mirror of
https://gitlab.com/freepascal.org/fpc/source.git
synced 2026-01-20 16:11:37 +01:00
458 lines
13 KiB
ObjectPascal
458 lines
13 KiB
ObjectPascal
{******************************************************************************}
|
|
{ }
|
|
{ Authz Generic Audits API interface Unit for Object Pascal }
|
|
{ }
|
|
{ Portions created by Microsoft are Copyright (C) 1995-2001 Microsoft }
|
|
{ Corporation. All Rights Reserved. }
|
|
{ }
|
|
{ The original file is: adtgen.h, released August 2001. The original Pascal }
|
|
{ code is: AdtGen.pas, released October 2001. The initial developer of the }
|
|
{ Pascal code is Marcel van Brakel (brakelm att chello dott nl). }
|
|
{ }
|
|
{ Portions created by Marcel van Brakel are Copyright (C) 1999-2001 }
|
|
{ Marcel van Brakel. All Rights Reserved. }
|
|
{ }
|
|
{ Obtained through: Joint Endeavour of Delphi Innovators (Project JEDI) }
|
|
{ }
|
|
{ You may retrieve the latest version of this file at the Project JEDI }
|
|
{ APILIB home page, located at http://jedi-apilib.sourceforge.net }
|
|
{ }
|
|
{ The contents of this file are used with permission, subject to the Mozilla }
|
|
{ Public License Version 1.1 (the "License"); you may not use this file except }
|
|
{ in compliance with the License. You may obtain a copy of the License at }
|
|
{ http://www.mozilla.org/MPL/MPL-1.1.html }
|
|
{ }
|
|
{ Software distributed under the License is distributed on an "AS IS" basis, }
|
|
{ WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for }
|
|
{ the specific language governing rights and limitations under the License. }
|
|
{ }
|
|
{ Alternatively, the contents of this file may be used under the terms of the }
|
|
{ GNU Lesser General Public License (the "LGPL License"), in which case the }
|
|
{ provisions of the LGPL License are applicable instead of those above. }
|
|
{ If you wish to allow use of your version of this file only under the terms }
|
|
{ of the LGPL License and not to allow others to use your version of this file }
|
|
{ under the MPL, indicate your decision by deleting the provisions above and }
|
|
{ replace them with the notice and other provisions required by the LGPL }
|
|
{ License. If you do not delete the provisions above, a recipient may use }
|
|
{ your version of this file under either the MPL or the LGPL License. }
|
|
{ }
|
|
{ For more information about the LGPL: http://www.gnu.org/copyleft/lesser.html }
|
|
{ }
|
|
{******************************************************************************}
|
|
|
|
|
|
unit JwaAdtGen;
|
|
|
|
{$WEAKPACKAGEUNIT}
|
|
|
|
{$HPPEMIT ''}
|
|
{$HPPEMIT '#include "adtgen.h"'}
|
|
{$HPPEMIT ''}
|
|
|
|
{$I jediapilib.inc}
|
|
|
|
interface
|
|
|
|
uses
|
|
JwaWinNT, JwaWinType;
|
|
|
|
//
|
|
// type of audit
|
|
//
|
|
// AUDIT_TYPE_LEGACY
|
|
// In this case the audit event schema is stored in a .mc file.
|
|
//
|
|
// AUDIT_TYPE_WMI
|
|
// The schema is stored in WMI. (currently not supported)
|
|
//
|
|
|
|
const
|
|
AUDIT_TYPE_LEGACY = 1;
|
|
{$EXTERNALSYM AUDIT_TYPE_LEGACY}
|
|
AUDIT_TYPE_WMI = 2;
|
|
{$EXTERNALSYM AUDIT_TYPE_WMI}
|
|
|
|
//
|
|
// Type of parameters passed in the AUDIT_PARAMS.Parameters array
|
|
//
|
|
// Use the AdtInitParams function to initialize and prepare
|
|
// an array of audit parameters.
|
|
//
|
|
|
|
type
|
|
_AUDIT_PARAM_TYPE = (
|
|
|
|
APT__0,
|
|
|
|
//
|
|
// do we need this?
|
|
//
|
|
|
|
APT_None,
|
|
|
|
//
|
|
// NULL terminated string
|
|
//
|
|
|
|
APT_String,
|
|
|
|
//
|
|
// unsigned long
|
|
//
|
|
|
|
APT_Ulong,
|
|
|
|
//
|
|
// a pointer. use for specifying handles/pointers
|
|
// (32 bit on 32 bit systems and 64 bit on 64 bit systems)
|
|
// Note that the memory to which the pointer points to
|
|
// is not marshalled when using this type. Use this when you
|
|
// are interested in the absolute value of the pointer.
|
|
// A good example of this is when specifying HANDLE values.
|
|
//
|
|
|
|
APT_Pointer,
|
|
|
|
//
|
|
// SID
|
|
//
|
|
|
|
APT_Sid,
|
|
|
|
//
|
|
// Logon ID (LUID)
|
|
//
|
|
|
|
APT_LogonId,
|
|
|
|
//
|
|
// Object Type List
|
|
//
|
|
|
|
APT_ObjectTypeList,
|
|
|
|
//
|
|
// Luid (not translated to LogonId)
|
|
//
|
|
|
|
APT_Luid,
|
|
|
|
//
|
|
// Guid
|
|
//
|
|
|
|
APT_Guid,
|
|
|
|
//
|
|
// Time (FILETIME)
|
|
//
|
|
|
|
APT_Time,
|
|
|
|
//
|
|
// ULONGLONG
|
|
//
|
|
|
|
APT_Int64
|
|
);
|
|
{$EXTERNALSYM _AUDIT_PARAM_TYPE}
|
|
AUDIT_PARAM_TYPE = _AUDIT_PARAM_TYPE;
|
|
{$EXTERNALSYM AUDIT_PARAM_TYPE}
|
|
TAuditParamType = AUDIT_PARAM_TYPE;
|
|
|
|
//
|
|
// There are two types of flags that can be used with a parameter.
|
|
//
|
|
// - formatting flag
|
|
// This defines the appearance of a parameter when
|
|
// written to the eventlog. Such flags may become obsolete
|
|
// when we move to WMI auditing.
|
|
//
|
|
// - control flag
|
|
// This causes a specified action to be taken that affects
|
|
// a parameter value.
|
|
//
|
|
// For example:
|
|
// If you use the AP_PrimaryLogonId/AP_ClientLogonId flag,
|
|
// the system will capture the logon-id from the process/thread token.
|
|
//
|
|
|
|
const
|
|
AP_ParamTypeBits = 8;
|
|
{$EXTERNALSYM AP_ParamTypeBits}
|
|
AP_ParamTypeMask = $000000ff;
|
|
{$EXTERNALSYM AP_ParamTypeMask}
|
|
|
|
//
|
|
// the flags values below have overlapping values. this is ok since
|
|
// the scope of each flag is limited to the type to which it applies.
|
|
//
|
|
|
|
//
|
|
// APT_Ulong : format flag : causes a number to appear in hex
|
|
//
|
|
|
|
AP_FormatHex = $0001 shl AP_ParamTypeBits;
|
|
{$EXTERNALSYM AP_FormatHex}
|
|
|
|
//
|
|
// APT_Ulong : format flag : causes a number to be treated as access-mask.
|
|
// The meaning of each bit depends on the associated
|
|
// object type.
|
|
//
|
|
|
|
AP_AccessMask = $0002 shl AP_ParamTypeBits;
|
|
{$EXTERNALSYM AP_AccessMask}
|
|
|
|
|
|
//
|
|
// APT_String : format flag : causes a string to be treated as a file-path
|
|
//
|
|
|
|
AP_Filespec = $0001 shl AP_ParamTypeBits;
|
|
{$EXTERNALSYM AP_Filespec}
|
|
|
|
//
|
|
// APT_LogonId : control flag : logon-id is captured from the process token
|
|
//
|
|
|
|
AP_PrimaryLogonId = $0001 shl AP_ParamTypeBits;
|
|
{$EXTERNALSYM AP_PrimaryLogonId}
|
|
|
|
//
|
|
// APT_LogonId : control flag : logon-id is captured from the thread token
|
|
//
|
|
|
|
AP_ClientLogonId = $0002 shl AP_ParamTypeBits;
|
|
{$EXTERNALSYM AP_ClientLogonId}
|
|
|
|
//
|
|
// internal helper macros
|
|
//
|
|
|
|
// (rom) MACRO
|
|
function ApExtractType(TypeFlags: DWORD): AUDIT_PARAM_TYPE;
|
|
{$EXTERNALSYM ApExtractType}
|
|
|
|
// (rom) MACRO
|
|
function ApExtractFlags(TypeFlags: DWORD): DWORD;
|
|
{$EXTERNALSYM ApExtractFlags}
|
|
|
|
//
|
|
// Element of an object-type-list
|
|
//
|
|
// The AUDIT_OBJECT_TYPES structure identifies an object type element
|
|
// in a hierarchy of object types. The AccessCheckByType functions use
|
|
// an array of such structures to define a hierarchy of an object and
|
|
// its subobjects, such as property sets and properties.
|
|
//
|
|
|
|
type
|
|
PAUDIT_OBJECT_TYPE = ^AUDIT_OBJECT_TYPE;
|
|
{$EXTERNALSYM PAUDIT_OBJECT_TYPE}
|
|
_AUDIT_OBJECT_TYPE = record
|
|
ObjectType: GUID; // guid of the (sub)object
|
|
Flags: USHORT; // currently not defined
|
|
Level: USHORT; // level within the hierarchy.
|
|
// 0 is the root level
|
|
AccessMask: ACCESS_MASK; // access-mask for this (sub)object
|
|
end;
|
|
{$EXTERNALSYM _AUDIT_OBJECT_TYPE}
|
|
AUDIT_OBJECT_TYPE = _AUDIT_OBJECT_TYPE;
|
|
{$EXTERNALSYM AUDIT_OBJECT_TYPE}
|
|
TAuditObjectType = AUDIT_OBJECT_TYPE;
|
|
PAuditObjectType = PAUDIT_OBJECT_TYPE;
|
|
|
|
PAUDIT_OBJECT_TYPES = ^AUDIT_OBJECT_TYPES;
|
|
{$EXTERNALSYM PAUDIT_OBJECT_TYPES}
|
|
_AUDIT_OBJECT_TYPES = record
|
|
Count: USHORT; // number of object-types in pObjectTypes
|
|
Flags: USHORT; // currently not defined
|
|
pObjectTypes: PAUDIT_OBJECT_TYPE; // array of object-types
|
|
end;
|
|
{$EXTERNALSYM _AUDIT_OBJECT_TYPES}
|
|
AUDIT_OBJECT_TYPES = _AUDIT_OBJECT_TYPES;
|
|
{$EXTERNALSYM AUDIT_OBJECT_TYPES}
|
|
TAuditObjectTypes = AUDIT_OBJECT_TYPES;
|
|
PAuditObjectTypes = PAUDIT_OBJECT_TYPES;
|
|
|
|
//
|
|
// Structure that defines a single audit parameter.
|
|
//
|
|
// LsaGenAuditEvent accepts an array of such elements to
|
|
// represent the parameters of the audit to be generated.
|
|
//
|
|
// It is best to initialize this structure using AdtInitParams function.
|
|
// This will ensure compatibility with any future changes to this
|
|
// structure.
|
|
//
|
|
|
|
type
|
|
_AUDIT_PARAM = record
|
|
Type_: AUDIT_PARAM_TYPE; // type
|
|
Length: ULONG; // currently unused
|
|
Flags: DWORD; // currently unused
|
|
U: record
|
|
case Integer of
|
|
0: (Data0: ULONG_PTR);
|
|
1: (String_: PWSTR);
|
|
2: (u: ULONG_PTR);
|
|
3: (psid: PSID);
|
|
4: (pguid: LPGUID);
|
|
5: (LogonId_LowPart: ULONG);
|
|
6: (pObjectTypes: PAUDIT_OBJECT_TYPES);
|
|
end;
|
|
case Integer of
|
|
0: (Data1: ULONG_PTR);
|
|
1: (LogonId_HighPart: LONG);
|
|
end;
|
|
{$EXTERNALSYM _AUDIT_PARAM}
|
|
AUDIT_PARAM = _AUDIT_PARAM;
|
|
{$EXTERNALSYM AUDIT_PARAM}
|
|
PAUDIT_PARAM = ^AUDIT_PARAM;
|
|
{$EXTERNALSYM PAUDIT_PARAM}
|
|
TAuditParam = AUDIT_PARAM;
|
|
PAuditParam = PAUDIT_PARAM;
|
|
|
|
//
|
|
// Audit control flags. To be used with AUDIT_PARAMS.Flags
|
|
//
|
|
|
|
const
|
|
APF_AuditFailure = $00000000; // generate a failure audit
|
|
{$EXTERNALSYM APF_AuditFailure}
|
|
APF_AuditSuccess = $00000001; // generate a success audit when set, a failure audit otherwise.
|
|
{$EXTERNALSYM APF_AuditSuccess}
|
|
|
|
//
|
|
// set of valid audit control flags
|
|
//
|
|
|
|
APF_ValidFlags = APF_AuditSuccess;
|
|
{$EXTERNALSYM APF_ValidFlags}
|
|
|
|
//
|
|
// Audit parameters passed to LsaGenAuditEvent
|
|
//
|
|
|
|
type
|
|
PAUDIT_PARAMS = ^AUDIT_PARAMS;
|
|
{$EXTERNALSYM PAUDIT_PARAMS}
|
|
_AUDIT_PARAMS = record
|
|
Length: ULONG; // size in bytes
|
|
Flags: DWORD; // currently unused
|
|
Count: USHORT; // number of parameters
|
|
Parameters: PAUDIT_PARAM; // array of parameters
|
|
end;
|
|
{$EXTERNALSYM _AUDIT_PARAMS}
|
|
AUDIT_PARAMS = _AUDIT_PARAMS;
|
|
{$EXTERNALSYM AUDIT_PARAMS}
|
|
TAuditParams = AUDIT_PARAMS;
|
|
PAuditParams = PAUDIT_PARAMS;
|
|
|
|
//
|
|
// Defines the elements of a legacy audit event.
|
|
//
|
|
|
|
PAUTHZ_AUDIT_EVENT_TYPE_LEGACY = ^AUTHZ_AUDIT_EVENT_TYPE_LEGACY;
|
|
{$EXTERNALSYM PAUTHZ_AUDIT_EVENT_TYPE_LEGACY}
|
|
_AUTHZ_AUDIT_EVENT_TYPE_LEGACY = record
|
|
//
|
|
// Audit category ID
|
|
//
|
|
CategoryId: USHORT;
|
|
//
|
|
// Audit event ID
|
|
//
|
|
AuditId: USHORT;
|
|
//
|
|
// Parameter count
|
|
//
|
|
ParameterCount: USHORT;
|
|
end;
|
|
{$EXTERNALSYM _AUTHZ_AUDIT_EVENT_TYPE_LEGACY}
|
|
AUTHZ_AUDIT_EVENT_TYPE_LEGACY = _AUTHZ_AUDIT_EVENT_TYPE_LEGACY;
|
|
{$EXTERNALSYM AUTHZ_AUDIT_EVENT_TYPE_LEGACY}
|
|
TAuthzAuditEventTypeLegacy = AUTHZ_AUDIT_EVENT_TYPE_LEGACY;
|
|
PAuthzAuditEventTypeLegacy = PAUTHZ_AUDIT_EVENT_TYPE_LEGACY;
|
|
|
|
_AUTHZ_AUDIT_EVENT_TYPE_UNION = record
|
|
case Integer of
|
|
0: (Legacy: AUTHZ_AUDIT_EVENT_TYPE_LEGACY);
|
|
end;
|
|
{$EXTERNALSYM _AUTHZ_AUDIT_EVENT_TYPE_UNION}
|
|
AUTHZ_AUDIT_EVENT_TYPE_UNION = _AUTHZ_AUDIT_EVENT_TYPE_UNION;
|
|
{$EXTERNALSYM AUTHZ_AUDIT_EVENT_TYPE_UNION}
|
|
PAUTHZ_AUDIT_EVENT_TYPE_UNION = ^AUTHZ_AUDIT_EVENT_TYPE_UNION;
|
|
{$EXTERNALSYM PAUTHZ_AUDIT_EVENT_TYPE_UNION}
|
|
TAuthzAuditEventTypeUnion = AUTHZ_AUDIT_EVENT_TYPE_UNION;
|
|
PAuthzAuditEventTypeUnion = PAUTHZ_AUDIT_EVENT_TYPE_UNION;
|
|
|
|
//
|
|
// description of an audit event
|
|
//
|
|
|
|
_AUTHZ_AUDIT_EVENT_TYPE_OLD = record
|
|
// version number
|
|
Version: ULONG;
|
|
dwFlags: DWORD;
|
|
RefCount: LONG;
|
|
hAudit: ULONG_PTR;
|
|
LinkId: LUID;
|
|
u: AUTHZ_AUDIT_EVENT_TYPE_UNION;
|
|
end;
|
|
{$EXTERNALSYM _AUTHZ_AUDIT_EVENT_TYPE_OLD}
|
|
AUTHZ_AUDIT_EVENT_TYPE_OLD = _AUTHZ_AUDIT_EVENT_TYPE_OLD;
|
|
{$EXTERNALSYM AUTHZ_AUDIT_EVENT_TYPE_OLD}
|
|
TAuthzAuditEventTypeOld = AUTHZ_AUDIT_EVENT_TYPE_OLD;
|
|
PAuthzAuditEventTypeOld = ^AUTHZ_AUDIT_EVENT_TYPE_OLD;
|
|
|
|
PAUTHZ_AUDIT_EVENT_TYPE_OLD = ^AUTHZ_AUDIT_EVENT_TYPE_OLD;
|
|
{$EXTERNALSYM PAUTHZ_AUDIT_EVENT_TYPE_OLD}
|
|
AUDIT_HANDLE = PVOID;
|
|
{$EXTERNALSYM AUDIT_HANDLE}
|
|
PAUDIT_HANDLE = ^AUDIT_HANDLE;
|
|
{$EXTERNALSYM PAUDIT_HANDLE}
|
|
|
|
(* todo
|
|
function AuthzpRegisterAuditEvent(pAuditEventType: PAUTHZ_AUDIT_EVENT_TYPE_OLD; var phAuditContext: AUDIT_HANDLE): BOOL; stdcall;
|
|
{$EXTERNALSYM AuthzpRegisterAuditEvent}
|
|
|
|
function AuthzpUnregisterAuditEvent(var phAuditContext: AUDIT_HANDLE): BOOL; stdcall;
|
|
{$EXTERNALSYM AuthzpUnregisterAuditEvent}
|
|
*)
|
|
|
|
//
|
|
// Begin support for extensible auditing.
|
|
//
|
|
|
|
const
|
|
AUTHZ_ALLOW_MULTIPLE_SOURCE_INSTANCES = $1;
|
|
{$EXTERNALSYM AUTHZ_ALLOW_MULTIPLE_SOURCE_INSTANCES}
|
|
|
|
AUTHZ_AUDIT_INSTANCE_INFORMATION = $2;
|
|
{$EXTERNALSYM AUTHZ_AUDIT_INSTANCE_INFORMATION}
|
|
|
|
implementation
|
|
|
|
const
|
|
authzlib = 'authz.dll';
|
|
|
|
// (rom) MACRO implementation
|
|
function ApExtractType(TypeFlags: DWORD): AUDIT_PARAM_TYPE;
|
|
begin
|
|
Result := AUDIT_PARAM_TYPE(TypeFlags and AP_ParamTypeMask);
|
|
end;
|
|
|
|
// (rom) MACRO implementation
|
|
function ApExtractFlags(TypeFlags: DWORD): DWORD;
|
|
begin
|
|
Result := TypeFlags and not AP_ParamTypeMask;
|
|
end;
|
|
|
|
{
|
|
AuthzpRegisterAuditEvent
|
|
AuthzpUnregisterAuditEvent
|
|
}
|
|
end.
|