPackage,
		_In_ PLSA_STRING	PrimaryKeyValue,
		_In_ PLSA_STRING	Credential
	)

Definition at line 259 of file session.c.

{
 
    return STATUS_SUCCESS;
}

Referenced by LsapInitAuthPackages().

LsapAppendRidToSid()

PSID LsapAppendRidToSid	(	PSID	SrcSid,
		ULONG	Rid
	)

Definition at line 152 of file utils.c.

{
    ULONG Rids[8] = {0, 0, 0, 0, 0, 0, 0, 0};
    UCHAR RidCount;
    PSID DstSid;
    ULONG i;
 
    RidCount = *RtlSubAuthorityCountSid(SrcSid);
    if (RidCount >= 8)
        return NULL;
 
    for (i = 0; i < RidCount; i++)
        Rids[i] = *RtlSubAuthoritySid(SrcSid, i);
 
    Rids[RidCount] = Rid;
    RidCount++;
 
    RtlAllocateAndInitializeSid(RtlIdentifierAuthoritySid(SrcSid),
                                RidCount,
                                Rids[0],
                                Rids[1],
                                Rids[2],
                                Rids[3],
                                Rids[4],
                                Rids[5],
                                Rids[6],
                                Rids[7],
                                &DstSid);
 
    return DstSid;
}

Referenced by LsapAppendSidToGroups().

LsapCallAuthenticationPackage()

NTSTATUS LsapCallAuthenticationPackage	(	PLSA_API_MSG	RequestMsg,
		PLSAP_LOGON_CONTEXT	LogonContext
	)

Definition at line 564 of file authpackage.c.

{
    PAUTH_PACKAGE Package;
    PVOID LocalBuffer = NULL;
    ULONG PackageId;
    NTSTATUS Status;
 
    TRACE("(%p %p)\n", RequestMsg, LogonContext);
 
    PackageId = RequestMsg->CallAuthenticationPackage.Request.AuthenticationPackage;
 
    /* Get the right authentication package */
    Package = LsapGetAuthenticationPackage(PackageId);
    if (Package == NULL)
    {
        TRACE("LsapGetAuthenticationPackage() failed to find a package\n");
        return STATUS_NO_SUCH_PACKAGE;
    }
 
    if (RequestMsg->CallAuthenticationPackage.Request.SubmitBufferLength > 0)
    {
        LocalBuffer = RtlAllocateHeap(RtlGetProcessHeap(),
                                      HEAP_ZERO_MEMORY,
                                      RequestMsg->CallAuthenticationPackage.Request.SubmitBufferLength);
        if (LocalBuffer == NULL)
        {
            return STATUS_INSUFFICIENT_RESOURCES;
        }
 
        Status = NtReadVirtualMemory(LogonContext->ClientProcessHandle,
                                     RequestMsg->CallAuthenticationPackage.Request.ProtocolSubmitBuffer,
                                     LocalBuffer,
                                     RequestMsg->CallAuthenticationPackage.Request.SubmitBufferLength,
                                     NULL);
        if (!NT_SUCCESS(Status))
        {
            TRACE("NtReadVirtualMemory() failed (Status 0x%08lx)\n", Status);
            RtlFreeHeap(RtlGetProcessHeap(), 0, LocalBuffer);
            return Status;
        }
    }
 
    if (LogonContext->TrustedCaller)
        Status = Package->LsaApCallPackage((PLSA_CLIENT_REQUEST)LogonContext,
                                           LocalBuffer,
                                           RequestMsg->CallAuthenticationPackage.Request.ProtocolSubmitBuffer,
                                           RequestMsg->CallAuthenticationPackage.Request.SubmitBufferLength,
                                           &RequestMsg->CallAuthenticationPackage.Reply.ProtocolReturnBuffer,
                                           &RequestMsg->CallAuthenticationPackage.Reply.ReturnBufferLength,
                                           &RequestMsg->CallAuthenticationPackage.Reply.ProtocolStatus);
    else
        Status = Package->LsaApCallPackageUntrusted((PLSA_CLIENT_REQUEST)LogonContext,
                                                    LocalBuffer,
                                                    RequestMsg->CallAuthenticationPackage.Request.ProtocolSubmitBuffer,
                                                    RequestMsg->CallAuthenticationPackage.Request.SubmitBufferLength,
                                                    &RequestMsg->CallAuthenticationPackage.Reply.ProtocolReturnBuffer,
                                                    &RequestMsg->CallAuthenticationPackage.Reply.ReturnBufferLength,
                                                    &RequestMsg->CallAuthenticationPackage.Reply.ProtocolStatus);
    if (!NT_SUCCESS(Status))
    {
        TRACE("Package->LsaApCallPackage() failed (Status 0x%08lx)\n", Status);
    }
 
    if (LocalBuffer != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalBuffer);
 
    return Status;
}

Referenced by AuthPortThreadRoutine().

LsapCloseDbObject()

NTSTATUS LsapCloseDbObject

(

IN PLSA_DB_OBJECT

DbObject

)

LsapCreateAccountSd()

NTSTATUS LsapCreateAccountSd	(	PSECURITY_DESCRIPTOR *	AccountSd,
		PULONG	AccountSdSize
	)

Definition at line 268 of file security.c.

{
    SECURITY_DESCRIPTOR AbsoluteSd;
    PSECURITY_DESCRIPTOR RelativeSd = NULL;
    ULONG RelativeSdSize = 0;
    PSID AdministratorsSid = NULL;
    PSID EveryoneSid = NULL;
    PSID LocalSystemSid = NULL;
    PACL Dacl = NULL;
    ULONG DaclSize;
    NTSTATUS Status;
 
    if (AccountSd == NULL || AccountSdSize == NULL)
        return STATUS_INVALID_PARAMETER;
 
    *AccountSd = NULL;
    *AccountSdSize = 0;
 
    /* Initialize the SD */
    Status = RtlCreateSecurityDescriptor(&AbsoluteSd,
                                         SECURITY_DESCRIPTOR_REVISION);
    if (!NT_SUCCESS(Status))
        return Status;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&WorldSidAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_LOCAL_SYSTEM_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &LocalSystemSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    /* Allocate and initialize the DACL */
    DaclSize = sizeof(ACL) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(AdministratorsSid) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(EveryoneSid);
 
    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    ACCOUNT_ALL_ACCESS,
                                    AdministratorsSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    ACCOUNT_EXECUTE,
                                    EveryoneSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetDaclSecurityDescriptor(&AbsoluteSd,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetGroupSecurityDescriptor(&AbsoluteSd,
                                           LocalSystemSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetOwnerSecurityDescriptor(&AbsoluteSd,
                                           AdministratorsSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAbsoluteToSelfRelativeSD(&AbsoluteSd,
                                         RelativeSd,
                                         &RelativeSdSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;
 
    RelativeSd = RtlAllocateHeap(RtlGetProcessHeap(),
                                 HEAP_ZERO_MEMORY,
                                 RelativeSdSize);
    if (RelativeSd == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    Status = RtlAbsoluteToSelfRelativeSD(&AbsoluteSd,
                                         RelativeSd,
                                         &RelativeSdSize);
    if (!NT_SUCCESS(Status))
        goto done;
 
    *AccountSd = RelativeSd;
    *AccountSdSize = RelativeSdSize;
 
done:
    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);
 
    if (AdministratorsSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AdministratorsSid);
 
    if (EveryoneSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, EveryoneSid);
 
    if (LocalSystemSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalSystemSid);
 
    if (!NT_SUCCESS(Status))
    {
        if (RelativeSd != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelativeSd);
    }
 
    return Status;
}

Referenced by LsarpCreateAccount().

LsapCreateDbObject()

NTSTATUS LsapCreateDbObject	(	IN PLSA_DB_OBJECT	ParentObject,
		IN LPWSTR	ContainerName,
		IN LPWSTR	ObjectName,
		IN LSA_DB_OBJECT_TYPE	HandleType,
		IN ACCESS_MASK	DesiredAccess,
		IN BOOLEAN	Trusted,
		OUT PLSA_DB_OBJECT *	DbObject
	)

Definition at line 592 of file database.c.

{
    PLSA_DB_OBJECT NewObject;
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING KeyName;
    HANDLE ParentKeyHandle;
    HANDLE ContainerKeyHandle = NULL;
    HANDLE ObjectKeyHandle = NULL;
    NTSTATUS Status;
 
    if (DbObject == NULL)
        return STATUS_INVALID_PARAMETER;
 
    if (ParentObject == NULL)
        ParentKeyHandle = SecurityKeyHandle;
    else
        ParentKeyHandle = ParentObject->KeyHandle;
 
    if (ContainerName != NULL)
    {
        /* Open the container key */
        RtlInitUnicodeString(&KeyName,
                             ContainerName);
 
        InitializeObjectAttributes(&ObjectAttributes,
                                   &KeyName,
                                   OBJ_CASE_INSENSITIVE,
                                   ParentKeyHandle,
                                   NULL);
 
        Status = NtOpenKey(&ContainerKeyHandle,
                           KEY_ALL_ACCESS,
                           &ObjectAttributes);
        if (!NT_SUCCESS(Status))
        {
            return Status;
        }
 
        /* Open the object key */
        RtlInitUnicodeString(&KeyName,
                             ObjectName);
 
        InitializeObjectAttributes(&ObjectAttributes,
                                   &KeyName,
                                   OBJ_CASE_INSENSITIVE,
                                   ContainerKeyHandle,
                                   NULL);
 
        Status = NtCreateKey(&ObjectKeyHandle,
                             KEY_ALL_ACCESS,
                             &ObjectAttributes,
                             0,
                             NULL,
                             0,
                             NULL);
 
        NtClose(ContainerKeyHandle);
 
        if (!NT_SUCCESS(Status))
        {
            return Status;
        }
    }
    else
    {
        RtlInitUnicodeString(&KeyName,
                             ObjectName);
 
        InitializeObjectAttributes(&ObjectAttributes,
                                   &KeyName,
                                   OBJ_CASE_INSENSITIVE,
                                   ParentKeyHandle,
                                   NULL);
 
        Status = NtCreateKey(&ObjectKeyHandle,
                             KEY_ALL_ACCESS,
                             &ObjectAttributes,
                             0,
                             NULL,
                             0,
                             NULL);
        if (!NT_SUCCESS(Status))
        {
            return Status;
        }
    }
 
    NewObject = RtlAllocateHeap(RtlGetProcessHeap(),
                                0,
                                sizeof(LSA_DB_OBJECT));
    if (NewObject == NULL)
    {
        NtClose(ObjectKeyHandle);
        return STATUS_NO_MEMORY;
    }
 
    NewObject->Signature = LSAP_DB_SIGNATURE;
    NewObject->RefCount = 1;
    NewObject->ObjectType = ObjectType;
    NewObject->Access = DesiredAccess;
    NewObject->KeyHandle = ObjectKeyHandle;
    NewObject->ParentObject = ParentObject;
    NewObject->Trusted = Trusted;
 
    if (ParentObject != NULL)
        ParentObject->RefCount++;
 
    *DbObject = NewObject;
 
    return STATUS_SUCCESS;
}

Referenced by LsarCreateSecret(), LsarpCreateAccount(), and LsarStorePrivateData().

LsapCreateLogonSession()

NTSTATUS NTAPI LsapCreateLogonSession

(

IN PLUID

LogonId

)

Definition at line 159 of file session.c.

{
    PLSAP_LOGON_SESSION Session;
    NTSTATUS Status;
 
    TRACE("LsapCreateLogonSession(%p)\n", LogonId);
 
    /* Fail, if a session already exists */
    if (LsapGetLogonSession(LogonId) != NULL)
        return STATUS_LOGON_SESSION_COLLISION;
 
    /* Allocate a new session entry */
    Session = RtlAllocateHeap(RtlGetProcessHeap(),
                              HEAP_ZERO_MEMORY,
                              sizeof(LSAP_LOGON_SESSION));
    if (Session == NULL)
        return STATUS_INSUFFICIENT_RESOURCES;
 
    /* Initialize the session entry */
    RtlCopyLuid(&Session->LogonId, LogonId);
 
    TRACE("LsapCreateLogonSession(<0x%lx,0x%lx>)\n",
          LogonId->HighPart, LogonId->LowPart);
 
    /* Tell ntoskrnl to create a new logon session */
    Status = LsapRmCreateLogonSession(LogonId);
    if (!NT_SUCCESS(Status))
    {
        RtlFreeHeap(RtlGetProcessHeap(), 0, Session);
        return Status;
    }
 
    /* Insert the new session into the session list */
    InsertHeadList(&SessionListHead, &Session->Entry);
    SessionCount++;
 
    return STATUS_SUCCESS;
}

Referenced by LsapInitAuthPackages().

LsapCreatePolicySd()

NTSTATUS LsapCreatePolicySd	(	PSECURITY_DESCRIPTOR *	PolicySd,
		PULONG	PolicySdSize
	)

Definition at line 14 of file security.c.

{
    SECURITY_DESCRIPTOR AbsoluteSd;
    PSECURITY_DESCRIPTOR RelativeSd = NULL;
    ULONG RelativeSdSize = 0;
    PSID AnonymousSid = NULL;
    PSID AdministratorsSid = NULL;
    PSID EveryoneSid = NULL;
    PSID LocalServiceSid = NULL;
    PSID NetworkServiceSid = NULL;
    PSID LocalSystemSid = NULL;
    PACL Dacl = NULL;
    ULONG DaclSize;
    NTSTATUS Status;
 
    if (PolicySd == NULL || PolicySdSize == NULL)
        return STATUS_INVALID_PARAMETER;
 
    *PolicySd = NULL;
    *PolicySdSize = 0;
 
    /* Initialize the SD */
    Status = RtlCreateSecurityDescriptor(&AbsoluteSd,
                                         SECURITY_DESCRIPTOR_REVISION);
    if (!NT_SUCCESS(Status))
        return Status;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_ANONYMOUS_LOGON_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AnonymousSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&WorldSidAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_LOCAL_SERVICE_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &LocalServiceSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_NETWORK_SERVICE_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &NetworkServiceSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_LOCAL_SYSTEM_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &LocalSystemSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    /* Allocate and initialize the DACL */
    DaclSize = sizeof(ACL) +
               sizeof(ACCESS_DENIED_ACE)  - sizeof(ULONG) + RtlLengthSid(AnonymousSid) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(AdministratorsSid) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(EveryoneSid) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(AnonymousSid) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(LocalServiceSid) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(NetworkServiceSid);
 
    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessDeniedAce(Dacl,
                                   ACL_REVISION,
                                   POLICY_LOOKUP_NAMES,
                                   AnonymousSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    POLICY_ALL_ACCESS | POLICY_NOTIFICATION,
                                    AdministratorsSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    POLICY_EXECUTE,
                                    EveryoneSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    POLICY_LOOKUP_NAMES | POLICY_VIEW_LOCAL_INFORMATION,
                                    AnonymousSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    POLICY_NOTIFICATION,
                                    LocalServiceSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    POLICY_NOTIFICATION,
                                    NetworkServiceSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetDaclSecurityDescriptor(&AbsoluteSd,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetGroupSecurityDescriptor(&AbsoluteSd,
                                           LocalSystemSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetOwnerSecurityDescriptor(&AbsoluteSd,
                                           AdministratorsSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAbsoluteToSelfRelativeSD(&AbsoluteSd,
                                         RelativeSd,
                                         &RelativeSdSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;
 
    RelativeSd = RtlAllocateHeap(RtlGetProcessHeap(),
                                 HEAP_ZERO_MEMORY,
                                 RelativeSdSize);
    if (RelativeSd == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    Status = RtlAbsoluteToSelfRelativeSD(&AbsoluteSd,
                                         RelativeSd,
                                         &RelativeSdSize);
    if (!NT_SUCCESS(Status))
        goto done;
 
    *PolicySd = RelativeSd;
    *PolicySdSize = RelativeSdSize;
 
done:
    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);
 
    if (AnonymousSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AnonymousSid);
 
    if (AdministratorsSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AdministratorsSid);
 
    if (EveryoneSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, EveryoneSid);
 
    if (LocalServiceSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalServiceSid);
 
    if (NetworkServiceSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, NetworkServiceSid);
 
    if (LocalSystemSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalSystemSid);
 
    if (!NT_SUCCESS(Status))
    {
        if (RelativeSd != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelativeSd);
    }
 
    return Status;
}

Referenced by LsapCreateDatabaseObjects().

LsapCreateSecretSd()

NTSTATUS LsapCreateSecretSd	(	PSECURITY_DESCRIPTOR *	SecretSd,
		PULONG	SecretSdSize
	)

Definition at line 436 of file security.c.

{
    SECURITY_DESCRIPTOR AbsoluteSd;
    PSECURITY_DESCRIPTOR RelativeSd = NULL;
    ULONG RelativeSdSize = 0;
    PSID AdministratorsSid = NULL;
    PSID EveryoneSid = NULL;
    PSID LocalSystemSid = NULL;
    PACL Dacl = NULL;
    ULONG DaclSize;
    NTSTATUS Status;
 
    if (SecretSd == NULL || SecretSdSize == NULL)
        return STATUS_INVALID_PARAMETER;
 
    *SecretSd = NULL;
    *SecretSdSize = 0;
 
    /* Initialize the SD */
    Status = RtlCreateSecurityDescriptor(&AbsoluteSd,
                                         SECURITY_DESCRIPTOR_REVISION);
    if (!NT_SUCCESS(Status))
        return Status;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &AdministratorsSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&WorldSidAuthority,
                                         1,
                                         SECURITY_WORLD_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &EveryoneSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_LOCAL_SYSTEM_RID,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         0,
                                         &LocalSystemSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    /* Allocate and initialize the DACL */
    DaclSize = sizeof(ACL) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(AdministratorsSid) +
               sizeof(ACCESS_ALLOWED_ACE) - sizeof(ULONG) + RtlLengthSid(EveryoneSid);
 
    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    SECRET_ALL_ACCESS,
                                    AdministratorsSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    SECRET_EXECUTE,
                                    EveryoneSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetDaclSecurityDescriptor(&AbsoluteSd,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetGroupSecurityDescriptor(&AbsoluteSd,
                                           LocalSystemSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetOwnerSecurityDescriptor(&AbsoluteSd,
                                           AdministratorsSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAbsoluteToSelfRelativeSD(&AbsoluteSd,
                                         RelativeSd,
                                         &RelativeSdSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;
 
    RelativeSd = RtlAllocateHeap(RtlGetProcessHeap(),
                                 HEAP_ZERO_MEMORY,
                                 RelativeSdSize);
    if (RelativeSd == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    Status = RtlAbsoluteToSelfRelativeSD(&AbsoluteSd,
                                         RelativeSd,
                                         &RelativeSdSize);
    if (!NT_SUCCESS(Status))
        goto done;
 
    *SecretSd = RelativeSd;
    *SecretSdSize = RelativeSdSize;
 
done:
    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);
 
    if (AdministratorsSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AdministratorsSid);
 
    if (EveryoneSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, EveryoneSid);
 
    if (LocalSystemSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalSystemSid);
 
    if (!NT_SUCCESS(Status))
    {
        if (RelativeSd != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelativeSd);
    }
 
    return Status;
}

Referenced by LsarCreateSecret().

LsapCreateTokenSd()

NTSTATUS LsapCreateTokenSd	(	_In_ const TOKEN_USER *	User,
		_Outptr_ PSECURITY_DESCRIPTOR *	TokenSd,
		_Out_ PULONG	TokenSdSize
	)

Creates a security descriptor for the token object.

Parameters

[in]	User	A primary user to be given to the function. This user represents the owner that is in charge of this object.
[out]	TokenSd	A pointer to an allocated security descriptor for the token object.
[out]	TokenSdSize	A pointer to a returned size of the descriptor.

Returns

STATUS_SUCCESS is returned if the function has successfully created the security descriptor. STATUS_INVALID_PARAMETER is returned if one of the parameters are not valid. STATUS_INSUFFICIENT_RESOURCES is returned if memory heap allocation for specific security buffers couldn't be done. A NTSTATUS status code is returned otherwise.

Remarks

Bot the local system and user are given full access rights for the token (they can open it, read and write into it, etc.) whereas admins can only read from the token. This security descriptor is TO NOT BE confused with the default DACL of the token which is another thing that serves different purpose.

Definition at line 637 of file security.c.

{
    SECURITY_DESCRIPTOR AbsoluteSd;
    PSECURITY_DESCRIPTOR RelativeSd = NULL;
    ULONG RelativeSdSize = 0;
    PSID AdministratorsSid = NULL;
    PSID LocalSystemSid = NULL;
    PACL Dacl = NULL;
    ULONG DaclSize;
    NTSTATUS Status;
 
    if (TokenSd == NULL || TokenSdSize == NULL)
        return STATUS_INVALID_PARAMETER;
 
    *TokenSd = NULL;
    *TokenSdSize = 0;
 
    /* Initialize the SD */
    Status = RtlCreateSecurityDescriptor(&AbsoluteSd,
                                         SECURITY_DESCRIPTOR_REVISION);
    if (!NT_SUCCESS(Status))
        return Status;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         1,
                                         SECURITY_LOCAL_SYSTEM_RID,
                                         0, 0, 0, 0, 0, 0, 0,
                                         &LocalSystemSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAllocateAndInitializeSid(&NtAuthority,
                                         2,
                                         SECURITY_BUILTIN_DOMAIN_RID,
                                         DOMAIN_ALIAS_RID_ADMINS,
                                         0, 0, 0, 0, 0, 0,
                                         &AdministratorsSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    /* Allocate and initialize the DACL */
    DaclSize = sizeof(ACL) +
               sizeof(ACCESS_ALLOWED_ACE) + RtlLengthSid(LocalSystemSid) +
               sizeof(ACCESS_ALLOWED_ACE) + RtlLengthSid(AdministratorsSid) +
               sizeof(ACCESS_ALLOWED_ACE) + RtlLengthSid(User->User.Sid);
 
    Dacl = RtlAllocateHeap(RtlGetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           DaclSize);
    if (Dacl == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    Status = RtlCreateAcl(Dacl,
                          DaclSize,
                          ACL_REVISION);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    TOKEN_ALL_ACCESS,
                                    LocalSystemSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    TOKEN_READ,
                                    AdministratorsSid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAddAccessAllowedAce(Dacl,
                                    ACL_REVISION,
                                    TOKEN_ALL_ACCESS,
                                    User->User.Sid);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetDaclSecurityDescriptor(&AbsoluteSd,
                                          TRUE,
                                          Dacl,
                                          FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlSetOwnerSecurityDescriptor(&AbsoluteSd,
                                           AdministratorsSid,
                                           FALSE);
    if (!NT_SUCCESS(Status))
        goto done;
 
    Status = RtlAbsoluteToSelfRelativeSD(&AbsoluteSd,
                                         RelativeSd,
                                         &RelativeSdSize);
    if (Status != STATUS_BUFFER_TOO_SMALL)
        goto done;
 
    RelativeSd = RtlAllocateHeap(RtlGetProcessHeap(),
                                 HEAP_ZERO_MEMORY,
                                 RelativeSdSize);
    if (RelativeSd == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    Status = RtlAbsoluteToSelfRelativeSD(&AbsoluteSd,
                                         RelativeSd,
                                         &RelativeSdSize);
    if (!NT_SUCCESS(Status))
        goto done;
 
    *TokenSd = RelativeSd;
    *TokenSdSize = RelativeSdSize;
 
done:
    if (Dacl != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Dacl);
 
    if (AdministratorsSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, AdministratorsSid);
 
    if (LocalSystemSid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalSystemSid);
 
    if (!NT_SUCCESS(Status))
    {
        if (RelativeSd != NULL)
            RtlFreeHeap(RtlGetProcessHeap(), 0, RelativeSd);
    }
 
    return Status;
}

Referenced by LsapLogonUser().

LsapDeleteCredential()

NTSTATUS NTAPI LsapDeleteCredential	(	_In_ PLUID	LogonId,
		_In_ ULONG	AuthenticationPackage,
		_In_ PLSA_STRING	PrimaryKeyValue
	)

Definition at line 288 of file session.c.

{
 
    return STATUS_SUCCESS;
}

Referenced by LsapInitAuthPackages().

LsapDeleteDbObject()

NTSTATUS LsapDeleteDbObject

(

IN PLSA_DB_OBJECT

DbObject

)

Definition at line 901 of file database.c.

{
    PLSA_DB_OBJECT ParentObject = NULL;
    WCHAR KeyName[64];
    ULONG Index;
    NTSTATUS Status = STATUS_SUCCESS;
 
    DbObject->RefCount--;
 
    if (DbObject->RefCount > 0)
        return STATUS_SUCCESS;
 
    if (DbObject->KeyHandle != NULL)
    {
        Index = 0;
 
        while (TRUE)
        {
            Status = LsapRegEnumerateSubKey(DbObject->KeyHandle,
                                            Index,
                                            sizeof(KeyName),
                                            KeyName);
            if (!NT_SUCCESS(Status))
                break;
 
            TRACE("Index: %lu\n", Index);
            TRACE("Key name: %S\n", KeyName);
 
            Status = LsapRegDeleteSubKey(DbObject->KeyHandle,
                                         KeyName);
            if (!NT_SUCCESS(Status))
                break;
        }
 
        if (Status == STATUS_NO_MORE_ENTRIES)
            Status = STATUS_SUCCESS;
 
        LsapRegDeleteKey(DbObject->KeyHandle);
 
        NtClose(DbObject->KeyHandle);
    }
 
    if (DbObject->ParentObject != NULL)
        ParentObject = DbObject->ParentObject;
 
    RtlFreeHeap(RtlGetProcessHeap(), 0, DbObject);
 
    if (ParentObject != NULL)
    {
        ParentObject->RefCount--;
 
        if (ParentObject->RefCount == 0)
            Status = LsapCloseDbObject(ParentObject);
    }
 
    return Status;
}

Referenced by LsarDeleteObject(), and LsarStorePrivateData().

LsapDeleteLogonSession()

NTSTATUS NTAPI LsapDeleteLogonSession

(

IN PLUID

LogonId

)

Definition at line 201 of file session.c.

{
    PLSAP_LOGON_SESSION Session;
    NTSTATUS Status;
 
    TRACE("LsapDeleteLogonSession(%p)\n", LogonId);
 
    /* Fail, if the session does not exist */
    Session = LsapGetLogonSession(LogonId);
    if (Session == NULL)
        return STATUS_NO_SUCH_LOGON_SESSION;
 
    TRACE("LsapDeleteLogonSession(0x%08lx%08lx)\n",
          LogonId->HighPart, LogonId->LowPart);
 
    /* Tell ntoskrnl to delete the logon session */
    Status = LsapRmDeleteLogonSession(LogonId);
    if (!NT_SUCCESS(Status))
        return Status;
 
    /* Notify the authentication packages */
    LsapTerminateLogon(LogonId);
 
    /* Remove the session entry from the list */
    RemoveEntryList(&Session->Entry);
    SessionCount--;
 
    /* Free the session data */
    if (Session->Sid != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Session->Sid);
 
    if (Session->UserName.Buffer != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Session->UserName.Buffer);
 
    if (Session->LogonDomain.Buffer != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Session->LogonDomain.Buffer);
 
    if (Session->AuthenticationPackage.Buffer != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Session->AuthenticationPackage.Buffer);
 
    if (Session->LogonServer.Buffer != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Session->LogonServer.Buffer);
 
    if (Session->DnsDomainName.Buffer != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Session->DnsDomainName.Buffer);
 
    if (Session->Upn.Buffer != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, Session->Upn.Buffer);
 
    /* Free the session entry */
    RtlFreeHeap(RtlGetProcessHeap(), 0, Session);
 
    return STATUS_SUCCESS;
}

Referenced by LsapInitAuthPackages(), and LsapLogonUser().

LsapDeleteObjectAttribute()

NTSTATUS LsapDeleteObjectAttribute	(	PLSA_DB_OBJECT	DbObject,
		LPWSTR	AttributeName
	)

Definition at line 1082 of file database.c.

{
    return LsapRegDeleteSubKey(DbObject->KeyHandle,
                               AttributeName);
}

Referenced by LsarRemovePrivilegesFromAccount().

LsapEnumLogonSessions()

NTSTATUS LsapEnumLogonSessions

(

IN OUT PLSA_API_MSG

RequestMsg

)

Definition at line 299 of file session.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    HANDLE ProcessHandle = NULL;
    PLIST_ENTRY SessionEntry;
    PLSAP_LOGON_SESSION CurrentSession;
    PLUID SessionList;
    ULONG i, Length;
    SIZE_T MemSize;
    PVOID ClientBaseAddress = NULL;
    NTSTATUS Status;
 
    TRACE("LsapEnumLogonSessions(%p)\n", RequestMsg);
 
    Length = SessionCount * sizeof(LUID);
    SessionList = RtlAllocateHeap(RtlGetProcessHeap(),
                                  HEAP_ZERO_MEMORY,
                                  Length);
    if (SessionList == NULL)
        return STATUS_INSUFFICIENT_RESOURCES;
 
    i = 0;
    SessionEntry = SessionListHead.Flink;
    while (SessionEntry != &SessionListHead)
    {
        CurrentSession = CONTAINING_RECORD(SessionEntry,
                                           LSAP_LOGON_SESSION,
                                           Entry);
 
        RtlCopyLuid(&SessionList[i],
                    &CurrentSession->LogonId);
 
        SessionEntry = SessionEntry->Flink;
        i++;
    }
 
    InitializeObjectAttributes(&ObjectAttributes,
                               NULL,
                               0,
                               NULL,
                               NULL);
 
    Status = NtOpenProcess(&ProcessHandle,
                           PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION,
                           &ObjectAttributes,
                           &RequestMsg->h.ClientId);
    if (!NT_SUCCESS(Status))
    {
        TRACE("NtOpenProcess() failed (Status %lx)\n", Status);
        goto done;
    }
 
    TRACE("Length: %lu\n", Length);
 
    MemSize = Length;
    Status = NtAllocateVirtualMemory(ProcessHandle,
                                     &ClientBaseAddress,
                                     0,
                                     &MemSize,
                                     MEM_COMMIT,
                                     PAGE_READWRITE);
    if (!NT_SUCCESS(Status))
    {
        TRACE("NtAllocateVirtualMemory() failed (Status %lx)\n", Status);
        goto done;
    }
 
    TRACE("MemSize: %lu\n", MemSize);
    TRACE("ClientBaseAddress: %p\n", ClientBaseAddress);
 
    Status = NtWriteVirtualMemory(ProcessHandle,
                                  ClientBaseAddress,
                                  SessionList,
                                  Length,
                                  NULL);
    if (!NT_SUCCESS(Status))
    {
        TRACE("NtWriteVirtualMemory() failed (Status %lx)\n", Status);
        goto done;
    }
 
    RequestMsg->EnumLogonSessions.Reply.LogonSessionCount = SessionCount;
    RequestMsg->EnumLogonSessions.Reply.LogonSessionBuffer = ClientBaseAddress;
 
done:
    if (ProcessHandle != NULL)
        NtClose(ProcessHandle);
 
    if (SessionList != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, SessionList);
 
    return Status;
}

Referenced by AuthPortThreadRoutine().

LsapGetCredentials()

NTSTATUS NTAPI LsapGetCredentials	(	_In_ PLUID	LogonId,
		_In_ ULONG	AuthenticationPackage,
		_Inout_ PULONG	QueryContext,
		_In_ BOOLEAN	RetrieveAllCredentials,
		_Inout_ PLSA_STRING	PrimaryKeyValue,
		_Out_ PULONG	PrimaryKeyLength,
		_Out_ PLSA_STRING	Credentials
	)

Definition at line 272 of file session.c.

{
 
    return STATUS_SUCCESS;
}

Referenced by LsapInitAuthPackages().

LsapGetLogonSessionData()

NTSTATUS LsapGetLogonSessionData

(

IN OUT PLSA_API_MSG

RequestMsg

)

Definition at line 395 of file session.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    HANDLE ProcessHandle = NULL;
    PLSAP_LOGON_SESSION Session;
    PSECURITY_LOGON_SESSION_DATA LocalSessionData;
    PVOID ClientBaseAddress = NULL;
    ULONG TotalLength, SidLength = 0;
    SIZE_T MemSize;
    PUCHAR Ptr;
    NTSTATUS Status;
 
    TRACE("LsapGetLogonSessionData(%p)\n", RequestMsg);
 
    TRACE("LogonId: %lx\n", RequestMsg->GetLogonSessionData.Request.LogonId.LowPart);
    Session = LsapGetLogonSession(&RequestMsg->GetLogonSessionData.Request.LogonId);
    if (Session == NULL)
        return STATUS_NO_SUCH_LOGON_SESSION;
 
    /* Calculate the required buffer size */
    TotalLength = sizeof(SECURITY_LOGON_SESSION_DATA) +
                  Session->UserName.MaximumLength +
                  Session->LogonDomain.MaximumLength +
                  Session->AuthenticationPackage.MaximumLength +
                  Session->LogonServer.MaximumLength +
                  Session->DnsDomainName.MaximumLength +
                  Session->Upn.MaximumLength;
    if (Session->Sid != NULL)
    {
        SidLength = RtlLengthSid(Session->Sid);
        TotalLength += SidLength;
    }
    TRACE("TotalLength: %lu\n", TotalLength);
 
    /* Allocate the buffer */
    LocalSessionData = RtlAllocateHeap(RtlGetProcessHeap(),
                                       HEAP_ZERO_MEMORY,
                                       TotalLength);
    if (LocalSessionData == NULL)
        return STATUS_INSUFFICIENT_RESOURCES;
 
    Ptr = (PUCHAR)((ULONG_PTR)LocalSessionData + sizeof(SECURITY_LOGON_SESSION_DATA));
    TRACE("LocalSessionData: %p  Ptr: %p\n", LocalSessionData, Ptr);
 
    LocalSessionData->Size = sizeof(SECURITY_LOGON_SESSION_DATA);
 
    /* Copy the LogonId */
    RtlCopyLuid(&LocalSessionData->LogonId,
                &RequestMsg->GetLogonSessionData.Request.LogonId);
 
    /* Copy the UserName string */
    LocalSessionData->UserName.Length = Session->UserName.Length;
    LocalSessionData->UserName.MaximumLength = Session->UserName.MaximumLength;
    if (Session->UserName.MaximumLength != 0)
    {
        RtlCopyMemory(Ptr, Session->UserName.Buffer, Session->UserName.MaximumLength);
        LocalSessionData->UserName.Buffer = (PWSTR)((ULONG_PTR)Ptr - (ULONG_PTR)LocalSessionData);
 
        Ptr = (PUCHAR)((ULONG_PTR)Ptr + Session->UserName.MaximumLength);
    }
 
    /* Copy the LogonDomain string */
    LocalSessionData->LogonDomain.Length = Session->LogonDomain.Length;
    LocalSessionData->LogonDomain.MaximumLength = Session->LogonDomain.MaximumLength;
    if (Session->LogonDomain.MaximumLength != 0)
    {
        RtlCopyMemory(Ptr, Session->LogonDomain.Buffer, Session->LogonDomain.MaximumLength);
        LocalSessionData->LogonDomain.Buffer = (PWSTR)((ULONG_PTR)Ptr - (ULONG_PTR)LocalSessionData);
 
        Ptr = (PUCHAR)((ULONG_PTR)Ptr + Session->LogonDomain.MaximumLength);
    }
 
    /* Copy the AuthenticationPackage string */
    LocalSessionData->AuthenticationPackage.Length = Session->AuthenticationPackage.Length;
    LocalSessionData->AuthenticationPackage.MaximumLength = Session->AuthenticationPackage.MaximumLength;
    if (Session->AuthenticationPackage.MaximumLength != 0)
    {
        RtlCopyMemory(Ptr, Session->AuthenticationPackage.Buffer, Session->AuthenticationPackage.MaximumLength);
        LocalSessionData->AuthenticationPackage.Buffer = (PWSTR)((ULONG_PTR)Ptr - (ULONG_PTR)LocalSessionData);
 
        Ptr = (PUCHAR)((ULONG_PTR)Ptr + Session->AuthenticationPackage.MaximumLength);
    }
 
    LocalSessionData->LogonType = Session->LogonType;
    LocalSessionData->Session = 0;
 
    /* Sid */
    if (Session->Sid != NULL)
    {
        RtlCopyMemory(Ptr, Session->Sid, SidLength);
        LocalSessionData->Sid = (PSID)((ULONG_PTR)Ptr - (ULONG_PTR)LocalSessionData);
 
        Ptr = (PUCHAR)((ULONG_PTR)Ptr + SidLength);
    }
 
    /* LogonTime */
    LocalSessionData->LogonTime.QuadPart = Session->LogonTime.QuadPart;
 
    /* Copy the LogonServer string */
    LocalSessionData->LogonServer.Length = Session->LogonServer.Length;
    LocalSessionData->LogonServer.MaximumLength = Session->LogonServer.MaximumLength;
    if (Session->LogonServer.MaximumLength != 0)
    {
        RtlCopyMemory(Ptr, Session->LogonServer.Buffer, Session->LogonServer.MaximumLength);
        LocalSessionData->LogonServer.Buffer = (PWSTR)((ULONG_PTR)Ptr - (ULONG_PTR)LocalSessionData);
 
        Ptr = (PUCHAR)((ULONG_PTR)Ptr + Session->LogonServer.MaximumLength);
    }
 
    /* Copy the DnsDomainName string */
    LocalSessionData->DnsDomainName.Length = Session->DnsDomainName.Length;
    LocalSessionData->DnsDomainName.MaximumLength = Session->DnsDomainName.MaximumLength;
    if (Session->DnsDomainName.MaximumLength != 0)
    {
        RtlCopyMemory(Ptr, Session->DnsDomainName.Buffer, Session->DnsDomainName.MaximumLength);
        LocalSessionData->DnsDomainName.Buffer = (PWSTR)((ULONG_PTR)Ptr - (ULONG_PTR)LocalSessionData);
 
        Ptr = (PUCHAR)((ULONG_PTR)Ptr + Session->DnsDomainName.MaximumLength);
    }
 
    /* Copy the Upn string */
    LocalSessionData->Upn.Length = Session->Upn.Length;
    LocalSessionData->Upn.MaximumLength = Session->Upn.MaximumLength;
    if (Session->Upn.MaximumLength != 0)
    {
        RtlCopyMemory(Ptr, Session->Upn.Buffer, Session->Upn.MaximumLength);
        LocalSessionData->Upn.Buffer = (PWSTR)((ULONG_PTR)Ptr - (ULONG_PTR)LocalSessionData);
 
        Ptr = (PUCHAR)((ULONG_PTR)Ptr + Session->Upn.MaximumLength);
    }
 
    InitializeObjectAttributes(&ObjectAttributes,
                               NULL,
                               0,
                               NULL,
                               NULL);
 
    Status = NtOpenProcess(&ProcessHandle,
                           PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION,
                           &ObjectAttributes,
                           &RequestMsg->h.ClientId);
    if (!NT_SUCCESS(Status))
    {
        TRACE("NtOpenProcess() failed (Status %lx)\n", Status);
        goto done;
    }
 
    MemSize = TotalLength;
    Status = NtAllocateVirtualMemory(ProcessHandle,
                                     &ClientBaseAddress,
                                     0,
                                     &MemSize,
                                     MEM_COMMIT,
                                     PAGE_READWRITE);
    if (!NT_SUCCESS(Status))
    {
        TRACE("NtAllocateVirtualMemory() failed (Status %lx)\n", Status);
        goto done;
    }
 
    TRACE("MemSize: %lu\n", MemSize);
    TRACE("ClientBaseAddress: %p\n", ClientBaseAddress);
 
    Status = NtWriteVirtualMemory(ProcessHandle,
                                  ClientBaseAddress,
                                  LocalSessionData,
                                  TotalLength,
                                  NULL);
    if (!NT_SUCCESS(Status))
    {
        TRACE("NtWriteVirtualMemory() failed (Status %lx)\n", Status);
        goto done;
    }
 
    RequestMsg->GetLogonSessionData.Reply.SessionDataBuffer = ClientBaseAddress;
 
done:
    if (ProcessHandle != NULL)
        NtClose(ProcessHandle);
 
    if (LocalSessionData != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalSessionData);
 
    return Status;
}

Referenced by AuthPortThreadRoutine().

LsapGetObjectAttribute()

NTSTATUS LsapGetObjectAttribute	(	PLSA_DB_OBJECT	DbObject,
		LPWSTR	AttributeName,
		LPVOID	AttributeData,
		PULONG	AttributeSize
	)

Definition at line 1012 of file database.c.

{
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING KeyName;
    HANDLE AttributeKey;
    ULONG ValueSize;
    NTSTATUS Status;
 
    RtlInitUnicodeString(&KeyName,
                         AttributeName);
 
    InitializeObjectAttributes(&ObjectAttributes,
                               &KeyName,
                               OBJ_CASE_INSENSITIVE,
                               DbObject->KeyHandle,
                               NULL);
 
    Status = NtOpenKey(&AttributeKey,
                       KEY_QUERY_VALUE,
                       &ObjectAttributes);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    ValueSize = *AttributeSize;
    Status = RtlpNtQueryValueKey(AttributeKey,
                                 NULL,
                                 NULL,
                                 &ValueSize,
                                 0);
    if (!NT_SUCCESS(Status) && Status != STATUS_BUFFER_OVERFLOW)
    {
        goto Done;
    }
 
    if (AttributeData == NULL || *AttributeSize == 0)
    {
        *AttributeSize = ValueSize;
        Status = STATUS_SUCCESS;
        goto Done;
    }
    else if (*AttributeSize < ValueSize)
    {
        *AttributeSize = ValueSize;
        Status = STATUS_BUFFER_OVERFLOW;
        goto Done;
    }
 
    Status = RtlpNtQueryValueKey(AttributeKey,
                                 NULL,
                                 AttributeData,
                                 &ValueSize,
                                 0);
    if (NT_SUCCESS(Status))
    {
        *AttributeSize = ValueSize;
    }
 
Done:
    NtClose(AttributeKey);
 
    return Status;
}

Referenced by LsapGetDomainInfo(), LsarAddAccountRights(), LsarAddPrivilegesToAccount(), LsarEnumeratePrivilegesAccount(), LsarGetQuotasForAccount(), LsarGetSystemAccessAccount(), LsarQueryAccountDomain(), LsarQueryAuditEvents(), LsarQueryAuditFull(), LsarQueryAuditLog(), LsarQueryDefaultQuota(), LsarQueryDnsDomain(), LsarQueryModification(), LsarQueryPrimaryDomain(), LsarQuerySecret(), LsarQuerySecurityObject(), LsarQueryServerRole(), LsarRemoveAccountRights(), LsarRemovePrivilegesFromAccount(), LsarRetrievePrivateData(), LsarSetAuditFull(), LsarSetQuotasForAccount(), and LsarSetSecurityObject().

LsapGetRelativeIdFromSid()

ULONG LsapGetRelativeIdFromSid

(

PSID

Sid

)

Definition at line 1038 of file lookup.c.

{
    PISID Sid = Sid_;
 
    if (Sid->SubAuthorityCount != 0)
        return Sid->SubAuthority[Sid->SubAuthorityCount - 1];
 
    return 0;
}

Referenced by LsapLookupAccountDomainSids(), LsapLookupBuiltinDomainSids(), LsarLookupNames(), and LsarLookupNames2().

LsapGetResourceStringLengthEx()

INT LsapGetResourceStringLengthEx	(	_In_ HINSTANCE	hInstance,
		_In_ UINT	uId,
		_In_ USHORT	usLanguage
	)

Definition at line 64 of file utils.c.

{
    HGLOBAL hmem;
    HRSRC hrsrc;
    WCHAR *p;
    UINT i, string_num;
 
    /* Use loword (incremented by 1) as resourceid */
//    hrsrc = FindResourceExW(hInstance,
//                            MAKEINTRESOURCEW((LOWORD(uId) >> 4) + 1),
//                            (LPWSTR)RT_STRING,
//                            usLanguage);
    hrsrc = FindResourceW(hInstance,
                          MAKEINTRESOURCEW((LOWORD(uId) >> 4) + 1),
                          (LPWSTR)RT_STRING);
    if (!hrsrc)
        return 0;
 
    hmem = LoadResource(hInstance, hrsrc);
    if (!hmem)
        return 0;
 
    p = LockResource(hmem);
    string_num = uId & 0x000f;
    for (i = 0; i < string_num; i++)
        p += *p + 1;
 
    return *p + 1;
}

Referenced by LsarpLookupPrivilegeDisplayName().

LsapInitAuthPackages()

NTSTATUS LsapInitAuthPackages

(

VOID

)

Definition at line 474 of file authpackage.c.

{
    RTL_QUERY_REGISTRY_TABLE AuthPackageTable[] = {
    {LsapAddAuthPackage, 0, L"Authentication Packages", NULL, REG_NONE, NULL, 0},
    {NULL, 0, NULL, NULL, REG_NONE, NULL, 0}};
 
    NTSTATUS Status;
 
    InitializeListHead(&PackageListHead);
    PackageId = 0;
 
    /* Initialize the dispatch table */
    DispatchTable.CreateLogonSession = &LsapCreateLogonSession;
    DispatchTable.DeleteLogonSession = &LsapDeleteLogonSession;
    DispatchTable.AddCredential = &LsapAddCredential;
    DispatchTable.GetCredentials = &LsapGetCredentials;
    DispatchTable.DeleteCredential = &LsapDeleteCredential;
    DispatchTable.AllocateLsaHeap = &LsapAllocateHeapZero;
    DispatchTable.FreeLsaHeap = &LsapFreeHeap;
    DispatchTable.AllocateClientBuffer = &LsapAllocateClientBuffer;
    DispatchTable.FreeClientBuffer = &LsapFreeClientBuffer;
    DispatchTable.CopyToClientBuffer = &LsapCopyToClientBuffer;
    DispatchTable.CopyFromClientBuffer = &LsapCopyFromClientBuffer;
 
    /* Add registered authentication packages */
    Status = RtlQueryRegistryValues(RTL_REGISTRY_CONTROL,
                                    L"Lsa",
                                    AuthPackageTable,
                                    &PackageId,
                                    NULL);
 
    return Status;
}

Referenced by LsapInitLsa().

LsapInitDatabase()

NTSTATUS LsapInitDatabase

(

VOID

)

Definition at line 539 of file database.c.

{
    NTSTATUS Status;
 
    TRACE("LsapInitDatabase()\n");
 
    Status = LsapOpenServiceKey();
    if (!NT_SUCCESS(Status))
    {
        ERR("Failed to open the service key (Status: 0x%08lx)\n", Status);
        return Status;
    }
 
    if (!LsapIsDatabaseInstalled())
    {
        Status = LsapCreateDatabaseKeys();
        if (!NT_SUCCESS(Status))
        {
            ERR("Failed to create the LSA database keys (Status: 0x%08lx)\n", Status);
            return Status;
        }
 
        Status = LsapCreateDatabaseObjects();
        if (!NT_SUCCESS(Status))
        {
            ERR("Failed to create the LSA database objects (Status: 0x%08lx)\n", Status);
            return Status;
        }
    }
    else
    {
        Status = LsapUpdateDatabase();
        if (!NT_SUCCESS(Status))
        {
            ERR("Failed to update the LSA database (Status: 0x%08lx)\n", Status);
            return Status;
        }
    }
 
    Status = LsapGetDomainInfo();
    if (!NT_SUCCESS(Status))
    {
        ERR("Failed to get the domain information (Status: 0x%08lx)\n", Status);
        return Status;
    }
 
    TRACE("LsapInitDatabase() done\n");
 
    return STATUS_SUCCESS;
}

Referenced by LsapInitLsa().

LsapInitLogonSessions()

VOID LsapInitLogonSessions

(

VOID

)

Definition at line 36 of file session.c.

{
    InitializeListHead(&SessionListHead);
    SessionCount = 0;
}

Referenced by LsapInitLsa().

LsapInitNotificationList()

VOID LsapInitNotificationList

(

VOID

)

Definition at line 28 of file notify.c.

{
    InitializeListHead(&NotificationListHead);
    RtlInitializeResource(&NotificationListLock);
}

Referenced by LsapInitLsa().

LsapInitSids()

NTSTATUS LsapInitSids

(

VOID

)

Definition at line 182 of file lookup.c.

{
    WCHAR szAccountName[80];
    WCHAR szDomainName[80];
    ULONG SubAuthorities[8];
    HINSTANCE hInstance;
 
    InitializeListHead(&WellKnownSidListHead);
 
    hInstance = GetModuleHandleW(L"lsasrv.dll");
 
    /* NT Authority */
    LsapLoadString(hInstance, IDS_NT_AUTHORITY, szAccountName, ARRAYSIZE(szAccountName));
    LsapLoadString(hInstance, IDS_NT_AUTHORITY, szDomainName, ARRAYSIZE(szDomainName));
    LsapCreateSid(&NtAuthority,
                  0,
                  NULL,
                  szAccountName,
                  szDomainName,
                  SidTypeDomain,
                  NULL);
 
    /* Null Sid */
    LsapLoadString(hInstance, IDS_NULL_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_NULL_RID;
    LsapCreateSid(&NullSidAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  L"",
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* World Sid */
    LsapLoadString(hInstance, IDS_WORLD_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_WORLD_RID;
    LsapCreateSid(&WorldSidAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  L"",
                  SidTypeWellKnownGroup,
                  &LsapWorldSid);
 
    /* Local Sid */
    LsapLoadString(hInstance, IDS_LOCAL_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_LOCAL_RID;
    LsapCreateSid(&LocalSidAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  L"",
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Creator Owner Sid */
    LsapLoadString(hInstance, IDS_CREATOR_OWNER_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_CREATOR_OWNER_RID;
    LsapCreateSid(&CreatorSidAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  L"",
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Creator Group Sid */
    LsapLoadString(hInstance, IDS_CREATOR_GROUP_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_CREATOR_GROUP_RID;
    LsapCreateSid(&CreatorSidAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  L"",
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Creator Owner Server Sid */
    LsapLoadString(hInstance, IDS_CREATOR_OWNER_SERVER_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_CREATOR_OWNER_SERVER_RID;
    LsapCreateSid(&CreatorSidAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  L"",
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Creator Group Server Sid */
    LsapLoadString(hInstance, IDS_CREATOR_GROUP_SERVER_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_CREATOR_GROUP_SERVER_RID;
    LsapCreateSid(&CreatorSidAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  L"",
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Dialup Sid */
    LsapLoadString(hInstance, IDS_DIALUP_RID, szAccountName, ARRAYSIZE(szAccountName));
    LsapLoadString(hInstance, IDS_NT_AUTHORITY, szDomainName, ARRAYSIZE(szDomainName));
 
    SubAuthorities[0] = SECURITY_DIALUP_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Network Sid */
    LsapLoadString(hInstance, IDS_NETWORK_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_NETWORK_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  &LsapNetworkSid);
 
    /* Batch Sid*/
    LsapLoadString(hInstance, IDS_BATCH_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BATCH_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  &LsapBatchSid);
 
    /* Interactive Sid */
    LsapLoadString(hInstance, IDS_INTERACTIVE_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_INTERACTIVE_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  &LsapInteractiveSid);
 
    /* Service Sid */
    LsapLoadString(hInstance, IDS_SERVICE_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_SERVICE_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  &LsapServiceSid);
 
    /* Anonymous Logon Sid */
    LsapLoadString(hInstance, IDS_ANONYMOUS_LOGON_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_ANONYMOUS_LOGON_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Proxy Sid */
    LsapLoadString(hInstance, IDS_PROXY_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_PROXY_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Enterprise Controllers Sid */
    LsapLoadString(hInstance, IDS_ENTERPRISE_CONTROLLERS_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_ENTERPRISE_CONTROLLERS_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Principal Self Sid */
    LsapLoadString(hInstance, IDS_PRINCIPAL_SELF_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_PRINCIPAL_SELF_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Authenticated Users Sid */
    LsapLoadString(hInstance, IDS_AUTHENTICATED_USER_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_AUTHENTICATED_USER_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Restricted Code Sid */
    LsapLoadString(hInstance, IDS_RESTRICTED_CODE_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_RESTRICTED_CODE_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Terminal Server Sid */
    LsapLoadString(hInstance, IDS_TERMINAL_SERVER_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_TERMINAL_SERVER_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Remote Logon Sid */
    LsapLoadString(hInstance, IDS_REMOTE_LOGON_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_REMOTE_LOGON_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* This Organization Sid */
    LsapLoadString(hInstance, IDS_THIS_ORGANIZATION_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_THIS_ORGANIZATION_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Local System Sid */
    LsapLoadString(hInstance, IDS_LOCAL_SYSTEM_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_LOCAL_SYSTEM_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  &LsapLocalSystemSid);
 
    /* Local Service Sid */
    LsapLoadString(hInstance, IDS_LOCAL_SERVICE_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_LOCAL_SERVICE_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  L"LOCALSERVICE",
                  L"NT AUTHORITY",
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Network Service Sid */
    LsapLoadString(hInstance, IDS_NETWORK_SERVICE_RID, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_NETWORK_SERVICE_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeWellKnownGroup,
                  NULL);
 
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  L"NETWORKSERVICE",
                  L"NT AUTHORITY",
                  SidTypeWellKnownGroup,
                  NULL);
 
    /* Builtin Domain Sid */
    LsapLoadString(hInstance, IDS_BUILTIN_DOMAIN_RID, szAccountName, ARRAYSIZE(szAccountName));
    LsapLoadString(hInstance, IDS_BUILTIN_DOMAIN_RID, szDomainName, ARRAYSIZE(szDomainName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    LsapCreateSid(&NtAuthority,
                  1,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeDomain,
                  NULL);
 
    /* Administrators Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_ADMINS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_ADMINS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  &LsapAdministratorsSid);
 
    /* Users Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_USERS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_USERS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Guests Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_GUESTS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_GUESTS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Power User Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_POWER_USERS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_POWER_USERS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Account Operators Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_ACCOUNT_OPS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_ACCOUNT_OPS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* System Operators Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_SYSTEM_OPS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_SYSTEM_OPS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Print Operators Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_PRINT_OPS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_PRINT_OPS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Backup Operators Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_BACKUP_OPS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_BACKUP_OPS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Replicators Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_REPLICATOR, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_REPLICATOR;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* RAS Servers Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_RAS_SERVERS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_RAS_SERVERS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Pre-Windows 2000 Compatible Access Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_PREW2KCOMPACCESS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_PREW2KCOMPACCESS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Remote Desktop Users Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_REMOTE_DESKTOP_USERS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* Network Configuration Operators Alias Sid */
    LsapLoadString(hInstance, IDS_ALIAS_RID_NETWORK_CONFIGURATION_OPS, szAccountName, ARRAYSIZE(szAccountName));
 
    SubAuthorities[0] = SECURITY_BUILTIN_DOMAIN_RID;
    SubAuthorities[1] = DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS;
    LsapCreateSid(&NtAuthority,
                  2,
                  SubAuthorities,
                  szAccountName,
                  szDomainName,
                  SidTypeAlias,
                  NULL);
 
    /* FIXME: Add more well known sids */
 
    return STATUS_SUCCESS;
}

Referenced by LsapInitLsa().

LsapLoadString()

INT LsapLoadString	(	HINSTANCE	hInstance,
		UINT	uId,
		LPWSTR	lpBuffer,
		INT	nBufferMax
	)

Definition at line 17 of file utils.c.

{
    HGLOBAL hmem;
    HRSRC hrsrc;
    WCHAR *p;
    int string_num;
    int i;
 
    /* Use loword (incremented by 1) as resourceid */
    hrsrc = FindResourceW(hInstance,
                          MAKEINTRESOURCEW((LOWORD(uId) >> 4) + 1),
                          (LPWSTR)RT_STRING);
    if (!hrsrc)
        return 0;
 
    hmem = LoadResource(hInstance, hrsrc);
    if (!hmem)
        return 0;
 
    p = LockResource(hmem);
    string_num = uId & 0x000f;
    for (i = 0; i < string_num; i++)
        p += *p + 1;
 
    i = min(nBufferMax - 1, *p);
    if (i > 0)
    {
        memcpy(lpBuffer, p + 1, i * sizeof(WCHAR));
        lpBuffer[i] = 0;
    }
    else
    {
        if (nBufferMax > 1)
        {
            lpBuffer[0] = 0;
            return 0;
        }
    }
 
    return i;
}

Referenced by LsapInitSids().

LsapLoadStringEx()

INT LsapLoadStringEx	(	_In_ HINSTANCE	hInstance,
		_In_ UINT	uId,
		_In_ USHORT	usLanguage,
		_Out_ LPWSTR	lpBuffer,
		_Out_ INT	nBufferMax
	)

Definition at line 99 of file utils.c.

{
    HGLOBAL hmem;
    HRSRC hrsrc;
    WCHAR *p;
    int string_num;
    int i;
 
    /* Use loword (incremented by 1) as resourceid */
//    hrsrc = FindResourceExW(hInstance,
//                            MAKEINTRESOURCEW((LOWORD(uId) >> 4) + 1),
//                            (LPWSTR)RT_STRING,
//                            usLanguage);
    hrsrc = FindResourceW(hInstance,
                          MAKEINTRESOURCEW((LOWORD(uId) >> 4) + 1),
                          (LPWSTR)RT_STRING);
    if (!hrsrc)
        return 0;
 
    hmem = LoadResource(hInstance, hrsrc);
    if (!hmem)
        return 0;
 
    p = LockResource(hmem);
    string_num = uId & 0x000f;
    for (i = 0; i < string_num; i++)
        p += *p + 1;
 
    i = min(nBufferMax - 1, *p);
    if (i > 0)
    {
        memcpy(lpBuffer, p + 1, i * sizeof(WCHAR));
        lpBuffer[i] = 0;
    }
    else
    {
        if (nBufferMax > 1)
        {
            lpBuffer[0] = 0;
            return 0;
        }
    }
 
    return i;
}

Referenced by LsarpLookupPrivilegeDisplayName().

LsapLogonUser()

NTSTATUS LsapLogonUser	(	PLSA_API_MSG	RequestMsg,
		PLSAP_LOGON_CONTEXT	LogonContext
	)

Definition at line 1394 of file authpackage.c.

{
    PAUTH_PACKAGE Package;
    OBJECT_ATTRIBUTES ObjectAttributes;
    SECURITY_QUALITY_OF_SERVICE Qos;
    LSA_TOKEN_INFORMATION_TYPE TokenInformationType;
    PVOID TokenInformation = NULL;
    PLSA_TOKEN_INFORMATION_NULL TokenInfo0 = NULL;
    PLSA_TOKEN_INFORMATION_V1 TokenInfo1 = NULL;
    PUNICODE_STRING AccountName = NULL;
    PUNICODE_STRING AuthenticatingAuthority = NULL;
    PUNICODE_STRING MachineName = NULL;
    PVOID LocalAuthInfo = NULL;
    PTOKEN_GROUPS LocalGroups = NULL;
    HANDLE TokenHandle = NULL;
    ULONG i;
    ULONG PackageId;
    SECURITY_LOGON_TYPE LogonType;
    NTSTATUS Status;
 
    PUNICODE_STRING UserName = NULL;
    PUNICODE_STRING LogonDomainName = NULL;
//    UNICODE_STRING LogonServer;
 
 
    TRACE("LsapLogonUser(%p %p)\n", RequestMsg, LogonContext);
 
    PackageId = RequestMsg->LogonUser.Request.AuthenticationPackage;
    LogonType = RequestMsg->LogonUser.Request.LogonType;
 
    /* Get the right authentication package */
    Package = LsapGetAuthenticationPackage(PackageId);
    if (Package == NULL)
    {
        ERR("LsapGetAuthenticationPackage() failed to find a package\n");
        return STATUS_NO_SUCH_PACKAGE;
    }
 
    if (RequestMsg->LogonUser.Request.AuthenticationInformationLength > 0)
    {
        /* Allocate the local authentication info buffer */
        LocalAuthInfo = RtlAllocateHeap(RtlGetProcessHeap(),
                                        HEAP_ZERO_MEMORY,
                                        RequestMsg->LogonUser.Request.AuthenticationInformationLength);
        if (LocalAuthInfo == NULL)
        {
            ERR("RtlAllocateHeap() failed\n");
            return STATUS_INSUFFICIENT_RESOURCES;
        }
 
        /* Read the authentication info from the callers address space */
        Status = NtReadVirtualMemory(LogonContext->ClientProcessHandle,
                                     RequestMsg->LogonUser.Request.AuthenticationInformation,
                                     LocalAuthInfo,
                                     RequestMsg->LogonUser.Request.AuthenticationInformationLength,
                                     NULL);
        if (!NT_SUCCESS(Status))
        {
            ERR("NtReadVirtualMemory() failed (Status 0x%08lx)\n", Status);
            RtlFreeHeap(RtlGetProcessHeap(), 0, LocalAuthInfo);
            return Status;
        }
    }
 
    if (RequestMsg->LogonUser.Request.LocalGroupsCount > 0)
    {
        Status = LsapCopyLocalGroups(LogonContext,
                                     RequestMsg->LogonUser.Request.LocalGroups,
                                     RequestMsg->LogonUser.Request.LocalGroupsCount,
                                     &LocalGroups);
        if (!NT_SUCCESS(Status))
        {
            ERR("LsapCopyLocalGroups failed (Status 0x%08lx)\n", Status);
            goto done;
        }
 
        TRACE("GroupCount: %lu\n", LocalGroups->GroupCount);
    }
 
    if (Package->LsaApLogonUserEx2 != NULL)
    {
        Status = Package->LsaApLogonUserEx2((PLSA_CLIENT_REQUEST)LogonContext,
                                            RequestMsg->LogonUser.Request.LogonType,
                                            LocalAuthInfo,
                                            RequestMsg->LogonUser.Request.AuthenticationInformation,
                                            RequestMsg->LogonUser.Request.AuthenticationInformationLength,
                                            &RequestMsg->LogonUser.Reply.ProfileBuffer,
                                            &RequestMsg->LogonUser.Reply.ProfileBufferLength,
                                            &RequestMsg->LogonUser.Reply.LogonId,
                                            &RequestMsg->LogonUser.Reply.SubStatus,
                                            &TokenInformationType,
                                            &TokenInformation,
                                            &AccountName,
                                            &AuthenticatingAuthority,
                                            &MachineName,
                                            NULL,  /* FIXME: PSECPKG_PRIMARY_CRED PrimaryCredentials */
                                            NULL); /* FIXME: PSECPKG_SUPPLEMENTAL_CRED_ARRAY *SupplementalCredentials */
    }
    else if (Package->LsaApLogonUserEx != NULL)
    {
        Status = Package->LsaApLogonUserEx((PLSA_CLIENT_REQUEST)LogonContext,
                                           RequestMsg->LogonUser.Request.LogonType,
                                           LocalAuthInfo,
                                           RequestMsg->LogonUser.Request.AuthenticationInformation,
                                           RequestMsg->LogonUser.Request.AuthenticationInformationLength,
                                           &RequestMsg->LogonUser.Reply.ProfileBuffer,
                                           &RequestMsg->LogonUser.Reply.ProfileBufferLength,
                                           &RequestMsg->LogonUser.Reply.LogonId,
                                           &RequestMsg->LogonUser.Reply.SubStatus,
                                           &TokenInformationType,
                                           &TokenInformation,
                                           &AccountName,
                                           &AuthenticatingAuthority,
                                           &MachineName);
    }
    else
    {
        Status = Package->LsaApLogonUser((PLSA_CLIENT_REQUEST)LogonContext,
                                         RequestMsg->LogonUser.Request.LogonType,
                                         LocalAuthInfo,
                                         RequestMsg->LogonUser.Request.AuthenticationInformation,
                                         RequestMsg->LogonUser.Request.AuthenticationInformationLength,
                                         &RequestMsg->LogonUser.Reply.ProfileBuffer,
                                         &RequestMsg->LogonUser.Reply.ProfileBufferLength,
                                         &RequestMsg->LogonUser.Reply.LogonId,
                                         &RequestMsg->LogonUser.Reply.SubStatus,
                                         &TokenInformationType,
                                         &TokenInformation,
                                         &AccountName,
                                         &AuthenticatingAuthority);
    }
 
    if (!NT_SUCCESS(Status))
    {
        ERR("LsaApLogonUser/Ex/2 failed (Status 0x%08lx)\n", Status);
        goto done;
    }
 
    if (LocalGroups->GroupCount > 0)
    {
        /* Add local groups to the token information */
        Status = LsapAddLocalGroups(TokenInformation,
                                    TokenInformationType,
                                    LocalGroups);
        if (!NT_SUCCESS(Status))
        {
            ERR("LsapAddLocalGroupsToTokenInfo() failed (Status 0x%08lx)\n", Status);
            goto done;
        }
    }
 
    Status = LsapAddDefaultGroups(TokenInformation,
                                  TokenInformationType,
                                  LogonType);
    if (!NT_SUCCESS(Status))
    {
        ERR("LsapAddDefaultGroups() failed (Status 0x%08lx)\n", Status);
        goto done;
    }
 
    Status = LsapAddSamGroups(TokenInformation,
                              TokenInformationType);
    if (!NT_SUCCESS(Status))
    {
        ERR("LsapAddSamGroups() failed (Status 0x%08lx)\n", Status);
        goto done;
    }
 
    Status = LsapSetTokenOwner(TokenInformation,
                               TokenInformationType);
    if (!NT_SUCCESS(Status))
    {
        ERR("LsapSetTokenOwner() failed (Status 0x%08lx)\n", Status);
        goto done;
    }
 
    Status = LsapAddTokenDefaultDacl(TokenInformation,
                                     TokenInformationType);
    if (!NT_SUCCESS(Status))
    {
        ERR("LsapAddTokenDefaultDacl() failed (Status 0x%08lx)\n", Status);
        goto done;
    }
 
    Status = LsapSetPrivileges(TokenInformation,
                               TokenInformationType);
    if (!NT_SUCCESS(Status))
    {
        ERR("LsapSetPrivileges() failed (Status 0x%08lx)\n", Status);
        goto done;
    }
 
    if (TokenInformationType == LsaTokenInformationNull)
    {
        TOKEN_USER TokenUser;
        TOKEN_PRIMARY_GROUP TokenPrimaryGroup;
        TOKEN_GROUPS NoGroups = {0};
        TOKEN_PRIVILEGES NoPrivileges = {0};
 
        TokenInfo0 = (PLSA_TOKEN_INFORMATION_NULL)TokenInformation;
 
        TokenUser.User.Sid = LsapWorldSid;
        TokenUser.User.Attributes = 0;
        TokenPrimaryGroup.PrimaryGroup = LsapWorldSid;
 
        Qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
        Qos.ImpersonationLevel = SecurityImpersonation;
        Qos.ContextTrackingMode = SECURITY_STATIC_TRACKING;
        Qos.EffectiveOnly = TRUE;
 
        ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
        ObjectAttributes.RootDirectory = NULL;
        ObjectAttributes.ObjectName = NULL;
        ObjectAttributes.Attributes = 0;
        ObjectAttributes.SecurityDescriptor = NULL;
        ObjectAttributes.SecurityQualityOfService = &Qos;
 
        /* Create the logon token */
        Status = NtCreateToken(&TokenHandle,
                               TOKEN_ALL_ACCESS,
                               &ObjectAttributes,
                               TokenImpersonation,
                               &RequestMsg->LogonUser.Reply.LogonId,
                               &TokenInfo0->ExpirationTime,
                               &TokenUser,
                               &NoGroups,
                               &NoPrivileges,
                               NULL,
                               &TokenPrimaryGroup,
                               NULL,
                               &RequestMsg->LogonUser.Request.SourceContext);
    }
    else if (TokenInformationType == LsaTokenInformationV1)
    {
        TOKEN_PRIVILEGES NoPrivileges = {0};
        PSECURITY_DESCRIPTOR TokenSd;
        ULONG TokenSdSize;
 
        TokenInfo1 = (PLSA_TOKEN_INFORMATION_V1)TokenInformation;
 
        /* Set up a security descriptor for token object itself */
        Status = LsapCreateTokenSd(&TokenInfo1->User, &TokenSd, &TokenSdSize);
        if (!NT_SUCCESS(Status))
        {
            TokenSd = NULL;
        }
 
        Qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
        Qos.ImpersonationLevel = SecurityImpersonation;
        Qos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
        Qos.EffectiveOnly = FALSE;
 
        ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
        ObjectAttributes.RootDirectory = NULL;
        ObjectAttributes.ObjectName = NULL;
        ObjectAttributes.Attributes = 0;
        ObjectAttributes.SecurityDescriptor = TokenSd;
        ObjectAttributes.SecurityQualityOfService = &Qos;
 
        /* Create the logon token */
        Status = NtCreateToken(&TokenHandle,
                               TOKEN_ALL_ACCESS,
                               &ObjectAttributes,
                               (RequestMsg->LogonUser.Request.LogonType == Network) ? TokenImpersonation : TokenPrimary,
                               &RequestMsg->LogonUser.Reply.LogonId,
                               &TokenInfo1->ExpirationTime,
                               &TokenInfo1->User,
                               TokenInfo1->Groups,
                               TokenInfo1->Privileges ? TokenInfo1->Privileges : &NoPrivileges,
                               &TokenInfo1->Owner,
                               &TokenInfo1->PrimaryGroup,
                               &TokenInfo1->DefaultDacl,
                               &RequestMsg->LogonUser.Request.SourceContext);
 
        /* Free the allocated security descriptor */
        RtlFreeHeap(RtlGetProcessHeap(), 0, TokenSd);
 
        if (!NT_SUCCESS(Status))
        {
            ERR("NtCreateToken failed (Status 0x%08lx)\n", Status);
            goto done;
        }
    }
    else
    {
        FIXME("TokenInformationType %d is not supported!\n", TokenInformationType);
        Status = STATUS_NOT_IMPLEMENTED;
        goto done;
    }
 
    if (LogonType == Interactive ||
        LogonType == Batch ||
        LogonType == Service)
    {
        UserName = &((PMSV1_0_INTERACTIVE_LOGON)LocalAuthInfo)->UserName;
        LogonDomainName = &((PMSV1_0_INTERACTIVE_LOGON)LocalAuthInfo)->LogonDomainName;
    }
    else
    {
        FIXME("LogonType %lu is not supported yet!\n", LogonType);
    }
 
    Status = LsapSetLogonSessionData(&RequestMsg->LogonUser.Reply.LogonId,
                                     LogonType,
                                     UserName,
                                     LogonDomainName,
                                     TokenInfo1->User.User.Sid);
    if (!NT_SUCCESS(Status))
    {
        ERR("LsapSetLogonSessionData failed (Status 0x%08lx)\n", Status);
        goto done;
    }
 
    /*
     * Duplicate the token handle into the client process.
     * This must be the last step because we cannot
     * close the duplicated token handle in case something fails.
     */
    Status = NtDuplicateObject(NtCurrentProcess(),
                               TokenHandle,
                               LogonContext->ClientProcessHandle,
                               &RequestMsg->LogonUser.Reply.Token,
                               0,
                               0,
                               DUPLICATE_SAME_ACCESS | DUPLICATE_SAME_ATTRIBUTES | DUPLICATE_CLOSE_SOURCE);
    if (!NT_SUCCESS(Status))
    {
        ERR("NtDuplicateObject failed (Status 0x%08lx)\n", Status);
        goto done;
    }
 
done:
    if (!NT_SUCCESS(Status))
    {
        /* Notify the authentification package of the failure */
        Package->LsaApLogonTerminated(&RequestMsg->LogonUser.Reply.LogonId);
 
        /* Delete the logon session */
        LsapDeleteLogonSession(&RequestMsg->LogonUser.Reply.LogonId);
 
        /* Release the profile buffer */
        LsapFreeClientBuffer((PLSA_CLIENT_REQUEST)LogonContext,
                             RequestMsg->LogonUser.Reply.ProfileBuffer);
        RequestMsg->LogonUser.Reply.ProfileBuffer = NULL;
    }
 
    if (TokenHandle != NULL)
        NtClose(TokenHandle);
 
    /* Free the local groups */
    if (LocalGroups != NULL)
    {
        for (i = 0; i < LocalGroups->GroupCount; i++)
        {
            if (LocalGroups->Groups[i].Sid != NULL)
                RtlFreeHeap(RtlGetProcessHeap(), 0, LocalGroups->Groups[i].Sid);
        }
 
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalGroups);
    }
 
    /* Free the local authentication info buffer */
    if (LocalAuthInfo != NULL)
        RtlFreeHeap(RtlGetProcessHeap(), 0, LocalAuthInfo);
 
    /* Free the token information */
    if (TokenInformation != NULL)
    {
        if (TokenInformationType == LsaTokenInformationNull)
        {
            TokenInfo0 = (PLSA_TOKEN_INFORMATION_NULL)TokenInformation;
 
            if (TokenInfo0 != NULL)
            {
                if (TokenInfo0->Groups != NULL)
                {
                    for (i = 0; i < TokenInfo0->Groups->GroupCount; i++)
                    {
                        if (TokenInfo0->Groups->Groups[i].Sid != NULL)
                            LsapFreeHeap(TokenInfo0->Groups->Groups[i].Sid);
                    }
 
                    LsapFreeHeap(TokenInfo0->Groups);
                }
 
                LsapFreeHeap(TokenInfo0);
            }
        }
        else if (TokenInformationType == LsaTokenInformationV1)
        {
            TokenInfo1 = (PLSA_TOKEN_INFORMATION_V1)TokenInformation;
 
            if (TokenInfo1 != NULL)
            {
                if (TokenInfo1->User.User.Sid != NULL)
                    LsapFreeHeap(TokenInfo1->User.User.Sid);
 
                if (TokenInfo1->Groups != NULL)
                {
                    for (i = 0; i < TokenInfo1->Groups->GroupCount; i++)
                    {
                        if (TokenInfo1->Groups->Groups[i].Sid != NULL)
                            LsapFreeHeap(TokenInfo1->Groups->Groups[i].Sid);
                    }
 
                    LsapFreeHeap(TokenInfo1->Groups);
                }
 
                if (TokenInfo1->PrimaryGroup.PrimaryGroup != NULL)
                    LsapFreeHeap(TokenInfo1->PrimaryGroup.PrimaryGroup);
 
                if (TokenInfo1->Privileges != NULL)
                    LsapFreeHeap(TokenInfo1->Privileges);
 
                if (TokenInfo1->Owner.Owner != NULL)
                    LsapFreeHeap(TokenInfo1->Owner.Owner);
 
                if (TokenInfo1->DefaultDacl.DefaultDacl != NULL)
                    LsapFreeHeap(TokenInfo1->DefaultDacl.DefaultDacl);
 
                LsapFreeHeap(TokenInfo1);
            }
        }
        else
        {
            FIXME("TokenInformationType %d is not supported!\n", TokenInformationType);
        }
    }
 
    /* Free the account name */
    if (AccountName != NULL)
    {
        if (AccountName->Buffer != NULL)
            LsapFreeHeap(AccountName->Buffer);
 
        LsapFreeHeap(AccountName);
    }
 
    /* Free the authentication authority */
    if (AuthenticatingAuthority != NULL)
    {
        if (AuthenticatingAuthority->Buffer != NULL)
            LsapFreeHeap(AuthenticatingAuthority->Buffer);
 
        LsapFreeHeap(AuthenticatingAuthority);
    }
 
    /* Free the machine name */
    if (MachineName != NULL)
    {
        if (MachineName->Buffer != NULL)
            LsapFreeHeap(MachineName->Buffer);
 
        LsapFreeHeap(MachineName);
    }
 
    TRACE("LsapLogonUser done (Status 0x%08lx)\n", Status);
 
    return Status;
}

Referenced by AuthPortThreadRoutine().

LsapLookupAccountRightName()

NTSTATUS LsapLookupAccountRightName	(	ULONG	RightValue,
		PRPC_UNICODE_STRING *	Name
	)

Definition at line 343 of file privileges.c.

{
    PRPC_UNICODE_STRING NameBuffer;
    ULONG i;
 
    for (i = 0; i < ARRAYSIZE(WellKnownRights); i++)
    {
        if (WellKnownRights[i].Flag == RightValue)
        {
            NameBuffer = MIDL_user_allocate(sizeof(RPC_UNICODE_STRING));
            if (NameBuffer == NULL)
                return STATUS_NO_MEMORY;
 
            NameBuffer->Length = (USHORT)wcslen(WellKnownRights[i].Name) * sizeof(WCHAR);
            NameBuffer->MaximumLength = NameBuffer->Length + sizeof(WCHAR);
 
            NameBuffer->Buffer = MIDL_user_allocate(NameBuffer->MaximumLength);
            if (NameBuffer->Buffer == NULL)
            {
                MIDL_user_free(NameBuffer);
                return STATUS_INSUFFICIENT_RESOURCES;
            }
 
            wcscpy(NameBuffer->Buffer, WellKnownRights[i].Name);
 
            *Name = NameBuffer;
 
            return STATUS_SUCCESS;
        }
    }
 
    return STATUS_NO_SUCH_PRIVILEGE;
}

Referenced by LsarEnumerateAccountRights().

LsapLookupAccountRightValue()

ACCESS_MASK LsapLookupAccountRightValue

(

IN PRPC_UNICODE_STRING

Name

)

Definition at line 380 of file privileges.c.

{
    ULONG i;
 
    if (Name->Length == 0 || Name->Buffer == NULL)
        return 0;
 
    for (i = 0; i < ARRAYSIZE(WellKnownRights); i++)
    {
        if (_wcsicmp(Name->Buffer, WellKnownRights[i].Name) == 0)
            return WellKnownRights[i].Flag;
    }
 
    return 0;
}

Referenced by LsarAddAccountRights(), LsarEnumerateAccountsWithUserRight(), and LsarRemoveAccountRights().

LsapLookupAuthenticationPackage()

NTSTATUS LsapLookupAuthenticationPackage	(	PLSA_API_MSG	RequestMsg,
		PLSAP_LOGON_CONTEXT	LogonContext
	)

Definition at line 510 of file authpackage.c.

{
    PLIST_ENTRY ListEntry;
    PAUTH_PACKAGE Package;
    ULONG PackageNameLength;
    PCHAR PackageName;
 
    TRACE("(%p %p)\n", RequestMsg, LogonContext);
 
    PackageNameLength = RequestMsg->LookupAuthenticationPackage.Request.PackageNameLength;
    PackageName = RequestMsg->LookupAuthenticationPackage.Request.PackageName;
 
    TRACE("PackageName: %s\n", PackageName);
 
    ListEntry = PackageListHead.Flink;
    while (ListEntry != &PackageListHead)
    {
        Package = CONTAINING_RECORD(ListEntry, AUTH_PACKAGE, Entry);
 
        if ((PackageNameLength == Package->Name->Length) &&
            (_strnicmp(PackageName, Package->Name->Buffer, Package->Name->Length) == 0))
        {
            RequestMsg->LookupAuthenticationPackage.Reply.Package = Package->Id;
            return STATUS_SUCCESS;
        }
 
        ListEntry = ListEntry->Flink;
    }
 
    return STATUS_NO_SUCH_PACKAGE;
}

Referenced by AuthPortThreadRoutine().

LsapLookupNames()

NTSTATUS LsapLookupNames	(	DWORD	Count,
		PRPC_UNICODE_STRING	Names,
		PLSAPR_REFERENCED_DOMAIN_LIST *	ReferencedDomains,
		PLSAPR_TRANSLATED_SIDS_EX2	TranslatedSids,
		LSAP_LOOKUP_LEVEL	LookupLevel,
		DWORD *	MappedCount,
		DWORD	LookupOptions,
		DWORD	ClientRevision
	)

Definition at line 1813 of file lookup.c.

{
    PLSAPR_REFERENCED_DOMAIN_LIST DomainsBuffer = NULL;
    PLSAPR_TRANSLATED_SID_EX2 SidsBuffer = NULL;
    PRPC_UNICODE_STRING DomainNames = NULL;
    PRPC_UNICODE_STRING AccountNames = NULL;
    ULONG SidsBufferLength;
    ULONG i;
    ULONG Mapped = 0;
    NTSTATUS Status = STATUS_SUCCESS;
 
//TRACE("()\n");
 
    TranslatedSids->Entries = 0;
    TranslatedSids->Sids = NULL;
    *ReferencedDomains = NULL;
 
    SidsBufferLength = Count * sizeof(LSAPR_TRANSLATED_SID_EX2);
    SidsBuffer = MIDL_user_allocate(SidsBufferLength);
    if (SidsBuffer == NULL)
    {
//TRACE("\n");
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    DomainsBuffer = MIDL_user_allocate(sizeof(LSAPR_REFERENCED_DOMAIN_LIST));
    if (DomainsBuffer == NULL)
    {
//TRACE("\n");
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    DomainsBuffer->Domains = MIDL_user_allocate(Count * sizeof(LSA_TRUST_INFORMATION));
    if (DomainsBuffer->Domains == NULL)
    {
//TRACE("\n");
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
    DomainsBuffer->Entries = 0;
    DomainsBuffer->MaxEntries = Count;
 
    for (i = 0; i < Count; i++)
    {
        SidsBuffer[i].Use = SidTypeUnknown;
        SidsBuffer[i].Sid = NULL;
        SidsBuffer[i].DomainIndex = -1;
        SidsBuffer[i].Flags = 0;
    }
 
    Status = LsapSplitNames(Count,
                            Names,
                            &DomainNames,
                            &AccountNames);
    if (!NT_SUCCESS(Status))
    {
        TRACE("LsapSplitNames failed! (Status %lx)\n", Status);
        goto done;
    }
 
 
    Status = LsapLookupIsolatedNames(Count,
                                     DomainNames,
                                     AccountNames,
                                     DomainsBuffer,
                                     SidsBuffer,
                                     &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
    {
        TRACE("LsapLookupIsolatedNames failed! (Status %lx)\n", Status);
        goto done;
    }
 
    if (Mapped == Count)
        goto done;
 
 
    Status = LsapLookupIsolatedBuiltinNames(Count,
                                            DomainNames,
                                            AccountNames,
                                            DomainsBuffer,
                                            SidsBuffer,
                                            &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
    {
        TRACE("LsapLookupIsolatedBuiltinNames failed! (Status %lx)\n", Status);
        goto done;
    }
 
    if (Mapped == Count)
        goto done;
 
 
    Status = LsapLookupIsolatedAccountNames(Count,
                                            DomainNames,
                                            AccountNames,
                                            DomainsBuffer,
                                            SidsBuffer,
                                            &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
    {
        TRACE("LsapLookupIsolatedAccountNames failed! (Status %lx)\n", Status);
        goto done;
    }
 
    if (Mapped == Count)
        goto done;
 
    Status = LsapLookupFullyQualifiedWellKnownNames(Count,
                                                    DomainNames,
                                                    AccountNames,
                                                    DomainsBuffer,
                                                    SidsBuffer,
                                                    &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
    {
        TRACE("LsapLookupFullyQualifiedWellKnownNames failed! (Status %lx)\n", Status);
        goto done;
    }
 
    if (Mapped == Count)
        goto done;
 
    Status = LsapLookupBuiltinNames(Count,
                                    DomainNames,
                                    AccountNames,
                                    DomainsBuffer,
                                    SidsBuffer,
                                    &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
    {
        TRACE("LsapLookupBuiltinNames failed! (Status %lx)\n", Status);
        goto done;
    }
 
    if (Mapped == Count)
        goto done;
 
 
    Status = LsapLookupAccountNames(Count,
                                    DomainNames,
                                    AccountNames,
                                    DomainsBuffer,
                                    SidsBuffer,
                                    &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
    {
        TRACE("LsapLookupAccountNames failed! (Status %lx)\n", Status);
        goto done;
    }
 
    if (Mapped == Count)
        goto done;
 
done:
//    TRACE("done: Status %lx\n", Status);
 
    if (DomainNames != NULL)
    {
//TRACE("Free DomainNames\n");
        for (i = 0; i < Count; i++)
        {
            if (DomainNames[i].Buffer != NULL)
                MIDL_user_free(DomainNames[i].Buffer);
        }
 
        MIDL_user_free(DomainNames);
    }
 
    if (AccountNames != NULL)
    {
//TRACE("Free AccountNames\n");
        for (i = 0; i < Count; i++)
        {
//TRACE("i: %lu\n", i);
            if (AccountNames[i].Buffer != NULL)
            {
                MIDL_user_free(AccountNames[i].Buffer);
            }
        }
 
        MIDL_user_free(AccountNames);
    }
 
    if (!NT_SUCCESS(Status))
    {
//TRACE("Failure!\n");
 
//TRACE("Free DomainsBuffer\n");
        if (DomainsBuffer != NULL)
        {
            if (DomainsBuffer->Domains != NULL)
                MIDL_user_free(DomainsBuffer->Domains);
 
            MIDL_user_free(DomainsBuffer);
        }
 
//TRACE("Free SidsBuffer\n");
        if (SidsBuffer != NULL)
            MIDL_user_free(SidsBuffer);
    }
    else
    {
//TRACE("Success!\n");
 
        *ReferencedDomains = DomainsBuffer;
        TranslatedSids->Entries = Count;
        TranslatedSids->Sids = SidsBuffer;
        *MappedCount = Mapped;
 
        if (Mapped == 0)
            Status = STATUS_NONE_MAPPED;
        else if (Mapped < Count)
            Status = STATUS_SOME_NOT_MAPPED;
    }
 
//    TRACE("done: Status %lx\n", Status);
 
    return Status;
}

Referenced by LsarLookupNames(), LsarLookupNames2(), LsarLookupNames3(), and LsarLookupNames4().

LsapLookupSids()

NTSTATUS LsapLookupSids	(	PLSAPR_SID_ENUM_BUFFER	SidEnumBuffer,
		PLSAPR_REFERENCED_DOMAIN_LIST *	ReferencedDomains,
		PLSAPR_TRANSLATED_NAMES_EX	TranslatedNames,
		LSAP_LOOKUP_LEVEL	LookupLevel,
		DWORD *	MappedCount,
		DWORD	LookupOptions,
		DWORD	ClientRevision
	)

Definition at line 2412 of file lookup.c.

{
    PLSAPR_REFERENCED_DOMAIN_LIST DomainsBuffer = NULL;
    PLSAPR_TRANSLATED_NAME_EX NamesBuffer = NULL;
    ULONG NamesBufferLength;
    ULONG i;
    ULONG Mapped = 0;
    NTSTATUS Status = STATUS_SUCCESS;
 
    NamesBufferLength = SidEnumBuffer->Entries * sizeof(LSAPR_TRANSLATED_NAME_EX);
    NamesBuffer = MIDL_user_allocate(NamesBufferLength);
    if (NamesBuffer == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    DomainsBuffer = MIDL_user_allocate(sizeof(LSAPR_REFERENCED_DOMAIN_LIST));
    if (DomainsBuffer == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    DomainsBuffer->Domains = MIDL_user_allocate(SidEnumBuffer->Entries * sizeof(LSA_TRUST_INFORMATION));
    if (DomainsBuffer->Domains == NULL)
    {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto done;
    }
 
    DomainsBuffer->Entries = 0;
    DomainsBuffer->MaxEntries = SidEnumBuffer->Entries;
 
    /* Initialize all name entries */
    for (i = 0; i < SidEnumBuffer->Entries; i++)
    {
        NamesBuffer[i].Use = SidTypeUnknown;
        NamesBuffer[i].Name.Length = 0;
        NamesBuffer[i].Name.MaximumLength = 0;
        NamesBuffer[i].Name.Buffer = NULL;
        NamesBuffer[i].DomainIndex = -1;
        NamesBuffer[i].Flags = 0;
    }
 
    /* Look-up well-known SIDs */
    Status = LsapLookupWellKnownSids(SidEnumBuffer,
                                     NamesBuffer,
                                     DomainsBuffer,
                                     &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
        goto done;
 
    if (Mapped == SidEnumBuffer->Entries)
        goto done;
 
    /* Look-up builtin domain SIDs */
    Status = LsapLookupBuiltinDomainSids(SidEnumBuffer,
                                         NamesBuffer,
                                         DomainsBuffer,
                                         &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
        goto done;
 
    if (Mapped == SidEnumBuffer->Entries)
        goto done;
 
    /* Look-up account domain SIDs */
    Status = LsapLookupAccountDomainSids(SidEnumBuffer,
                                         NamesBuffer,
                                         DomainsBuffer,
                                         &Mapped);
    if (!NT_SUCCESS(Status) &&
        Status != STATUS_NONE_MAPPED &&
        Status != STATUS_SOME_NOT_MAPPED)
        goto done;
 
    if (Mapped == SidEnumBuffer->Entries)
        goto done;
 
done:
    TRACE("done Status: %lx  Mapped: %lu\n", Status, Mapped);
 
    if (!NT_SUCCESS(Status))
    {
        if (DomainsBuffer != NULL)
        {
            if (DomainsBuffer->Domains != NULL)
                MIDL_user_free(DomainsBuffer->Domains);
 
            MIDL_user_free(DomainsBuffer);
        }
 
        if (NamesBuffer != NULL)
            MIDL_user_free(NamesBuffer);
    }
    else
    {
        *ReferencedDomains = DomainsBuffer;
        TranslatedNames->Entries = SidEnumBuffer->Entries;
        TranslatedNames->Names = NamesBuffer;
        *MappedCount = Mapped;
 
        if (Mapped == 0)
            Status = STATUS_NONE_MAPPED;
        else if (Mapped < SidEnumBuffer->Entries)
            Status = STATUS_SOME_NOT_MAPPED;
    }
 
    return Status;
}

Referenced by LsarLookupSids(), LsarLookupSids2(), and LsarLookupSids3().

LsapNotifyPolicyChange()

VOID LsapNotifyPolicyChange

(

POLICY_NOTIFICATION_INFORMATION_CLASS

InformationClass

)

Definition at line 188 of file notify.c.

{
    PLIST_ENTRY NotificationEntry;
    PLSA_NOTIFICATION_ENTRY CurrentNotification;
 
    TRACE("LsapNotifyPolicyChange(%lu)\n", InformationClass);
 
    /* Acquire the notification list lock shared */
    RtlAcquireResourceShared(&NotificationListLock, TRUE);
 
    NotificationEntry = NotificationListHead.Flink;
    while (NotificationEntry != &NotificationListHead)
    {
        CurrentNotification = CONTAINING_RECORD(NotificationEntry, LSA_NOTIFICATION_ENTRY, Entry);
 
        if (CurrentNotification->InformationClass == InformationClass)
        {
            TRACE("Notify event %p\n", CurrentNotification->MappedEventHandle);
            NtSetEvent(CurrentNotification->MappedEventHandle, NULL);
        }
 
        NotificationEntry = NotificationEntry->Flink;
    }
 
    /* Release the notification list lock */
    RtlReleaseResource(&NotificationListLock);
}

Referenced by LsarSetInformationPolicy().

LsapOpenDbObject()

NTSTATUS LsapOpenDbObject	(	IN PLSA_DB_OBJECT	ParentObject,
		IN LPWSTR	ContainerName,
		IN LPWSTR	ObjectName,
		IN LSA_DB_OBJECT_TYPE	ObjectType,
		IN ACCESS_MASK	DesiredAccess,
		IN BOOLEAN	Trusted,
		OUT PLSA_DB_OBJECT *	DbObject
	)

Definition at line 712 of file database.c.

{
    PLSA_DB_OBJECT NewObject;
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING KeyName;
    HANDLE ParentKeyHandle;
    HANDLE ContainerKeyHandle = NULL;
    HANDLE ObjectKeyHandle = NULL;
    NTSTATUS Status;
 
    if (DbObject == NULL)
        return STATUS_INVALID_PARAMETER;
 
    if (ParentObject == NULL)
        ParentKeyHandle = SecurityKeyHandle;
    else
        ParentKeyHandle = ParentObject->KeyHandle;
 
    if (ContainerName != NULL)
    {
        /* Open the container key */
        RtlInitUnicodeString(&KeyName,
                             ContainerName);
 
        InitializeObjectAttributes(&ObjectAttributes,
                                   &KeyName,
                                   OBJ_CASE_INSENSITIVE,
                                   ParentKeyHandle,
                                   NULL);
 
        Status = NtOpenKey(&ContainerKeyHandle,
                           KEY_ALL_ACCESS,
                           &ObjectAttributes);
        if (!NT_SUCCESS(Status))
        {
            return Status;
        }
 
        /* Open the object key */
        RtlInitUnicodeString(&KeyName,
                             ObjectName);
 
        InitializeObjectAttributes(&ObjectAttributes,
                                   &KeyName,
                                   OBJ_CASE_INSENSITIVE,
                                   ContainerKeyHandle,
                                   NULL);
 
        Status = NtOpenKey(&ObjectKeyHandle,
                           KEY_ALL_ACCESS,
                           &ObjectAttributes);
 
        NtClose(ContainerKeyHandle);
 
        if (!NT_SUCCESS(Status))
        {
            return Status;
        }
    }
    else
    {
        /* Open the object key */
        RtlInitUnicodeString(&KeyName,
                             ObjectName);
 
        InitializeObjectAttributes(&ObjectAttributes,
                                   &KeyName,
                                   OBJ_CASE_INSENSITIVE,
                                   ParentKeyHandle,
                                   NULL);
 
        Status = NtOpenKey(&ObjectKeyHandle,
                           KEY_ALL_ACCESS,
                           &ObjectAttributes);
        if (!NT_SUCCESS(Status))
        {
            return Status;
        }
    }
 
    NewObject = RtlAllocateHeap(RtlGetProcessHeap(),
                                0,
                                sizeof(LSA_DB_OBJECT));
    if (NewObject == NULL)
    {
        NtClose(ObjectKeyHandle);
        return STATUS_NO_MEMORY;
    }
 
    NewObject->Signature = LSAP_DB_SIGNATURE;
    NewObject->RefCount = 1;
    NewObject->ObjectType = ObjectType;
    NewObject->Access = DesiredAccess;
    NewObject->KeyHandle = ObjectKeyHandle;
    NewObject->ParentObject = ParentObject;
    NewObject->Trusted = Trusted;
 
    if (ParentObject != NULL)
        ParentObject->RefCount++;
 
    *DbObject = NewObject;
 
    return STATUS_SUCCESS;
}

Referenced by LsaIOpenPolicyTrusted(), LsapCreateDatabaseObjects(), LsapGetDomainInfo(), LsarOpenPolicy(), LsarOpenSecret(), LsarpOpenAccount(), LsarRetrievePrivateData(), and LsarStorePrivateData().

LsapRegCloseKey()

NTSTATUS LsapRegCloseKey

(

IN HANDLE

KeyHandle

)

Definition at line 23 of file registry.c.

{
    return NtClose(KeyHandle);
}

Referenced by LsarEnumerateAccounts(), and LsarEnumerateAccountsWithUserRight().

LsapRegCreateKey()

NTSTATUS LsapRegCreateKey	(	IN HANDLE	ParentKeyHandle,
		IN LPCWSTR	KeyName,