windows-xp/Source/XPSP1/NT/base/ntos/se/ctsertl.c

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

    ctsertl.c

Abstract:

    Common security RTL test routines.

    These routines are used in both the kernel and user mode RTL tests.



Author:

    Jim Kelly       (JimK)     23-Mar-1990

Environment:

    Test of security.

Revision History:

--*/

#include "tsecomm.c"




////////////////////////////////////////////////////////////////
//                                                            //
// Test routines                                              //
//                                                            //
////////////////////////////////////////////////////////////////


BOOLEAN
TestSeSid()
{

#define TARGET_SID_ARRAY_LENGTH   1024

typedef struct _TALT_SID1 {
    ULONG Value[3];
} TALT_SID1;
typedef TALT_SID1 *PTALT_SID1;

    NTSTATUS Status;

    PVOID Ignore;

    PSID TFredSid;
    PSID TBarneySid;
    PSID TWilmaSid;
    PSID TWilmaSubSid;
    PSID TNoSubSid;
    PSID TTempSid;

    PSID_AND_ATTRIBUTES SourceArray;
    PSID_AND_ATTRIBUTES TargetArray;
    ULONG TargetLength;
    ULONG OriginalTargetLength;

    ULONG NormalGroupAttributes;
    ULONG OwnerGroupAttributes;

    // Temporary Hack ...
    NormalGroupAttributes = 7;
    OwnerGroupAttributes = 15;
    // End Temporary Hack...


    TFredSid     = (PSID)TstAllocatePool( PagedPool, 256 );
    TBarneySid   = (PSID)TstAllocatePool( PagedPool, 256 );
    TWilmaSid    = (PSID)TstAllocatePool( PagedPool, 256 );
    TWilmaSubSid = (PSID)TstAllocatePool( PagedPool, 256 );
    TNoSubSid    = (PSID)TstAllocatePool( PagedPool, 256 );
    TTempSid     = (PSID)TstAllocatePool( PagedPool, 256 );


    //
    // Valid SID structure test
    //

    if (!RtlValidSid( TFredSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, TFredSid\n");
        return FALSE;
    }

    if (!RtlValidSid( TBarneySid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, TBarneySid\n");
        return FALSE;
    }

    if (!RtlValidSid( TWilmaSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, TWilmaSid\n");
        return FALSE;
    }

    if (!RtlValidSid( TWilmaSubSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, TWilmaSubSid\n");
        return FALSE;
    }

    if (!RtlValidSid( TNoSubSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, TNoSubSid\n");
        return FALSE;
    }


    //
    // Equal SIDs Test
    //

    if (RtlEqualSid( TFredSid, TBarneySid )) {
        DbgPrint("*Se**     Failure: RtlEqualSid, TFredSid - TBarneySid\n");
        DbgPrint("**** Failed **** \n");
        return FALSE;
    }

    if (!RtlEqualSid( TFredSid, TFredSid )) {
        DbgPrint("*Se**     Failure: RtlEqualSid, TFredSid - TFredSid\n");
        return FALSE;
    }

    if (RtlEqualSid( TWilmaSid, TWilmaSubSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlEqualSid, TWilmaSid - TWilmaSubSid\n");
        return FALSE;
    }

    if (RtlEqualSid( TWilmaSid, TNoSubSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlEqualSid, TWilmaSid - TNoSubSid\n");
        return FALSE;
    }


    //
    // Length Required test
    //

    if (RtlLengthRequiredSid( 0 ) != 8) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlLengthRequiredSid, 0 SubAuthorities\n");
        return FALSE;
    }

    if (RtlLengthRequiredSid( 1 ) != 12) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlLengthRequiredSid, 1 SubAuthorities\n");
        return FALSE;
    }

    if (RtlLengthRequiredSid( 2 ) != 16) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlLengthRequiredSid, 2 SubAuthorities\n");
        return FALSE;
    }


    //
    // Length of SID test
    //

    if (SeLengthSid( TNoSubSid ) != 8) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: SeLengthSid, TNoSubSid\n");
        return FALSE;
    }

    if (SeLengthSid( TFredSid ) != 12) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: SeLengthSid, TFredSid\n");
        return FALSE;
    }

    if (SeLengthSid( TWilmaSubSid ) != 16) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: SeLengthSid, TWilmaSubSid\n");
        return FALSE;
    }


    //
    // Copy SID Test
    //

    if (NT_SUCCESS(RtlCopySid( 7, TTempSid, TNoSubSid ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid, insufficient TNoSubSid\n");
        return FALSE;
    }


    if (!NT_SUCCESS(RtlCopySid( 256, TTempSid, TNoSubSid ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid, TNoSubSid\n");
        return FALSE;
    }

    if (!RtlEqualSid( TTempSid, TNoSubSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid compare, TNoSubSid\n");
        return FALSE;
    }


    if (NT_SUCCESS(RtlCopySid( 11, TTempSid, TBarneySid ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid, insufficient TBarneySid\n");
        return FALSE;
    }


    if (!NT_SUCCESS(RtlCopySid( 256, TTempSid, TBarneySid ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid, TBarneySid\n");
        return FALSE;
    }

    if (!RtlEqualSid( TTempSid, TBarneySid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid compare, TBarneySid\n");
        return FALSE;
    }

    if (NT_SUCCESS(RtlCopySid( 15, TTempSid, TWilmaSubSid ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid, insufficient TWilmaSubSid\n");
        return FALSE;
    }

    if (!NT_SUCCESS(RtlCopySid( 256, TTempSid, TWilmaSubSid ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid, TNoSubSid\n");
        return FALSE;
    }

    if (!RtlEqualSid( TTempSid, TWilmaSubSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCopySid compare, TWilmaSubSid\n");
        return FALSE;
    }


    //
    // Validate all the tsevars SIDs
    //

    //
    //  Bedrock SIDs
    //


    if (!RtlValidSid( BedrockDomainSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, BedrockDomainSid\n");
        return FALSE;
    }

    if (!RtlValidSid( FredSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, FredSid\n");
        return FALSE;
    }

    if (!RtlValidSid( WilmaSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, WilmaSid\n");
        return FALSE;
    }

    if (!RtlValidSid( PebblesSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, PebblesSid\n");
        return FALSE;
    }

    if (!RtlValidSid( DinoSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, DinoSid\n");
        return FALSE;
    }

    if (!RtlValidSid( BarneySid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, BarneySid\n");
        return FALSE;
    }

    if (!RtlValidSid( BettySid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, BettySid\n");
        return FALSE;
    }

    if (!RtlValidSid( BambamSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, BambamSid\n");
        return FALSE;
    }

    if (!RtlValidSid( FlintstoneSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, FlintstoneSid\n");
        return FALSE;
    }

    if (!RtlValidSid( RubbleSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, RubbleSid\n");
        return FALSE;
    }

    if (!RtlValidSid( AdultSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, AdultSid\n");
        return FALSE;
    }

    if (!RtlValidSid( ChildSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, ChildSid\n");
        return FALSE;
    }

    if (!RtlValidSid( NeandertholSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, NeandertholSid\n");
        return FALSE;
    }

    //
    //  Well known SIDs
    //

    if (!RtlValidSid( NullSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, NullSid\n");
        return FALSE;
    }

    if (!RtlValidSid( WorldSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, WorldSid\n");
        return FALSE;
    }

    if (!RtlValidSid( LocalSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, CreatorSid\n");
        return FALSE;
    }

    if (!RtlValidSid( NtAuthoritySid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, NtAuthoritySid\n");
        return FALSE;
    }

    if (!RtlValidSid( DialupSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, DialupSid\n");
        return FALSE;
    }

    if (!RtlValidSid( NetworkSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, NetworkSid\n");
        return FALSE;
    }

    if (!RtlValidSid( BatchSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, BatchSid\n");
        return FALSE;
    }

    if (!RtlValidSid( InteractiveSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, InteractiveSid\n");
        return FALSE;
    }


    if (!RtlValidSid( LocalSystemSid )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSid, LocalSystemSid\n");
        return FALSE;
    }




    //
    //  Test SidAndAttributesArray copy routine
    //

    SourceArray = (PSID_AND_ATTRIBUTES)TstAllocatePool( PagedPool, 100 );
    TargetArray = (PSID_AND_ATTRIBUTES)TstAllocatePool( PagedPool,
                                                        TARGET_SID_ARRAY_LENGTH
                                                        );
    TargetLength = TARGET_SID_ARRAY_LENGTH - (5 * sizeof(PSID_AND_ATTRIBUTES));
    OriginalTargetLength = TargetLength;

    SourceArray[0].Sid = &PebblesSid;
    SourceArray[0].Attributes = 0;
    SourceArray[1].Sid = &FlintstoneSid;
    SourceArray[1].Attributes = OwnerGroupAttributes;
    SourceArray[2].Sid = &ChildSid;
    SourceArray[2].Attributes = NormalGroupAttributes;
    SourceArray[3].Sid = &NeandertholSid;
    SourceArray[3].Attributes = NormalGroupAttributes;
    SourceArray[4].Sid = &WorldSid;
    SourceArray[4].Attributes = NormalGroupAttributes;

    Status = RtlCopySidAndAttributesArray(
                 0,
                 SourceArray,
                 TargetLength,
                 TargetArray,
                 &(TargetArray[5]),
                 &(PSID)Ignore,
                 &TargetLength
                 );

    if (!NT_SUCCESS(Status) || TargetLength != OriginalTargetLength ) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtLCopySidAndAttributesArray, Zero length.\n");
        return FALSE;
    }



    Status = RtlCopySidAndAttributesArray(
                 1,
                 SourceArray,
                 1,                 // too short buffer
                 TargetArray,
                 &(TargetArray[1]),
                 &(PSID)Ignore,
                 &TargetLength
                 );

    if (NT_SUCCESS(Status)) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtLCopySidAndAttributesArray,\n");
        DbgPrint("*Se**              Buffer Too Short Test.\n");
        return FALSE;
    }


    TargetLength = TARGET_SID_ARRAY_LENGTH - (5 * sizeof(PSID_AND_ATTRIBUTES));
    OriginalTargetLength = TargetLength;

    Status = RtlCopySidAndAttributesArray(
                 5,
                 SourceArray,
                 TargetLength,
                 TargetArray,
                 &(TargetArray[5]),
                 &(PSID)Ignore,
                 &TargetLength
                 );

    if (!NT_SUCCESS(Status) ||
        !RtlEqualSid( SourceArray[0].Sid, TargetArray[0].Sid ) ||
        !RtlEqualSid( SourceArray[1].Sid, TargetArray[1].Sid ) ||
        !RtlEqualSid( SourceArray[2].Sid, TargetArray[2].Sid ) ||
        !RtlEqualSid( SourceArray[3].Sid, TargetArray[3].Sid ) ||
        !RtlEqualSid( SourceArray[4].Sid, TargetArray[4].Sid ) ||
        ( SourceArray[0].Attributes != TargetArray[0].Attributes )  ||
        ( SourceArray[1].Attributes != TargetArray[1].Attributes )  ||
        ( SourceArray[2].Attributes != TargetArray[2].Attributes )  ||
        ( SourceArray[3].Attributes != TargetArray[3].Attributes )  ||
        ( SourceArray[4].Attributes != TargetArray[4].Attributes ) ) {

        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtLCopySidAndAttributesArray,\n");
        DbgPrint("*Se**              Valid copy of 5 SIDs test.\n");
        return FALSE;
    }



    return TRUE;


}


BOOLEAN
TestSeSecurityDescriptor()
{
    NTSTATUS Status;
    PSECURITY_DESCRIPTOR TFredDescriptor;
    PSECURITY_DESCRIPTOR TBarneyDescriptor;
    PSECURITY_DESCRIPTOR TWilmaDescriptor;

    PSECURITY_DESCRIPTOR TTempDescriptor;

    SECURITY_DESCRIPTOR_CONTROL Control;
    ULONG Revision;

    PACL TDacl;
    BOOLEAN TDaclPresent;
    BOOLEAN TDaclDefaulted;

    PACL TSacl;
    BOOLEAN TSaclPresent;
    BOOLEAN TSaclDefaulted;

    PSID TOwner;
    BOOLEAN TOwnerDefaulted;
    PSID TGroup;
    BOOLEAN TGroupDefaulted;


    PSID TFredSid;
    PSID TBarneySid;
    PSID TWilmaSid;
    PSID TWilmaSubSid;
    PSID TNoSubSid;
    PSID TTempSid;


    TFredDescriptor   = (PSECURITY_DESCRIPTOR)TstAllocatePool( PagedPool, 1024 );
    TBarneyDescriptor = (PSECURITY_DESCRIPTOR)TstAllocatePool( PagedPool, 1024 );
    TWilmaDescriptor  = (PSECURITY_DESCRIPTOR)TstAllocatePool( PagedPool, 1024 );
    TTempDescriptor   = (PSECURITY_DESCRIPTOR)TstAllocatePool( PagedPool, 1024 );


    TFredSid     = (PSID)TstAllocatePool( PagedPool, 256 );
    TBarneySid   = (PSID)TstAllocatePool( PagedPool, 256 );
    TWilmaSid    = (PSID)TstAllocatePool( PagedPool, 256 );
    TWilmaSubSid = (PSID)TstAllocatePool( PagedPool, 256 );
    TNoSubSid    = (PSID)TstAllocatePool( PagedPool, 256 );
    TTempSid     = (PSID)TstAllocatePool( PagedPool, 256 );


    //
    // Build an ACL or two for use.

    TDacl        = (PACL)TstAllocatePool( PagedPool, 256 );
    TSacl        = (PACL)TstAllocatePool( PagedPool, 256 );

    TDacl->AclRevision=TSacl->AclRevision=ACL_REVISION;
    TDacl->Sbz1=TSacl->Sbz1=0;
    TDacl->Sbz2=TSacl->Sbz2=0;
    TDacl->AclSize=256;
    TSacl->AclSize=8;
    TDacl->AceCount=TSacl->AceCount=0;


    //
    // Create Security Descriptor test
    //

    if (NT_SUCCESS(RtlCreateSecurityDescriptor( TTempDescriptor, 0 ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCreateSecurityDescriptor, Rev=0\n");
        return FALSE;
    }

    if (NT_SUCCESS(RtlCreateSecurityDescriptor( TTempDescriptor, 2 ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCreateSecurityDescriptor, Rev=2\n");
        return FALSE;
    }

    if (!NT_SUCCESS(RtlCreateSecurityDescriptor( TTempDescriptor, 1 ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlCreateSecurityDescriptor, Rev=1\n");
        return FALSE;
    }

#ifdef NOT_YET_DEBUGGED
    //
    // Make sure fields have been set properly
    //

    if (!NT_SUCCESS(RtlGetControlSecurityDescriptor( TTempDescriptor,
                                               &Control,
                                               &Revision))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetControlSecurityDescriptor\n");
        DbgPrint("*Se**     Call failed.  Status = 0x%lx\n", Status);
        return FALSE;
    }

    if ( (Control != 0) || (Revision != 1) ) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetControlSecurityDescriptor\n");
        DbgPrint("*Se**     Bad Control or Revision value. \n");
        DbgPrint("*Se**     Status = 0x%lx\n", Status);
        DbgPrint("*Se**     Returned Revision = 0x%lx\n",Revision );
        DbgPrint("*Se**     Returned Control  = 0x%lx\n", (ULONG)Control);
        return FALSE;
    }
#else
    DBG_UNREFERENCED_LOCAL_VARIABLE( Status );
    DBG_UNREFERENCED_LOCAL_VARIABLE( Revision );
    DBG_UNREFERENCED_LOCAL_VARIABLE( Control );
#endif //NOT_YET_DEFINED

    if (!NT_SUCCESS(RtlGetDaclSecurityDescriptor( TTempDescriptor,
                                               &TDaclPresent,
                                               &TDacl,
                                               &TDaclDefaulted))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetDaclSecurityDescriptor, Empty\n");
        return FALSE;
    }

    if (TDaclPresent) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetDaclSecurityDescriptor, Empty-TDaclPresent\n");
        return FALSE;
    }

    if (!NT_SUCCESS(RtlGetSaclSecurityDescriptor( TTempDescriptor,
                                               &TSaclPresent,
                                               &TSacl,
                                               &TSaclDefaulted))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetSaclSecurityDescriptor, Empty\n");
        return FALSE;
    }

    if (TSaclPresent) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetSaclSecurityDescriptor, Empty-TSaclPresent\n");
        return FALSE;
    }

    if (!NT_SUCCESS(RtlGetOwnerSecurityDescriptor( TTempDescriptor,
                                                &TOwner,
                                                &TOwnerDefaulted))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetOwnerSecurityDescriptor, Empty\n");
        return FALSE;
    }

    if (TOwner != NULL) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetOwnerSecurityDescriptor, Empty-TOwner\n");
        return FALSE;
    }

    if (!NT_SUCCESS(RtlGetGroupSecurityDescriptor( TTempDescriptor,
                                                &TGroup,
                                                &TGroupDefaulted))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetGroupSecurityDescriptor, Empty\n");
        return FALSE;
    }

    if (TGroup != NULL) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlGetGroupSecurityDescriptor, Empty-TGroup\n");
        return FALSE;
    }

    //
    // Valid Security Descriptor test
    //

    ((SECURITY_DESCRIPTOR *)TTempDescriptor)->Revision=0;
    if (RtlValidSecurityDescriptor( TTempDescriptor )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSecurityDescriptor, Rev=0\n");
        return FALSE;
    }
    ((SECURITY_DESCRIPTOR *)TTempDescriptor)->Revision=1;

    if (!RtlValidSecurityDescriptor( TTempDescriptor )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlValidSecurityDescriptor, Empty\n");
        return FALSE;
    }


    //
    // Length test
    //

    if (RtlLengthSecurityDescriptor( TTempDescriptor ) != 20) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlLengthSecurityDescriptor, Empty\n");
        return FALSE;
    }

    //
    // Add in an owner
    //

    if (!NT_SUCCESS(RtlSetOwnerSecurityDescriptor( TTempDescriptor, TWilmaSid, FALSE ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlSetOwnerSecurityDescriptor, TWilmaSid\n");
        return FALSE;
    }
    if (RtlLengthSecurityDescriptor( TTempDescriptor ) != 32) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlLengthSecurityDescriptor, Wilma Owner\n");
        return FALSE;
    }

    //
    // Add in a Dacl
    //

    if (!NT_SUCCESS(RtlSetDaclSecurityDescriptor( TTempDescriptor, TRUE,
                                              TDacl, FALSE ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlSetDaclSecurityDescriptor, TDacl\n");
        return FALSE;
    }
    if (RtlLengthSecurityDescriptor( TTempDescriptor ) != 40) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlLengthSecurityDescriptor, TDacl Dacl\n");
        return FALSE;
    }

    //
    // Add in a Sacl
    //

    if (!NT_SUCCESS(RtlSetSaclSecurityDescriptor( TTempDescriptor, TRUE,
                                              TSacl, FALSE ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlSetSaclSecurityDescriptor, TSacl\n");
        return FALSE;
    }
    if (RtlLengthSecurityDescriptor( TTempDescriptor ) != 48) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlLengthSecurityDescriptor, TSacl Sacl\n");
        return FALSE;
    }

    //
    // Add in a Group (with 2 sub-authorities)
    //

    if (!NT_SUCCESS(RtlSetGroupSecurityDescriptor( TTempDescriptor, TWilmaSubSid, FALSE ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlSetGroupSecurityDescriptor, TWilmaSubSid\n");
        return FALSE;
    }
    if (RtlLengthSecurityDescriptor( TTempDescriptor ) != 64) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("*Se**     Failure: RtlLengthSecurityDescriptor, WilmaSub Group\n");
        return FALSE;
    }


    return TRUE;

}


BOOLEAN
TestSeAccessMask()
{
    return TRUE;
}




VOID
DumpAclSizeInfo(PACL_SIZE_INFORMATION AclSizeInfo)
{
    DbgPrint("\n");
    DbgPrint("Acl size info:\n");
    DbgPrint("AceCount = %d\n",AclSizeInfo->AceCount);
    DbgPrint("AclBytesInUse = %d\n",AclSizeInfo->AclBytesInUse);
    DbgPrint("AclBytesFree = %d\n",AclSizeInfo->AclBytesFree);
    return;
}

#define NUM_ACE 6

typedef struct _SIMPLE_ACE {
    ACE_HEADER Header;
    ACCESS_MASK Mask;
    SID Sid;
    } SIMPLE_ACE, *PSIMPLE_ACE;


BOOLEAN
TestSeAclRtl()
{

    PACL    TDacl;
    NTSTATUS Status;

    ACL_REVISION_INFORMATION AclInformation;
    ACL_REVISION_INFORMATION AclInformationOut;

    ACL_SIZE_INFORMATION AclSizeInfo;

    PVOID AceList;
    PVOID Ace;

    ULONG AceSize;

//
// Define the Dead domain
//
//     Dead Domain         S-1-54399-23-18-02
//     Bobby               S-1-54399-23-18-02-2
//     Jerry               S-1-54399-23-18-02-3
//     Phil                S-1-54399-23-18-02-4
//     Kreutzman           S-1-54399-23-18-02-5
//     Brent               S-1-54399-23-18-02-6
//     Micky               S-1-54399-23-18-02-7
//

#define DEAD_AUTHORITY               {0,0,0,0,212,127}
#define DEAD_SUBAUTHORITY_0          0x00000017L
#define DEAD_SUBAUTHORITY_1          0x00000012L
#define DEAD_SUBAUTHORITY_2          0x00000002L

#define BOBBY_RID               0x00000002
#define JERRY_RID               0x00000003
#define PHIL_RID                0x00000004
#define KREUTZMAN_RID           0x00000005
#define BRENT_RID               0x00000006
#define MICKY_RID               0x00000007

    PSID DeadDomainSid;

    PSID BobbySid;
    PSID JerrySid;
    PSID PhilSid;
    PSID KreutzmanSid;
    PSID BrentSid;
    PSID MickySid;

    ULONG SidWithZeroSubAuthorities;
    ULONG SidWithOneSubAuthority;
    ULONG SidWithThreeSubAuthorities;
    ULONG SidWithFourSubAuthorities;

    SID_IDENTIFIER_AUTHORITY DeadAuthority = DEAD_AUTHORITY;


    //
    //  The following SID sizes need to be allocated
    //

    SidWithZeroSubAuthorities  = RtlLengthRequiredSid( 0 );
    SidWithOneSubAuthority     = RtlLengthRequiredSid( 1 );
    SidWithThreeSubAuthorities = RtlLengthRequiredSid( 3 );
    SidWithFourSubAuthorities  = RtlLengthRequiredSid( 4 );

    DeadDomainSid   = (PSID)TstAllocatePool(PagedPool,SidWithThreeSubAuthorities);

    BobbySid    = (PSID)TstAllocatePool(PagedPool,SidWithFourSubAuthorities);
    JerrySid    = (PSID)TstAllocatePool(PagedPool,SidWithFourSubAuthorities);
    PhilSid     = (PSID)TstAllocatePool(PagedPool,SidWithFourSubAuthorities);
    KreutzmanSid    = (PSID)TstAllocatePool(PagedPool,SidWithFourSubAuthorities);

    BrentSid    = (PSID)TstAllocatePool(PagedPool,SidWithFourSubAuthorities);
    MickySid    = (PSID)TstAllocatePool(PagedPool,SidWithFourSubAuthorities);

    RtlInitializeSid( DeadDomainSid,   &DeadAuthority, 3 );
    *(RtlSubAuthoritySid( DeadDomainSid, 0)) = DEAD_SUBAUTHORITY_0;
    *(RtlSubAuthoritySid( DeadDomainSid, 1)) = DEAD_SUBAUTHORITY_1;
    *(RtlSubAuthoritySid( DeadDomainSid, 2)) = DEAD_SUBAUTHORITY_2;

    RtlCopySid( SidWithFourSubAuthorities, BobbySid, DeadDomainSid);
    *(RtlSubAuthorityCountSid( BobbySid )) += 1;
    *(RtlSubAuthoritySid( BobbySid, 3)) = BOBBY_RID;

    RtlCopySid( SidWithFourSubAuthorities, JerrySid, DeadDomainSid);
    *(RtlSubAuthorityCountSid( JerrySid )) += 1;
    *(RtlSubAuthoritySid( JerrySid, 3)) = JERRY_RID;

    RtlCopySid( SidWithFourSubAuthorities, PhilSid, DeadDomainSid);
    *(RtlSubAuthorityCountSid( PhilSid )) += 1;
    *(RtlSubAuthoritySid( PhilSid, 3)) = PHIL_RID;

    RtlCopySid( SidWithFourSubAuthorities, KreutzmanSid, DeadDomainSid);
    *(RtlSubAuthorityCountSid( KreutzmanSid )) += 1;
    *(RtlSubAuthoritySid( KreutzmanSid, 3)) = KREUTZMAN_RID;

    RtlCopySid( SidWithFourSubAuthorities, BrentSid, DeadDomainSid);
    *(RtlSubAuthorityCountSid( BrentSid )) += 1;
    *(RtlSubAuthoritySid( BrentSid, 3)) = BRENT_RID;

    RtlCopySid( SidWithFourSubAuthorities, MickySid, DeadDomainSid);
    *(RtlSubAuthorityCountSid( MickySid )) += 1;
    *(RtlSubAuthoritySid( MickySid, 3)) = MICKY_RID;

    TDacl = (PACL)TstAllocatePool( PagedPool, 256 );

    //DbgBreakPoint();

    if (!NT_SUCCESS(Status = RtlCreateAcl( TDacl, 256, ACL_REVISION ))) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("RtlCreateAcl returned %X \n",Status);
        return(FALSE);
    }

    //DbgBreakPoint();

    if (!NT_SUCCESS( Status = RtlValidAcl( TDacl ) )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("RtlValidAcl returned %X \n",Status);
        return(FALSE);
    }

    //DbgBreakPoint();

    AclInformation.AclRevision = ACL_REVISION;

    if (!NT_SUCCESS( Status = RtlSetInformationAcl( TDacl, &AclInformation,
                sizeof(AclInformation), AclRevisionInformation ) )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("RtlSetInformation returned %X \n",Status);
        return(FALSE);
    }

    if (!NT_SUCCESS( Status = RtlQueryInformationAcl( TDacl, (PVOID)&AclInformationOut,
                sizeof(AclInformationOut), AclRevisionInformation ) )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("RtlQueryInformation returned %X during revision query \n",Status);
        return(FALSE);
    }

    if (AclInformationOut.AclRevision != ACL_REVISION) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("RtlQueryInformation returned incorrect revision \n");
        return(FALSE);
    }

    if (!NT_SUCCESS( Status = RtlQueryInformationAcl( TDacl, (PVOID)&AclSizeInfo,
                sizeof(AclSizeInfo), AclSizeInformation ) )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("RtlQueryInformation returned %X during size query \n",Status);
        return(FALSE);
    }

    // DumpAclSizeInfo(&AclSizeInfo);

    AceSize = 6 * SidWithFourSubAuthorities + 1 * SidWithThreeSubAuthorities
                    + 7 * (sizeof( ACE_HEADER ) + sizeof( ACCESS_MASK ));

    AceList = (PVOID)TstAllocatePool(PagedPool, AceSize);

    Ace = AceList;

    ((PSIMPLE_ACE)Ace)->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    ((PSIMPLE_ACE)Ace)->Header.AceSize = (USHORT)SidWithThreeSubAuthorities +
                  (USHORT)sizeof(ACE_HEADER) + (USHORT)sizeof( ACCESS_MASK );
    ((PSIMPLE_ACE)Ace)->Header.AceFlags = OBJECT_INHERIT_ACE;
    ((PSIMPLE_ACE)Ace)->Mask = DELETE;
    RtlCopySid(SidWithThreeSubAuthorities,&((PSIMPLE_ACE)Ace)->Sid,DeadDomainSid);

    (ULONG)Ace += ((PSIMPLE_ACE)Ace)->Header.AceSize;

    ((PSIMPLE_ACE)Ace)->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    ((PSIMPLE_ACE)Ace)->Header.AceSize = (USHORT)SidWithFourSubAuthorities +
                  (USHORT)sizeof(ACE_HEADER) + (USHORT)sizeof( ACCESS_MASK );
    ((PSIMPLE_ACE)Ace)->Header.AceFlags = OBJECT_INHERIT_ACE;
    ((PSIMPLE_ACE)Ace)->Mask = DELETE;
    RtlCopySid(SidWithFourSubAuthorities,&((PSIMPLE_ACE)Ace)->Sid,BobbySid);

    (ULONG)Ace += ((PSIMPLE_ACE)Ace)->Header.AceSize;

    ((PSIMPLE_ACE)Ace)->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    ((PSIMPLE_ACE)Ace)->Header.AceSize = (USHORT)SidWithFourSubAuthorities +
                  (USHORT)sizeof(ACE_HEADER) + (USHORT)sizeof( ACCESS_MASK );
    ((PSIMPLE_ACE)Ace)->Header.AceFlags = OBJECT_INHERIT_ACE;
    ((PSIMPLE_ACE)Ace)->Mask = DELETE;
    RtlCopySid(SidWithFourSubAuthorities,&((PSIMPLE_ACE)Ace)->Sid,JerrySid);

    (ULONG)Ace += ((PSIMPLE_ACE)Ace)->Header.AceSize;

    ((PSIMPLE_ACE)Ace)->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    ((PSIMPLE_ACE)Ace)->Header.AceSize = (USHORT)SidWithFourSubAuthorities +
                  (USHORT)sizeof(ACE_HEADER) + (USHORT)sizeof( ACCESS_MASK );
    ((PSIMPLE_ACE)Ace)->Header.AceFlags = OBJECT_INHERIT_ACE;
    ((PSIMPLE_ACE)Ace)->Mask = DELETE;
    RtlCopySid(SidWithFourSubAuthorities,&((PSIMPLE_ACE)Ace)->Sid,PhilSid);

    (ULONG)Ace += ((PSIMPLE_ACE)Ace)->Header.AceSize;

    ((PSIMPLE_ACE)Ace)->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    ((PSIMPLE_ACE)Ace)->Header.AceSize = (USHORT)SidWithFourSubAuthorities +
                  (USHORT)sizeof(ACE_HEADER) + (USHORT)sizeof( ACCESS_MASK );
    ((PSIMPLE_ACE)Ace)->Header.AceFlags = OBJECT_INHERIT_ACE;
    ((PSIMPLE_ACE)Ace)->Mask = DELETE;
    RtlCopySid(SidWithFourSubAuthorities,&((PSIMPLE_ACE)Ace)->Sid,KreutzmanSid);

    (ULONG)Ace += ((PSIMPLE_ACE)Ace)->Header.AceSize;

    ((PSIMPLE_ACE)Ace)->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    ((PSIMPLE_ACE)Ace)->Header.AceSize = (USHORT)SidWithFourSubAuthorities +
                  (USHORT)sizeof(ACE_HEADER) + (USHORT)sizeof( ACCESS_MASK );
    ((PSIMPLE_ACE)Ace)->Header.AceFlags = OBJECT_INHERIT_ACE;
    ((PSIMPLE_ACE)Ace)->Mask = DELETE;
    RtlCopySid(SidWithFourSubAuthorities,&((PSIMPLE_ACE)Ace)->Sid,BrentSid);

    (ULONG)Ace += ((PSIMPLE_ACE)Ace)->Header.AceSize;

    ((PSIMPLE_ACE)Ace)->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
    ((PSIMPLE_ACE)Ace)->Header.AceSize = (USHORT)SidWithFourSubAuthorities +
                  (USHORT)sizeof(ACE_HEADER) + (USHORT)sizeof( ACCESS_MASK );
    ((PSIMPLE_ACE)Ace)->Header.AceFlags = OBJECT_INHERIT_ACE;
    ((PSIMPLE_ACE)Ace)->Mask = DELETE;
    RtlCopySid(SidWithFourSubAuthorities,&((PSIMPLE_ACE)Ace)->Sid,MickySid);

    //DbgBreakPoint();

    RtlAddAce(TDacl, ACL_REVISION, 0, AceList, AceSize);

    if (!NT_SUCCESS( Status = RtlQueryInformationAcl( TDacl, (PVOID)&AclSizeInfo,
                sizeof(AclSizeInfo), AclSizeInformation ) )) {
        DbgPrint("**** Failed **** \n");
        DbgPrint("RtlQueryInformation returned %X during size query \n",Status);
        return(FALSE);
    }

#if 0
    RtlDumpAcl(TDacl);
#endif

    RtlGetAce( TDacl, 5, &Ace );

    if ( !RtlEqualSid( &((PSIMPLE_ACE)Ace)->Sid, BrentSid) ) {
        DbgPrint("\n **** Failed **** \n");
        DbgPrint("RtlGetAce returned wrong Ace\n");
        return(FALSE);
    }

    if (!NT_SUCCESS(RtlDeleteAce (TDacl, 5))) {
        DbgPrint("\n **** Failed **** \n");
        DbgPrint("RtlDeleteAce failed\n");
        return(FALSE);
    }

#if 0
    RtlDumpAcl(TDacl);
#endif

    return(TRUE);
}


BOOLEAN
TestSeRtl()
{

    BOOLEAN Result = TRUE;

    DbgPrint("Se:   Global Variable Initialization...                        ");
    if (TSeVariableInitialization()) {
        DbgPrint("Succeeded.\n");
    } else {
        Result = FALSE;
    }

    DbgPrint("Se:   SID test...                                              ");
    if (TestSeSid()) {
        DbgPrint("Succeeded.\n");
    } else {
        Result = FALSE;
    }

    DbgPrint("Se:   SECURITY_DESCRIPTOR test...                              ");
    if (TestSeSecurityDescriptor()) {
        DbgPrint("Succeeded.\n");
    } else {
        Result = FALSE;
    }

    DbgPrint("Se:   ACCESS_MASK test...                                      ");
    if (TestSeAccessMask()) {
        DbgPrint("Succeeded.\n");
    } else {
        Result = FALSE;
    }

    DbgPrint("Se:   ACL test...                                              ");
    if (TestSeAclRtl()) {
        DbgPrint("Succeeded.\n");
    } else {
        Result = FALSE;
    }

    DbgPrint("\n");
    DbgPrint("\n");
    DbgPrint("    ********************\n");
    DbgPrint("    **                **\n");

    if (Result = TRUE) {
        DbgPrint("    ** Test Succeeded **\n");
    } else {
        DbgPrint("    **  Test Failed   **\n");
    }

    DbgPrint("    **                **\n");
    DbgPrint("    ********************\n");
    DbgPrint("\n");
    DbgPrint("\n");

    return Result;
}