windows-xp/Source/XPSP1/NT/ds/security/authz/authzp.h

/*++

Copyright (c) 2000  Microsoft Corporation

Module Name:

    authzp.h

Abstract:

    Internal header file for authorization APIs.

Author:

    Kedar Dubhashi - March 2000

Environment:

    User mode only.

Revision History:

    Created - March 2000

--*/

#ifndef __AUTHZP_H__
#define __AUTHZP_H__

#define _AUTHZ_

#include <authz.h>
#include <authzi.h>

#if 0
#define AUTHZ_DEBUG       
#define AUTHZ_DEBUG_QUEUE 
#define AUTHZ_DEBUG_MEMLEAK
#else
#define AUTHZ_PARAM_CHECK
#define AUTHZ_AUDIT_COUNTER
#endif

#define AuthzpCloseHandleNonNull(h) if (NULL != (h)) { AuthzpCloseHandle((h)); }
#define AuthzpCloseHandle(h) CloseHandle((h))

//
// Size of the local stack buffer used to save a kernel call as well as a memory
// allocation.
//

#define AUTHZ_MAX_STACK_BUFFER_SIZE 1024

#ifndef AUTHZ_DEBUG_MEMLEAK

#define AuthzpAlloc(s) LocalAlloc(LMEM_FIXED | LMEM_ZEROINIT, (s))
#define AuthzpFree(p) LocalFree((p))

#else

//
// This is to be used for debugging memory leaks. Primitive method but works in
// a small project like this.
//

PVOID
AuthzpAlloc(IN DWORD Size);

VOID
AuthzpFree(PVOID l);

#endif

//
// Given two sids and length of the first sid, compare the two sids.
//

#define AUTHZ_EQUAL_SID(s, d, l) ((*((DWORD*) s) == *((DWORD*) d)) && (RtlEqualMemory((s), (d), (l))))

//
// Compares a given sids with a well known constant PrincipalSelfSid.
//

#define AUTHZ_IS_PRINCIPAL_SELF_SID(s) (RtlEqualMemory(pAuthzPrincipalSelfSid, (s), 12))

//
// The client context is restricted if the restricted sid and attribute array is
// present.
//

#define AUTHZ_TOKEN_RESTRICTED(t) (NULL != (t)->RestrictedSids)

//
// Two privileges are inportant for access check:
//     SeSecurityPrivilege
//     SeTakeOwnershipPrivilege
// Both these are detected at the time of client context capture from token
// and stored in the flags.
//

#define AUTHZ_PRIVILEGE_CHECK(t, f) (FLAG_ON((t)->Flags, (f)))

//
// Flags in the cached handle.
//

#define AUTHZ_DENY_ACE_PRESENT            0x00000001
#define AUTHZ_PRINCIPAL_SELF_ACE_PRESENT  0x00000002
#define AUTHZ_DYNAMIC_ALLOW_ACE_PRESENT   0x00000004
#define AUTHZ_DYNAMIC_DENY_ACE_PRESENT    0x00000008
#define AUTHZ_DYNAMIC_EVALUATION_PRESENT  (AUTHZ_PRINCIPAL_SELF_ACE_PRESENT |  \
                                           AUTHZ_DYNAMIC_ALLOW_ACE_PRESENT  |  \
                                           AUTHZ_DYNAMIC_DENY_ACE_PRESENT)

//
// There are only two valid attributes from access check point of view
//     SE_GROUP_ENABLED
//     SE_GROUP_USE_FOR_DENY_ONLY
//

#define AUTHZ_VALID_SID_ATTRIBUTES (SE_GROUP_ENABLED | SE_GROUP_USE_FOR_DENY_ONLY)

#ifdef FLAG_ON
#undef FLAG_ON
#endif

#define FLAG_ON(f, b) (0 != ((f) & (b)))

#ifdef AUTHZ_NON_NULL_PTR
#undef AUTHZ_NON_NULL_PTR
#endif

#define AUTHZ_NON_NULL_PTR(f) (NULL != (f))

//
// If the pointer is not null then free it. This will save us a function call in
// cases when the pointer is null. Note that LocalFree would also take care null
// pointer being freed.
//

#define AuthzpFreeNonNull(p) if (NULL != (p)) { AuthzpFree((p)); }

//
// Check to see if the memory allocation failed.
//

#define AUTHZ_ALLOCATION_FAILED(p) (NULL == (p))

//
// Macros to traverse the acl.
//     The first one gets the first ace in a given acl.
//     The second one gives the next ace given the current one.
//

#define FirstAce(Acl) ((PVOID)((PUCHAR)(Acl) + sizeof(ACL)))
#define NextAce(Ace) ((PVOID)((PUCHAR)(Ace) + ((PACE_HEADER)(Ace))->AceSize))

//
// These do not need to be defined now since the decision was to put the burden
// on the resource managers. There are disadvantages of making it thread safe.
// Our choices are:
//     1. Have exactly one lock in authz.dll and suffer heavy contention.
//     2. Define one lock per client context which might be too expensive in
//        cases where the clients are too many.
//     3. Let the resource manager decide whether they need locking - unlikely
//        that locks are needed since it is wrong design on part of the RM to
//        have one thread that changes the client context while the other one
//        is doing an access check.
//

#define AuthzpAcquireClientContextWriteLock(c)
#define AuthzpAcquireClientContextReadLock(c)
#define AuthzpReleaseClientContextLock(c)

#define AuthzpAcquireClientCacheWriteLock(c)
#define AuthzpReleaseClientCacheLock(c)
#define AuthzpZeroMemory(p, s) RtlZeroMemory((p), (s))

#define AuthzObjectAceSid(Ace) \
    ((PSID)(((PUCHAR)&(((PKNOWN_OBJECT_ACE)(Ace))->SidStart)) + \
     (RtlObjectAceObjectTypePresent(Ace) ? sizeof(GUID) : 0 ) + \
     (RtlObjectAceInheritedObjectTypePresent(Ace) ? sizeof(GUID) : 0 )))

#define AuthzAceSid(Ace) ((PSID)&((PKNOWN_ACE)Ace)->SidStart)
    
#define AuthzCallbackAceSid(Ace) AuthzAceSid(Ace)

#define AuthzCallbackObjectAceSid(Ace) AuthzObjectAceSid(Ace)
                      
//
// Internal structure of the object type list.
//
// Level - Level of the element in the tree. The level of the root is 0.
// Flags - To be used for auditing. The valid ones are
//           AUTHZ_OBJECT_SUCCESS_AUDIT
//           AUTHZ_OBJECT_FAILURE_AUDIT
// ObjectType - Pointer to the guid for this element.
// ParentIndex - The index of the parent of this element in the array. The
//     parent index for the root is -1.
// Remaining - Remaining access bits for this element, used during normal access
//     check algorithm.
// CurrentGranted - Granted access bits so far for this element, used during
//     maximum allowed access check.
// CurrentDenied - Explicitly denied access bits for this element, used during
//     maximum allowed access check.
//

typedef struct _IOBJECT_TYPE_LIST {
    USHORT Level;
    USHORT Flags;
#define AUTHZ_OBJECT_SUCCESS_AUDIT 0x1
#define AUTHZ_OBJECT_FAILURE_AUDIT 0x2
    GUID ObjectType;
    LONG ParentIndex;
    ACCESS_MASK Remaining;
    ACCESS_MASK CurrentGranted;
    ACCESS_MASK CurrentDenied;
} IOBJECT_TYPE_LIST, *PIOBJECT_TYPE_LIST;

typedef struct _AUTHZI_AUDIT_QUEUE
{
    
    //
    // Flags defined in authz.h
    //

    DWORD Flags;

    //
    // High and low marks for the auditing queue
    //

    DWORD dwAuditQueueHigh;
    DWORD dwAuditQueueLow;

    //
    // CS for locking the audit queue
    //

    RTL_CRITICAL_SECTION AuthzAuditQueueLock;
    
    //
    // The audit queue and length.
    //

    LIST_ENTRY AuthzAuditQueue;
    ULONG AuthzAuditQueueLength;

    //
    // Handle to the thread that maintains the audit queue.
    //

    HANDLE hAuthzAuditThread;

    //
    // This event signals that an audit was placed on the queue.
    //

    HANDLE hAuthzAuditAddedEvent;

    //
    // This event signals that the queue is empty.  Initially signalled.
    //

    HANDLE hAuthzAuditQueueEmptyEvent;

    //
    // This boolean indicates that the queue size has reached the RM-specified high water mark.
    //

    BOOL bAuthzAuditQueueHighEvent;

    //
    // This event signals that the queue size is at or below the RM-specified low water mark.
    //

    HANDLE hAuthzAuditQueueLowEvent;

    //
    // This boolean is set to TRUE during the life of the resource manager.  When it turns to FALSE, the 
    // dequeue thread knows that it should exit.
    //

    BOOL bWorker;

} AUTHZI_AUDIT_QUEUE, *PAUTHZI_AUDIT_QUEUE;

typedef struct _AUTHZI_RESOURCE_MANAGER
{
    //
    // No valid flags have been defined yet.
    //

    DWORD Flags;

    //
    // Callback function registered by AuthzRegisterRMAccessCheckCallback, to be
    // used to interpret callback aces. If no such function is registered by the
    // RM then the default  behavior is to return TRUE for a deny ACE, FALSE for
    // a grant ACE.
    //

    PFN_AUTHZ_DYNAMIC_ACCESS_CHECK pfnDynamicAccessCheck;

    //
    // Callback function registered by AuthzRegisterDynamicGroupsCallback, to be
    // used to compute groups to be added to the client context. If no such
    // function is registered by the RM then the default behavior is to return
    // no groups.
    //

    PFN_AUTHZ_COMPUTE_DYNAMIC_GROUPS pfnComputeDynamicGroups;

    //
    // Callback function registered by AuthzRegisterDynamicGroupsCallback, to be
    // used to free memory allocated by ComputeDynamicGroupsFn.
    //

    PFN_AUTHZ_FREE_DYNAMIC_GROUPS pfnFreeDynamicGroups;

    //
    // String name of resource manager.  Appears in audits.
    //

    PWSTR szResourceManagerName;

    //
    // The user SID and Authentication ID of the RM process
    //

    PSID pUserSID;
    LUID AuthID;

    //
    // Default queue and audit events for the RM
    //

#define AUTHZP_DEFAULT_RM_EVENTS        0x2

    AUTHZ_AUDIT_EVENT_TYPE_HANDLE hAET;
    AUTHZ_AUDIT_EVENT_TYPE_HANDLE hAETDS;

    AUTHZ_AUDIT_QUEUE_HANDLE hAuditQueue;

} AUTHZI_RESOURCE_MANAGER, *PAUTHZI_RESOURCE_MANAGER;


typedef struct _AUTHZI_CLIENT_CONTEXT AUTHZI_CLIENT_CONTEXT, *PAUTHZI_CLIENT_CONTEXT;
typedef struct _AUTHZI_HANDLE AUTHZI_HANDLE, *PAUTHZI_HANDLE;

//
// the number of sids that we hash is equal to 
// the number of  bits in AUTHZI_SID_HASH_ENTRY
//

#ifdef _WIN64_
typedef ULONGLONG AUTHZI_SID_HASH_ENTRY, *PAUTHZI_SID_HASH_ENTRY;
#else
typedef DWORD AUTHZI_SID_HASH_ENTRY, *PAUTHZI_SID_HASH_ENTRY;
#endif

#define AUTHZI_SID_HASH_ENTRY_NUM_BITS (8*sizeof(AUTHZI_SID_HASH_ENTRY))

//
// the hash size is not related to the number of bits. it is the size
// required to hold two 16 element arrays
//

#define AUTHZI_SID_HASH_SIZE 32

struct _AUTHZI_CLIENT_CONTEXT
{

    //
    // The client context structure is recursive to support delegated clients.
    // Not in the picture yet though.
    //

    PAUTHZI_CLIENT_CONTEXT Server;

    //
    // Context will always be created with Revision of AUTHZ_CURRENT_CONTEXT_REVISION.
    //

#define AUTHZ_CURRENT_CONTEXT_REVISION 1

    DWORD Revision;

    //
    // Resource manager supplied identifier. We do not ever use this.
    //

    LUID Identifier;

    //
    // AuthenticationId captured from the token of the client. Needed for
    // auditing.
    //

    LUID AuthenticationId;

    //
    // Token expiration time. This one will be checked at the time of access check against
    // the current time.
    //

    LARGE_INTEGER ExpirationTime;

    //
    // Internal flags for the token.
    //

#define AUTHZ_TAKE_OWNERSHIP_PRIVILEGE_ENABLED 0x00000001
#define AUTHZ_SECURITY_PRIVILEGE_ENABLED       0x00000002


    DWORD Flags;

    //
    // Sids used for normal access checks.
    //

    DWORD SidCount;
    DWORD SidLength;
    PSID_AND_ATTRIBUTES Sids;
             
    AUTHZI_SID_HASH_ENTRY SidHash[AUTHZI_SID_HASH_SIZE];


    //
    // Sids used if the token is resticted. These will usually be 0 and NULL respectively.
    //

    DWORD RestrictedSidCount;
    DWORD RestrictedSidLength;
    PSID_AND_ATTRIBUTES RestrictedSids;

    AUTHZI_SID_HASH_ENTRY RestrictedSidHash[AUTHZI_SID_HASH_SIZE];
    
    //
    // Privileges used in access checks. Relevant ones are:
    //   1. SeSecurityPrivilege
    //   2. SeTakeOwnershipPrivilege
    // If there are no privileges associated with the client context then the PrivilegeCount = 0
    // and Privileges = NULL
    //

    DWORD PrivilegeCount;
    DWORD PrivilegeLength;
    PLUID_AND_ATTRIBUTES Privileges;

    //
    // Handles open for this client. When the client context is destroyed all the handles are
    // cleaned up.
    //

     PAUTHZI_HANDLE AuthzHandleHead;

    //
    // Pointer to the resource manager, needed to retrieve static auditing information.
    //

    PAUTHZI_RESOURCE_MANAGER pResourceManager;

};

struct _AUTHZI_HANDLE
{
    //
    // Pointers to the next handle maintained by the AuthzClientContext object.
    //

    PAUTHZI_HANDLE next;

    //
    // Pointer to the security descriptors provided by the RM at the time of first access
    // check call. We do not make a copy of the security descriptors. The assumption
    // is that the SDs will be valid at least as long as the the handle is open.
    //

    PSECURITY_DESCRIPTOR pSecurityDescriptor;
    PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray;
    DWORD OptionalSecurityDescriptorCount;

    //
    // Flags for internal usage only.
    //

    DWORD Flags;

    //
    // Back pointer to the client context that created this handle, required if the static
    // access granted is insufficient and access check needs to be performed again.
    //

    PAUTHZI_CLIENT_CONTEXT pAuthzClientContext;

    //
    // Results of the maximum allowed static access.
    //

    DWORD ResultListLength;
    ACCESS_MASK GrantedAccessMask[ANYSIZE_ARRAY];
};


//
// This structure stores per access audit information.  The structure
// is opaque and initialized with AuthzInitAuditInfo
//

typedef struct _AUTHZI_AUDIT_EVENT
{

    //
    // size of allocated blob for this structure
    //

    DWORD dwSize;

    //
    // Flags are specified in authz.h, and this single private flag for DS callers.
    //

    DWORD Flags;

    //
    // AuditParams used for audit if available.  If no AuditParams is available
    // and the audit id is SE_AUDITID_OBJECT_OPERATION then Authz will construct a
    // suitable structure.
    //

    PAUDIT_PARAMS pAuditParams;

    //
    // Structure defining the Audit Event category and id
    //

    AUTHZ_AUDIT_EVENT_TYPE_HANDLE hAET;
    
    //
    // millisecond timeout value
    //

    DWORD dwTimeOut;

    //
    // RM specified strings describing this event.
    //

    PWSTR szOperationType;
    PWSTR szObjectType;
    PWSTR szObjectName;
    PWSTR szAdditionalInfo;

    AUTHZ_AUDIT_QUEUE_HANDLE hAuditQueue;

} AUTHZI_AUDIT_EVENT, *PAUTHZI_AUDIT_EVENT;

//
// structure to maintain queue of audits to be sent to LSA
//

typedef struct _AUTHZ_AUDIT_QUEUE_ENTRY
{
    LIST_ENTRY list;
    PAUTHZ_AUDIT_EVENT_TYPE_OLD pAAETO;
    DWORD Flags;
    AUDIT_PARAMS * pAuditParams;
    PVOID pReserved;
} AUTHZ_AUDIT_QUEUE_ENTRY, *PAUTHZ_AUDIT_QUEUE_ENTRY;

//
// Enumeration type to be used to specify what type of coloring should be
// passed on to the rest of the tree starting at a given node.
//   Deny gets propagted down the entire subtree as well as to all the
//     ancestors (but NOT to siblings and below)
//   Grants get propagated down the subtree. When a grant exists on all the
//     siblings the parent automatically gets it.
//   Remaining is propagated downwards. The remaining on the parent is a
//     logical OR of the remaining bits on all the children.
//

typedef enum {
    AuthzUpdateRemaining = 1,
    AuthzUpdateCurrentGranted,
    AuthzUpdateCurrentDenied
} ACCESS_MASK_FIELD_TO_UPDATE;

//
// Enumeration type to be used to specify the kind of well known sid for context
// changes. We are not going to support these unless we get a requirement.
//

typedef enum _AUTHZ_WELL_KNOWN_SID_TYPE
{
    AuthzWorldSid = 1,
    AuthzUserSid,
    AuthzAdminSid,
    AuthzDomainAdminSid,
    AuthzAuthenticatedUsersSid,
    AuthzSystemSid
} AUTHZ_WELL_KNOWN_SID_TYPE;

BOOL
AuthzpVerifyAccessCheckArguments(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN OUT PAUTHZ_ACCESS_CHECK_RESULTS_HANDLE phAccessCheckResults OPTIONAL
    );

BOOL
AuthzpVerifyOpenObjectArguments(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN PAUTHZI_AUDIT_EVENT pAuditEvent
    );

BOOL
AuthzpCaptureObjectTypeList(
    IN POBJECT_TYPE_LIST ObjectTypeList,
    IN DWORD ObjectTypeLocalTypeListLength,
    OUT PIOBJECT_TYPE_LIST *CapturedObjectTypeList,
    OUT PIOBJECT_TYPE_LIST *CapturedCachingObjectTypeList OPTIONAL
    );

VOID
AuthzpFillReplyStructure(
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN DWORD Error,
    IN ACCESS_MASK GrantedAccess
    );

BOOL
AuthzpMaximumAllowedAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN OUT PIOBJECT_TYPE_LIST LocalCachingTypeList OPTIONAL,
    IN DWORD LocalTypeListLength,
    IN BOOL ObjectTypeListPresent,
    OUT PDWORD pCachingFlags
    );

BOOL
AuthzpMaximumAllowedMultipleSDAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN OUT PIOBJECT_TYPE_LIST LocalCachingTypeList OPTIONAL,
    IN DWORD LocalTypeListLength,
    IN BOOL ObjectTypeListPresent,
    IN BOOL Restricted,
    OUT PDWORD pCachingFlags
    );

BOOL
AuthzpMaximumAllowedSingleAclAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN DWORD SidCount,
    IN PAUTHZI_SID_HASH_ENTRY pHash,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PACL pAcl,
    IN PSID pOwnerSid,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN OUT PIOBJECT_TYPE_LIST LocalCachingTypeList OPTIONAL,
    IN DWORD LocalTypeListLength,
    IN BOOL ObjectTypeListPresent,
    OUT PDWORD pCachingFlags
    );


BOOL
AuthzpSidApplicable(
    IN DWORD SidCount,
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN PAUTHZI_SID_HASH_ENTRY pHash,
    IN PSID pSid,
    IN PSID PrincipalSelfSid,
    IN PSID CreatorOwnerSid,
    IN BOOL DenyAce,
    OUT PDWORD pCachingFlags
    );

BOOL
AuthzpAccessCheckWithCaching(
    IN DWORD Flags,
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    OUT PAUTHZ_ACCESS_CHECK_RESULTS_HANDLE phAccessCheckResults OPTIONAL,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN OUT PIOBJECT_TYPE_LIST LocalCachingTypeList OPTIONAL,
    IN DWORD LocalTypeListLength
    );

BOOL
AuthzpNormalAccessCheckWithoutCaching(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength
    );

BOOL
AuthzpNormalMultipleSDAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN DWORD SidCount,
    IN PAUTHZI_SID_HASH_ENTRY pSidHash,
    IN ACCESS_MASK Remaining,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength
    );

BOOL
AuthzpOwnerSidInClientContext(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PISECURITY_DESCRIPTOR pSecurityDescriptor
    );

BOOL
AuthzpNormalAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN DWORD SidCount,
    IN PAUTHZI_SID_HASH_ENTRY pSidHash,
    IN ACCESS_MASK Remaining,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PACL pAcl,
    IN PSID pOwnerSid,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength
    );

BOOL
AuthzpQuickMaximumAllowedAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZI_HANDLE pAH,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength
    );

BOOL
AuthzpQuickNormalAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZI_HANDLE pAH,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength
    );

BOOL
AuthzpAllowOnlyNormalMultipleSDAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN DWORD SidCount,
    IN PAUTHZI_SID_HASH_ENTRY pSidHash,
    IN ACCESS_MASK Remaining,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength
    );

BOOL
AuthzpAllowOnlyNormalSingleAclAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN DWORD SidCount,
    IN PAUTHZI_SID_HASH_ENTRY pSidHash,
    IN ACCESS_MASK Remaining,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PACL pAcl,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength
    );

BOOL
AuthzpAllowOnlySidApplicable(
    IN DWORD SidCount,
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN PAUTHZI_SID_HASH_ENTRY pSidHash,
    IN PSID pSid
    );


VOID
AuthzpAddAccessTypeList (
    IN PIOBJECT_TYPE_LIST ObjectTypeList,
    IN DWORD ObjectTypeListLength,
    IN DWORD StartIndex,
    IN ACCESS_MASK AccessMask,
    IN ACCESS_MASK_FIELD_TO_UPDATE FieldToUpdate
    );

BOOL
AuthzpObjectInTypeList (
    IN GUID *ObjectType,
    IN PIOBJECT_TYPE_LIST ObjectTypeList,
    IN DWORD ObjectTypeListLength,
    OUT PDWORD ReturnedIndex
    );

BOOL
AuthzpCacheResults(
    IN DWORD Flags,
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PIOBJECT_TYPE_LIST LocalCachingTypeList,
    IN DWORD LocalTypeListLength,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN DWORD CachingFlags,
    IN PAUTHZ_ACCESS_CHECK_RESULTS_HANDLE phAccessCheckResults
    );


BOOL
AuthzpVerifyCachedAccessCheckArguments(
    IN PAUTHZI_HANDLE pAH,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN OUT PAUTHZ_ACCESS_REPLY pReply
    );

BOOL
AuthzpAllowOnlyMaximumAllowedMultipleSDAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength,
    IN BOOL ObjectTypeListPresent,
    IN BOOL Restricted
    );

BOOL
AuthzpAllowOnlyMaximumAllowedSingleAclAccessCheck(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN DWORD SidCount,
    IN PAUTHZI_SID_HASH_ENTRY pSidHash,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PACL pAcl,
    IN PSID pOwnerSid,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD LocalTypeListLength,
    IN BOOL ObjectTypeListPresent
    );

VOID
AuthzpAddAccessTypeList (
    IN OUT PIOBJECT_TYPE_LIST ObjectTypeList,
    IN DWORD ObjectTypeListLength,
    IN DWORD StartIndex,
    IN ACCESS_MASK AccessMask,
    IN ACCESS_MASK_FIELD_TO_UPDATE FieldToUpdate
    );

VOID
AuthzpUpdateParentTypeList(
    IN OUT PIOBJECT_TYPE_LIST ObjectTypeList,
    IN DWORD ObjectTypeListLength,
    IN DWORD StartIndex
    );

BOOL
AuthzpObjectInTypeList (
    IN GUID *ObjectType,
    IN PIOBJECT_TYPE_LIST ObjectTypeList,
    IN DWORD ObjectTypeListLength,
    OUT PDWORD ReturnedIndex
    );


BOOL
AuthzpGenerateAudit(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PAUTHZI_AUDIT_EVENT pAuditEvent,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList
    );

BOOL
AuthzpCopySidsAndAttributes(
    IN OUT PSID_AND_ATTRIBUTES DestSidAttr,
    IN PSID_AND_ATTRIBUTES SidAttr1,
    IN DWORD Count1,
    IN PSID_AND_ATTRIBUTES SidAttr2,
    IN DWORD Count2
    );

VOID
AuthzpCopyLuidAndAttributes(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PLUID_AND_ATTRIBUTES Source,
    IN DWORD Count,
    IN OUT PLUID_AND_ATTRIBUTES Destination
    );

BOOL
AuthzpDefaultAccessCheck(
    IN AUTHZ_CLIENT_CONTEXT_HANDLE hAuthzClientContext,
    IN PACE_HEADER pAce,
    IN PVOID pArgs OPTIONAL,
    IN OUT PBOOL pbAceApplicable
    );

VOID
AuthzPrintContext(
    IN PAUTHZI_CLIENT_CONTEXT pCC
    );

VOID
AuthzpFillReplyFromParameters(
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN PIOBJECT_TYPE_LIST LocalTypeList
    );

BOOL
AuthzpGetAllGroupsBySid(
    IN  PSID pUserSid,
    IN  DWORD Flags,
    OUT PSID_AND_ATTRIBUTES *ppSidAttr,
    OUT PDWORD pSidCount,
    OUT PDWORD pSidLength
    );

BOOL
AuthzpGetAllGroupsByName(
    IN  PUNICODE_STRING pusUserName,
    IN  PUNICODE_STRING pusDomainName,
    IN  DWORD Flags,
    OUT PSID_AND_ATTRIBUTES *ppSidAttr,
    OUT PDWORD pSidCount,
    OUT PDWORD pSidLength
    );

BOOL
AuthzpAllocateAndInitializeClientContext(
    OUT PAUTHZI_CLIENT_CONTEXT *ppCC,
    IN PAUTHZI_CLIENT_CONTEXT Server,
    IN DWORD Revision,
    IN LUID Identifier,
    IN LARGE_INTEGER ExpirationTime,
    IN DWORD Flags,
    IN DWORD SidCount,
    IN DWORD SidLength,
    IN PSID_AND_ATTRIBUTES Sids,
    IN DWORD RestrictedSidCount,
    IN DWORD RestrictedSidLength,
    IN PSID_AND_ATTRIBUTES RestrictedSids,
    IN DWORD PrivilegeCount,
    IN DWORD PrivilegeLength,
    IN PLUID_AND_ATTRIBUTES Privileges,
    IN LUID AuthenticationId,
    IN PAUTHZI_HANDLE AuthzHandleHead,
    IN PAUTHZI_RESOURCE_MANAGER pRM
    );

BOOL
AuthzpAddDynamicSidsToToken(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZI_RESOURCE_MANAGER pRM,
    IN PVOID DynamicGroupsArgs,
    IN PSID_AND_ATTRIBUTES Sids,
    IN DWORD SidLength,
    IN DWORD SidCount,
    IN PSID_AND_ATTRIBUTES RestrictedSids,
    IN DWORD RestrictedSidLength,
    IN DWORD RestrictedSidCount,
    IN PLUID_AND_ATTRIBUTES Privileges,
    IN DWORD PrivilegeLength,
    IN DWORD PrivilegeCount,
    IN BOOL bAllocated
    );

BOOL
AuthzpExamineSingleSacl(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN ACCESS_MASK AccessMask,
    IN PACL pAcl,
    IN PSID pOwnerSid,
    IN UCHAR AuditMaskType,
    IN BOOL bMaximumFailed,
    OUT PAUTHZ_ACCESS_REPLY pReply,
    OUT PBOOL pbGenerateAudit
    );

BOOL
AuthzpExamineSacl(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN PAUTHZ_ACCESS_REPLY pReply,
    OUT PBOOL pbGenerateAudit
    );


BOOL
AuthzpExamineSaclForObjectTypeList(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
    IN PSECURITY_DESCRIPTOR *OptionalSecurityDescriptorArray OPTIONAL,
    IN DWORD OptionalSecurityDescriptorCount,
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    OUT PBOOL pbGenerateSuccessAudit,
    OUT PBOOL pbGenerateFailureAudit
    );

BOOL
AuthzpExamineSingleSaclForObjectTypeList(
    IN PAUTHZI_CLIENT_CONTEXT pCC,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PACL pAcl,
    IN PSID pOwnerSid,
    IN PAUTHZ_ACCESS_REPLY pReply,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    OUT PBOOL pbGenerateSuccessAudit,
    OUT PBOOL pbGenerateFailureAudit
    );

VOID
AuthzpSetAuditInfoForObjectType(
    IN PAUTHZ_ACCESS_REPLY pReply,
    IN OUT PIOBJECT_TYPE_LIST LocalTypeList,
    IN DWORD StartIndex,
    IN ACCESS_MASK AceAccessMask,
    IN ACCESS_MASK DesiredAccessMask,
    IN UCHAR AceFlags,
    OUT PBOOL pbGenerateSuccessAudit,
    OUT PBOOL pbGenerateFailureAudit
    );

BOOL
AuthzpCreateAndLogAudit(
    IN DWORD AuditTypeFlag,
    IN PAUTHZI_CLIENT_CONTEXT pAuthzClientContext,
    IN PAUTHZI_AUDIT_EVENT pAuditEvent,
    IN PAUTHZI_RESOURCE_MANAGER pRM,
    IN PIOBJECT_TYPE_LIST LocalTypeList,
    IN PAUTHZ_ACCESS_REQUEST pRequest,
    IN PAUTHZ_ACCESS_REPLY pReply
    );

VOID
AuthzpFillReplyStructureFromCachedGrantedAccessMask(
    IN OUT PAUTHZ_ACCESS_REPLY pReply,
    IN ACCESS_MASK DesiredAccess,
    IN PACCESS_MASK GrantedAccessMask
    );

BOOL
AuthzpSendAuditToLsa(
    IN AUDIT_HANDLE  hAuditContext,
    IN DWORD         Flags,
    IN PAUDIT_PARAMS pAuditParams,
    IN PVOID         Reserved
    );

BOOL
AuthzpEnQueueAuditEvent(
    PAUTHZI_AUDIT_QUEUE pQueue,
    PAUTHZ_AUDIT_QUEUE_ENTRY pAudit
    );

BOOL
AuthzpEnQueueAuditEventMonitor(
    PAUTHZI_AUDIT_QUEUE pQueue,
    PAUTHZ_AUDIT_QUEUE_ENTRY pAudit
    );

BOOL
AuthzpMarshallAuditParams(
    OUT PAUDIT_PARAMS * ppMarshalledAuditParams,
    IN  PAUDIT_PARAMS   pAuditParams
    );

ULONG
AuthzpDeQueueThreadWorker(
    LPVOID lpParameter
    );

#define AUTHZ_SID_HASH_LOW_MASK 0xf
#define AUTHZ_SID_HASH_HIGH_MASK 0xf0
#define AUTHZ_SID_HASH_HIGH 16
#define AUTHZ_SID_HASH_LOOKUP(table, byte) (((table)[(byte) & 0xf]) & ((table)[AUTHZ_SID_HASH_HIGH + (((byte) & 0xf0) >> 4)]))
    
VOID
AuthzpInitSidHash(
    IN PSID_AND_ATTRIBUTES pSidAttr,
    IN ULONG SidCount,
    OUT PAUTHZI_SID_HASH_ENTRY pHash
    );

BOOL
AuthzpGetThreadTokenInfo(
    OUT PSID* pUserSid,
    OUT PLUID pAuthenticationId
    );

BOOL
AuthzpGetProcessTokenInfo(
    OUT PSID* ppUserSid,
    OUT PLUID pAuthenticationId
    );

VOID
AuthzpReferenceAuditEventType(
    IN AUTHZ_AUDIT_EVENT_TYPE_HANDLE
    );
BOOL
AuthzpDereferenceAuditEventType(
    IN OUT AUTHZ_AUDIT_EVENT_TYPE_HANDLE
    );

BOOL
AuthzpEveryoneIncludesAnonymous(
    );

#endif