windows-xp/Source/XPSP1/NT/ds/security/gina/userenv/policy/gphdr.h

//*************************************************************
//
//  Policy specific headers
//
//  Microsoft Confidential
//  Copyright (c) Microsoft Corporation 1997-1998
//  All rights reserved
//
//*************************************************************

#include "uenv.h"
#include "reghash.h"
#include "rsop.h"
#include "chkacc.h"
#include "collect.h"
#include "Indicate.h"
#include "rsopsec.h"
#include "gpfilter.h"
#include "locator.h"
#include "rsopinc.h"

#define GPO_LPARAM_FLAG_DELETE         0x00000001


//
// Structures
//

typedef struct _GPINFOHANDLE
{
    LPGPOINFO pGPOInfo;
} GPINFOHANDLE, *LPGPINFOHANDLE;


typedef struct _DNENTRY {
    LPTSTR                pwszDN;            // Distinguished name
    union {
        PGROUP_POLICY_OBJECT  pDeferredGPO;  // GPO corresponding to this DN
        struct _DNENTRY *     pDeferredOU;   // OU correspdonding to this DN
    };
    PLDAPMessage          pOUMsg;            // Message for evaluating deferred OU
    GPO_LINK              gpoLink;           // Type of GPO
    struct _DNENTRY *     pNext;             // Singly linked list pointer
} DNENTRY;


typedef struct _LDAPQUERY {
    LPTSTR              pwszDomain;          // Domain of subtree search
    LPTSTR              pwszFilter;          // Ldap filter for search
    DWORD               cbAllocLen;          // Allocated size of pwszFilter in bytes
    DWORD               cbLen;               // Size of pwszFilter currently used in bytes
    PLDAP               pLdapHandle;         // Ldap bind handle
    BOOL                bOwnLdapHandle;      // Does this struct own pLdapHandle ?
    PLDAPMessage        pMessage;            // Ldap message handle
    DNENTRY *           pDnEntry;            // Distinguished name entry
    struct _LDAPQUERY * pNext;               // Singly linked list pointer
} LDAPQUERY;

typedef struct _POLICYCHANGEDINFO {
    HANDLE  hToken;
    BOOL    bMachine;
} POLICYCHANGEDINFO, *LPPOLICYCHANGEDINFO;



//
// Verison number for the registry file format
//

#define REGISTRY_FILE_VERSION       1


//
// File signature
//

#define REGFILE_SIGNATURE  0x67655250


//
// Default refresh rate (minutes)
//
// Client machines will refresh every 90 minutes
// Domain controllers will refresh every 5 minutes
//

#define GP_DEFAULT_REFRESH_RATE      90
#define GP_DEFAULT_REFRESH_RATE_DC    5


//
// Default refresh rate max offset
//
// To prevent many clients from querying policy at the exact same
// time, a random amount is added to the refresh rate.  In the
// default case, a number between 0 and 30 will be added to
// 180 to determine when the next background refresh will occur
//

#define GP_DEFAULT_REFRESH_RATE_OFFSET    30
#define GP_DEFAULT_REFRESH_RATE_OFFSET_DC  0


//
// Max keyname size
//

#define MAX_KEYNAME_SIZE         2048
#define MAX_VALUENAME_SIZE        512


//
// Max time to wait for the network to start (in ms)
//

#define MAX_WAIT_TIME            120000


//
// Extension registry path
//

#define GP_EXTENSIONS   TEXT("Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions")

//
// Path for extension preference policies
//

#define GP_EXTENSIONS_POLICIES   TEXT("Software\\Policies\\Microsoft\\Windows\\Group Policy\\%s")

//
// Group Policy Object option flags
//
// Note, this was taken from sdk\inc\gpedit.h
//

#define GPO_OPTION_DISABLE_USER     0x00000001  // The user portion of this GPO is disabled
#define GPO_OPTION_DISABLE_MACHINE  0x00000002  // The machine portion of this GPO is disabled

//
// DS Object class types
//

extern TCHAR szDSClassAny[];
extern TCHAR szDSClassGPO[];
extern TCHAR szDSClassSite[];
extern TCHAR szDSClassDomain[];
extern TCHAR szDSClassOU[];
extern TCHAR szObjectClass[];

//
// Extension name properties
//
#define GPO_MACHEXTENSION_NAMES   L"gPCMachineExtensionNames"
#define GPO_USEREXTENSION_NAMES   L"gPCUserExtensionNames"
#define GPO_FUNCTIONALITY_VERSION L"gPCFunctionalityVersion"
#define MACHPOLICY_DENY_USERS     L"DenyUsersFromMachGP"

extern TCHAR wszKerberos[];

#define POLICY_GUID_PATH            TEXT("Software\\Microsoft\\Windows NT\\CurrentVersion\\PolicyGuid")

//
// Global flags for Gpo shutdown processing. These are accessed outside
// the lock because its value is either 0 or 1. Even if there is a race,
// all it means is that shutdown will start one iteration later.
//

extern BOOL g_bStopMachGPOProcessing;
extern BOOL g_bStopUserGPOProcessing;

//
// Critical section for handling concurrent, asynchronous completion
//

extern CRITICAL_SECTION g_GPOCS;

//
// Global pointers for maintaining asynchronous completion context
//

extern LPGPINFOHANDLE g_pMachGPInfo;
extern LPGPINFOHANDLE g_pUserGPInfo;


//
// Status UI critical section, callback, and proto-types
//

extern CRITICAL_SECTION g_StatusCallbackCS;
extern PFNSTATUSMESSAGECALLBACK g_pStatusMessageCallback;
DWORD UserPolicyCallback (BOOL bVerbose, LPWSTR lpMessage);
DWORD MachinePolicyCallback (BOOL bVerbose, LPWSTR lpMessage);


//
// Function proto-types
//

DWORD WINAPI GPOThread (LPGPOINFO lpGPOInfo);
extern "C" BOOL ProcessGPOs (LPGPOINFO lpGPOInfo);
DWORD WINAPI PolicyChangedThread (LPPOLICYCHANGEDINFO lpPolicyChangedInfo);
BOOL ResetPolicies (LPGPOINFO lpGPOInfo, LPTSTR lpArchive);
BOOL SetupGPOFilter (LPGPOINFO lpGPOInfo );
void FilterGPOs( LPGPEXT lpExt, LPGPOINFO lpGPOInfo );
void FreeLists( LPGPOINFO lpGPOInfo );
void FreeExtList(LPEXTLIST pExtList );
BOOL CheckGPOs (LPGPEXT lpExt, LPGPOINFO lpGPOInfo, DWORD dwTime, BOOL *pbProcessGPOs,
                BOOL *pbNoChanges, PGROUP_POLICY_OBJECT *ppDeletedGPOList);
BOOL CheckForChangedSid( LPGPOINFO lpGPOInfo, CLocator *plocator );
BOOL CheckForSkippedExtensions( LPGPOINFO lpGPOInfo, BOOL bRsopPlanningMode );
BOOL ReadGPExtensions( LPGPOINFO lpGPOInfo );
BOOL LoadGPExtension (LPGPEXT lpExt, BOOL bRsopPlanningMode );
BOOL UnloadGPExtensions (LPGPOINFO lpGPOInfo);
BOOL WriteStatus( TCHAR *lpExtName, LPGPOINFO lpGPOInfo, LPTSTR lpwszSidUser,  LPGPEXTSTATUS lpExtStatus );
void ReadStatus ( TCHAR *lpExtName, LPGPOINFO lpGPOInfo, LPTSTR lpwszSidUser,  LPGPEXTSTATUS lpExtStatus );
DWORD ProcessGPOList (LPGPEXT lpExt, LPGPOINFO lpGPOInfo, PGROUP_POLICY_OBJECT pDeletedGPOList,
                     PGROUP_POLICY_OBJECT pChangedGPOList, BOOL bNoChanges,
                     ASYNCCOMPLETIONHANDLE pAsyncHandle, HRESULT *phrCSERsopStatus );
BOOL ProcessGPORegistryPolicy (LPGPOINFO lpGPOInfo, PGROUP_POLICY_OBJECT pChangedGPOList, HRESULT *phrRsopLogging);
BOOL SaveGPOList (TCHAR *pszExtName, LPGPOINFO lpGPOInfo,
                  HKEY hKeyRootMach, LPTSTR lpwszSidUser, BOOL bShadow, PGROUP_POLICY_OBJECT lpGPOList);

BOOL AddGPO (PGROUP_POLICY_OBJECT * lpGPOList,
             DWORD dwFlags, BOOL bFound, BOOL bAccessGranted, BOOL bDisabled, DWORD dwOptions,
             DWORD dwVersion, LPTSTR lpDSPath, LPTSTR lpFileSysPath,
             LPTSTR lpDisplayName, LPTSTR lpGPOName, LPTSTR lpExtensions,
             PSECURITY_DESCRIPTOR pSD, DWORD cbSDLen,
             GPO_LINK GPOLink, LPTSTR lpLink,
             LPARAM lParam, BOOL bFront, BOOL bBlock, BOOL bVerbose, BOOL bProcessGPO);
BOOL RefreshDisplay (LPGPOINFO lpGPOInfo);
extern "C" DWORD IsSlowLink (HKEY hKeyRoot, LPTSTR lpDCAddress, BOOL *bSlow, DWORD* pdwAdapterIndex );
BOOL GetGPOInfo (DWORD dwFlags, LPTSTR lpHostName, LPTSTR lpDNName,
                 LPCTSTR lpComputerName, PGROUP_POLICY_OBJECT *lpGPOList,
                 LPSCOPEOFMGMT *ppSOMList, LPGPCONTAINER *ppGpContainerList,
                 PNETAPI32_API pNetAPI32, BOOL bMachineTokenOk, PRSOPTOKEN pRsopToken, WCHAR *pwszSiteName,
                 CGpoFilter *pGpoFilter, CLocator *pLocator );
void WINAPI ShutdownGPOProcessing( BOOL bMachine );
void DebugPrintGPOList( LPGPOINFO lpGPOInfo );

typedef BOOL (*PFNREGFILECALLBACK)(LPGPOINFO lpGPOInfo, LPTSTR lpKeyName,
                                   LPTSTR lpValueName, DWORD dwType,
                                   DWORD dwDataLength, LPBYTE lpData,
                                   WCHAR *pwszGPO,
                                   WCHAR *pwszSOM, REGHASHTABLE *pHashTable);
BOOL ParseRegistryFile (LPGPOINFO lpGPOInfo, LPTSTR lpRegistry,
                        PFNREGFILECALLBACK pfnRegFileCallback,
                        HANDLE hArchive, WCHAR *pwszGPO,
                        WCHAR *pwszSOM, REGHASHTABLE *pHashTable,
                        BOOL bRsopPlanningMode);
BOOL ExtensionHasPerUserLocalSetting( LPTSTR pszExtension, HKEY hKeyRoot );
void CheckGroupMembership( LPGPOINFO lpGPOInfo, HANDLE hToken, BOOL *pbMemChanged, BOOL *pbUserLocalMemChanged, PTOKEN_GROUPS *pTokenGroups );
BOOL ReadMembershipList( LPGPOINFO lpGPOInfo, LPTSTR lpwszSidUser, PTOKEN_GROUPS pGroups );
void SaveMembershipList( LPGPOINFO lpGPOInfo, LPTSTR lpwszSidUser, PTOKEN_GROUPS pGroups );
BOOL GroupInList( LPTSTR lpSid, PTOKEN_GROUPS pGroups );
DWORD GetCurTime();
extern "C" DWORD GetDomainControllerInfo(  PNETAPI32_API pNetAPI32, LPTSTR szDomainName,
                                ULONG ulFlags, HKEY hKeyRoot, PDOMAIN_CONTROLLER_INFO* ppInfo,
                                BOOL* pfSlow,
                                DWORD* pdwAdapterIndex );
PLDAP GetMachineDomainDS( PNETAPI32_API pNetApi32, PLDAP_API pLdapApi );
extern "C" HANDLE GetMachineToken();
NTSTATUS CallDFS(LPWSTR lpDomainName, LPWSTR lpDCName);
BOOL AddLocalGPO( LPSCOPEOFMGMT *ppSOMList );
BOOL AddGPOToRsopList( LPGPCONTAINER *ppGpContainerList,
                       DWORD dwFlags,
                       BOOL bFound,
                       BOOL bAccessGranted,
                       BOOL bDisabled,
                       DWORD dwVersion,
                       LPTSTR lpDSPath,
                       LPTSTR lpFileSysPath,
                       LPTSTR lpDisplayName,
                       LPTSTR lpGPOName,
                       PSECURITY_DESCRIPTOR pSD, 
                       DWORD cbSDLen,
                       BOOL bFilterAllowed, 
                       WCHAR *pwszFilterId, 
                       LPWSTR szSOM,
                       DWORD dwGPOOptions );
SCOPEOFMGMT *AllocSOM( LPWSTR pwszSOMId );
void FreeSOM( SCOPEOFMGMT *pSOM );
GPLINK *AllocGpLink( LPWSTR pwszGPO, DWORD dwOptions );
void FreeGpLink( GPLINK *pGpLink );
GPCONTAINER *AllocGpContainer(  DWORD dwFlags,
                                BOOL bFound,
                                BOOL bAccessGranted,
                                BOOL bDisabled,
                                DWORD dwVersion,
                                LPTSTR lpDSPath,
                                LPTSTR lpFileSysPath,
                                LPTSTR lpDisplayName,
                                LPTSTR lpGpoName,
                                PSECURITY_DESCRIPTOR pSD,
                                DWORD cbSDLen,
                                BOOL bFilterAllowed,
                                WCHAR *pwszFilterId,
                                LPWSTR szSOM,
                                DWORD dwOptions );
void FreeGpContainer( GPCONTAINER *pGpContainer );
void FreeSOMList( SCOPEOFMGMT *pSOMList );
void FreeGpContainerList( GPCONTAINER *pGpContainerList );
LONG GPOExceptionFilter( PEXCEPTION_POINTERS pExceptionPtrs );
BOOL FreeGpoInfo( LPGPOINFO pGpoInfo );

BOOL ReadExtStatus(LPGPOINFO lpGPOInfo);

BOOL ReadGPOList ( TCHAR * pszExtName, HKEY hKeyRoot,
                   HKEY hKeyRootMach, LPTSTR lpwszSidUser, BOOL bShadow,
                   PGROUP_POLICY_OBJECT * lpGPOList);

BOOL GetDeletedGPOList (PGROUP_POLICY_OBJECT lpGPOList,
                        PGROUP_POLICY_OBJECT *ppDeletedGPOList);

BOOL HistoryPresent( LPGPOINFO lpGPOInfo, LPGPEXT lpExt );


extern "C" BOOL InitializePolicyProcessing(BOOL bMachine);

BOOL FilterCheck( PLDAP pld, PLDAP_API pLDAP, 
                  PLDAPMessage pMessage,
                  PRSOPTOKEN pRsopToken,
                  LPTSTR szWmiFilter,
                  CGpoFilter *pGpoFilter,
                  CLocator *pLocator,
                  BOOL *pbFilterAllowed,
                  WCHAR **ppwszFilterId );

BOOL CheckGPOAccess (PLDAP pld, PLDAP_API pLDAP, HANDLE hToken, PLDAPMessage pMessage,
                     LPTSTR lpSDProperty, DWORD dwFlags,
                     PSECURITY_DESCRIPTOR *ppSD, DWORD *pcbSDLen,
                     BOOL *pbAccessGranted,
                     PRSOPTOKEN pRsopToken );


BOOL AddOU( DNENTRY **ppOUList, LPTSTR pwszOU, GPO_LINK gpoLink );
BOOL EvaluateDeferredGPOs (PLDAP pldBound,
                           PLDAP_API pLDAP,
                           LPTSTR pwszDomainBound,
                           DWORD dwFlags,
                           HANDLE hToken,
                           BOOL bVerbose,
                           PGROUP_POLICY_OBJECT pDeferredForcedList,
                           PGROUP_POLICY_OBJECT pDeferredNonForcedList,
                           PGROUP_POLICY_OBJECT *ppForcedList,
                           PGROUP_POLICY_OBJECT *ppNonForcedList,
                           LPGPCONTAINER *ppGpContainerList,
                           PRSOPTOKEN pRsopToken,
                           CGpoFilter *pGpoFilter,
                           CLocator *pLocator );

BOOL SearchDSObject (LPTSTR lpDSObject, DWORD dwFlags, HANDLE hToken, PGROUP_POLICY_OBJECT *pGPOForcedList,
                     PGROUP_POLICY_OBJECT *pGPONonForcedList,
                     LPSCOPEOFMGMT *ppSOMList, LPGPCONTAINER *ppGpContainerList,
                     BOOL bVerbose,
                     GPO_LINK GPOLink, PLDAP  pld, PLDAP_API pLDAP, PLDAPMessage pLDAPMsg,BOOL *bBlock, PRSOPTOKEN pRsopToken );

BOOL EvaluateDeferredOUs(   DNENTRY *pOUList,
                            DWORD dwFlags,
                            HANDLE hToken,
                            PGROUP_POLICY_OBJECT *ppDeferredForcedList,
                            PGROUP_POLICY_OBJECT *ppDeferredNonForcedList,
                            LPSCOPEOFMGMT *ppSOMList,
                            LPGPCONTAINER *ppGpContainerList,
                            BOOL bVerbose,
                            PLDAP  pld,
                            PLDAP_API pLDAP,
                            BOOL *pbBlock,
                            PRSOPTOKEN pRsopToken);

void FreeDnEntry( DNENTRY *pDnEntry );

BOOL CheckOUAccess( PLDAP_API pLDAP,
                    PLDAP pld,
                    PLDAPMessage    pMessage,
                    PRSOPTOKEN pRsopToken,
                    BOOL *pbAccessGranted );

BOOL AddAdmFile( WCHAR *pwszFile, WCHAR *pwszGPO, FILETIME *pftWrite, LPTSTR szComputer, ADMFILEINFO **ppAdmFileCache );
void FreeAdmFileCache( ADMFILEINFO *pAdmFileCache );

ADMFILEINFO * AllocAdmFileInfo( WCHAR *pwszFile, WCHAR *pwszGPO, FILETIME *pftWrite );
void FreeAdmFileInfo( ADMFILEINFO *pAdmFileInfo );

DWORD
SavePolicyState( LPGPOINFO pInfo );

DWORD
SaveLinkState( LPGPOINFO pInfo );

DWORD
ComparePolicyState( LPGPOINFO pInfo, BOOL* pbLinkChanged, BOOL* pbStateChanged, BOOL *pbNoState );

DWORD
DeletePolicyState( LPCWSTR szSid );

LPTSTR GetSomPath( LPTSTR szContainer );
HRESULT RsopSidsFromToken(PRSOPTOKEN     pRsopToken,
                          PTOKEN_GROUPS* ppGroups);