1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
|
/**
* This file is part of the mingw-w64 runtime package.
* No warranty is given; refer to the file DISCLAIMER within this package.
*/
#include <winapifamily.h>
#ifndef _ADTGEN_H
#define _ADTGEN_H
#if WINAPI_FAMILY_PARTITION (WINAPI_PARTITION_DESKTOP)
#define AUDIT_TYPE_LEGACY 1
#define AUDIT_TYPE_WMI 2
typedef enum _AUDIT_PARAM_TYPE {
APT_None = 1,
APT_String,
APT_Ulong,
APT_Pointer,
APT_Sid,
APT_LogonId,
APT_ObjectTypeList,
APT_Luid,
APT_Guid,
APT_Time,
APT_Int64,
APT_IpAddress,
APT_LogonIdWithSid
} AUDIT_PARAM_TYPE;
#define AP_ParamTypeBits 8
#define AP_ParamTypeMask __MSABI_LONG(0xff)
#define AP_FormatHex (__MSABI_LONG(0x1) << AP_ParamTypeBits)
#define AP_AccessMask (__MSABI_LONG(0x2) << AP_ParamTypeBits)
#define AP_Filespec (__MSABI_LONG(0x1) << AP_ParamTypeBits)
#define AP_SidAsLogonId (__MSABI_LONG(0x1) << AP_ParamTypeBits)
#define AP_PrimaryLogonId (__MSABI_LONG(0x1) << AP_ParamTypeBits)
#define AP_ClientLogonId (__MSABI_LONG(0x2) << AP_ParamTypeBits)
#define ApExtractType(TypeFlags) ((AUDIT_PARAM_TYPE) (TypeFlags & AP_ParamTypeMask))
#define ApExtractFlags(TypeFlags) ((TypeFlags & ~AP_ParamTypeMask))
#define _AUTHZ_SS_MAXSIZE 128
#define APF_AuditFailure 0x0
#define APF_AuditSuccess 0x1
#define APF_ValidFlags (APF_AuditSuccess)
#define AUTHZ_ALLOW_MULTIPLE_SOURCE_INSTANCES 0x1
#define AUTHZ_MIGRATED_LEGACY_PUBLISHER 0x2
#define AUTHZ_AUDIT_INSTANCE_INFORMATION 0x2
typedef struct _AUDIT_OBJECT_TYPE {
GUID ObjectType;
USHORT Flags;
USHORT Level;
ACCESS_MASK AccessMask;
} AUDIT_OBJECT_TYPE,*PAUDIT_OBJECT_TYPE;
typedef struct _AUDIT_OBJECT_TYPES {
USHORT Count;
USHORT Flags;
#ifdef __WIDL__
[size_is (Count)]
#endif
AUDIT_OBJECT_TYPE *pObjectTypes;
} AUDIT_OBJECT_TYPES,*PAUDIT_OBJECT_TYPES;
typedef struct _AUDIT_IP_ADDRESS {
BYTE pIpAddress[_AUTHZ_SS_MAXSIZE];
} AUDIT_IP_ADDRESS,*PAUDIT_IP_ADDRESS;
typedef struct _AUDIT_PARAM {
AUDIT_PARAM_TYPE Type;
ULONG Length;
DWORD Flags;
#ifdef __WIDL__
[switch_type (AUDIT_PARAM_TYPE), switch_is (Type)]
#else
__C89_NAMELESS
#endif
union {
#ifdef __WIDL__
[default]
#endif
ULONG_PTR Data0;
#ifdef __WIDL__
[case (APT_String)]
[string]
#endif
PWSTR String;
#ifdef __WIDL__
[case (APT_Ulong, APT_Pointer)]
#endif
ULONG_PTR u;
#ifdef __WIDL__
[case (APT_Sid)]
#endif
SID *psid;
#ifdef __WIDL__
[case (APT_Guid)]
#endif
GUID *pguid;
#ifdef __WIDL__
[case (APT_LogonId)]
#endif
ULONG LogonId_LowPart;
#ifdef __WIDL__
[case (APT_ObjectTypeList)]
#endif
AUDIT_OBJECT_TYPES *pObjectTypes;
#ifdef __WIDL__
[case (APT_IpAddress)]
#endif
AUDIT_IP_ADDRESS *pIpAddress;
};
#ifdef __WIDL__
[switch_type (AUDIT_PARAM_TYPE), switch_is (Type)]
#else
__C89_NAMELESS
#endif
union {
#ifdef __WIDL__
[default]
#endif
ULONG_PTR Data1;
#ifdef __WIDL__
[case (APT_LogonId)]
#endif
LONG LogonId_HighPart;
};
} AUDIT_PARAM,*PAUDIT_PARAM;
typedef struct _AUDIT_PARAMS {
ULONG Length;
DWORD Flags;
USHORT Count;
#ifdef __WIDL__
[size_is (Count)]
#endif
AUDIT_PARAM *Parameters;
} AUDIT_PARAMS,*PAUDIT_PARAMS;
typedef struct _AUTHZ_AUDIT_EVENT_TYPE_LEGACY {
USHORT CategoryId;
USHORT AuditId;
USHORT ParameterCount;
} AUTHZ_AUDIT_EVENT_TYPE_LEGACY,*PAUTHZ_AUDIT_EVENT_TYPE_LEGACY;
typedef
#ifdef __WIDL__
[switch_type (BYTE)]
#endif
union _AUTHZ_AUDIT_EVENT_TYPE_UNION {
#ifdef __WIDL__
[case (AUDIT_TYPE_LEGACY)]
#endif
AUTHZ_AUDIT_EVENT_TYPE_LEGACY Legacy;
} AUTHZ_AUDIT_EVENT_TYPE_UNION,*PAUTHZ_AUDIT_EVENT_TYPE_UNION;
typedef
struct _AUTHZ_AUDIT_EVENT_TYPE_OLD {
ULONG Version;
DWORD dwFlags;
LONG RefCount;
ULONG_PTR hAudit;
LUID LinkId;
#ifdef __WIDL__
[switch_is (Version)]
#endif
AUTHZ_AUDIT_EVENT_TYPE_UNION u;
} AUTHZ_AUDIT_EVENT_TYPE_OLD;
typedef
#ifdef __WIDL__
[handle]
#endif
AUTHZ_AUDIT_EVENT_TYPE_OLD *PAUTHZ_AUDIT_EVENT_TYPE_OLD;
#define AUTHZP_WPD_EVENT 0x10
typedef
#ifdef __WIDL__
[context_handle]
#endif
PVOID AUDIT_HANDLE,*PAUDIT_HANDLE;
#endif
#endif
|
