Microsoft/Windows2000
Microsoft
/
Windows2000
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
Windows2000/private/eventlog/server/logclear.c

454 lines
15 KiB
C
Raw Permalink Blame History

/*++
Copyright (c) 1991-1994 Microsoft Corporation
Module Name:
LOGCLEAR.C
Abstract:
Contains functions used to log an event indicating who cleared the log.
This is only called after the security log has been cleared.
Author:
Dan Lafferty (danl) 01-July-1994
Environment:
User Mode -Win32
Revision History:
01-July-1994 danl & robertre
Created - Rob supplied the code which I fitted into the eventlog.
--*/
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#include <windows.h>
#include <stdio.h>
#include <msaudite.h>
#include <eventp.h>
#include <tstr.h>
#define NUM_STRINGS 6
// Globals
PUNICODE_STRING pGlobalComputerNameU = NULL;
PANSI_STRING pGlobalComputerNameA = NULL;
// LOCAL FUNCTION PROTOTYPES
BOOL GetUserInfo(IN HANDLE Token, OUT LPWSTR* UserName, OUT LPWSTR* DomainName, OUT LPWSTR* AuthenticationId, OUT PSID* UserSid);
NTSTATUS ElfpGetComputerName(IN LPSTR* ComputerNamePtr);
PUNICODE_STRING TmpGetComputerNameW(VOID);
VOID w_GetComputerName();
VOID ElfpGenerateLogClearedEvent(IELF_HANDLE LogHandle)
/*++
Routine Description:
This function generates an event indicating that the log was cleared.
Arguments:
LogHandle - This is a handle to the log that the event is to be placed in.
It is intended that this function only be called when the SecurityLog
has been cleared. So it is expected the LogHandle will always be a handle to the security log.
Return Value:
NONE - Either it works or it doesn't. If it doesn't, there isn't much we can do about it.
--*/
{
LPWSTR UserName = NULL;
LPWSTR DomainName = NULL;
LPWSTR AuthenticationId = NULL;
LPWSTR ClientUserName = NULL;
LPWSTR ClientDomainName = NULL;
LPWSTR ClientAuthenticationId = NULL;
PSID UserSid = NULL;
PSID ClientSid = NULL;
DWORD i;
BOOL Result;
HANDLE Token;
PUNICODE_STRING StringPtrArray[NUM_STRINGS];
UNICODE_STRING StringArray[NUM_STRINGS];
NTSTATUS Status;
LARGE_INTEGER Time;
ULONG EventTime;
ULONG LogHandleGrantedAccess;
PUNICODE_STRING pComputerNameU;
DWORD dwStatus;
// Get information about the Eventlog service (i.e., LocalSystem)
Result = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &Token);
if (!Result) {
ASSERT(FALSE);
ElfDbgPrint(("OpenProcessToken failed, error = %d", GetLastError()));
return;
}
Result = GetUserInfo(Token, &UserName, &DomainName, &AuthenticationId, &UserSid);
CloseHandle(Token);
if (!Result) {
ElfDbgPrint(("1st GetUserInfo ret'd %d\n", GetLastError()));
return;
}
ElfDbgPrint(("\nGetUserInfo ret'd \nUserName = %ws, "
"\nDomainName = %ws, \nAuthenticationId = %ws\n",
UserName, DomainName, AuthenticationId));
// Now impersonate in order to get the client's
// information. This call should never fail.
dwStatus = RpcImpersonateClient(NULL);
if (dwStatus != RPC_S_OK) {
ElfDbgPrint(("RPC IMPERSONATION FAILED %d\n", dwStatus));
ASSERT(FALSE);
}
Result = OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &Token);
if (Result) {
Result = GetUserInfo(Token, &ClientUserName, &ClientDomainName, &ClientAuthenticationId, &ClientSid);
CloseHandle(Token);
if (!Result) {
ElfDbgPrint(("2nd GetUserInfo ret'd %d\n", GetLastError()));
goto CleanExit;
}
} else {
// We're impersonating here, so this should never
// happen but just in case, use dashes
ASSERT(FALSE);
ClientUserName = L"-";
ClientDomainName = L"-";
ClientAuthenticationId = L"-";
}
ElfDbgPrint(("\nGetUserInfo ret'd \nUserName = %ws, "
"\nDomainName = %ws, \nAuthenticationId = %ws\n",
ClientUserName, ClientDomainName, ClientAuthenticationId));
RtlInitUnicodeString(&StringArray[0], UserName);
RtlInitUnicodeString(&StringArray[1], DomainName);
RtlInitUnicodeString(&StringArray[2], AuthenticationId);
RtlInitUnicodeString(&StringArray[3], ClientUserName);
RtlInitUnicodeString(&StringArray[4], ClientDomainName);
RtlInitUnicodeString(&StringArray[5], ClientAuthenticationId);
// Create an array of pointers to UNICODE_STRINGs.
for (i = 0; i < NUM_STRINGS; i++) {
StringPtrArray[i] = &StringArray[i];
}
// Generate the time of the event. This is done on the client side
// since that is where the event occurred.
NtQuerySystemTime(&Time);
RtlTimeToSecondsSince1970(&Time, &EventTime);
// Generate the ComputerName of the client.
// We have to do this in the client side since this call may be
// remoted to another server and we would not necessarily have
// the computer name there.
pComputerNameU = TmpGetComputerNameW();
// Since all processes other than LSA are given read-only access
// to the security log, we have to explicitly give the current
// process the right to write the "Log cleared" event
LogHandleGrantedAccess = LogHandle->GrantedAccess;
LogHandle->GrantedAccess |= ELF_LOGFILE_WRITE;
Status = ElfrReportEventW(
LogHandle, // Log Handle
EventTime, // Time
EVENTLOG_AUDIT_SUCCESS, // Event Type
(USHORT)SE_CATEGID_SYSTEM, // Event Category
SE_AUDITID_AUDIT_LOG_CLEARED, // EventID
NUM_STRINGS, // NumStrings
0, // DataSize
pComputerNameU, // pComputerNameU
UserSid, // UserSid
StringPtrArray, // *Strings
NULL, // Data
0, // Flags
NULL, // RecordNumber
NULL // TimeWritten
);
LogHandle->GrantedAccess = LogHandleGrantedAccess;
CleanExit:
// We only come down this path if we know for sure that these
// first three have been allocated.
ElfpFreeBuffer(UserName);
ElfpFreeBuffer(DomainName);
ElfpFreeBuffer(AuthenticationId);
if (UserSid != NULL) {
ElfpFreeBuffer(UserSid);
}
if (ClientUserName != NULL) {
ElfpFreeBuffer(ClientUserName);
}
if (ClientDomainName != NULL) {
ElfpFreeBuffer(ClientDomainName);
}
if (ClientAuthenticationId != NULL) {
ElfpFreeBuffer(ClientAuthenticationId);
}
if (ClientSid != NULL) {
ElfpFreeBuffer(ClientSid);
}
// Stop impersonating
dwStatus = RpcRevertToSelf();
if (dwStatus != RPC_S_OK) {
ElfDbgPrint(("RPC REVERT TO SELF FAILED %d\n", dwStatus));
ASSERT(FALSE);
}
}
BOOL GetUserInfo(IN HANDLE Token, OUT LPWSTR* UserName, OUT LPWSTR* DomainName, OUT LPWSTR* AuthenticationId, OUT PSID* UserSid)
/*++
Routine Description:
This function gathers information about the user identified with the token.
Arguments:
Token - This token identifies the entity for which we are gathering information.
UserName - This is the entity's user name.
DomainName - This is the entity's domain name.
AuthenticationId - This is the entity's Authentication ID.
UserSid - This is the entity's SID.
NOTE:
Memory is allocated by this routine for UserName, DomainName,
AuthenticationId, and UserSid. It is the caller's responsibility to free this memory.
Return Value:
TRUE - If the operation was successful. It is possible that
UserSid did not get allocated in the successful case. Therefore,
the caller should test prior to freeing.
FALSE - If unsuccessful. No memory is allocated in this case.
--*/
{
PTOKEN_USER Buffer = NULL;
// WCHAR User[256];
LPWSTR Domain = NULL;
LPWSTR AccountName = NULL;
SID_NAME_USE Use;
BOOL Result;
DWORD RequiredLength;
DWORD AccountNameSize;
DWORD DomainNameSize;
TOKEN_STATISTICS Statistics;
WCHAR LogonIdString[256];
DWORD Status = ERROR_SUCCESS;
*UserSid = NULL;
Result = GetTokenInformation(Token, TokenUser, NULL, 0, &RequiredLength);
if (!Result) {
if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
Buffer = ElfpAllocateBuffer((RequiredLength + 1) * sizeof(WCHAR));
Result = GetTokenInformation(Token, TokenUser, Buffer, RequiredLength, &RequiredLength);
if (!Result) {
ElfDbgPrint(("2nd GetTokenInformation failed, "
"error = %d\n", GetLastError()));
return(FALSE);
}
} else {
DbgPrint("1st GetTokenInformation failed, error = %d\n", GetLastError());
return(FALSE);
}
}
if (!Result) {
goto ErrorCleanup;
}
AccountNameSize = 0;
DomainNameSize = 0;
Result = LookupAccountSidW(L"", Buffer->User.Sid, NULL, &AccountNameSize, NULL, &DomainNameSize, &Use);
if (!Result) {
if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) {
AccountName = ElfpAllocateBuffer((AccountNameSize + 1) * sizeof(WCHAR));
Domain = ElfpAllocateBuffer((DomainNameSize + 1) * sizeof(WCHAR));
if (AccountName == NULL) {
ElfDbgPrint(("LocalAlloc failed allocating %d bytes, "
"error = %d\n", AccountNameSize, GetLastError()));
goto ErrorCleanup;
}
if (Domain == NULL) {
ElfDbgPrint(("LocalAlloc failed allocating %d bytes, "
"error = %d\n", DomainNameSize, GetLastError()));
goto ErrorCleanup;
}
Result = LookupAccountSidW(L"", Buffer->User.Sid, AccountName, &AccountNameSize, Domain, &DomainNameSize, &Use);
if (!Result) {
ElfDbgPrint(("2nd LookupAccountSid failed, "
"error = %d\n", GetLastError()));
goto ErrorCleanup;
}
} else {
ElfDbgPrint(("1st LookupAccountSid failed, "
"error = %d\n", GetLastError()));
goto ErrorCleanup;
}
} else {
ElfDbgPrint(("LookupAccountSid succeeded unexpectedly\n"));
goto ErrorCleanup;
}
ElfDbgPrint(("Name = %ws\\%ws\n", Domain, AccountName));
Result = GetTokenInformation(Token, TokenStatistics, &Statistics, sizeof(Statistics), &RequiredLength);
if (!Result) {
ElfDbgPrint(("GetTokenInformation failed, error = %d\n", GetLastError()));
goto ErrorCleanup;
}
swprintf(LogonIdString, L"(0x%X,0x%X)", Statistics.AuthenticationId.HighPart, Statistics.AuthenticationId.LowPart);
ElfDbgPrint(("LogonIdString = %ws\n", LogonIdString));
*AuthenticationId = ElfpAllocateBuffer(WCSSIZE(LogonIdString));
if (*AuthenticationId == NULL) {
ElfDbgPrint(("[ELF]GetUserInfo: Failed to allocate buffer "
"for AuthenticationId %d\n", GetLastError()));
goto ErrorCleanup;
}
wcscpy(*AuthenticationId, LogonIdString);
// Return accumulated information
*UserSid = ElfpAllocateBuffer(GetLengthSid(Buffer->User.Sid));
Result = CopySid(GetLengthSid(Buffer->User.Sid), *UserSid, Buffer->User.Sid);
ElfpFreeBuffer(Buffer);
*DomainName = Domain;
*UserName = AccountName;
return(TRUE);
ErrorCleanup:
if (Buffer != NULL) {
ElfpFreeBuffer(Buffer);
}
if (Domain != NULL) {
ElfpFreeBuffer(Domain);
}
if (AccountName != NULL) {
ElfpFreeBuffer(AccountName);
}
if (*UserSid != NULL) {
ElfpFreeBuffer(*UserSid);
}
if (*AuthenticationId != NULL) {
ElfpFreeBuffer(*AuthenticationId);
}
return(FALSE);
}
NTSTATUS ElfpGetComputerName(IN LPSTR* ComputerNamePtr)
/*++
Routine Description:
This routine obtains the computer name from a persistent database,
by calling the GetcomputerNameA Win32 Base API
This routine assumes the length of the computername is no greater
than MAX_COMPUTERNAME_LENGTH, space for which it allocates using
LocalAlloc. It is necessary for the user to free that space using
ElfpFreeBuffer when finished.
Arguments:
ComputerNamePtr - This is a pointer to the location where the pointer to the computer name is to be placed.
Return Value:
NERR_Success - If the operation was successful.
It will return assorted Net or Win32 or NT error messages if not.
--*/
{
DWORD nSize = MAX_COMPUTERNAME_LENGTH + 1;
// Allocate a buffer to hold the largest possible computer name.
*ComputerNamePtr = ElfpAllocateBuffer(nSize);
if (*ComputerNamePtr == NULL) {
return (GetLastError());
}
// Get the computer name string into the locally allocated buffer by calling the Win32 GetComputerNameA API.
if (!GetComputerNameA(*ComputerNamePtr, &nSize)) {
ElfpFreeBuffer(*ComputerNamePtr);
*ComputerNamePtr = NULL;
return (GetLastError());
}
return (ERROR_SUCCESS);
}
VOID w_GetComputerName()
/*++
Routine Description:
This routine gets the name of the computer. It checks the global variable to see if the computer name has already been determined.
If not, it updates that variable with the name.
It does this for the UNICODE and the ANSI versions.
--*/
{
PUNICODE_STRING pNameU = NULL;
PANSI_STRING pNameA = NULL;
LPSTR pName;
NTSTATUS Error;
NTSTATUS Status;
if (pGlobalComputerNameU != NULL) {
return;
}
pNameU = ElfpAllocateBuffer(sizeof(UNICODE_STRING));
pNameA = ElfpAllocateBuffer(sizeof(ANSI_STRING));
if ((pNameU != NULL) && (pNameA != NULL)) {
if ((Error = ElfpGetComputerName(&pName)) == ERROR_SUCCESS) {
// ElfpComputerName has allocated a buffer to contain the
// ASCII name of the computer. We use that for the ANSI
// string structure.
RtlInitAnsiString(pNameA, pName);
} else {
// We could not get the computer name for some reason. Set up
// the golbal pointer to point to the NULL string.
RtlInitAnsiString(pNameA, "\0");
}
// Set up the UNICODE_STRING structure.
Status = RtlAnsiStringToUnicodeString(pNameU, pNameA, TRUE);
// If there was no error, set the global variables.
// Otherwise, free the buffer allocated by ElfpGetComputerName and leave the global variables unchanged.
if (NT_SUCCESS(Status)) {
pGlobalComputerNameU = pNameU; // Set global variable if no error
pGlobalComputerNameA = pNameA; // Set global ANSI variable
} else {
ElfDbgPrint(("[ELFCLNT] GetComputerName - Error 0x%lx\n", Status));
ElfpFreeBuffer(pName);
ElfpFreeBuffer(pNameU); // Free the buffers
ElfpFreeBuffer(pNameA);
}
}
}
PUNICODE_STRING TmpGetComputerNameW()
/*++
Routine Description:
This routine gets the UNICODE name of the computer. It checks the global variable to see if the computer name has already been determined.
If not, it calls the worker routine to do that.
Return Value:
Returns a pointer to the computer name, or a NULL.
--*/
{
if (pGlobalComputerNameU == NULL) {
w_GetComputerName();
}
return (pGlobalComputerNameU);
}
Reference in New Issue View Git Blame Copy Permalink