/*++ Copyright (c) 2000 Microsoft Corporation Module Name: mailrm.cpp Abstract: The implementation of the Mail resource manager Author: t-eugenz - August 2000 Environment: User mode only. Revision History: Created - August 2000 --*/ #include "pch.h" #include "mailrm.h" #include "mailrmp.h" #include MailRM::MailRM() /*++ Routine Description The constructor for the Mail resource manager. It initializes an instance of an Authz Resource Manager, providing it with the appropriate callback functions. It also creates a security descriptor for the mail RM, with a SACL and DACL. Arguments None. Return Value None. --*/ { // // Initialize the audit information // AUTHZ_RM_AUDIT_INFO_HANDLE hRMAuditInfo; if( FALSE == AuthzInitializeRMAuditInfo(&hRMAuditInfo, 0, 0, 0, L"MailRM") ) { throw (DWORD)ERROR_INTERNAL_ERROR; } if( FALSE == AuthzInitializeResourceManager( MailRM::AccessCheck, MailRM::ComputeDynamicGroups, MailRM::FreeDynamicGroups, hRMAuditInfo, 0, // no flags &_hRM ) ) { AuthzFreeRMAuditInfo(hRMAuditInfo); throw (DWORD)ERROR_INTERNAL_ERROR; } // // Create the security descriptor // try { InitializeMailSecurityDescriptor(); } catch(...) { AuthzFreeRMAuditInfo(hRMAuditInfo); AuthzFreeResourceManager(_hRM); throw; } } MailRM::~MailRM() /*++ Routine Description The destructor for the Mail resource manager. Frees any dynamically allocated memory used, including deleting any registered mailboxes. Arguments None. Return Value None. --*/ { // // Deallocate the DACL and SACL in the security descriptor // PACL pAclMail = NULL; BOOL fPresent; BOOL fDefaulted; DWORD dwTmp; AUTHZ_RM_AUDIT_INFO_HANDLE hAuditInfo; if( FALSE != AuthzGetInformationFromResourceManager( _hRM, AuthzRMInfoRMAuditInfo, &hAuditInfo, sizeof(AUTHZ_RM_AUDIT_INFO_HANDLE), &dwTmp ) ) { AuthzFreeRMAuditInfo(hAuditInfo); } GetSecurityDescriptorDacl(&_sd, &fPresent, &pAclMail, &fDefaulted); if( pAclMail != NULL ) { delete[] (PBYTE)pAclMail; pAclMail = NULL; } GetSecurityDescriptorSacl(&_sd, &fPresent, &pAclMail, &fDefaulted); if( pAclMail != NULL ) { delete[] (PBYTE)pAclMail; } // // Deallocate the resource manager // AuthzFreeResourceManager(_hRM); // // Delete the mailboxes // while( ! _mapSidMailbox.empty() ) { delete (*(_mapSidMailbox.begin())).second; _mapSidMailbox.erase(_mapSidMailbox.begin()); } // // Free the AuthZ client contexts // while( ! _mapSidContext.empty() ) { AuthzFreeContext((*(_mapSidContext.begin())).second); _mapSidContext.erase(_mapSidContext.begin()); } } void MailRM::InitializeMailSecurityDescriptor() /*++ Routine Description This private method initializes the MailRM's security descriptor. It should be called exactly once, and only by the constructor. It creates a security descriptor with the following DACL: CallbackDeny READ Insecure 11pm-5am OR Sensitive Allow READ, WRITE PrincipalSelf Allow READ, WRITE, ADMIN MailAdmins And the following SACL CallbackAudit READ Insecure 11pm-5am OR Sensitive (audit on both success and failure) Arguments None. Return Value None. --*/ { DWORD dwAclSize = sizeof(ACL); DWORD dwAceSize = 0; PMAILRM_OPTIONAL_DATA pOptionalData = NULL; // // Initialize the security descriptor // No need for owner or group // InitializeSecurityDescriptor(&_sd, SECURITY_DESCRIPTOR_REVISION); SetSecurityDescriptorGroup(&_sd, NULL, FALSE); SetSecurityDescriptorOwner(&_sd, MailAdminsSid, FALSE); // // Callback deny ace RWA for Insecure group SID // Optional data: Sensitive mailbox OR 11pm-5am // Any users coming in over an insecure connection between 11pm and 5am // should be denied read access. // Also any users coming in over insecure connections to sensitive mailboxes // should be denied read access. // PACCESS_DENIED_CALLBACK_ACE pDenyAce = NULL; // // This audit ACE has the same conditions as the above deny ACE. It audits // any successful (should not happen with the above deny) or failed // authentications which fit the callback parameters. // PSYSTEM_AUDIT_CALLBACK_ACE pAuditAce = NULL; // // DACL for the security descriptor // PACL pDacl = NULL; // // SACL for the security descriptor // PACL pSacl = NULL; // // We allocate and initialize the callback deny ACE // // // Size of the callback access denied ACE with the optional data // dwAceSize = sizeof(ACCESS_DENIED_CALLBACK_ACE) // ACE and 1 DWORD of SID - sizeof(DWORD) // minus the dword + GetLengthSid(InsecureSid) // length of the SID + sizeof(MAILRM_OPTIONAL_DATA); // size of optional data pDenyAce = (PACCESS_DENIED_CALLBACK_ACE)new BYTE[dwAceSize]; if( pDenyAce == NULL ) { throw (DWORD)ERROR_OUTOFMEMORY; } // // Manually initialize the ACE structure // pDenyAce->Header.AceFlags = 0; pDenyAce->Header.AceSize = dwAceSize; pDenyAce->Header.AceType = ACCESS_DENIED_CALLBACK_ACE_TYPE; pDenyAce->Mask = ACCESS_MAIL_READ; // // Copy the Insecure SID into the ACE // memcpy(&(pDenyAce->SidStart), InsecureSid, GetLengthSid(InsecureSid)); // // Our optional data is at the end of the ACE // pOptionalData = (PMAILRM_OPTIONAL_DATA)( (PBYTE)pDenyAce + dwAceSize - sizeof(MAILRM_OPTIONAL_DATA) ); // // Initialize the optional data as described above // pOptionalData->bIsSensitive = MAILRM_SENSITIVE; pOptionalData->bLogicType = MAILRM_USE_OR; pOptionalData->bStartHour = MAILRM_DEFAULT_START_TIME; pOptionalData->bEndHour = MAILRM_DEFAULT_END_TIME; // // Add the size of the callback ACE to the expected ACL size // dwAclSize += dwAceSize; // // We also need to add non-callback ACEs // dwAclSize += ( sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + GetLengthSid(PrincipalSelfSid) ); dwAclSize += ( sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) + GetLengthSid(MailAdminsSid) ); // // Now we can allocate the DACL // pDacl = (PACL) (new BYTE[dwAclSize]); if( pDacl == NULL ) { delete[] (PBYTE)pDenyAce; throw (DWORD)ERROR_OUTOFMEMORY; } // // Finally, initialize the ACL and copy the ACEs into it // InitializeAcl(pDacl, dwAclSize, ACL_REVISION_DS); // // Copy the ACE into the ACL // AddAce(pDacl, ACL_REVISION_DS, 0xFFFFFFFF, // Add to end pDenyAce, dwAceSize); delete[] (PBYTE)pDenyAce; // // Add a PRINCIPAL_SELF_SID allow read and write ace // AddAccessAllowedAce(pDacl, ACL_REVISION_DS, ACCESS_MAIL_READ | ACCESS_MAIL_WRITE, PrincipalSelfSid); // // Add an allow mail administrators group full access // AddAccessAllowedAce(pDacl, ACL_REVISION_DS, ACCESS_MAIL_READ | ACCESS_MAIL_WRITE | ACCESS_MAIL_ADMIN, MailAdminsSid); // // Now create the SACL, which will onlye have a single callback ACE // dwAclSize = sizeof(ACL); dwAceSize = sizeof(SYSTEM_AUDIT_CALLBACK_ACE) // ACE and 1 DWORD of SID - sizeof(DWORD) // minus the dword + GetLengthSid(InsecureSid) // length of the SID + sizeof(MAILRM_OPTIONAL_DATA); // size of optional data // // Allocate the callback audit ACE // pAuditAce = (PSYSTEM_AUDIT_CALLBACK_ACE)new BYTE[dwAceSize]; if( pAuditAce == NULL ) { delete[] (PBYTE)pDacl; throw (DWORD)ERROR_OUTOFMEMORY; } // // Initialize the ACE structure // pAuditAce->Header.AceFlags = FAILED_ACCESS_ACE_FLAG | SUCCESSFUL_ACCESS_ACE_FLAG; pAuditAce->Header.AceSize = dwAceSize; pAuditAce->Header.AceType = SYSTEM_AUDIT_CALLBACK_ACE_TYPE; pAuditAce->Mask = ACCESS_MAIL_READ; // // Copy the Insecure SID into the ACE // memcpy(&(pAuditAce->SidStart), InsecureSid, GetLengthSid(InsecureSid)); pOptionalData = (PMAILRM_OPTIONAL_DATA)( (PBYTE)pAuditAce + dwAceSize - sizeof(MAILRM_OPTIONAL_DATA) ); // // Initialize the optional data as described above // pOptionalData->bIsSensitive = MAILRM_SENSITIVE; pOptionalData->bLogicType = MAILRM_USE_OR; pOptionalData->bStartHour = MAILRM_DEFAULT_START_TIME; pOptionalData->bEndHour = MAILRM_DEFAULT_END_TIME; dwAclSize += dwAceSize; // // Allocate the SACL // pSacl = (PACL)new BYTE[dwAclSize]; if( pSacl == NULL ) { delete[] (PBYTE)pDacl; throw (DWORD)ERROR_OUTOFMEMORY; } InitializeAcl(pSacl, dwAclSize, ACL_REVISION_DS); // // Now add the audit ACE to the SACL // AddAce(pSacl, ACL_REVISION_DS, 0xFFFFFFFF, // Add to end pAuditAce, dwAceSize); delete[] (PBYTE)pAuditAce; // // We now have the DACL and the SACL, set them // in the security descriptor // SetSecurityDescriptorDacl(&_sd, TRUE, pDacl, FALSE); SetSecurityDescriptorSacl(&_sd, TRUE, pSacl, FALSE); } void MailRM::AddMailbox(Mailbox *pMailbox) /*++ Routine Description Registers a mailbox (and its user) with the resource manager. Arguments pMailbox - Pointer to an allocated and initialized mailbox Return Value None. --*/ { _mapSidMailbox[pMailbox->GetOwnerSid()] = pMailbox; } Mailbox * MailRM::GetMailboxAccess( const PSID psMailbox, const PSID psUser, DWORD dwIncomingIp, ACCESS_MASK amAccessRequested ) /*++ Routine Description This routine checks whether the user with SID psUser should be allowed access to the mailbox of user psMailbox. psUser is coming from dwIncomingIp, and desires amAccessRequested access mask. Arguments psMailbox - PSID of the user whose mailbox will be accessed psUser - PSID of the user accessing the mailbox dwIncomingIp- IP address of the user accessing the mailbox amAccessRequested - Requested access type to the mailbox Return Value Non-NULL Mailbox * if access is granted. NULL if mailbox does not exist or access is denied. --*/ { AUTHZ_CLIENT_CONTEXT_HANDLE hAuthzClient; AUTHZ_ACCESS_REQUEST AuthzAccessRequest; AUTHZ_ACCESS_REPLY AuthzAccessReply; AUTHZ_AUDIT_INFO_HANDLE hAuthzAuditInfo = NULL; PAUDIT_EVENT_INFO pAuditEventInfo = NULL; wstring wsAccessType; DWORD dwErr = ERROR_SUCCESS; ACCESS_MASK amAccessGranted = 0; WCHAR szIP[20]; // // Find the correct mailbox // Mailbox *pMbx = _mapSidMailbox[psMailbox]; // // Initialize the auditing info for a Generic object // if( FALSE == AuthzInitializeAuditEvent( &pAuditEventInfo, AUTHZ_INIT_GENERIC_AUDIT_EVENT, 0, 0, 0) ) { throw (DWORD)ERROR_INTERNAL_ERROR; } try { if( amAccessRequested & ACCESS_MAIL_READ ) { wsAccessType.append(L"Read "); } if( amAccessRequested & ACCESS_MAIL_WRITE ) { wsAccessType.append(L"Write "); } if( amAccessRequested & ACCESS_MAIL_ADMIN ) { wsAccessType.append(L"Administer"); } } catch(...) { throw (DWORD)ERROR_INTERNAL_ERROR; } wsprintf(szIP, L"IP: %d.%d.%d.%d", (dwIncomingIp >> 24) & 0x000000FF, (dwIncomingIp >> 16) & 0x000000FF, (dwIncomingIp >> 8 ) & 0x000000FF, (dwIncomingIp ) & 0x000000FF ); if( NULL == AuthzInitializeAuditInfo( &hAuthzAuditInfo, 0, pAuditEventInfo, NULL, INFINITE, wsAccessType.c_str(), L"Mailbox", pMbx->GetOwnerName(), szIP) ) { AuthzFreeAuditEvent(pAuditEventInfo); throw (DWORD)ERROR_INTERNAL_ERROR; } // // The audit event info is only needed for the above call, we can // deallocate it immediately after // AuthzFreeAuditEvent(pAuditEventInfo); // // Set up the Authz access request // AuthzAccessRequest.DesiredAccess = amAccessRequested; AuthzAccessRequest.ObjectTypeList = NULL; AuthzAccessRequest.ObjectTypeListLength = 0; AuthzAccessRequest.OptionalArguments = pMbx; // // The PrincipalSelf SID is the SID of the mailbox owner // This way, the PRINCIPAL_SELF_SID allow ACE grants access // only to the owner. PrincipalSelfSid in the ACE will be replaced // by this value for access check purposes. The owner of this mailbox // will have the same SID in his context. Therefore, the two SIDs will // match if there is a PrincipalSelfSid ACE in the ACL. // AuthzAccessRequest.PrincipalSelfSid = pMbx->GetOwnerSid(); // // Prepare the reply structure // AuthzAccessReply.Error = &dwErr; AuthzAccessReply.GrantedAccessMask = &amAccessGranted; AuthzAccessReply.ResultListLength = 1; // // Create or retrieve the client context // if( _mapSidContext.find(pair(psUser, dwIncomingIp)) == _mapSidContext.end()) { // // No context available, initialize // LUID lIdentifier = {0L, 0L}; // // Since we are using SIDs which are not generated by NT, // it would be pointless to resolve group memberships, since // the SIDs will not be recognized by any machine in the domain, // and none of our ACLs use actual NT account SIDs. Therefore, // we use the SKIP_LOCAL_GROUPS and SKIP_TOKEN_GROUPS flags, // the LOCAL prevents a check for groups on the local machine, // and TOKEN prevents a search on the domain // if( FALSE == AuthzInitializeContextFromSid( psUser, NULL, _hRM, NULL, lIdentifier, AUTHZ_SKIP_LOCAL_GROUPS | AUTHZ_SKIP_TOKEN_GROUPS, &dwIncomingIp, &hAuthzClient) ) { AuthzFreeAuditInfo(hAuthzAuditInfo, _hRM); throw (DWORD)ERROR_INTERNAL_ERROR; } _mapSidContext[pair(psUser, dwIncomingIp)] = hAuthzClient; } else { // // Use existing context // hAuthzClient = _mapSidContext[pair(psUser, dwIncomingIp)]; } BOOL bTmp; // // Perform the access check // bTmp = AuthzAccessCheck( hAuthzClient, &AuthzAccessRequest, hAuthzAuditInfo, &_sd, NULL, 0, &AuthzAccessReply, NULL ); AuthzFreeAuditInfo(hAuthzAuditInfo, _hRM); // // Determine whether to grant access // On AccessCheck error, deny access // if( dwErr == ERROR_SUCCESS && bTmp != FALSE) { return pMbx; } else { return NULL; } } BOOL MailRM::GetMultipleMailboxAccess( IN const PMAILRM_MULTI_REQUEST pRequest, IN OUT PMAILRM_MULTI_REPLY pReply ) /*++ Routine Description This routine performs a set of cached access checks in order to request access to a set of mailboxes for a single user (for example, mail admin sending out a message to all users). No need to audit, since this type of access would be only done by an administrator, and multiple audits would most likely flood the mailbox. Something like this would be use, for example, to send out a message to all users. The cached access check first assumes all callback deny ACEs which match SIDs in the user's context apply, and no allow callback ACEs apply. Therefore, the cached access check may initially deny access when it should be granted. If a cached access check results in access denied, a regular access check is performed automatically by AuthZ. As a result, the cached access check is guaranteed to have the same results as a normal access check, though it will take significantly more time if many denies are encountered than if most access requests succeed. Arguments pRequest - Request structure describing the user and the mailboxes pReply - Reply structure returning mailbox pointers and granted access masks. If the access check fails, a NULL pointer is returned for the given mailbox. This is allocated by the caller, and should have the same number of elements as the request. Return Value TRUE on success FALSE on failure. If failure, pReply may not be completely filled --*/ { AUTHZ_CLIENT_CONTEXT_HANDLE hAuthzClient; AUTHZ_ACCESS_REQUEST AuthzAccessRequest; AUTHZ_ACCESS_REPLY AuthzAccessReply; DWORD dwErr = ERROR_SUCCESS; ACCESS_MASK amAccessGranted = 0; AUTHZ_HANDLE hAuthzCached; // // Set up the Authz access request // Only the DesiredAccess and PrincipalSelfSid parameters will change // per mailbox. Initial access check is MAXIMUM_ALLOWED. // AuthzAccessRequest.ObjectTypeList = NULL; AuthzAccessRequest.ObjectTypeListLength = 0; // // Initial access check will be caching, therefore optional parameters // will not be used // AuthzAccessRequest.OptionalArguments = NULL; // // The PrincipalSelf SID is the SID of the mailbox owner // This way, the PRINCIPAL_SELF_SID allow ACE grants access // only to the owner // AuthzAccessRequest.PrincipalSelfSid = NULL; // // Initially ask for MAXIMUM_ALLOWED access // AuthzAccessRequest.DesiredAccess = MAXIMUM_ALLOWED; // // Prepare the reply structure // AuthzAccessReply.Error = &dwErr; AuthzAccessReply.GrantedAccessMask = &amAccessGranted; AuthzAccessReply.ResultListLength = 1; // // Create or retrieve the client context // if( _mapSidContext.find( pair(pRequest->psUser , pRequest->dwIp)) == _mapSidContext.end()) { // // No context available, initialize // LUID lIdentifier = {0L, 0L}; // // The SIDs are not real, therefore do not attempt to resolve // local or domain group memberships for the token // AuthzInitializeContextFromSid( pRequest->psUser, NULL, _hRM, NULL, lIdentifier, AUTHZ_SKIP_LOCAL_GROUPS | AUTHZ_SKIP_TOKEN_GROUPS, &(pRequest->dwIp), &hAuthzClient); _mapSidContext[pair(pRequest->psUser, pRequest->dwIp)] = hAuthzClient; } else { // // Use existing context // hAuthzClient = _mapSidContext[pair(pRequest->psUser, pRequest->dwIp)]; } // // Perform a single AuthZ access check to get the cached handle // if( FALSE == AuthzAccessCheck( hAuthzClient, &AuthzAccessRequest, NULL, &_sd, NULL, 0, &AuthzAccessReply, &hAuthzCached )) { return FALSE; } // // Now use the cached access check for all of the access requests // DWORD i; Mailbox * mbx; for( i = 0; i < pRequest->dwNumElems; i++ ) { mbx = _mapSidMailbox[pRequest->pRequestElem[i].psMailbox]; AuthzAccessRequest.DesiredAccess = pRequest->pRequestElem[i].amAccessRequested; AuthzAccessRequest.PrincipalSelfSid = mbx->GetOwnerSid(); AuthzAccessRequest.OptionalArguments = mbx; if( FALSE == AuthzCachedAccessCheck( hAuthzCached, &AuthzAccessRequest, NULL, &AuthzAccessReply )) { return FALSE; } // // Access check done, now fill in the access array element // if( dwErr == ERROR_SUCCESS ) { pReply[i].pMailbox = mbx; pReply[i].amAccessGranted = amAccessGranted; } else { pReply[i].pMailbox = NULL; pReply[i].amAccessGranted = 0; } } return TRUE; } BOOL CALLBACK MailRM::AccessCheck( IN AUTHZ_CLIENT_CONTEXT_HANDLE pAuthzClientContext, IN PACE_HEADER pAce, IN PVOID pArgs OPTIONAL, IN OUT PBOOL pbAceApplicable ) /*++ Routine Description This is the Authz callback access check for the mail resource manager. It determines whether the given callback ACE applies based on whether the mailbox contains sensitive information and the current time. Arguments pAuthzClientContext - the AuthZ client context of the user accessing the mailbox, with dynamic groups already computed pAce - Pointer to the start of the callback ACE The optional ACE data is in the last 4 bytes of the ACE pArgs - The optional argument passed to the AuthzAccessCheck, pointer to the Mailbox being accessed pbAceApplicable - Set to TRUE iff the ACE should be used in the access check. Return Value TRUE on success FALSE on failure --*/ { BOOL bTimeApplies; BOOL bSensitiveApplies; // // If pArgs are not present, ACE is never applicable // if( pArgs == NULL ) { *pbAceApplicable = FALSE; return TRUE; } // // Offset of the optional data, last 4 bytes of the callback ACE // PMAILRM_OPTIONAL_DATA pOptData = (PMAILRM_OPTIONAL_DATA) ( (PBYTE)pAce + pAce->AceSize - sizeof(MAILRM_OPTIONAL_DATA)); // // Get current time and check if the ACE time restriction applies // time_t tTime; struct tm * tStruct; time(&tTime); tStruct = localtime(&tTime); if( WITHIN_TIMERANGE(tStruct->tm_hour, pOptData->bStartHour, pOptData->bEndHour) ) { bTimeApplies = TRUE; } else { bTimeApplies = FALSE; } // // Check whether the mailbox is sensitive and the ACE applies to sensitive // mailboxes // if( ((Mailbox *)pArgs)->IsSensitive() && pOptData->bIsSensitive == MAILRM_SENSITIVE ) { bSensitiveApplies = TRUE; } else { bSensitiveApplies = FALSE; } // // Make the final decision based on whether the optional argument // calls for an AND or OR condition // if( pOptData->bLogicType == MAILRM_USE_AND ) { *pbAceApplicable = bSensitiveApplies && bTimeApplies; } else { *pbAceApplicable = bSensitiveApplies || bTimeApplies; } // // AccessCheck succeeded // return TRUE; } BOOL CALLBACK MailRM::ComputeDynamicGroups( IN AUTHZ_CLIENT_CONTEXT_HANDLE pAuthzClientContext, IN PVOID Args, OUT PSID_AND_ATTRIBUTES *pSidAttrArray, OUT PDWORD pSidCount, OUT PSID_AND_ATTRIBUTES *pRestrictedSidAttrArray, OUT PDWORD pRestrictedSidCount ) /*++ Routine Description This is the Authz callback which computes additional dynamic groups for the user context. If the user is originating at an IP address outside the company lan (company lan assumed to be 192.*), the InsecureSid SID is added to the client's context, signifying that the connection is not secure. This enables callback ACEs which prohibit sensitive information from being sent over insecure connections. Arguments pAuthzClientContext - the AuthZ client context of the user pArgs - The optional argument passed to the AuthzCreateContext, pointer to a DWORD containing the user's IP address pSidAttrArray * - The additional SIDs, if any are assigned, are returned here. pSidCount - Number of entries in pSidAttrArray pRestrictedSidAttrArray * - The additional restricted SIDs, if any are assigned, are returned here. pRestrictedSidCount - Number of entries in pSidAttrArray Return Value TRUE on success FALSE on failure --*/ { // // No restrict-only groups used // *pRestrictedSidCount = 0; *pRestrictedSidAttrArray = NULL; // // Internal company network (secure) is 192.*, anything else is insecure // if( *( (DWORD *) Args) >= 0xC0000000 && *( (DWORD *) Args) < 0xC1000000 ) { // // Secure, within the company IP range, no restricted groups // *pSidCount = 0; *pSidAttrArray = NULL; } else { // // Insecure external connection, add the Insecure group SID // *pSidCount = 1; *pSidAttrArray = (PSID_AND_ATTRIBUTES)malloc( sizeof(SID_AND_ATTRIBUTES) ); if( pSidAttrArray == NULL ) { SetLastError(ERROR_OUTOFMEMORY); return FALSE; } (*pSidAttrArray)[0].Attributes = SE_GROUP_ENABLED; (*pSidAttrArray)[0].Sid = InsecureSid; } return TRUE; } VOID CALLBACK MailRM::FreeDynamicGroups ( IN PSID_AND_ATTRIBUTES pSidAttrArray ) /*++ Routine Description This routine frees any memory allocated by ComputeDynamicGroups Arguments pSidAttrArray - Pointer to the memory to be freed Return Value None --*/ { free(pSidAttrArray); } bool CompareSidStruct::operator()(const PSID pSid1, const PSID pSid2) const /*++ Routine Description This is a less-than function which places a complete ordering on a set of PSIDs by value, NULL PSIDs are valid. This is used by the STL map. Since the number of subauthorities appears before the subauthorities themselves, that difference will be noticed for two SIDs of different size before the memcmp tries to access the nonexistant subauthority in the shorter SID, therefore an access violation will not occur. Arguments pSid1 - The first PSID pSid2 - The second PSID Return Value true IFF pSid1 < pSid2 --*/ { // // If both are NULL, false should be returned for complete ordering // if(pSid2 == NULL) { return false; } if(pSid1 == NULL) { return true; } if( memcmp(pSid1, pSid2, GetLengthSid(pSid1)) < 0 ) { return true; } else { return false; } } bool CompareSidPairStruct::operator()(const pair pair1, const pair pair2) const /*++ Routine Description This is a less-than function which places a complete ordering on a set of pairs by value, NULL PSIDs are valid. This is used by the STL map Arguments pair1 - The first pair pair2 - The second pair Return Value true IFF pSid1 < pSid2 OR (pSid1 = pSid2 AND DWORD1 < DWORD2) --*/ { CompareSidStruct SidComp; if( pair1.second < pair2.second ) { return true; } if( pair1.second > pair2.second ) { return false; } return SidComp.operator()(pair1.first, pair2.first); }