//+-------------------------------------------------------------------------
//
// Microsoft Windows
//
// Copyright (C) Microsoft Corporation, 1997 - 1999
//
// File: ace.cpp
//
// This file contains the implementation of the CAce class
//
//--------------------------------------------------------------------------
#include "aclpriv.h"
#include "sddl.h" // ConvertSidToStringSid
CAce::CAce(PACE_HEADER pAce):pszInheritSourceName(NULL),
iInheritSourceLevel(0)
{
ULONG nSidLength = 0;
ULONG nAceLength = SIZEOF(KNOWN_ACE) - SIZEOF(ULONG);
ZeroMemory(this, SIZEOF(CAce));
sidType = SidTypeInvalid;
InheritedObjectType = GUID_NULL;
if (pAce != NULL)
{
PSID psidT;
// Copy the header and mask
*(PACE_HEADER)this = *pAce;
Mask = ((PKNOWN_ACE)pAce)->Mask;
// Is this an object ACE?
if (IsObjectAceType(pAce))
{
GUID *pGuid;
nAceLength = SIZEOF(KNOWN_OBJECT_ACE) - SIZEOF(ULONG);
// Copy the object type guid if present
pGuid = RtlObjectAceObjectType(pAce);
if (pGuid)
{
Flags |= ACE_OBJECT_TYPE_PRESENT;
ObjectType = *pGuid;
nAceLength += SIZEOF(GUID);
}
//
//ACE_INHERITED_OBJECT_TYPE_PRESENT is invalid without
//either of container inherit or object inherit flags.
//NTRAID#NTBUG9-287737-2001/01/23-hiteshr
//
if (pAce->AceFlags & ACE_INHERIT_ALL)
{
//Copy the inherit type guid if present
pGuid = RtlObjectAceInheritedObjectType(pAce);
if (pGuid)
{
Flags |= ACE_INHERITED_OBJECT_TYPE_PRESENT;
InheritedObjectType = *pGuid;
nAceLength += SIZEOF(GUID);
}
}
}
// Copy the SID
psidT = GetAceSid(pAce);
nSidLength = GetLengthSid(psidT);
psid = (PSID)LocalAlloc(LPTR, nSidLength);
if (psid)
CopyMemory(psid, psidT, nSidLength);
}
AceSize = (USHORT)(nAceLength + nSidLength);
}
CAce::~CAce()
{
if (psid != NULL)
LocalFree(psid);
LocalFreeString(&pszName);
LocalFreeString(&pszType);
LocalFreeString(&pszAccessType);
LocalFreeString(&pszInheritType);
LocalFreeString(&pszInheritSourceName);
}
void
CAce::SetInheritSourceInfo(LPCTSTR psz, INT level)
{
#define MAX_BUFFER 1000
iInheritSourceLevel = level;
if(psz != NULL)
{
SetString(&pszInheritSourceName,psz);
}
else
{
WCHAR Buffer[MAX_BUFFER];
if(IsInheritedAce())
{
LoadString(::hModule, IDS_FROM_PARENT, Buffer, ARRAYSIZE(Buffer));
SetString(&pszInheritSourceName,Buffer);
iInheritSourceLevel = -1;
}
else
{
LoadString(::hModule, IDS_NOT_INHERITED, Buffer, ARRAYSIZE(Buffer));
SetString(&pszInheritSourceName,Buffer);
iInheritSourceLevel = 0;
}
}
}
LPTSTR
CAce::LookupName(LPCTSTR pszServer, LPSECURITYINFO2 psi2)
{
if (SidTypeInvalid == sidType)
{
PUSER_LIST pUserList = NULL;
LPCTSTR pszN = NULL;
LPCTSTR pszL = NULL;
sidType = SidTypeUnknown;
if (LookupSid(psid, pszServer, psi2, &pUserList))
{
sidType = pUserList->rgUsers[0].SidType;
pszN = pUserList->rgUsers[0].pszName;
pszL = pUserList->rgUsers[0].pszLogonName;
}
SetName(pszN, pszL);
if (pUserList)
LocalFree(pUserList);
}
return pszName;
}
void
CAce::SetName(LPCTSTR pszN, LPCTSTR pszL)
{
LocalFreeString(&pszName);
if (!BuildUserDisplayName(&pszName, pszN, pszL) && psid)
ConvertSidToStringSid(psid, &pszName);
}
void
CAce::SetSid(PSID p, LPCTSTR pszName, LPCTSTR pszLogonName, SID_NAME_USE type)
{
ULONG nSidLength = 0;
ULONG nAceLength = SIZEOF(KNOWN_ACE) - SIZEOF(ULONG);
if (psid != NULL)
{
LocalFree(psid);
psid = NULL;
}
if (p != NULL)
{
nSidLength = GetLengthSid(p);
psid = (PSID)LocalAlloc(LPTR, nSidLength);
if (psid)
CopyMemory(psid, p, nSidLength);
}
if (Flags != 0)
{
nAceLength = SIZEOF(KNOWN_OBJECT_ACE) - SIZEOF(ULONG);
if (Flags & ACE_OBJECT_TYPE_PRESENT)
nAceLength += SIZEOF(GUID);
if (Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT)
nAceLength += SIZEOF(GUID);
}
AceSize = (USHORT)(nAceLength + nSidLength);
sidType = type;
SetName(pszName, pszLogonName);
}
void
CAce::SetString(LPTSTR *ppszDest, LPCTSTR pszSrc)
{
LocalFreeString(ppszDest);
if (NULL != pszSrc)
LocalAllocString(ppszDest, pszSrc);
}
PACE_HEADER
CAce::Copy() const
{
PACE_HEADER pAceCopy = (PACE_HEADER)LocalAlloc(LPTR, AceSize);
CopyTo(pAceCopy);
return pAceCopy;
}
void
CAce::CopyTo(PACE_HEADER pAceDest) const
{
if (pAceDest)
{
ULONG nAceLength = SIZEOF(KNOWN_ACE) - SIZEOF(ULONG);
ULONG nSidLength;
// Copy the header and mask
*pAceDest = *(PACE_HEADER)this;
((PKNOWN_ACE)pAceDest)->Mask = Mask;
// Is this an object ACE?
if (IsObjectAceType(this))
{
GUID *pGuid;
nAceLength = SIZEOF(KNOWN_OBJECT_ACE) - SIZEOF(ULONG);
// Copy the object flags
((PKNOWN_OBJECT_ACE)pAceDest)->Flags = Flags;
// Copy the object type guid if present
pGuid = RtlObjectAceObjectType(pAceDest);
if (pGuid)
{
*pGuid = ObjectType;
nAceLength += SIZEOF(GUID);
}
// Copy the inherit type guid if present
pGuid = RtlObjectAceInheritedObjectType(pAceDest);
if (pGuid)
{
*pGuid = InheritedObjectType;
nAceLength += SIZEOF(GUID);
}
}
// Copy the SID
nSidLength = GetLengthSid(psid);
CopyMemory(GetAceSid(pAceDest), psid, nSidLength);
// The size should already be correct, but set it here to be sure.
pAceDest->AceSize = (USHORT)(nAceLength + nSidLength);
}
}
int
CAce::CompareType(const CAce *pAceCompare) const
{
//
// Determine which ACE preceeds the other in canonical ordering.
//
// Return negative if this ACE preceeds pAceCompare, positive if
// pAceCompare preceeds this ACE, and 0 if they are equivalent in
// canonical ordering.
//
BOOL b1;
BOOL b2;
//
// First check inheritance. Inherited ACEs follow non-inherited ACEs.
//
b1 = AceFlags & INHERITED_ACE;
b2 = pAceCompare->AceFlags & INHERITED_ACE;
if (b1 != b2)
{
// One (and only one) of the ACEs is inherited.
return (b1 ? 1 : -1);
}
//
// Next, Allow ACEs follow Deny ACEs.
// Note that allow/deny has no effect on the ordering of Audit ACEs.
//
b1 = (AceType == ACCESS_ALLOWED_ACE_TYPE ||
AceType == ACCESS_ALLOWED_OBJECT_ACE_TYPE);
b2 = (pAceCompare->AceType == ACCESS_ALLOWED_ACE_TYPE ||
pAceCompare->AceType == ACCESS_ALLOWED_OBJECT_ACE_TYPE);
if (b1 != b2)
{
// One of the ACEs is an Allow ACE.
return (b1 ? 1 : -1);
}
//
// Next, Object ACEs follow non-object ACEs.
//
b1 = (AceType >= ACCESS_MIN_MS_OBJECT_ACE_TYPE &&
AceType <= ACCESS_MAX_MS_OBJECT_ACE_TYPE);
b2 = (pAceCompare->AceType >= ACCESS_MIN_MS_OBJECT_ACE_TYPE &&
pAceCompare->AceType <= ACCESS_MAX_MS_OBJECT_ACE_TYPE);
if (b1 != b2)
{
// One of the ACEs is an Object ACE.
return (b1 ? 1 : -1);
}
return 0;
}
DWORD
CAce::Merge(const CAce *pAce2)
{
DWORD dwStatus;
DWORD dwMergeFlags = 0;
DWORD dwResult;
if (pAce2 == NULL)
return MERGE_FAIL;
//if either of the ace is inherited and they are not from the same parent
if( GetInheritSourceLevel() != pAce2->GetInheritSourceLevel() )
return MERGE_FAIL;
//
// The ACEs have to be the same basic type and have the same SID or
// there's no hope.
//
if (!IsEqualACEType(AceType, pAce2->AceType) ||
!EqualSid(psid, pAce2->psid))
return MERGE_FAIL;
if (!IsEqualGUID(InheritedObjectType, pAce2->InheritedObjectType))
return MERGE_FAIL; // incompatible inherit object types
if (Flags & ACE_OBJECT_TYPE_PRESENT)
dwMergeFlags |= MF_OBJECT_TYPE_1_PRESENT;
if (pAce2->Flags & ACE_OBJECT_TYPE_PRESENT)
dwMergeFlags |= MF_OBJECT_TYPE_2_PRESENT;
if (IsEqualGUID(ObjectType, pAce2->ObjectType))
dwMergeFlags |= MF_OBJECT_TYPE_EQUAL;
if (IsAuditAlarmACE(AceType))
dwMergeFlags |= MF_AUDIT_ACE_TYPE;
dwStatus = MergeAceHelper(AceFlags,
Mask,
pAce2->AceFlags,
pAce2->Mask,
dwMergeFlags,
&dwResult);
switch (dwStatus)
{
case MERGE_MODIFIED_FLAGS:
AceFlags = (UCHAR)dwResult;
break;
case MERGE_MODIFIED_MASK:
Mask = dwResult;
break;
}
return dwStatus;
}
BOOL
IsEqualACEType(DWORD dwType1, DWORD dwType2)
{
if (dwType1 >= ACCESS_MIN_MS_OBJECT_ACE_TYPE &&
dwType1 <= ACCESS_MAX_MS_OBJECT_ACE_TYPE)
dwType1 -= (ACCESS_ALLOWED_OBJECT_ACE_TYPE - ACCESS_ALLOWED_ACE_TYPE);
if (dwType2 >= ACCESS_MIN_MS_OBJECT_ACE_TYPE &&
dwType2 <= ACCESS_MAX_MS_OBJECT_ACE_TYPE)
dwType2 -= (ACCESS_ALLOWED_OBJECT_ACE_TYPE - ACCESS_ALLOWED_ACE_TYPE);
return (dwType1 == dwType2);
}
DWORD
MergeAceHelper(DWORD dwAceFlags1,
DWORD dwMask1,
DWORD dwAceFlags2,
DWORD dwMask2,
DWORD dwMergeFlags,
LPDWORD pdwResult)
{
// Assumptions:
// The ACEs are the same basic type.
// The SIDs are the same for both.
// The Inherit object type is the same for both.
if (pdwResult == NULL)
return MERGE_FAIL;
*pdwResult = 0;
if (dwMergeFlags & MF_OBJECT_TYPE_EQUAL)
{
if (dwAceFlags1 == dwAceFlags2)
{
//
// Everything matches except maybe the mask, which
// can be combined here.
//
if (AllFlagsOn(dwMask1, dwMask2))
return MERGE_OK_1;
else if (AllFlagsOn(dwMask2, dwMask1))
return MERGE_OK_2;
*pdwResult = dwMask1 | dwMask2;
return MERGE_MODIFIED_MASK;
}
else if ((dwAceFlags1 & VALID_INHERIT_FLAGS) == (dwAceFlags2 & VALID_INHERIT_FLAGS) &&
dwMask1 == dwMask2)
{
// If 2 audit aces are identical except for the audit
// type (success/fail), the flags can be combined.
if (dwMergeFlags & MF_AUDIT_ACE_TYPE)
{
*pdwResult = dwAceFlags1 | dwAceFlags2;
return MERGE_MODIFIED_FLAGS;
}
}
else if ((dwAceFlags1 & (NO_PROPAGATE_INHERIT_ACE | INHERITED_ACE | FAILED_ACCESS_ACE_FLAG | SUCCESSFUL_ACCESS_ACE_FLAG))
== (dwAceFlags2 & (NO_PROPAGATE_INHERIT_ACE | INHERITED_ACE | FAILED_ACCESS_ACE_FLAG | SUCCESSFUL_ACCESS_ACE_FLAG)))
{
// The NO_PROPAGATE_INHERIT_ACE bit is the same for both
if (dwMask1 == dwMask2)
{
// The masks are the same, so we can combine inherit flags
*pdwResult = dwAceFlags1;
// INHERIT_ONLY_ACE should be turned on only if it is
// already on in both ACEs, otherwise leave it off.
if (!(dwAceFlags2 & INHERIT_ONLY_ACE))
*pdwResult &= ~INHERIT_ONLY_ACE;
// Combine the remaining inherit flags and return
*pdwResult |= dwAceFlags2 & (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE);
return MERGE_MODIFIED_FLAGS;
}
else if (AllFlagsOn(dwMask1, dwMask2))
{
// mask1 contains mask2. If Ace1 is inherited onto all of the
// same things that Ace2 is, then Ace2 is redundant.
if ((!(dwAceFlags1 & INHERIT_ONLY_ACE) || (dwAceFlags2 & INHERIT_ONLY_ACE))
&& AllFlagsOn(dwAceFlags1 & ACE_INHERIT_ALL, dwAceFlags2 & ACE_INHERIT_ALL))
return MERGE_OK_1;
}
else if (AllFlagsOn(dwMask2, dwMask1))
{
// Same as above, reversed.
if ((!(dwAceFlags2 & INHERIT_ONLY_ACE) || (dwAceFlags1 & INHERIT_ONLY_ACE))
&& AllFlagsOn(dwAceFlags2 & ACE_INHERIT_ALL, dwAceFlags1 & ACE_INHERIT_ALL))
return MERGE_OK_2;
}
}
}
else if (dwAceFlags1 == dwAceFlags2)
{
if (!(dwMergeFlags & MF_OBJECT_TYPE_1_PRESENT) &&
AllFlagsOn(dwMask1, dwMask2))
{
//
// The other ACE has a non-NULL object type but this ACE has no object
// type and a mask that includes all of the bits in the other one.
// I.e. This ACE implies the other ACE.
//
return MERGE_OK_1;
}
else if (!(dwMergeFlags & MF_OBJECT_TYPE_2_PRESENT) &&
AllFlagsOn(dwMask2, dwMask1))
{
//
// This ACE has a non-NULL object type but the other ACE has no object
// type and a mask that includes all of the bits in this one.
// I.e. The other ACE implies this ACE.
//
return MERGE_OK_2;
}
}
return MERGE_FAIL;
}