/*++

Copyright (c) 1998-2001 Microsoft Corporation

Module Name:

    secutil.c

Abstract:

    Domain Name System (DNS) Library

    DNS secure update API.

Author:

    Jim Gilroy (jamesg)         January, 1998

Revision History:

--*/

#include "local.h"

//  security headers

//#define SECURITY_WIN32
//#include "sspi.h"
//#include "issperr.h"
//#include "rpc.h"
//#include "rpcndr.h"
//#include "ntdsapi.h"



//
//  Security utilities
//

DNS_STATUS
Dns_CreateSecurityDescriptor(
    OUT     PSECURITY_DESCRIPTOR *  ppSD,
    IN      DWORD                   AclCount,
    IN      PSID *                  SidPtrArray,
    IN      DWORD *                 AccessMaskArray
    )
/*++

Routine Description:

    Build security descriptor.

Arguments:

    ppSD -- addr to receive SD created

    AclCount -- number of ACLs to add

    SidPtrArray -- array of SIDs to create ACLs for

    AccessMaskArray -- array of access masks corresponding to SIDs

Return Value:

    ERROR_SUCCESS if successful
    Error code on failure.

--*/
{
    DNS_STATUS              status;
    DWORD                   i;
    DWORD                   lengthAcl;
    PSECURITY_DESCRIPTOR    psd = NULL;
    PACL                    pacl;

    //
    //  calculate space for SD
    //

    lengthAcl = sizeof(ACL);

    for ( i=0;  i<AclCount;  i++ )
    {
        if ( SidPtrArray[i] && AccessMaskArray[i] )
        {
            lengthAcl += GetLengthSid( SidPtrArray[i] ) + sizeof(ACCESS_ALLOWED_ACE);
        }
        ELSE
        {
            DNS_PRINT((
                "ERROR:  SD building with SID (%p) and mask (%p)\n",
                SidPtrArray[i],
                AccessMaskArray[i] ));
        }
    }

    //
    //  allocate SD
    //

    psd = (PSECURITY_DESCRIPTOR) ALLOCATE_HEAP(
                                    SECURITY_DESCRIPTOR_MIN_LENGTH + lengthAcl );
    if ( !psd )
    {
        status = DNS_ERROR_NO_MEMORY;
        goto Failed;
    }

    DNSDBG( INIT, (
        "Allocated SecurityDesc at %p of length %d\n",
        psd,
        SECURITY_DESCRIPTOR_MIN_LENGTH + lengthAcl ));

    //
    //  build ACL, adding ACE with desired access for each SID
    //

    pacl = (PACL) ((PBYTE)psd + SECURITY_DESCRIPTOR_MIN_LENGTH);

    if ( !InitializeAcl(
            pacl,
            lengthAcl,
            ACL_REVISION ) )
    {
        status = GetLastError();
        goto Failed;
    }

    for ( i=0;  i<AclCount;  i++ )
    {
        if ( SidPtrArray[i] && AccessMaskArray[i] )
        {
            if ( !AddAccessAllowedAce(
                    pacl,
                    ACL_REVISION,
                    AccessMaskArray[i],
                    SidPtrArray[i] ) )
            {
                status = GetLastError();
                DNSDBG( ANY, (
                    "ERROR:  failed adding ACE for SID %p, mask %p\n",
                    SidPtrArray[i],
                    AccessMaskArray[i] ));
                goto Failed;
            }
        }
    }

    //
    //  setup SD with ACL
    //

    if ( !InitializeSecurityDescriptor(
            psd,
            SECURITY_DESCRIPTOR_REVISION ))
    {
        status = GetLastError();
        goto Failed;
    }

    if ( !SetSecurityDescriptorDacl(
                psd,
                TRUE,       // ACL present
                pacl,
                FALSE       // explicit ACL, not defaulted
                ))
    {
        status = GetLastError();
        goto Failed;
    }

    *ppSD = psd;

    return( ERROR_SUCCESS );


Failed:

    ASSERT( status != ERROR_SUCCESS );
    *ppSD = NULL;
    FREE_HEAP( psd );

    return( status );
}



//
//  Credential utilities
//

PSEC_WINNT_AUTH_IDENTITY_W
Dns_AllocateAndInitializeCredentialsW(
    IN      PSEC_WINNT_AUTH_IDENTITY_W  pAuthIn
    )
/*++

Description:

    Allocates auth identity info and initializes pAuthIn info

Parameters:

    pAuthIn -- auth identity info

Return:

    Ptr to newly create credentials.
    NULL on failure.

--*/
{
    PSEC_WINNT_AUTH_IDENTITY_W pauthCopy = NULL;

    DNSDBG( SECURITY, (
        "Call Dns_AllocateAndInitializeCredentialsW\n" ));

    if ( !pAuthIn )
    {
        return NULL;
    }
    ASSERT( pAuthIn->Flags == SEC_WINNT_AUTH_IDENTITY_UNICODE );

    //
    //  allocate credentials struct
    //      - zero for simple cleanup on subfield alloc failures
    //

    pauthCopy = ALLOCATE_HEAP_ZERO( sizeof(SEC_WINNT_AUTH_IDENTITY_W) );
    if ( !pauthCopy )
    {
        return NULL;
    }

    //
    //  copy subfields
    //

    //  user

    pauthCopy->UserLength = pAuthIn->UserLength;
    if ( pAuthIn->UserLength )
    {
        ASSERT( pAuthIn->UserLength == wcslen(pAuthIn->User) );

        pauthCopy->User = ALLOCATE_HEAP( (pAuthIn->UserLength + 1) * sizeof(WCHAR) );
        if ( ! pauthCopy->User )
        {
            goto Failed;
        }
        wcscpy( pauthCopy->User, pAuthIn->User );
    }

    //  password
    //      - must allow zero length password

    pauthCopy->PasswordLength = pAuthIn->PasswordLength;

    if ( pAuthIn->PasswordLength  ||  pAuthIn->Password )
    {
        ASSERT( pAuthIn->PasswordLength == wcslen(pAuthIn->Password) );

        pauthCopy->Password = ALLOCATE_HEAP( (pAuthIn->PasswordLength + 1) * sizeof(WCHAR) );
        if ( ! pauthCopy->Password )
        {
            goto Failed;
        }
        wcscpy( pauthCopy->Password, pAuthIn->Password );
    }

    //  domain

    pauthCopy->DomainLength = pAuthIn->DomainLength;
    if ( pAuthIn->DomainLength )
    {
        ASSERT( pAuthIn->DomainLength == wcslen(pAuthIn->Domain) );

        pauthCopy->Domain = ALLOCATE_HEAP( (pAuthIn->DomainLength + 1) * sizeof(WCHAR) );
        if ( ! pauthCopy->Domain )
        {
            goto Failed;
        }
        wcscpy( pauthCopy->Domain, pAuthIn->Domain );
    }

    pauthCopy->Flags = pAuthIn->Flags;

    DNSDBG( SECURITY, (
        "Exit Dns_AllocateAndInitializeCredentialsW()\n" ));

    return pauthCopy;


Failed:

    //  allocation failure
    //      - cleanup what was allocated and get out

    Dns_FreeAuthIdentityCredentials( pauthCopy );
    return( NULL );
}



PSEC_WINNT_AUTH_IDENTITY_A
Dns_AllocateAndInitializeCredentialsA(
    IN      PSEC_WINNT_AUTH_IDENTITY_A  pAuthIn
    )
/*++

Description:

    Allocates auth identity info and initializes pAuthIn info

    Note:  it is more work to convert to unicode and call previous
        function than to call this one

Parameters:

    pAuthIn -- auth identity info

Return:

    Ptr to newly create credentials.
    NULL on failure.

--*/
{
    PSEC_WINNT_AUTH_IDENTITY_A pauthCopy = NULL;

    DNSDBG( SECURITY, (
        "Call Dns_AllocateAndInitializeCredentialsA\n" ));

    //
    //  allocate credentials struct
    //      - zero for simple cleanup on subfield alloc failures
    //

    if ( !pAuthIn )
    {
        return NULL;
    }
    ASSERT( pAuthIn->Flags == SEC_WINNT_AUTH_IDENTITY_ANSI );

    //
    //  allocate credentials struct
    //      - zero for simple cleanup on subfield alloc failures
    //

    pauthCopy = ALLOCATE_HEAP_ZERO( sizeof(SEC_WINNT_AUTH_IDENTITY_A) );
    if ( !pauthCopy )
    {
        return NULL;
    }

    //
    //  copy subfields
    //

    //  user

    pauthCopy->UserLength = pAuthIn->UserLength;
    if ( pAuthIn->UserLength )
    {
        ASSERT( pAuthIn->UserLength == strlen(pAuthIn->User) );

        pauthCopy->User = ALLOCATE_HEAP( (pAuthIn->UserLength + 1) * sizeof(CHAR) );
        if ( ! pauthCopy->User )
        {
            goto Failed;
        }
        strcpy( pauthCopy->User, pAuthIn->User );
    }

    //  password
    //      - must allow zero length password

    pauthCopy->PasswordLength = pAuthIn->PasswordLength;

    if ( pAuthIn->PasswordLength  ||  pAuthIn->Password )
    {
        ASSERT( pAuthIn->PasswordLength == strlen(pAuthIn->Password) );

        pauthCopy->Password = ALLOCATE_HEAP( (pAuthIn->PasswordLength + 1) * sizeof(CHAR) );
        if ( ! pauthCopy->Password )
        {
            goto Failed;
        }
        strcpy( pauthCopy->Password, pAuthIn->Password );
    }

    //  domain

    pauthCopy->DomainLength = pAuthIn->DomainLength;
    if ( pAuthIn->DomainLength )
    {
        ASSERT( pAuthIn->DomainLength == strlen(pAuthIn->Domain) );

        pauthCopy->Domain = ALLOCATE_HEAP( (pAuthIn->DomainLength + 1) * sizeof(CHAR) );
        if ( ! pauthCopy->Domain )
        {
            goto Failed;
        }
        strcpy( pauthCopy->Domain, pAuthIn->Domain );
    }

    pauthCopy->Flags = pAuthIn->Flags;

    DNSDBG( SECURITY, (
        "Exit Dns_AllocateAndInitializeCredentialsA()\n" ));

    return pauthCopy;


Failed:

    //  allocation failure
    //      - cleanup what was allocated and get out

    Dns_FreeAuthIdentityCredentials( pauthCopy );
    return( NULL );
}



VOID
Dns_FreeAuthIdentityCredentials(
    IN OUT  PVOID           pAuthIn
    )
/*++

Routine Description (Dns_FreeAuthIdentityCredentials):

    Free's structure given

Arguments:

    pAuthIn -- in param to free

Return Value:

    None

--*/
{
    register PSEC_WINNT_AUTH_IDENTITY_W pauthId;

    pauthId = (PSEC_WINNT_AUTH_IDENTITY_W) pAuthIn;
    if ( !pauthId )
    {
        return;
    }

    //
    //  assuming _W and _A structs are equivalent except
    //      for string types
    //

    ASSERT( sizeof( SEC_WINNT_AUTH_IDENTITY_W ) ==
            sizeof( SEC_WINNT_AUTH_IDENTITY_A ) );

    if ( pauthId->User )
    {
        FREE_HEAP ( pauthId->User );
    }
    if ( pauthId->Password )
    {
        FREE_HEAP ( pauthId->Password );
    }
    if ( pauthId->Domain )
    {
        FREE_HEAP ( pauthId->Domain );
    }

    FREE_HEAP ( pauthId );
}



PSEC_WINNT_AUTH_IDENTITY_W
Dns_AllocateCredentials(
    IN      PWSTR           pwsUserName,
    IN      PWSTR           pwsDomain,
    IN      PWSTR           pwsPassword
    )
/*++

Description:

    Allocates auth identity info and initializes pAuthIn info

Parameters:

    pwsUserName -- user name

    pwsDomain   -- domain name

    pwsPassword -- password

Return:

    Ptr to newly create credentials.
    NULL on failure.

--*/
{
    PSEC_WINNT_AUTH_IDENTITY_W  pauth = NULL;
    DWORD   length;
    PWSTR   pstr;


    DNSDBG( SECURITY, (
        "Enter Dns_AllocateCredentials()\n"
        "\tuser     = %S\n"
        "\tdomain   = %S\n"
        "\tpassword = %S\n",
        pwsUserName,
        pwsDomain,
        pwsPassword ));

    //
    //  allocate credentials struct
    //      - zero for simple cleanup on subfield alloc failures
    //

    pauth = ALLOCATE_HEAP_ZERO( sizeof(SEC_WINNT_AUTH_IDENTITY_W) );
    if ( !pauth )
    {
        return NULL;
    }

    //  copy user

    length = wcslen( pwsUserName );

    pstr = ALLOCATE_HEAP( (length + 1) * sizeof(WCHAR) );
    if ( ! pstr )
    {
        goto Failed;
    }
    wcscpy( pstr, pwsUserName );

    pauth->User = pstr;
    pauth->UserLength = length;

    //  copy domain

    length = wcslen( pwsDomain );

    pstr = ALLOCATE_HEAP( (length + 1) * sizeof(WCHAR) );
    if ( ! pstr )
    {
        goto Failed;
    }
    wcscpy( pstr, pwsDomain );

    pauth->Domain = pstr;
    pauth->DomainLength = length;

    //  copy password

    length = wcslen( pwsPassword );

    pstr = ALLOCATE_HEAP( (length + 1) * sizeof(WCHAR) );
    if ( ! pstr )
    {
        goto Failed;
    }
    wcscpy( pstr, pwsPassword );

    pauth->Password = pstr;
    pauth->PasswordLength = length;

    //  set to unicode

    pauth->Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;

    DNSDBG( SECURITY, (
        "Exit Dns_AllocateCredentialsW( %p )\n",
        pauth ));

    return pauth;


Failed:

    //  allocation failure
    //      - cleanup what was allocated and get out

    Dns_FreeAuthIdentityCredentials( pauth );
    return( NULL );
}



//
//  DNS Credential utilities (unused)
//

DNS_STATUS
Dns_ImpersonateUser(
    IN      PDNS_CREDENTIALS    pCreds
    )
/*++

Routine Description:

    Impersonate a user.

Arguments:

    pCreds -- credentials of user to impersonate

Return Value:

    ERROR_SUCCESS if successful
    Error code on failure.

--*/
{
    DNS_STATUS  status = NO_ERROR;
    HANDLE      htoken;
    
    //
    //  attempt logon
    //

    if ( ! LogonUserW(
                pCreds->pUserName,
                pCreds->pDomain,
                pCreds->pPassword,
                LOGON32_LOGON_SERVICE,
                LOGON32_PROVIDER_WINNT50,
                &htoken ) )
    {
        status = GetLastError();
        if ( status == NO_ERROR )
        {
            status = ERROR_CANNOT_IMPERSONATE;
            DNS_ASSERT( FALSE );
        }

        DNSDBG( SECURITY, (
            "LogonUser() failed => %d\n"
            "\tuser     = %S\n"
            "\tdomain   = %S\n"
            "\tpassword = %S\n",
            status,
            pCreds->pUserName,
            pCreds->pDomain,
            pCreds->pPassword
            ));

        return status;
    }

    //
    //  impersonate
    //

    if ( !ImpersonateLoggedOnUser( htoken ) )
    {
        status = GetLastError();
        if ( status == NO_ERROR )
        {
            status = ERROR_CANNOT_IMPERSONATE;
            DNS_ASSERT( FALSE );
        }

        DNSDBG( SECURITY, (
            "ImpersonateLoggedOnUser() failed = %d\n",
            status ));
    }
    
    CloseHandle( htoken );

    DNSDBG( SECURITY, (
        "%s\n"
        "\tuser     = %S\n"
        "\tdomain   = %S\n"
        "\tpassword = %S\n",
        (status == NO_ERROR)
            ? "Successfully IMPERSONATING!"
            : "Failed IMPERSONATION!",
        pCreds->pUserName,
        pCreds->pDomain,
        pCreds->pPassword ));

    return  status;
}



VOID
Dns_FreeCredentials(
    IN      PDNS_CREDENTIALS    pCreds
    )
/*++

Routine Description:

    Free DNS credentials.

Arguments:

    pCreds -- credentials to free

Return Value:

    None

--*/
{
    //
    //  free subfields, then credentials
    //

    if ( !pCreds )
    {
        return;
    }

    if ( pCreds->pUserName )
    {
        FREE_HEAP( pCreds->pUserName );
    }
    if ( pCreds->pDomain )
    {
        FREE_HEAP( pCreds->pDomain );
    }
    if ( pCreds->pPassword )
    {
        FREE_HEAP( pCreds->pPassword );
    }
    FREE_HEAP( pCreds );
}



PDNS_CREDENTIALS
Dns_CopyCredentials(
    IN      PDNS_CREDENTIALS    pCreds
    )
/*++

Routine Description:

    Create copy of DNS credentials.

Arguments:

    pCreds -- credentials of user to copy

Return Value:

    Ptr to allocated copy of credentials.

--*/
{
    PDNS_CREDENTIALS    pnewCreds = NULL;
    PWSTR               pfield;

    //
    //  allocate credentials
    //      - copy of subfields
    //

    pnewCreds = (PDNS_CREDENTIALS) ALLOCATE_HEAP_ZERO( sizeof(*pnewCreds) );
    if ( !pnewCreds )
    {
        return( NULL );
    }

    pfield = (PWSTR) Dns_CreateStringCopy_W( pCreds->pUserName );
    if ( !pfield )
    {
        goto Failed;
    }
    pnewCreds->pUserName = pfield;

    pfield = (PWSTR) Dns_CreateStringCopy_W( pCreds->pDomain );
    if ( !pfield )
    {
        goto Failed;
    }
    pnewCreds->pDomain = pfield;

    pfield = (PWSTR) Dns_CreateStringCopy_W( pCreds->pPassword );
    if ( !pfield )
    {
        goto Failed;
    }
    pnewCreds->pPassword = pfield;

    return( pnewCreds );

Failed:

    Dns_FreeCredentials( pnewCreds );
    return( NULL );
}
    
//
//  End secutil.c
//