windows-xp/Source/XPSP1/NT/base/eventlog/server/logclear.c

/*++

Copyright (c) 1991-1994  Microsoft Corporation

Module Name:

    logclear.c

Abstract:

    Contains functions used to log an event indicating who cleared the log.
    This is only called after the security log has been cleared.

Author:

    Dan Lafferty (danl)     01-July-1994

Environment:

    User Mode -Win32

Revision History:

    01-July-1994    danl & robertre
        Created - Rob supplied the code which I fitted into the eventlog.

--*/

#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#include <windows.h>
#include <stdio.h>
#include <msaudite.h>
#include <eventp.h>
#include <tstr.h>
#include <winsock2.h>

#define NUM_STRINGS     6


//
// LOCAL FUNCTION PROTOTYPES
//
BOOL
GetUserInfo(
    IN HANDLE Token,
    OUT LPWSTR *UserName,
    OUT LPWSTR *DomainName,
    OUT LPWSTR *AuthenticationId,
    OUT PSID *UserSid
    );

LPWSTR
ElfpGetComputerName(
    VOID
    );

LPWSTR 
GetNameFromIPAddress(
	LPWSTR pszComputerNameFromBinding);

BOOL
IsLocal(
    VOID
    );
    
VOID
ElfpGenerateLogClearedEvent(
    IELF_HANDLE    LogHandle
    )

/*++

Routine Description:

    This function generates an event indicating that the log was cleared.

Arguments:

    LogHandle -- This is a handle to the log that the event is to be placed in.
        It is intended that this function only be called when the SecurityLog
        has been cleared.  So it is expected the LogHandle will always be
        a handle to the security log.

Return Value:

    None -- Either it works or it doesn't.  If it doesn't, there isn't much
            we can do about it.

--*/
{
    LPWSTR  UserName               = NULL;
    LPWSTR  DomainName             = NULL;
    LPWSTR  AuthenticationId       = NULL;
    LPWSTR  ClientUserName         = NULL;
    LPWSTR  ClientDomainName       = NULL;
    LPWSTR  ClientAuthenticationId = NULL;
    PSID    UserSid                = NULL;
    PSID    ClientSid              = NULL;
    LPWSTR  ComputerName           = NULL;
    DWORD   i;
    BOOL    Result;
    HANDLE  Token;
    PUNICODE_STRING StringPtrArray[NUM_STRINGS];
    UNICODE_STRING  StringArray[NUM_STRINGS];
    NTSTATUS        Status;
    LARGE_INTEGER   Time;
    ULONG           EventTime;
    ULONG           LogHandleGrantedAccess;
    UNICODE_STRING  ComputerNameU;
    DWORD           dwStatus;

    //
    // Get information about the Eventlog service (i.e., LocalSystem)
    //
    Result = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &Token);

    if (!Result)
    {
        ELF_LOG1(ERROR,
                 "ElfpGenerateLogClearedEvent: OpenProcessToken failed %d\n",
                 GetLastError());

        return;
    }

    Result = GetUserInfo(Token,
                         &UserName,
                         &DomainName,
                         &AuthenticationId,
                         &UserSid);

    CloseHandle(Token);

    if (!Result)
    {
        ELF_LOG1(ERROR,
                 "ElfpGenerateLogClearedEvent: GetUserInfo failed %d\n",
                 GetLastError());

        return;
    }

    ELF_LOG3(TRACE,
             "ElfpGenerateLogClearedEvent: GetUserInfo returned: \n"
                 "\tUserName         = %ws,\n"
                 "\tDomainName       = %ws,\n"
                 "\tAuthenticationId = %ws\n",
             UserName,
             DomainName,
             AuthenticationId);

    //
    // Now impersonate in order to get the client's information.
    // This call should never fail.
    //
    dwStatus = RpcImpersonateClient(NULL);

    if (dwStatus != RPC_S_OK)
    {
        ELF_LOG1(ERROR,
                 "ElfpGenerateLogClearedEvent: RpcImpersonateClient failed %d\n",
                 dwStatus);
        goto CleanExit;
                 
    }

    Result = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &Token);

    if (Result)
    {
        Result = GetUserInfo(Token,
                             &ClientUserName,
                             &ClientDomainName,
                             &ClientAuthenticationId,
                             &ClientSid);

        CloseHandle(Token);

        if (!Result)
        {
            ELF_LOG1(ERROR,
                     "ElfpGenerateLogClearedEvent: GetUserInfo (call 2) failed %d\n",
                     GetLastError());

            goto CleanExit;
        }
    }
    else
    {
        //
        // We're impersonating here, so this should never
        // happen but just in case, use dashes
        //
        ELF_LOG1(ERROR,
                 "ElfpGenerateLogClearedEvent: OpenThreadToken failed %d\n",
                 GetLastError());

        ASSERT(FALSE);

        ClientUserName = L"-";
        ClientDomainName = L"-";
        ClientAuthenticationId = L"-";
    }

    ELF_LOG3(TRACE,
             "ElfpGenerateLogClearedEvent: GetUserInfo (call 2) returned: \n"
                 "\tUserName         = %ws,\n"
                 "\tDomainName       = %ws,\n"
                 "\tAuthenticationId = %ws\n",
             ClientUserName,
             ClientDomainName,
             ClientAuthenticationId);

    RtlInitUnicodeString(&StringArray[0], UserName);
    RtlInitUnicodeString(&StringArray[1], DomainName);
    RtlInitUnicodeString(&StringArray[2], AuthenticationId);
    RtlInitUnicodeString(&StringArray[3], ClientUserName);
    RtlInitUnicodeString(&StringArray[4], ClientDomainName);
    RtlInitUnicodeString(&StringArray[5], ClientAuthenticationId);

    //
    // Create an array of pointers to UNICODE_STRINGs.
    //
    for (i = 0; i < NUM_STRINGS; i++)
    {
        StringPtrArray[i] = &StringArray[i];
    }

    //
    // Generate the time of the event. This is done on the client side
    // since that is where the event occurred.
    //
    NtQuerySystemTime(&Time);
    RtlTimeToSecondsSince1970(&Time, &EventTime);

    //
    // Generate the ComputerName of the client.
    // We have to do this in the client side since this call may be
    // remoted to another server and we would not necessarily have
    // the computer name there.
    //

    ComputerName = ElfpGetComputerName();
    if(ComputerName == NULL)
    	goto CleanExit;				// ElfpGetComputerName dumps error msg
    RtlInitUnicodeString(&ComputerNameU, ComputerName);

    //
    // Since all processes other than LSA are given read-only access
    // to the security log, we have to explicitly give the current
    // process the right to write the "Log cleared" event
    //
    LogHandleGrantedAccess    = LogHandle->GrantedAccess;
    LogHandle->GrantedAccess |= ELF_LOGFILE_WRITE;

    Status = ElfrReportEventW (
                 LogHandle,                         // Log Handle
                 EventTime,                         // Time
                 EVENTLOG_AUDIT_SUCCESS,            // Event Type
                 (USHORT)SE_CATEGID_SYSTEM,         // Event Category
                 SE_AUDITID_AUDIT_LOG_CLEARED,      // EventID
                 NUM_STRINGS,                       // NumStrings
                 0,                                 // DataSize
                 &ComputerNameU,                    // ComputerNameU
                 UserSid,                           // UserSid
                 StringPtrArray,                    // *Strings
                 NULL,                              // Data
                 0,                                 // Flags
                 NULL,                              // RecordNumber
                 NULL);                             // TimeWritten

    LogHandle->GrantedAccess = LogHandleGrantedAccess;

CleanExit:

    //
    // We only come down this path if we know for sure that these
    // first three have been allocated.
    //
    ElfpFreeBuffer(UserName);
    ElfpFreeBuffer(DomainName);
    ElfpFreeBuffer(AuthenticationId);

    ElfpFreeBuffer(UserSid);
    ElfpFreeBuffer(ClientUserName);
    ElfpFreeBuffer(ClientDomainName);
    ElfpFreeBuffer(ClientAuthenticationId);
    ElfpFreeBuffer(ClientSid);
    ElfpFreeBuffer(ComputerName);
    //
    // Stop impersonating
    //
    dwStatus = RpcRevertToSelf();
    
    if (dwStatus != RPC_S_OK)
    {
        ELF_LOG1(ERROR,
                 "ElfpGenerateLogClearedEvent: RpcRevertToSelf failed %d\n",
                 GetLastError());
    }
}


BOOL
GetUserInfo(
    IN HANDLE  Token,
    OUT LPWSTR *UserName,
    OUT LPWSTR *DomainName,
    OUT LPWSTR *AuthenticationId,
    OUT PSID   *UserSid
    )

/*++

Routine Description:

    This function gathers information about the user identified with the
    token.

Arguments:
    Token - This token identifies the entity for which we are gathering
        information.
    UserName - This is the entity's user name.
    DomainName -  This is the entity's domain name.
    AuthenticationId -  This is the entity's Authentication ID.
    UserSid - This is the entity's SID.

NOTE:
    Memory is allocated by this routine for UserName, DomainName,
    AuthenticationId, and UserSid.  It is the caller's responsibility to
    free this memory.

Return Value:
    TRUE - If the operation was successful.  It is possible that
        UserSid did not get allocated in the successful case.  Therefore,
        the caller should test prior to freeing.
    FALSE - If unsuccessful.  No memory is allocated in this case.


--*/
{
    PTOKEN_USER      Buffer      = NULL;
    LPWSTR           Domain      = NULL;
    LPWSTR           AccountName = NULL;
    SID_NAME_USE     Use;
    BOOL             Result;
    DWORD            RequiredLength;
    DWORD            AccountNameSize;
    DWORD            DomainNameSize;
    TOKEN_STATISTICS Statistics;
    WCHAR            LogonIdString[256];
    DWORD            Status = ERROR_SUCCESS;


    *UserSid = NULL;

    Result = GetTokenInformation(Token, TokenUser, NULL, 0, &RequiredLength);

    if (!Result)
    {
        if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
        {
            ELF_LOG1(TRACE,
                     "GetUserInfo: GetTokenInformation needs %d bytes\n",
                     RequiredLength);

            Buffer = ElfpAllocateBuffer(RequiredLength);

            if (Buffer == NULL)
            {
                ELF_LOG0(ERROR,
                         "GetUserInfo: Unable to allocate memory for token\n");

                return FALSE;
            }

            Result = GetTokenInformation(Token,
                                         TokenUser,
                                         Buffer,
                                         RequiredLength,
                                         &RequiredLength);

            if (!Result)
            {
                ELF_LOG1(ERROR,
                         "GetUserInfo: GetTokenInformation (call 2) failed %d\n",
                         GetLastError());

                return FALSE;
            }
        }
        else
        {
            ELF_LOG1(ERROR,
                     "GetUserInfo: GetTokenInformation (call 1) failed %d\n",
                     GetLastError());

            return FALSE;
        }
    }

    AccountNameSize = 0;
    DomainNameSize  = 0;

    Result = LookupAccountSidW(L"",
                               Buffer->User.Sid,
                               NULL,
                               &AccountNameSize,
                               NULL,
                               &DomainNameSize,
                               &Use);

    if (!Result)
    {
        if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
        {
            AccountName = ElfpAllocateBuffer((AccountNameSize + 1) * sizeof(WCHAR));
            Domain = ElfpAllocateBuffer((DomainNameSize + 1) * sizeof(WCHAR));

            if (AccountName == NULL)
            {
                ELF_LOG1(ERROR,
                         "GetUserInfo: Unable to allocate %d bytes for AccountName\n",
                         AccountNameSize);

                goto ErrorCleanup;
            }

            if (Domain == NULL)
            {
                ELF_LOG1(ERROR,
                         "GetUserInfo: Unable to allocate %d bytes for Domain\n",
                         DomainNameSize);

                goto ErrorCleanup;
            }

            Result = LookupAccountSidW(L"",
                                       Buffer->User.Sid,
                                       AccountName,
                                       &AccountNameSize,
                                       Domain,
                                       &DomainNameSize,
                                       &Use
                                       );
            if (!Result)
            {
                ELF_LOG1(ERROR,
                         "GetUserInfo: LookupAccountSid (call 2) failed %d\n",
                         GetLastError());

                goto ErrorCleanup;
            }
        }
        else
        {
            ELF_LOG1(ERROR,
                     "GetUserInfo: LookupAccountsid (call 1) failed %d\n",
                     GetLastError());

            goto ErrorCleanup;
        }
    }
    else
    {
        ELF_LOG0(ERROR,
                 "GetUserInfo: LookupAccountSid succeeded unexpectedly\n");

        goto ErrorCleanup;
    }

    ELF_LOG2(TRACE,
             "GetUserInfo: Name = %ws\\%ws\n",
             Domain,
             AccountName);

    Result = GetTokenInformation(Token,
                                 TokenStatistics,
                                 &Statistics,
                                 sizeof(Statistics),
                                 &RequiredLength);

    if (!Result)
    {
        ELF_LOG1(ERROR,
                 "GetUserInfo: GetTokenInformation (call 3) failed %d\n",
                 GetLastError());

        goto ErrorCleanup;
    }

    swprintf(LogonIdString,
             L"(0x%X,0x%X)",
             Statistics.AuthenticationId.HighPart,
             Statistics.AuthenticationId.LowPart);

    ELF_LOG1(TRACE,
             "GetUserInfo: LogonIdString = %ws\n",
             LogonIdString);

    *AuthenticationId = ElfpAllocateBuffer(WCSSIZE(LogonIdString));

    if (*AuthenticationId == NULL)
    {
        ELF_LOG0(ERROR,
                 "GetUserInfo: Unable to allocate memory for AuthenticationId\n");

        goto ErrorCleanup;
    }

    wcscpy(*AuthenticationId, LogonIdString);

    //
    // Return accumulated information
    //
    *UserSid = ElfpAllocateBuffer(GetLengthSid(Buffer->User.Sid));

    if (*UserSid == NULL)
    {
        ELF_LOG0(ERROR,
                 "GetUserInfo: Unable to allocate memory for UserSid\n");

        goto ErrorCleanup;
    }

    Result = CopySid(GetLengthSid(Buffer->User.Sid),
                     *UserSid,
                     Buffer->User.Sid);

    ElfpFreeBuffer(Buffer);

    *DomainName = Domain;
    *UserName   = AccountName;

    return TRUE;

ErrorCleanup:

    ElfpFreeBuffer(Buffer);
    ElfpFreeBuffer(Domain);
    ElfpFreeBuffer(AccountName);
    ElfpFreeBuffer(*UserSid);
    ElfpFreeBuffer(*AuthenticationId);

    return FALSE;
}



LPWSTR 
GetNameFromIPAddress(
	LPWSTR pszComputerNameFromBinding)
/*++

Routine Description:

    Examines a string and determines if it looks like an ip address.  If it
    does, then it converts it to a fqdn

Arguments:

    Machine name:  Could be xxx.xxx.xxx.xxx or anything else!

Return Value:

    If successful, returns a fully qualified domain name which the caller
    will free.  Returns NULL if there are any problems.


--*/
{

	LPWSTR pComputerName = NULL;
	DWORD dwAddr;
	char cName[17];  // should be plenty of room
	size_t NumConv;
	HOSTENT  FAR * pEnt;
	DWORD dwSize;
	WORD wVersionRequested;
	WSADATA wsaData;
	int error;
	
	NumConv = wcstombs(cName, pszComputerNameFromBinding, 16);  
	if(NumConv == -1 || NumConv == 0)
	    return NULL;

	// convert the string into a network order dword representation
	
	dwAddr = inet_addr(cName);
	if(dwAddr == INADDR_NONE)
		return NULL;

	//  initialize sockets.

	wVersionRequested = MAKEWORD( 2, 2 );
 
    error = WSAStartup( wVersionRequested, &wsaData );
	if(error != 0)
	{
	   	ELF_LOG1(TRACE,
           "GetNameFromIPAddress: failed to initialize sockets, error = 0x%x\n", error);
		return NULL;
	}

		
	pEnt = gethostbyaddr((char FAR *)&dwAddr, 4, PF_INET);
	if(pEnt == NULL || pEnt->h_name == NULL)
	{
	   	ELF_LOG1(TRACE,
                 "GetNameFromIPAddress: failed gethostbyaddr, error = 0x%x\n",
                 WSAGetLastError());
		WSACleanup();
		return NULL;
	}
	dwSize = strlen(pEnt->h_name) + 1 ;
	pComputerName = ElfpAllocateBuffer(2*dwSize);
	if(pComputerName == NULL)
	{
	   	ELF_LOG0(ERROR,
                 "GetNameFromIPAddress: failed trying to allocate memory\n");
	    WSACleanup();
		return NULL;
	}
	pComputerName[0] = 0;
	mbstowcs(pComputerName, pEnt->h_name, dwSize);
    WSACleanup();
	return pComputerName;
}

BOOL
IsLocal(
    VOID
    )
/*++

Routine Description:

    Determines if the caller is local. 

Arguments:

    NONE

Return Value:

    TRUE if definately local.


--*/
{
    UINT            LocalFlag;
    RPC_STATUS      RpcStatus;
    RpcStatus = I_RpcBindingIsClientLocal(0, &LocalFlag);

    if( RpcStatus != RPC_S_OK ) 
    {
        ELF_LOG1(ERROR,
                 "IsLocal: I_RpcBindingIsClientLocal failed %d\n",
                 RpcStatus);
        return FALSE;
    }
    if(LocalFlag == 0)
        return FALSE;
    else
    	return TRUE;
}

LPWSTR
ElfpGetComputerName(
    VOID
    )

/*++

Routine Description:

    This routine gets the LPWSTR name of the computer. 

Arguments:

    NONE

Return Value:

    Returns a pointer to the computer name, or a NULL.  Note that the caller
    is expected to free this via 


--*/
{
    RPC_STATUS      RpcStatus;
    handle_t hServerBinding = NULL;
    LPWSTR pszBinding = NULL;
    LPWSTR pszComputerNameFromBinding = NULL;
	LPWSTR pszComputerName = NULL;
	DWORD dwSize;
	BOOL bOK;

//      Check if the connection is local.  If it is, then just 
//      call GetComputerName

	if(IsLocal())
	{
		dwSize = MAX_COMPUTERNAME_LENGTH + 1 ;
		pszComputerName = ElfpAllocateBuffer(2*dwSize);
		if(pszComputerName == NULL)
		{
        	ELF_LOG0(ERROR,
                 "ElfpGetComputerName: failed trying to allocate memory\n");
			return NULL;
		}
		bOK = GetComputerNameW(pszComputerName, &dwSize);
		if(bOK == FALSE)
		{
			ElfpFreeBuffer(pszComputerName);
        	ELF_LOG1(ERROR,
                 "ElfpGetComputerName: failed calling GetComputerNameW, last error 0x%x\n",
                  GetLastError());
            return NULL;    
		}
		else
			return pszComputerName;
	}

    RpcStatus = RpcBindingServerFromClient( NULL, &hServerBinding );
    if( RpcStatus != RPC_S_OK ) 
    {
        ELF_LOG1(ERROR,
                 "ElfpGetComputerName: RpcBindingServerFromClient failed %d\n",
                 RpcStatus);
        return NULL;
    }

	// This gets us something like "ncacn_np:xxx.xxx.xxx.xxx" or 
	// "ncacn_np:localMachine"
	
    RpcStatus = RpcBindingToStringBinding( hServerBinding, &pszBinding );
    if( RpcStatus != ERROR_SUCCESS )
    {
        ELF_LOG1(ERROR,
                 "ElfpGetComputerName: RpcBindingToStringBinding failed %d\n",
                 RpcStatus);
        goto CleanExitGetCompName;
    } 

    // Acquire just the network address.  That will be something like
    // "xxx.xxx.xxx.xxx" or "mymachine"

    RpcStatus = RpcStringBindingParse( pszBinding,
                                                NULL,
                                                NULL,
                                                &pszComputerNameFromBinding,
                                                NULL,
                                                NULL );
    if( RpcStatus != ERROR_SUCCESS || pszComputerNameFromBinding == NULL)
    {
        ELF_LOG1(ERROR,
                 "ElfpGetComputerName: RpcStringBindingParse failed %d\n",
                 RpcStatus);
        goto CleanExitGetCompName;
    }

    // sometimes the name is an ip address.  If it is, then the following determines
    // that and returns the right string.

	pszComputerName = GetNameFromIPAddress(pszComputerNameFromBinding);                                                
	if(pszComputerName == NULL)
	{
		dwSize = wcslen(pszComputerNameFromBinding) + 1;
		pszComputerName = ElfpAllocateBuffer(2*dwSize);
		if(pszComputerName == NULL)
		{
        	ELF_LOG0(ERROR,
                 "ElfpGetComputerName: failed trying to allocate memory\n");
		}
		else
			wcscpy(pszComputerName, pszComputerNameFromBinding);
	}

CleanExitGetCompName:
	if(hServerBinding)
		RpcStatus = RpcBindingFree(&hServerBinding);
	if(pszBinding)
		RpcStatus = RpcStringFree(&pszBinding);
	if(pszComputerNameFromBinding)
		RpcStatus = RpcStringFree(&pszComputerNameFromBinding);
    return pszComputerName;
}