diff options
Diffstat (limited to 'private/eventlog')
65 files changed, 24957 insertions, 0 deletions
diff --git a/private/eventlog/dirs b/private/eventlog/dirs new file mode 100644 index 000000000..ecb7e74d1 --- /dev/null +++ b/private/eventlog/dirs @@ -0,0 +1,31 @@ +!IF 0 + +Copyright (c) 1989 Microsoft Corporation + +Module Name: + + dirs. + +Abstract: + + This file specifies the subdirectories of the current directory that + contain component makefiles. + + +Author: + + Steve Wood (stevewo) 17-Apr-1990 + +Note: + + The 'misc' directory is temporary. Will be removed after PPC. + +!ENDIF + +DIRS=server \ + elfclnt \ + netevent \ + misc + + +OPTIONAL_DIRS=test diff --git a/private/eventlog/elf.acf b/private/eventlog/elf.acf new file mode 100644 index 000000000..678a08bd6 --- /dev/null +++ b/private/eventlog/elf.acf @@ -0,0 +1,7 @@ +[ implicit_handle( handle_t eventlog_handle )] +interface eventlog +{ +#if defined(_PPC_) +[optimize( "s" )] ElfrChangeNotify(); +#endif +} diff --git a/private/eventlog/elf.idl b/private/eventlog/elf.idl new file mode 100644 index 000000000..8685828d3 --- /dev/null +++ b/private/eventlog/elf.idl @@ -0,0 +1,317 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + ELF.IDL + +Abstract: + + Contains the Elfr APIs which are used to remote the Elf APIs to + the local or remote server via RPC. + Also contains the RPC specific data structures for these API. + +Author: + + Rajen Shah (rajens) 02-Apr-1991 + +Revision History: + + 02-Apr-1991 RajenS + created + +--*/ + +// +// Interface Attributes +// + +[ + uuid(82273FDC-E32A-18C3-3F78-827929DC23EA), + version(0.0), +#ifdef __midl + ms_union, +#endif // __midl + pointer_default(unique) +] + +// +// Interface Keyword +// + +interface eventlog + +// +// Interface Body +// + +{ + +import "imports.idl"; // import all the include files +#include "event.h" + +// +// ELF Generic Handle used to bind from client to server. +// + +typedef [handle,unique] LPWSTR EVENTLOG_HANDLE_W; +typedef [handle,unique] LPSTR EVENTLOG_HANDLE_A; + +// +// ELF RPC Context Handle (Internal definition of ELF_HANDLE) +// + +typedef [context_handle] struct _IELF_HANDLE { + LIST_ENTRY Next; + ULONG Signature; // BUGBUG - For debug only + ULONG Flags; // e.g. "invalid" + ULONG GrantedAccess; + ATOM Atom; + ULONG SeekRecordPos; + ULONG SeekBytePos; + ULONG MajorVersion; // To identify caller + ULONG MinorVersion; + ULONG NameLength; + [size_is(NameLength)] WCHAR Name[]; // Keep this as last field +} *IELF_HANDLE; +typedef IELF_HANDLE *PIELF_HANDLE; + +// +// UNICODE Function Prototypes +// +// +// Only OpenEL and CloseEL need to take PIELF_HANDLE +// parameters since they are the only ones to modify the handle. +// The others will take IELF_HANDLE parameters instead. +// + +// NOTE: +// The names of the functions are short so that when RPC +// prepends the interface name to the names, they are still +// unique. +// + +NTSTATUS +ElfrClearELFW ( + [in] IELF_HANDLE LogHandle, + [in,unique] PRPC_UNICODE_STRING BackupFileName + ); + +NTSTATUS +ElfrBackupELFW ( + [in] IELF_HANDLE LogHandle, + [in] PRPC_UNICODE_STRING BackupFileName + ); + +NTSTATUS +ElfrCloseEL ( + [in,out] PIELF_HANDLE LogHandle + ); + +NTSTATUS +ElfrDeregisterEventSource ( + [in,out] PIELF_HANDLE LogHandle + ); + +NTSTATUS +ElfrNumberOfRecords( + [in] IELF_HANDLE LogHandle, + [out] PULONG NumberOfRecords + ); + +NTSTATUS +ElfrOldestRecord( + [in] IELF_HANDLE LogHandle, + [out] PULONG OldestRecordNumber + ); + +NTSTATUS +ElfrChangeNotify( + [in] IELF_HANDLE LogHandle, + [in] RPC_CLIENT_ID ClientId, + [in] ULONG Event + ); + +// +// The ModuleName is the one passed in by the caller of the API. This is +// the one that is written to the log file. +// +// RegModuleName is generated by the client stub, and is the name that is +// used to determine the default log file name from the registry. For +// NT Product1, this will be "Application". NOTE: It is necessary to do this +// now so that we can support viewing logs from a Product 2 system in the +// future if we change our logging mechanism. +// + +NTSTATUS +ElfrOpenELW ( + [in] EVENTLOG_HANDLE_W UNCServerName, + [in] PRPC_UNICODE_STRING ModuleName, // Passed in API call + [in] PRPC_UNICODE_STRING RegModuleName, // Used for registry + [in] ULONG MajorVersion, + [in] ULONG MinorVersion, + [out] PIELF_HANDLE LogHandle + ); + +NTSTATUS +ElfrRegisterEventSourceW ( + [in] EVENTLOG_HANDLE_W UNCServerName, + [in] PRPC_UNICODE_STRING ModuleName, // Passed in API call + [in] PRPC_UNICODE_STRING RegModuleName, // Used for registry info + [in] ULONG MajorVersion, + [in] ULONG MinorVersion, + [out] PIELF_HANDLE LogHandle + ); + +NTSTATUS +ElfrOpenBELW ( + [in] EVENTLOG_HANDLE_W UNCServerName, + [in] PRPC_UNICODE_STRING BackupFileName, // Passed in API call + [in] ULONG MajorVersion, + [in] ULONG MinorVersion, + [out] PIELF_HANDLE LogHandle + ); + +// +// BUGBUG - Fix this interface once RPC supports the ability to return +// zero bytes. Then, Buffer will have a length_is(*NumberOfBytesRead) +// added to it. For now, always transfer NumberOfBytesToRead bytes! +// +// The LogHandle is an [in,out] since the server side stores information +// in it that pertains to the current seek position. +// + +NTSTATUS +ElfrReadELW ( + [in] IELF_HANDLE LogHandle, + [in] ULONG ReadFlags, + [in] ULONG RecordOffset, + [in] ULONG NumberOfBytesToRead, + [out,size_is(NumberOfBytesToRead)] PBYTE Buffer, + [out] PULONG NumberOfBytesRead, + [out] PULONG MinNumberOfBytesNeeded + ); + +NTSTATUS +ElfrReportEventW ( + [in] IELF_HANDLE LogHandle, + [in] ULONG Time, + [in] USHORT EventType, + [in] USHORT EventCategory, + [in] ULONG EventID, + [in] USHORT NumStrings, + [in] ULONG DataSize, + [in] PRPC_UNICODE_STRING ComputerName, + [in, unique] PRPC_SID UserSID, + [in, size_is(NumStrings), unique] PRPC_UNICODE_STRING Strings[*], + [in, size_is(DataSize), unique] PBYTE Data, + [in] USHORT Flags, + [in,out,unique] PULONG RecordNumber, + [in,out,unique] PULONG TimeWritten + ); + +// +// ANSI Function Prototypes +// +// +// Only OpenEL needs to take PIELF_HANDLE +// parameters since they are the only ones to modify the handle. +// The others will take IELF_HANDLE parameters instead. +// +// NOTE that there is only one api for CloseEL since there are no +// strings involved. +// + +NTSTATUS +ElfrClearELFA ( + [in] IELF_HANDLE LogHandle, + [in,unique] PRPC_STRING BackupFileName + ); + +NTSTATUS +ElfrBackupELFA ( + [in] IELF_HANDLE LogHandle, + [in] PRPC_STRING BackupFileName + ); + +// +// The ModuleName is the one passed in by the caller of the API. This is +// the one that is written to the log file. +// +// RegModuleName is generated by the client stub, and is the name that is +// used to determine the default log file name from the registry. For +// NT Product1, this will be "Application". NOTE: It is necessary to do this +// now so that we can support viewing logs from a Product 2 system in the +// future if we change our logging mechanism. +// + +NTSTATUS +ElfrOpenELA ( + [in] EVENTLOG_HANDLE_A UNCServerName, + [in] PRPC_STRING ModuleName, // Passed in API call + [in] PRPC_STRING RegModuleName, // Used for registry info + [in] ULONG MajorVersion, + [in] ULONG MinorVersion, + [out] PIELF_HANDLE LogHandle + ); + +NTSTATUS +ElfrRegisterEventSourceA ( + [in] EVENTLOG_HANDLE_A UNCServerName, + [in] PRPC_STRING ModuleName, // Passed in API call + [in] PRPC_STRING RegModuleName, // Used for registry info + [in] ULONG MajorVersion, + [in] ULONG MinorVersion, + [out] PIELF_HANDLE LogHandle + ); + +NTSTATUS +ElfrOpenBELA ( + [in] EVENTLOG_HANDLE_A UNCServerName, + [in] PRPC_STRING FileName, // Passed in API call + [in] ULONG MajorVersion, + [in] ULONG MinorVersion, + [out] PIELF_HANDLE LogHandle + ); + +// +// BUGBUG - Fix this interface once RPC supports the ability to return +// zero bytes. Then, Buffer will have a length_is(*NumberOfBytesRead) +// added to it. For now, always transfer NumberOfBytesToRead bytes! +// +// The LogHandle is an [in,out] since the server side stores information +// in it that pertains to the current seek position. +// + +NTSTATUS +ElfrReadELA ( + [in] IELF_HANDLE LogHandle, + [in] ULONG ReadFlags, + [in] ULONG RecordOffset, + [in] ULONG NumberOfBytesToRead, + [out,size_is(NumberOfBytesToRead)] PBYTE Buffer, + [out] PULONG NumberOfBytesRead, + [out] PULONG MinNumberOfBytesNeeded + ); + +NTSTATUS +ElfrReportEventA ( + [in] IELF_HANDLE LogHandle, + [in] ULONG Time, + [in] USHORT EventType, + [in] USHORT EventCategory, + [in] ULONG EventID, + [in] USHORT NumStrings, + [in] ULONG DataSize, + [in] PRPC_STRING ComputerName, + [in, unique] PRPC_SID UserSID, + [in, size_is(NumStrings), unique] PRPC_STRING Strings[*], + [in, size_is(DataSize), unique] PBYTE Data, + [in] USHORT Flags, + [in,out,unique] PULONG RecordNumber, + [in,out,unique] PULONG TimeWritten + ); + + +} diff --git a/private/eventlog/elfclnt/apistub.c b/private/eventlog/elfclnt/apistub.c new file mode 100644 index 000000000..da62f55bf --- /dev/null +++ b/private/eventlog/elfclnt/apistub.c @@ -0,0 +1,1577 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + APISTUB.C + +Abstract: + + This module contains the client ends of the Elf APIs. + + +Author: + + Rajen Shah (rajens) 29-Jul-1991 + + +Revision History: + + 29-Jul-1991 RajenS + Created + +--*/ + +#include <elfclntp.h> +#include <lmerr.h> +#include <stdlib.h> +#include <string.h> + +// +// Global data +// +PUNICODE_STRING pGlobalComputerNameU; +PANSI_STRING pGlobalComputerNameA; + + + +VOID +w_GetComputerName ( ) + +/*++ + +Routine Description: + + This routine gets the name of the computer. It checks the global + variable to see if the computer name has already been determined. + If not, it updates that variable with the name. + It does this for the UNICODE and the ANSI versions. + +Arguments: + + NONE + +Return Value: + + NONE + + +--*/ +{ + PUNICODE_STRING pNameU; + PANSI_STRING pNameA; + LPSTR pName; + NTSTATUS Error; + NTSTATUS status; + + + pNameU = MIDL_user_allocate (sizeof (UNICODE_STRING)); + pNameA = MIDL_user_allocate (sizeof (ANSI_STRING)); + + if ((pNameU != NULL) && (pNameA != NULL)) { + + if ((Error = ElfpGetComputerName (&pName)) == NERR_Success) { + + // + // ElfpComputerName has allocated a buffer to contain the + // ASCII name of the computer. We use that for the ANSI + // string structure. + // + RtlInitAnsiString ( pNameA, pName ); + + } else { + // + // We could not get the computer name for some reason. Set up + // the golbal pointer to point to the NULL string. + // + RtlInitAnsiString ( pNameA, "\0"); + } + + // + // Set up the UNICODE_STRING structure. + // + status = RtlAnsiStringToUnicodeString ( + pNameU, + pNameA, + TRUE + ); + + // + // If there was no error, set the global variables. + // Otherwise, free the buffer allocated by ElfpGetComputerName + // and leave the global variables unchanged. + // + if (NT_SUCCESS(status)) { + + pGlobalComputerNameU = pNameU; // Set global variable if no error + pGlobalComputerNameA = pNameA; // Set global ANSI variable + + } else { + + DbgPrint("[ELFCLNT] GetComputerName - Error 0x%lx\n", status); + LocalFree(pName); + MIDL_user_free (pNameU); // Free the buffers + MIDL_user_free (pNameA); + } + + } +} + + + + +PUNICODE_STRING +TmpGetComputerNameW ( ) + +/*++ + +Routine Description: + + This routine gets the UNICODE name of the computer. It checks the global + variable to see if the computer name has already been determined. + If not, it calls the worker routine to do that. + +Arguments: + + NONE + +Return Value: + + Returns a pointer to the computer name, or a NULL. + + +--*/ +{ + if (pGlobalComputerNameU == NULL) { + w_GetComputerName(); + } + return (pGlobalComputerNameU); +} + + + +PANSI_STRING +TmpGetComputerNameA ( ) + +/*++ + +Routine Description: + + This routine gets the ANSI name of the computer. It checks the global + variable to see if the computer name has already been determined. + If not, it calls the worker routine to do that. + +Arguments: + + NONE + +Return Value: + + Returns a pointer to the computer name, or a NULL. + + +--*/ +{ + + if (pGlobalComputerNameA == NULL) { + w_GetComputerName(); + } + return (pGlobalComputerNameA); +} + +// +// These APIs only have one interface, since they don't take or return strings +// + +NTSTATUS +ElfNumberOfRecords( + IN HANDLE LogHandle, + OUT PULONG NumberOfRecords + ) +{ + NTSTATUS status; + + // + // Make sure the output pointer is valid + // + + if (!NumberOfRecords) { + return(STATUS_INVALID_PARAMETER); + } + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service entry point + + status = ElfrNumberOfRecords ( + (IELF_HANDLE) LogHandle, + NumberOfRecords + ); + + } + RpcExcept (1) { + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + +NTSTATUS +ElfOldestRecord( + IN HANDLE LogHandle, + OUT PULONG OldestRecordNumber + ) +{ + NTSTATUS status; + + // + // + // Make sure the output pointer is valid + // + + if (!OldestRecordNumber) { + return(STATUS_INVALID_PARAMETER); + } + + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service entry point + + status = ElfrOldestRecord ( + (IELF_HANDLE) LogHandle, + OldestRecordNumber + ); + + } + RpcExcept (1) { + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + +NTSTATUS +ElfChangeNotify( + IN HANDLE LogHandle, + IN HANDLE Event + ) +{ + + NTSTATUS status; + RPC_CLIENT_ID RpcClientId; + CLIENT_ID ClientId; + + // + // Map the handles to something that RPC can understand + // + + ClientId = NtCurrentTeb()->ClientId; + RpcClientId.UniqueProcess = (ULONG) ClientId.UniqueProcess; + RpcClientId.UniqueThread = (ULONG) ClientId.UniqueThread; + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + + RpcTryExcept { + + // Call service entry point + + status = ElfrChangeNotify ( + (IELF_HANDLE) LogHandle, + RpcClientId, + (DWORD) Event + ); + + } + RpcExcept (1) { + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + +// +// UNICODE APIs +// + +NTSTATUS +ElfOpenEventLogW ( + IN PUNICODE_STRING UNCServerName, + IN PUNICODE_STRING LogName, + OUT PHANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfOpenEventLog API. + + It creates an RPC binding for the server specified, and stores that + and additional data away. It returns a handle to the caller that can + be used to later on access the handle-specific information. + +Arguments: + + UNCServerName - Server with which to bind for subsequent operations. + + LogName - Supplies the name of the module for the logfile + to associate with this handle. + + LogHandle - Location where log handle is to be returned. + + +Return Value: + + Returns an NTSTATUS code and, if no error, a handle that can be used + for subsequent Elf API calls. + + +--*/ +{ + NTSTATUS status = STATUS_SUCCESS; + UNICODE_STRING RegModuleName; + EVENTLOG_HANDLE_W ServerNameString; + + // + // Make sure input & output pointers are valid + // + + if (!LogHandle || !LogName || LogName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + if ((UNCServerName != NULL) && (UNCServerName->Length != 0)) { + ServerNameString = UNCServerName->Buffer; + } else { + ServerNameString = NULL; + } + + RtlInitUnicodeString( &RegModuleName, UNICODE_NULL); + + // Call service via RPC. Pass in major and minor version numbers. + + *LogHandle = NULL; // Must be NULL so RPC fills it in + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + status = ElfrOpenELW( + ServerNameString, + (PRPC_UNICODE_STRING) LogName, + (PRPC_UNICODE_STRING) &RegModuleName, + ELF_VERSION_MAJOR, + ELF_VERSION_MINOR, + (PIELF_HANDLE) LogHandle + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + + return (status); +} + + +NTSTATUS +ElfRegisterEventSourceW ( + IN PUNICODE_STRING UNCServerName, + IN PUNICODE_STRING ModuleName, + OUT PHANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfRegisterEventSource API. + + It creates an RPC binding for the server specified, and stores that + and additional data away. It returns a handle to the caller that can + be used to later on access the handle-specific information. + +Arguments: + + UNCServerName - Server with which to bind for subsequent operations. + + ModuleName - Supplies the name of the module to associate with + this handle. + + LogHandle - Location where log handle is to be returned. + + +Return Value: + + Returns an NTSTATUS code and, if no error, a handle that can be used + for subsequent Elf API calls. + + +--*/ +{ + NTSTATUS status = STATUS_SUCCESS; + UNICODE_STRING RegModuleName; + EVENTLOG_HANDLE_W ServerNameString; + + // + // Make sure input & output pointers are valid + // + + if (!LogHandle || !ModuleName || ModuleName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + if ((UNCServerName != NULL) && (UNCServerName->Length != 0)) { + ServerNameString = UNCServerName->Buffer; + } else { + ServerNameString = NULL; + } + + RtlInitUnicodeString( &RegModuleName, UNICODE_NULL); + + // Call service via RPC. Pass in major and minor version numbers. + + *LogHandle = NULL; // Must be NULL so RPC fills it in + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + status = ElfrRegisterEventSourceW( + ServerNameString, + (PRPC_UNICODE_STRING)ModuleName, + (PRPC_UNICODE_STRING)&RegModuleName, + ELF_VERSION_MAJOR, + ELF_VERSION_MINOR, + (PIELF_HANDLE) LogHandle + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + + return (status); +} + + +NTSTATUS +ElfOpenBackupEventLogW ( + IN PUNICODE_STRING UNCServerName, + IN PUNICODE_STRING BackupFileName, + OUT PHANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfOpenBackupEventLog API. + + It creates an RPC binding for the server specified, and stores that + and additional data away. It returns a handle to the caller that can + be used to later on access the handle-specific information. + +Arguments: + + UNCServerName - Server with which to bind for subsequent operations. + + BackupFileName - Supplies the filename of the module to associate with + this handle. + + LogHandle - Location where log handle is to be returned. + + +Return Value: + + Returns an NTSTATUS code and, if no error, a handle that can be used + for subsequent Elf API calls. + + +--*/ +{ + NTSTATUS status = STATUS_SUCCESS; + EVENTLOG_HANDLE_W ServerNameString; + + // + // Make sure input & output pointers are valid + // + + if (!LogHandle || !BackupFileName || BackupFileName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + if ((UNCServerName != NULL) && (UNCServerName->Length != 0)) { + ServerNameString = UNCServerName->Buffer; + } else { + ServerNameString = NULL; + } + + // Call service via RPC. Pass in major and minor version numbers. + + *LogHandle = NULL; // Must be NULL so RPC fills it in + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + + RpcTryExcept { + + status = ElfrOpenBELW( + ServerNameString, + (PRPC_UNICODE_STRING)BackupFileName, + ELF_VERSION_MAJOR, + ELF_VERSION_MINOR, + (PIELF_HANDLE) LogHandle + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); +} + + + +NTSTATUS +ElfClearEventLogFileW ( + IN HANDLE LogHandle, + IN PUNICODE_STRING BackupFileName + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfClearEventLogFile API. + The call is passed to the eventlog service on the appropriate server + identified by LogHandle. + + +Arguments: + + LogHandle - Handle returned from a previous "Open" call. This is + used to identify the module and the server. + + BackupFileName - Name of the file to back up the current log file. + NULL implies not to back up the file. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS status; + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service entry point + + status = ElfrClearELFW ( + (IELF_HANDLE) LogHandle, + (PRPC_UNICODE_STRING)BackupFileName + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + + +NTSTATUS +ElfBackupEventLogFileW ( + IN HANDLE LogHandle, + IN PUNICODE_STRING BackupFileName + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfBackupEventLogFile API. + The call is passed to the eventlog service on the appropriate server + identified by LogHandle. + + +Arguments: + + LogHandle - Handle returned from a previous "Open" call. This is + used to identify the module and the server. + + BackupFileName - Name of the file to back up the current log file. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS status; + + // + // Make sure input pointers are valid + // + + if (!BackupFileName || BackupFileName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service entry point + + status = ElfrBackupELFW ( + (IELF_HANDLE) LogHandle, + (PRPC_UNICODE_STRING)BackupFileName + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + + +NTSTATUS +ElfCloseEventLog ( + IN HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfCloseEventLog API. + It closes the RPC binding, and frees any memory allocated for the + handle. + + +Arguments: + + LogHandle - Handle returned from a previous "Open" call. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS status; + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call server + + status = ElfrCloseEL ( + (PIELF_HANDLE) &LogHandle + ); + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + + +NTSTATUS +ElfDeregisterEventSource ( + IN HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfDeregisterEventSource API. + It closes the RPC binding, and frees any memory allocated for the + handle. + + +Arguments: + + LogHandle - Handle returned from a previous "Open" call. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS status; + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call server + + status = ElfrDeregisterEventSource ( + (PIELF_HANDLE) &LogHandle + ); + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + + + +NTSTATUS +ElfReadEventLogW ( + IN HANDLE LogHandle, + IN ULONG ReadFlags, + IN ULONG RecordNumber, + OUT PVOID Buffer, + IN ULONG NumberOfBytesToRead, + OUT PULONG NumberOfBytesRead, + OUT PULONG MinNumberOfBytesNeeded + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfReadEventLog API. + +Arguments: + + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS status; + ULONG FlagBits; + + // + // Make sure the output pointers are valid + // + + if (!Buffer || !NumberOfBytesRead || !MinNumberOfBytesNeeded) { + return(STATUS_INVALID_PARAMETER); + } + + // + // Ensure that the ReadFlags we got are valid. + // Make sure that one of each type of bit is set. + // + FlagBits = ReadFlags & (EVENTLOG_SEQUENTIAL_READ | EVENTLOG_SEEK_READ); + + if ((FlagBits > 2) || (FlagBits == 0)) { + return(STATUS_INVALID_PARAMETER); + } + + FlagBits = ReadFlags & (EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ); + + if ((FlagBits > 8) || (FlagBits == 0)) { + return(STATUS_INVALID_PARAMETER); + } + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service + + status = ElfrReadELW ( + (IELF_HANDLE) LogHandle, + ReadFlags, + RecordNumber, + NumberOfBytesToRead, + Buffer, + NumberOfBytesRead, + MinNumberOfBytesNeeded + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + // Return status and bytes read/required. + + return (status); + +} + + + +NTSTATUS +ElfReportEventW ( + IN HANDLE LogHandle, + IN USHORT EventType, + IN USHORT EventCategory OPTIONAL, + IN ULONG EventID, + IN PSID UserSid, + IN USHORT NumStrings, + IN ULONG DataSize, + IN PUNICODE_STRING *Strings, + IN PVOID Data, + IN USHORT Flags, + IN OUT PULONG RecordNumber OPTIONAL, + IN OUT PULONG TimeWritten OPTIONAL + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfReportEvent API. + +Arguments: + + +Return Value: + + Returns an NTSTATUS code. + +Note: + + The last three parameters (Flags, RecordNumber and TimeWritten) are + designed to be used by Security Auditing for the implementation of + paired events (associating a file open event with the subsequent file + close). This will not be implemented in Product 1, but the API is + defined to allow easier support of this in a later release. + + +--*/ +{ + NTSTATUS status; + PUNICODE_STRING pComputerNameU; + LARGE_INTEGER Time; + ULONG EventTime; + + // + // Generate the time of the event. This is done on the client side + // since that is where the event occurred. + // + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970(&Time, + &EventTime + ); + + // + // Generate the ComputerName of the client. + // We have to do this in the client side since this call may be + // remoted to another server and we would not necessarily have + // the computer name there. + // + pComputerNameU = TmpGetComputerNameW(); + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service + + status = ElfrReportEventW ( + (IELF_HANDLE) LogHandle, + EventTime, + EventType, + EventCategory, + EventID, + NumStrings, + DataSize, + (PRPC_UNICODE_STRING)pComputerNameU, + UserSid, + (PRPC_UNICODE_STRING *)Strings, + Data, + Flags, + RecordNumber, + TimeWritten + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + + +// +// ANSI APIs +// + +NTSTATUS +ElfOpenEventLogA ( + IN PANSI_STRING UNCServerName, + IN PANSI_STRING LogName, + OUT PHANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfOpenEventLog API. + + It creates an RPC binding for the server specified, and stores that + and additional data away. It returns a handle to the caller that can + be used to later on access the handle-specific information. + +Arguments: + + UNCServerName - Server with which to bind for subsequent operations. + + LogName - Supplies the name of the module for the logfile to + associate with this handle. + + LogHandle - Location where log handle is to be returned. + + +Return Value: + + Returns an NTSTATUS code and, if no error, a handle that can be used + for subsequent Elf API calls. + + +--*/ +{ + NTSTATUS status = STATUS_SUCCESS; + ANSI_STRING RegModuleName; + EVENTLOG_HANDLE_A ServerNameString; + + // + // Make sure input & output pointers are valid + // + + if (!LogHandle || !LogName || LogName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + if ((UNCServerName != NULL) && (UNCServerName->Length != 0)) { + ServerNameString = UNCServerName->Buffer; + } else { + ServerNameString = NULL; + } + + RtlInitAnsiString( &RegModuleName, ELF_APPLICATION_MODULE_NAME_ASCII ); + + if ( NT_SUCCESS (status) ) { + + // Call service via RPC. Pass in major and minor version numbers. + + *LogHandle = NULL; // Must be NULL so RPC fills it in + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + status = ElfrOpenELA ( + ServerNameString, + (PRPC_STRING) LogName, + (PRPC_STRING) &RegModuleName, + ELF_VERSION_MAJOR, + ELF_VERSION_MINOR, + (PIELF_HANDLE) LogHandle + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + + } + + return (status); +} + + +NTSTATUS +ElfRegisterEventSourceA ( + IN PANSI_STRING UNCServerName, + IN PANSI_STRING ModuleName, + OUT PHANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfOpenEventLog API. + + It creates an RPC binding for the server specified, and stores that + and additional data away. It returns a handle to the caller that can + be used to later on access the handle-specific information. + +Arguments: + + UNCServerName - Server with which to bind for subsequent operations. + + ModuleName - Supplies the name of the module to associate with + this handle. + + LogHandle - Location where log handle is to be returned. + + +Return Value: + + Returns an NTSTATUS code and, if no error, a handle that can be used + for subsequent Elf API calls. + + +--*/ +{ + NTSTATUS status = STATUS_SUCCESS; + ANSI_STRING RegModuleName; + EVENTLOG_HANDLE_A ServerNameString; + + // + // Make sure input & output pointers are valid + // + + if (!LogHandle || !ModuleName || ModuleName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + if ((UNCServerName != NULL) && (UNCServerName->Length != 0)) { + ServerNameString = UNCServerName->Buffer; + } else { + ServerNameString = NULL; + } + + RtlInitAnsiString( &RegModuleName, ELF_APPLICATION_MODULE_NAME_ASCII ); + + if ( NT_SUCCESS (status) ) { + + // Call service via RPC. Pass in major and minor version numbers. + + *LogHandle = NULL; // Must be NULL so RPC fills it in + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + status = ElfrRegisterEventSourceA ( + ServerNameString, + (PRPC_STRING)ModuleName, + (PRPC_STRING)&RegModuleName, + ELF_VERSION_MAJOR, + ELF_VERSION_MINOR, + (PIELF_HANDLE) LogHandle + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + + } + + return (status); +} + + + +NTSTATUS +ElfOpenBackupEventLogA ( + IN PANSI_STRING UNCServerName, + IN PANSI_STRING FileName, + OUT PHANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfOpenBackupEventLog API. + + It creates an RPC binding for the server specified, and stores that + and additional data away. It returns a handle to the caller that can + be used to later on access the handle-specific information. + +Arguments: + + UNCServerName - Server with which to bind for subsequent operations. + + FileName - Supplies the filename of the logfile to associate with + this handle. + + LogHandle - Location where log handle is to be returned. + + +Return Value: + + Returns an NTSTATUS code and, if no error, a handle that can be used + for subsequent Elf API calls. + + +--*/ +{ + EVENTLOG_HANDLE_A ServerNameString; + NTSTATUS status; + + // + // Make sure input & output pointers are valid + // + + if (!LogHandle || !FileName || FileName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + if ((UNCServerName != NULL) && (UNCServerName->Length != 0)) { + ServerNameString = UNCServerName->Buffer; + } else { + ServerNameString = NULL; + } + + // Call service via RPC. Pass in major and minor version numbers. + + *LogHandle = NULL; // Must be NULL so RPC fills it in + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + + RpcTryExcept { + + status = ElfrOpenBELA ( + ServerNameString, + (PRPC_STRING)FileName, + ELF_VERSION_MAJOR, + ELF_VERSION_MINOR, + (PIELF_HANDLE) LogHandle + ); + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); +} + + + +NTSTATUS +ElfClearEventLogFileA ( + IN HANDLE LogHandle, + IN PANSI_STRING BackupFileName + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfClearEventLogFile API. + The call is passed to the eventlog service on the appropriate server + identified by LogHandle. + + +Arguments: + + LogHandle - Handle returned from a previous "Open" call. This is + used to identify the module and the server. + + BackupFileName - Name of the file to back up the current log file. + NULL implies not to back up the file. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS status; + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service entry point + + status = ElfrClearELFA ( + (IELF_HANDLE) LogHandle, + (PRPC_STRING)BackupFileName + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + + +NTSTATUS +ElfBackupEventLogFileA ( + IN HANDLE LogHandle, + IN PANSI_STRING BackupFileName + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfBackupEventLogFile API. + The call is passed to the eventlog service on the appropriate server + identified by LogHandle. + + +Arguments: + + LogHandle - Handle returned from a previous "Open" call. This is + used to identify the module and the server. + + BackupFileName - Name of the file to back up the current log file. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS status; + + // + // Make sure input pointers are valid + // + + if (!BackupFileName || BackupFileName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service entry point + + status = ElfrBackupELFA ( + (IELF_HANDLE) LogHandle, + (PRPC_STRING)BackupFileName + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} + + + +NTSTATUS +ElfReadEventLogA ( + IN HANDLE LogHandle, + IN ULONG ReadFlags, + IN ULONG RecordNumber, + OUT PVOID Buffer, + IN ULONG NumberOfBytesToRead, + OUT PULONG NumberOfBytesRead, + OUT PULONG MinNumberOfBytesNeeded + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfReadEventLog API. + +Arguments: + + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS status; + ULONG FlagBits; + + // + // Make sure the output pointers are valid + // + + if (!Buffer || !NumberOfBytesRead || !MinNumberOfBytesNeeded) { + return(STATUS_INVALID_PARAMETER); + } + + // + // Ensure that the ReadFlags we got are valid. + // Make sure that one of each type of bit is set. + // + FlagBits = ReadFlags & (EVENTLOG_SEQUENTIAL_READ | EVENTLOG_SEEK_READ); + + if ( (FlagBits == (EVENTLOG_SEQUENTIAL_READ | EVENTLOG_SEEK_READ)) + || (FlagBits == 0)) { + return(STATUS_INVALID_PARAMETER); + } + + FlagBits = ReadFlags & (EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ); + + if ( (FlagBits == (EVENTLOG_FORWARDS_READ | EVENTLOG_BACKWARDS_READ)) + || (FlagBits == 0)) { + return(STATUS_INVALID_PARAMETER); + } + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service + + status = ElfrReadELA ( + (IELF_HANDLE) LogHandle, + ReadFlags, + RecordNumber, + NumberOfBytesToRead, + Buffer, + NumberOfBytesRead, + MinNumberOfBytesNeeded + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + // Return status and bytes read/required. + + return (status); + +} + + + +NTSTATUS +ElfReportEventA ( + IN HANDLE LogHandle, + IN USHORT EventType, + IN USHORT EventCategory OPTIONAL, + IN ULONG EventID, + IN PSID UserSid, + IN USHORT NumStrings, + IN ULONG DataSize, + IN PANSI_STRING *Strings, + IN PVOID Data, + IN USHORT Flags, + IN OUT PULONG RecordNumber OPTIONAL, + IN OUT PULONG TimeWritten OPTIONAL + ) + +/*++ + +Routine Description: + + This is the client DLL entry point for the ElfReportEvent API. + +Arguments: + + +Return Value: + + Returns an NTSTATUS code. + +Note: + + The last three parameters (Flags, RecordNumber and TimeWritten) are + designed to be used by Security Auditing for the implementation of + paired events (associating a file open event with the subsequent file + close). This will not be implemented in Product 1, but the API is + defined to allow easier support of this in a later release. + + +--*/ +{ + NTSTATUS status; + PANSI_STRING pComputerNameA; + LARGE_INTEGER Time; + ULONG EventTime; + + // + // Generate the time of the event. This is done on the client side + // since that is where the event occurred. + // + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970(&Time, + &EventTime + ); + + // + // Generate the ComputerName of the client. + // We have to do this in the client side since this call may be + // remoted to another server and we would not necessarily have + // the computer name there. + // + pComputerNameA = TmpGetComputerNameA(); + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service + + status = ElfrReportEventA ( + (IELF_HANDLE) LogHandle, + EventTime, + EventType, + EventCategory, + EventID, + NumStrings, + DataSize, + (PRPC_STRING)pComputerNameA, + UserSid, + (PRPC_STRING*)Strings, + Data, + Flags, + RecordNumber, + TimeWritten + ); + + } + RpcExcept (1) { + + status = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + + return (status); + +} diff --git a/private/eventlog/elfclnt/elfclntp.h b/private/eventlog/elfclnt/elfclntp.h new file mode 100644 index 000000000..ec0de3a67 --- /dev/null +++ b/private/eventlog/elfclnt/elfclntp.h @@ -0,0 +1,44 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + elfclntp.h + +Abstract: + + Common include file for all the client-side modules for the + event logging facility. + +Author: + + Rajen Shah (rajens) 29-Jul-1991 + + +Revision History: + + 29-Jul-1991 RajenS + Created + +--*/ + +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> + +#include <windef.h> +#include <winbase.h> +#include <rpc.h> +#include <ntrpcp.h> +#include <lmcons.h> +#include <lmerr.h> +//#include <netlib.h> + +#include <elf.h> +#include <elfcommn.h> + + +NTSTATUS +ElfpGetComputerName ( + IN LPSTR *ComputerNamePtr); diff --git a/private/eventlog/elfclnt/getconfg.c b/private/eventlog/elfclnt/getconfg.c new file mode 100644 index 000000000..a947af787 --- /dev/null +++ b/private/eventlog/elfclnt/getconfg.c @@ -0,0 +1,110 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + getconfg.c + +Abstract: + + This is a Hacked up version of getconfg.c stolen from + c:\nt\private\net\netlib. We need to make an rtl routine out + of this - something that is more globally available. + -Danl 9-3-91 + + + This module contains routines for manipulating configuration + information. The following functions available are: + + NetpGetComputerName + + Currently configuration information is kept in NT.CFG. + Later it will be kept by the configuration manager. + +Author: + + Dan Lafferty (danl) 09-Apr-1991 + +Environment: + + User Mode -Win32 (also uses nt RTL routines) + +Revision History: + + 09-Apr-1991 danl + created + +--*/ + +//#include <stdlib.h> // atol +#include <nt.h> // DbgPrint prototype +#include <ntrtl.h> // DbgPrint prototype +#include <ntdef.h> +#include <ntstatus.h> +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> +//#include <ntlsa.h> // +#include <windef.h> +#include <winbase.h> // LocalAlloc +#include <lmcons.h> +#include <string.h> +#include <lmerr.h> + + + +NTSTATUS +ElfpGetComputerName ( + IN LPSTR *ComputerNamePtr) + +/*++ + +Routine Description: + + This routine obtains the computer name from a persistent database, + by calling the GetcomputerNameA Win32 Base API + + This routine assumes the length of the computername is no greater + than MAX_COMPUTERNAME_LENGTH, space for which it allocates using + LocalAlloc. It is necessary for the user to free that space using + LocalFree when finished. + +Arguments: + + ComputerNamePtr - This is a pointer to the location where the pointer + to the computer name is to be placed. + +Return Value: + + NERR_Success - If the operation was successful. + + It will return assorted Net or Win32 or NT error messages if not. + +--*/ +{ + DWORD nSize = MAX_COMPUTERNAME_LENGTH + 1; + + // + // Allocate a buffer to hold the largest possible computer name. + // + + *ComputerNamePtr = LocalAlloc(LMEM_ZEROINIT, nSize); + + if (*ComputerNamePtr == NULL) { + return (GetLastError()); + } + + // + // Get the computer name string into the locally allocated buffer + // by calling the Win32 GetComputerNameA API. + // + + if (!GetComputerNameA(*ComputerNamePtr, &nSize)) { + LocalFree(*ComputerNamePtr); + *ComputerNamePtr = NULL; + return (GetLastError()); + } + + return (NERR_Success); +} diff --git a/private/eventlog/elfclnt/makefile b/private/eventlog/elfclnt/makefile new file mode 100644 index 000000000..6ee4f43fa --- /dev/null +++ b/private/eventlog/elfclnt/makefile @@ -0,0 +1,6 @@ +# +# DO NOT EDIT THIS FILE!!! Edit .\sources. if you want to add a new source +# file to this component. This file merely indirects to the real make file +# that is shared by all the components of NT OS/2 +# +!INCLUDE $(NTMAKEENV)\makefile.def diff --git a/private/eventlog/elfclnt/rpcbind.c b/private/eventlog/elfclnt/rpcbind.c new file mode 100644 index 000000000..2cf13c1eb --- /dev/null +++ b/private/eventlog/elfclnt/rpcbind.c @@ -0,0 +1,205 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + rpcbind.c + +Abstract: + + Contains the RPC bind and un-bind routines for the Eventlog + client-side APIs. + +Author: + + Rajen Shah (rajens) 30-Jul-1991 + +Revision History: + + 30-Jul-1991 RajenS + created + +--*/ + +// +// INCLUDES +// +#include <elfclntp.h> +#include <lmsvc.h> + +#define SERVICE_EVENTLOG L"EVENTLOG" + + +/****************************************************************************/ +handle_t +EVENTLOG_HANDLE_W_bind ( + EVENTLOG_HANDLE_W ServerName) + +/*++ + +Routine Description: + This routine calls a common bind routine that is shared by all services. + This routine is called from the ElfOpenEventLog API client stub when + it is necessary to bind to a server. + The binding is done to allow impersonation by the server since that is + necessary for the API calls. + +Arguments: + + ServerName - A pointer to a string containing the name of the server + to bind with. + +Return Value: + + The binding handle is returned to the stub routine. If the + binding is unsuccessful, a NULL will be returned. + +--*/ +{ + handle_t bindingHandle; + RPC_STATUS status; + + status = RpcpBindRpc ( + ServerName, + SERVICE_EVENTLOG, + NULL, + &bindingHandle); + + // DbgPrint("EVENTLOG_bind: handle=%d\n",bindingHandle); + return( bindingHandle); +} + + + +/****************************************************************************/ +void +EVENTLOG_HANDLE_W_unbind ( + EVENTLOG_HANDLE_W ServerName, + handle_t BindingHandle) + +/*++ + +Routine Description: + + This routine calls a common unbind routine that is shared by + all services. + +Arguments: + + ServerName - This is the name of the server from which to unbind. + + BindingHandle - This is the binding handle that is to be closed. + +Return Value: + + none. + +--*/ +{ + RPC_STATUS status; + + // DbgPrint("EVENTLOG_HANDLE_unbind: handle=%d\n",BindingHandle); + status = RpcpUnbindRpc ( BindingHandle); + return; + + UNREFERENCED_PARAMETER(ServerName); + +} + + +handle_t +EVENTLOG_HANDLE_A_bind ( + EVENTLOG_HANDLE_A ServerName) + +/*++ + +Routine Description: + + This routine calls EVENTLOG_HANDLE_W_bind to do the work. + +Arguments: + + ServerName - A pointer to a UNICODE string containing the name of + the server to bind with. + +Return Value: + + The binding handle is returned to the stub routine. If the + binding is unsuccessful, a NULL will be returned. + +--*/ +{ + UNICODE_STRING ServerNameU; + ANSI_STRING ServerNameA; + handle_t bindingHandle; + + // + // Convert the ANSI string to a UNICODE string before calling the + // UNICODE routine. + // + RtlInitAnsiString (&ServerNameA, (PSTR)ServerName); + + RtlAnsiStringToUnicodeString ( + &ServerNameU, + &ServerNameA, + TRUE + ); + + bindingHandle = EVENTLOG_HANDLE_W_bind( + (EVENTLOG_HANDLE_W)ServerNameU.Buffer + ); + + RtlFreeUnicodeString (&ServerNameU); + + return( bindingHandle); +} + + + +/****************************************************************************/ +void +EVENTLOG_HANDLE_A_unbind ( + EVENTLOG_HANDLE_A ServerName, + handle_t BindingHandle) + +/*++ + +Routine Description: + + This routine calls EVENTLOG_HANDLE_W_unbind. + +Arguments: + + ServerName - This is the ANSI name of the server from which to unbind. + + BindingHandle - This is the binding handle that is to be closed. + +Return Value: + + none. + +--*/ +{ + UNICODE_STRING ServerNameU; + ANSI_STRING ServerNameA; + + // + // Convert the ANSI string to a UNICODE string before calling the + // UNICODE routine. + // + RtlInitAnsiString (&ServerNameA, (PSTR)ServerName); + + RtlAnsiStringToUnicodeString ( + &ServerNameU, + &ServerNameA, + TRUE + ); + + EVENTLOG_HANDLE_W_unbind( (EVENTLOG_HANDLE_W)ServerNameU.Buffer, + BindingHandle ); + + RtlFreeUnicodeString (&ServerNameU); + + return; +} diff --git a/private/eventlog/elfclnt/sources b/private/eventlog/elfclnt/sources new file mode 100644 index 000000000..457c34587 --- /dev/null +++ b/private/eventlog/elfclnt/sources @@ -0,0 +1,59 @@ +!IF 0 + +Copyright (c) 1989 Microsoft Corporation + +Module Name: + + sources. + +Abstract: + + This file specifies the target component being built and the list of + sources files needed to build that component. Also specifies optional + compiler switches and libraries that are unique for the component being + built. + + +Author: + + Rajen Shah (rajens) 2-Jul-1991 + + +Revision History: + +!ENDIF + +# +# The TARGETNAME variable is defined by the developer. It is the name of +# the target (component) that is being built by this makefile. It +# should NOT include any path or file extension information. +# + +MAJORCOMP=eventlog +MINORCOMP=client +TARGETNAME=elfapi +TARGETPATH=$(BASEDIR)\public\sdk\lib +TARGETTYPE=LIBRARY + +# +# The INCLUDES variable specifies any include paths that are specific to +# this source directory. Separate multiple directory paths with single +# semicolons. Relative path specifications are okay. +# + +INCLUDES=.;..;$(BASEDIR)\private\inc + +# +# The SOURCES variable is defined by the developer. It is a list of all the +# source files for this component. Each source file should be on a separate +# line using the line continuation character. This will minimize merge +# conflicts if two developers adding source files to the same component. +# + +SOURCES= \ + elf_c.c \ + apistub.c \ + rpcbind.c \ + getconfg.c + +C_DEFINES=$(C_DEFINES) -DRPC_NO_WINDOWS_H -D_ADVAPI32_ diff --git a/private/eventlog/elfcommn.h b/private/eventlog/elfcommn.h new file mode 100644 index 000000000..6c49d6bdb --- /dev/null +++ b/private/eventlog/elfcommn.h @@ -0,0 +1,75 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + elfcommn.h + +Abstract: + + Common defines for client and server. + +Author: + + Rajen Shah (rajens) 12-Aug-1991 + +Revision History: + +--*/ + +#ifndef _ELFCOMMON_ +#define _ELFCOMMON_ + +// +// Current default names of modules supported +// + +#define ELF_MAX_LOG_MODULES 256 + +#define ELF_SYSTEM_MODULE_NAME L"System" +#define ELF_APPLICATION_MODULE_NAME L"Application" +#define ELF_SECURITY_MODULE_NAME L"Security" + +#define ELF_SYSTEM_MODULE_NAME_ASCII "System" +#define ELF_APPLICATION_MODULE_NAME_ASCII "Application" +#define ELF_SECURITY_MODULE_NAME_ASCII "Security" + + +// +// Version numbers for the file header and the client +// + +#define ELF_VERSION_MAJOR 0x0001 +#define ELF_VERSION_MINOR 0x0001 + +// +// The following are definitions for the Flags field in the context handle. +// +// ELF_LOG_HANDLE_INVALID is used to indicate that the handle is no +// longer valid - i.e. the contents of the file +// or the file itself have changed. It is used for +// READs to cause the reader to "resync". +// +// ELF_LOG_HANDLE_BACKUP_LOG indicates that this was created with the +// OpenBackupEventlog API and is not an active log. +// This means we do some additional work at close time +// and we disallow clear, backup, write and +// ChangeNotify operations. +// +// ELF_LOG_HANDLE_REMOTE_HANDLE indicates that this handle was created via +// a remote RPC call. This handle cannot be used for +// ElfChangeNotify +// +// ELF_LOG_HANDLE_GENERATE_ON_CLOSE indicates that NtCloseAuditAlarm must +// be called when this handle is closed. This flag +// is set when an audit is generated on open. +// + +#define ELF_LOG_HANDLE_INVALID_FOR_READ 0x0001 +#define ELF_LOG_HANDLE_BACKUP_LOG 0x0002 +#define ELF_LOG_HANDLE_REMOTE_HANDLE 0x0004 +#define ELF_LOG_HANDLE_LAST_READ_FORWARD 0x0008 +#define ELF_LOG_HANDLE_GENERATE_ON_CLOSE 0x0010 + +#endif /* _ELFCOMMON_ */ diff --git a/private/eventlog/eltest/eltest.c b/private/eventlog/eltest/eltest.c new file mode 100644 index 000000000..67d0812e2 --- /dev/null +++ b/private/eventlog/eltest/eltest.c @@ -0,0 +1,1535 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + ELTEST.C + +Abstract: + + Test Routines for the EventLog. + +THINGS I WANT THIS TO DO... + AddReg <ServerName> <logname> <EntryName> <EventMessageFile> + <CategoryMessageFile> <CategoryCount> <ParameterMessageFile> + <TypesSupported> - Creates A Registry Entry. + + eltest addreg application mytest mf= eltest.dll cat= + + CreateMessageFile <??? Is this possible ???> + + WriteEvent <ServerName> <EventSource> <Type> <Category> <EventId> <UserSid?> + <NumStrings> <Strings> <RawData> + + ReadLog <Server> <LogFile> <ReadFlags> <RecordOffset> <bufSize> + If LogFile isn't one of the popular ones, then it could be a backup + logfile. + + GetNumEvents <Server> <LogFile> + + GetOldest <Server> <LogFile> + + Clear <Server> <LogFile> + + Backup <Server> <LogFile> <BackupFile> + + + LOOPTESTS.... + I should be able to run this test like mprtest such that it doesn't leave + the test process until told. This way we can register an event source, + then if we call WriteEvent without a specified EventSource, it will use + the stored source. Calling RegisterEventSource twice without calling + DeRegisterSource would be an error. (Or better yet, I could keep a table + of sources and handles). + + RegisterEventSource <EventSource> + DeRegisterSource <EventSource> + + + + +PROTOTYPES FOR FUNCTION.... + +BOOL +CloseEventLog ( + HANDLE hEventLog + ) +BOOL +DeregisterEventSource ( + HANDLE hEventLog + ) + +BOOL +NotifyChangeEventLog( + HANDLE hEventLog, + HANDLE hEvent + ) +BOOL +GetNumberOfEventLogRecords ( + HANDLE hEventLog, + PDWORD NumberOfRecords + ) +BOOL +GetOldestEventLogRecord ( + HANDLE hEventLog, + PDWORD OldestRecord + ) +BOOL +ClearEventLogW ( + HANDLE hEventLog, + LPCWSTR BackupFileName + ) +BOOL +BackupEventLogW ( + HANDLE hEventLog, + LPCWSTR BackupFileName + ) +HANDLE +OpenEventLogW ( + LPCWSTR UNCServerName, + LPCWSTR ModuleName + ) +HANDLE +RegisterEventSourceW ( + LPCWSTR UNCServerName, + LPCWSTR ModuleName + ) +HANDLE +OpenBackupEventLogW ( + LPCWSTR UNCServerName, + LPCWSTR FileName + ) +BOOL +ReadEventLogW ( + HANDLE hEventLog, + DWORD dwReadFlags, + DWORD dwRecordOffset, + LPVOID lpBuffer, + DWORD nNumberOfBytesToRead, + DWORD *pnBytesRead, + DWORD *pnMinNumberOfBytesNeeded + ) +BOOL +ReportEventW ( + HANDLE hEventLog, + WORD wType, + WORD wCategory OPTIONAL, + DWORD dwEventID, + PSID lpUserSid OPTIONAL, + WORD wNumStrings, + DWORD dwDataSize, + LPCWSTR *lpStrings OPTIONAL, + LPVOID lpRawData OPTIONAL + ) + + + + +Author: + + Dan Lafferty (danl) 09-March-1994 + +Environment: + + User Mode - Win32 + +Revision History: + + 09-Mar-1994 danl + created + +--*/ + +// +// INCLUDES +// +#define UNICODE 1 +#include <nt.h> // DbgPrint prototype +#include <ntrtl.h> // DbgPrint prototype +#include <nturtl.h> // needed for winbase.h + + +#include <stdlib.h> // atoi +#include <stdio.h> // printf +#include <conio.h> // getch +#include <string.h> // strcmp +#include <windows.h> // win32 typedefs +#include <tstr.h> // Unicode +#include <debugfmt.h> // FORMAT_LPTSTR + +//------------------ +// DEFINES +//------------------ +#define APPLICATION_LOG "Application" +#define SYSTEM_LOG "System" +#define SECURITY_LOG "Security" + +#define REG_APPLICATION_KEY "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\" +#define REG_SYSTEM_KEY "SYSTEM\\CurrentControlSet\\Services\\EventLog\\System\\" +#define REG_SECURITY_KEY "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Security\\" + +#define EVENT_SOURCE_NAME "tevent" +#define MSG_DLL "%SystemRoot%\\System32\\tevent.dll" + +#define VALUE_EVENT_MF TEXT("EventMessageFile") +#define VALUE_CATEGORY_MF TEXT("CategoryMessageFile") +#define VALUE_PARAMETER_MF TEXT("ParameterMessageFile") +#define VALUE_TYPES_SUPPORTED TEXT("TypesSupported") +#define VALUE_CATEGORY_COUNT TEXT("CategoryCount") + +#define TYPES_SUPPORTED (EVENTLOG_ERROR_TYPE | \ + EVENTLOG_WARNING_TYPE | \ + EVENTLOG_INFORMATION_TYPE) +//---------------------- +// GLOBALS +//---------------------- + LPTSTR ApplLogRegName=TEXT(REG_APPLICATION_KEY); + LPTSTR SysLogRegName =TEXT(REG_SYSTEM_KEY); + LPTSTR SecLogRegName =TEXT(REG_SECURITY_KEY); + LPTSTR ApplLogName = TEXT(APPLICATION_LOG); + LPTSTR SysLogName = TEXT(SYSTEM_LOG); + LPTSTR SecLogName = TEXT(SECURITY_LOG); + +//---------------------- +// FUNCTION PROTOTYPES +//---------------------- + +VOID +AddRegUsage(VOID); + +DWORD +AddSourceToRegistry( + IN LPTSTR ServerName, + IN LPTSTR LogName, + IN LPTSTR EventSourceName, + IN LPTSTR *argv, + IN DWORD argc + ); + +BOOL +ConvertToUnicode( + OUT LPWSTR *UnicodeOut, + IN LPSTR AnsiIn + ); + +DWORD +DelSourceInRegistry( + IN LPTSTR ServerName, + IN LPTSTR LogName, + IN LPTSTR EventSourceName + ); + +VOID +DisplayStatus ( + IN LPTSTR ServiceName, + IN LPTSTR DisplayName, + IN LPSERVICE_STATUS ServiceStatus + ); + +BOOL +MakeArgsUnicode ( + DWORD argc, + PCHAR argv[] + ); + +BOOL +ProcessArgs ( + LPTSTR ServerName, + DWORD argc, + LPTSTR argv[] + ); + +VOID +Usage( + VOID); + +VOID +ConfigUsage(VOID); + +VOID +CreateUsage(VOID); + +VOID +QueryUsage(VOID); + +LONG +wtol( + IN LPWSTR string + ); + +VOID +UserInputLoop( + LPTSTR ServerName + ); +DWORD +ReadLogFile( + LPTSTR ServerName, + LPTSTR LogName, + IN LPTSTR *argv, + IN DWORD argc + ); +VOID +ReadLogUsage(VOID); + +VOID +DisplayRecord( + PEVENTLOGRECORD pElRecord, + BOOL PrintTheHeader + ); + +/****************************************************************************/ +VOID _CRTAPI1 +main ( + DWORD argc, + PCHAR argvAnsi[] + ) + +/*++ + +Routine Description: + + Allows manual testing of the EVENTLOG API. + + eltest + + + +Arguments: + + + +Return Value: + + + +--*/ +{ + UCHAR i; + DWORD j; + DWORD argIndex; + LPTSTR pServerName=NULL; + LPTSTR *argv; + + if (argc <2) { + Usage(); + return; + } + + // + // Make the arguments unicode if necessary. + // +#ifdef UNICODE + if (!MakeArgsUnicode(argc, argvAnsi)) { + return; + } +#endif + + argv = (LPTSTR *)argvAnsi; + + argIndex = 1; + if (STRNCMP (argv[1], TEXT("\\\\"), 2) == 0) { + pServerName = argv[1]; + argIndex = 2; // skip over servername. + } + + // + // Check to see if we are to run in Loop Mode, or in single function + // mode. In Loop Mode, we go into a loop, and ask the user for + // input until the user decides to quit. + // + // Process Arguments: + // + // INDEX 0 1 2 3 + // EL <ServerName> <Function> <FunctionOptions...> + // + + if (STRICMP (argv[argIndex], TEXT("Loop")) == 0) { + UserInputLoop(pServerName); + } + else { + ProcessArgs(pServerName, argc-argIndex, &(argv[argIndex])); + } + + +#ifdef UNICODE + // + // Free up the unicode strings if there are any + // + for(j=0; j<argc; j++) { + LocalFree(argv[j]); + } +#endif + + return; +} + +VOID +UserInputLoop( + LPTSTR ServerName + ) + +/*++ + +Routine Description: + + This function sits in a loop, gathering input from the user, and + processing that input until the user indicates that it should stop. + The following user commands indicate that we should stop: + done + exit + stop + quit + +Arguments: + + +Return Value: + + +--*/ +{ + UCHAR i; + DWORD j; + LPTSTR *argv; + UCHAR buffer[255]; + LPSTR argvA[20]; + DWORD argc=0; + BOOL KeepGoing; + + do { + //------------------------------ + // Get input from the user + //------------------------------ + buffer[0] = 90-2; + + printf("\nwaiting for instructions... \n"); + cgets(buffer); + + if (buffer[1] > 0) { + //-------------------------------------- + // put the string in argv/argc format. + //-------------------------------------- + buffer[1]+=2; // make this an end offset + argc=0; + for (i=2,j=0; i<buffer[1]; i++,j++) { + argc++; + argvA[j] = &(buffer[i]); + while ((buffer[i] != ' ') && (buffer[i] != '\0')) { + i++; + } + buffer[i] = '\0'; + } + + //------------------------------------------ + // Make the arguments unicode if necessary. + //------------------------------------------ +#ifdef UNICODE + + if (!MakeArgsUnicode(argc, argvA)) { + return; + } + +#endif + //----------------------------------------------- + // If the first argument doesn't indicate that + // we should stop, then process the arguments. + //----------------------------------------------- + argv = (LPTSTR *)argvA; + + if((STRICMP (argv[0], TEXT("done")) == 0) || + (STRICMP (argv[0], TEXT("stop")) == 0) || + (STRICMP (argv[0], TEXT("exit")) == 0) || + (STRICMP (argv[0], TEXT("quit")) == 0)) { + KeepGoing = FALSE; + } + else { + KeepGoing = ProcessArgs(ServerName, argc, argv); + } + +#ifdef UNICODE + //----------------------------------------------- + // Free up the unicode strings if there are any + //----------------------------------------------- + for(j=0; j<argc; j++) { + LocalFree(argv[j]); + } +#endif + } + } while (KeepGoing); + + return; + +} + +/****************************************************************************/ +BOOL +ProcessArgs ( + LPTSTR ServerName, + DWORD argc, + LPTSTR argv[] + ) + +/*++ + +Routine Description: + + +Arguments: + + + +Return Value: + + + +--*/ + +{ + DWORD status; + DWORD specialFlag = FALSE; + DWORD argIndex; // index to unchecked portion of arglist. + + + argIndex = 0; + + // + // If we are adding a registry entry, the get a handle to it. + // Otherwise, get a handle to the LogFile. + // + //----------------------- + // AddSourceToRegistry + //----------------------- + if (STRICMP (argv[argIndex], TEXT("AddReg")) == 0 ) { + + // + // Must have at least "AddReg logname EntryName" + // + if (argc < (argIndex + 3)) { + AddRegUsage(); + goto CleanExit; + } + + status = AddSourceToRegistry( + ServerName, + argv[argIndex+1], // LogName + argv[argIndex+2], // SourceName + &argv[argIndex+1], + argc-(argIndex+2) + ); + } + //----------------------- + // DeleteFromRegistry + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("DelReg")) == 0) { + // + // Must have at least "DelReg logname EntryName" + // + if (argc < (argIndex + 3)) { + goto CleanExit; + } + + status = DelSourceInRegistry( + ServerName, + argv[argIndex+1], // LogName + argv[argIndex+2] // SourceName + ); + + } + //----------------------- + // WriteEvent + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("WriteEvent")) == 0) { + printf("In WriteEvent\n"); + if (ServerName != NULL) { + printf("ServerName = "FORMAT_LPTSTR"\n",ServerName); + } + } + //----------------------- + // ReadLog + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("ReadLog")) == 0) { + printf("In ReadLog\n"); + if (ServerName != NULL) { + printf("ServerName = "FORMAT_LPTSTR"\n",ServerName); + } + // + // Must have at least "ReadLog logname" + // + if (argc < (argIndex + 2)) { + ReadLogUsage(); + goto CleanExit; + } + + status = ReadLogFile( + ServerName, // ServerName + argv[argIndex+1], // LogName + &argv[argIndex+1], // argv + argc-(argIndex+1)); // argc + } + //----------------------- + // GetNumEvents + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("GetNumEvents")) == 0) { + printf("in GetNumEvents\n"); + if (ServerName != NULL) { + printf("ServerName = "FORMAT_LPTSTR"\n",ServerName); + } + } + //----------------------- + // GetOldest + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("GetOldest")) == 0) { + printf("in GetOldest\n"); + if (ServerName != NULL) { + printf("ServerName = "FORMAT_LPTSTR"\n",ServerName); + } + } + //----------------------- + // ClearLog + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("ClearLog")) == 0) { + printf("in ClearLog\n"); + if (ServerName != NULL) { + printf("ServerName = "FORMAT_LPTSTR"\n",ServerName); + } + } + //----------------------- + // Backup + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("Backup")) == 0) { + printf("in Backup\n"); + if (ServerName != NULL) { + printf("ServerName = "FORMAT_LPTSTR"\n",ServerName); + } + } + //----------------------- + // RegisterSource + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("RegisterSource")) == 0) { + printf("in RegisterSource\n"); + if (ServerName != NULL) { + printf("ServerName = "FORMAT_LPTSTR"\n",ServerName); + } + } + //----------------------- + // DeRegisterSource + //----------------------- + else if (STRICMP (argv[argIndex], TEXT("DeRegisterSource")) == 0) { + printf("in DeRegisterSource\n"); + if (ServerName != NULL) { + printf("ServerName = "FORMAT_LPTSTR"\n",ServerName); + } + } + //**************** + // Exit Program + //**************** + else if (STRICMP (argv[0], TEXT("Exit")) == 0) { + // + // THIS SHOULD CLOSE HANDLES. + // + return(FALSE); + } + else { + printf("Bad argument\n"); + Usage(); + } + +CleanExit: + + + return(TRUE); +} + + + +BOOL +MakeArgsUnicode ( + DWORD argc, + PCHAR argv[] + ) + + +/*++ + +Routine Description: + + +Arguments: + + +Return Value: + + +Note: + + +--*/ +{ + DWORD i; + + // + // ScConvertToUnicode allocates storage for each string. + // We will rely on process termination to free the memory. + // + for(i=0; i<argc; i++) { + + if(!ConvertToUnicode( (LPWSTR *)&(argv[i]), argv[i])) { + printf("Couldn't convert argv[%d] to unicode\n",i); + return(FALSE); + } + + + } + return(TRUE); +} + +BOOL +ConvertToUnicode( + OUT LPWSTR *UnicodeOut, + IN LPSTR AnsiIn + ) + +/*++ + +Routine Description: + + This function translates an AnsiString into a Unicode string. + A new string buffer is created by this function. If the call to + this function is successful, the caller must take responsibility for + the unicode string buffer that was allocated by this function. + The allocated buffer should be free'd with a call to LocalFree. + + NOTE: This function allocates memory for the Unicode String. + + BUGBUG: This should be changed to return either + ERROR_NOT_ENOUGH_MEMORY or ERROR_INVALID_PARAMETER + +Arguments: + + AnsiIn - This is a pointer to an ansi string that is to be converted. + + UnicodeOut - This is a pointer to a location where the pointer to the + unicode string is to be placed. + +Return Value: + + TRUE - The conversion was successful. + + FALSE - The conversion was unsuccessful. In this case a buffer for + the unicode string was not allocated. + +--*/ +{ + + NTSTATUS ntStatus; + DWORD bufSize; + UNICODE_STRING unicodeString; + ANSI_STRING ansiString; + + // + // Allocate a buffer for the unicode string. + // + + bufSize = (strlen(AnsiIn)+1) * sizeof(WCHAR); + + *UnicodeOut = (LPWSTR)LocalAlloc(LMEM_ZEROINIT, (UINT)bufSize); + + if (*UnicodeOut == NULL) { + printf("ScConvertToUnicode:LocalAlloc Failure %ld\n",GetLastError()); + return(FALSE); + } + + // + // Initialize the string structures + // + RtlInitAnsiString( &ansiString, AnsiIn); + + unicodeString.Buffer = *UnicodeOut; + unicodeString.MaximumLength = (USHORT)bufSize; + unicodeString.Length = 0; + + // + // Call the conversion function. + // + ntStatus = RtlAnsiStringToUnicodeString ( + &unicodeString, // Destination + &ansiString, // Source + (BOOLEAN)FALSE); // Allocate the destination + + if (!NT_SUCCESS(ntStatus)) { + + printf("ScConvertToUnicode:RtlAnsiStringToUnicodeString Failure %lx\n", + ntStatus); + + return(FALSE); + } + + // + // Fill in the pointer location with the unicode string buffer pointer. + // + *UnicodeOut = unicodeString.Buffer; + + return(TRUE); + +} + +/****************************************************************************/ +VOID +DisplayStatus ( + IN LPTSTR ServiceName, + IN LPTSTR DisplayName, + IN LPSERVICE_STATUS ServiceStatus + ) + +/*++ + +Routine Description: + + Displays the service name and the service status. + + | + |SERVICE_NAME: messenger + |DISPLAY_NAME: messenger + | TYPE : WIN32 + | STATE : ACTIVE,STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN + | EXIT_CODE : 0xC002001 + | CHECKPOINT : 0x00000001 + | WAIT_HINT : 0x00003f21 + | + +Arguments: + + ServiceName - This is a pointer to a string containing the name of + the service. + + DisplayName - This is a pointer to a string containing the display + name for the service. + + ServiceStatus - This is a pointer to a SERVICE_STATUS structure from + which information is to be displayed. + +Return Value: + + none. + +--*/ +{ + + printf("\nSERVICE_NAME: "FORMAT_LPTSTR"\n", ServiceName); + if (DisplayName != NULL) { + printf("DISPLAY_NAME: "FORMAT_LPTSTR"\n", DisplayName); + } + + printf(" TYPE : %lx ", ServiceStatus->dwServiceType); + + switch(ServiceStatus->dwServiceType){ + case SERVICE_WIN32_OWN_PROCESS: + printf("WIN32_OWN_PROCESS \n"); + break; + case SERVICE_WIN32_SHARE_PROCESS: + printf("WIN32_SHARE_PROCESS \n"); + break; + case SERVICE_WIN32: + printf("WIN32 \n"); + break; + case SERVICE_ADAPTER: + printf("ADAPTER \n"); + break; + case SERVICE_KERNEL_DRIVER: + printf("KERNEL_DRIVER \n"); + break; + case SERVICE_FILE_SYSTEM_DRIVER: + printf("FILE_SYSTEM_DRIVER \n"); + break; + case SERVICE_DRIVER: + printf("DRIVER \n"); + break; + default: + printf(" ERROR \n"); + } + + printf(" STATE : %lx ", ServiceStatus->dwCurrentState); + + switch(ServiceStatus->dwCurrentState){ + case SERVICE_STOPPED: + printf("STOPPED "); + break; + case SERVICE_START_PENDING: + printf("START_PENDING "); + break; + case SERVICE_STOP_PENDING: + printf("STOP_PENDING "); + break; + case SERVICE_RUNNING: + printf("RUNNING "); + break; + case SERVICE_CONTINUE_PENDING: + printf("CONTINUE_PENDING "); + break; + case SERVICE_PAUSE_PENDING: + printf("PAUSE_PENDING "); + break; + case SERVICE_PAUSED: + printf("PAUSED "); + break; + default: + printf(" ERROR "); + } + + // + // Print Controls Accepted Information + // + + if (ServiceStatus->dwControlsAccepted & SERVICE_ACCEPT_STOP) { + printf("\n (STOPPABLE,"); + } + else { + printf("\n (NOT_STOPPABLE,"); + } + + if (ServiceStatus->dwControlsAccepted & SERVICE_ACCEPT_PAUSE_CONTINUE) { + printf("PAUSABLE,"); + } + else { + printf("NOT_PAUSABLE,"); + } + + if (ServiceStatus->dwControlsAccepted & SERVICE_ACCEPT_SHUTDOWN) { + printf("ACCEPTS_SHUTDOWN)\n"); + } + else { + printf("IGNORES_SHUTDOWN)\n"); + } + + // + // Print Exit Code + // + printf(" WIN32_EXIT_CODE : %d\t(0x%lx)\n", + ServiceStatus->dwWin32ExitCode, + ServiceStatus->dwWin32ExitCode); + printf(" SERVICE_EXIT_CODE : %d\t(0x%lx)\n", + ServiceStatus->dwServiceSpecificExitCode, + ServiceStatus->dwServiceSpecificExitCode ); + + // + // Print CheckPoint & WaitHint Information + // + + printf(" CHECKPOINT : 0x%lx\n", ServiceStatus->dwCheckPoint); + printf(" WAIT_HINT : 0x%lx\n", ServiceStatus->dwWaitHint ); + + return; +} + +VOID +Usage( + VOID) +{ + printf("DESCRIPTION:\n"); + printf("\tEL is a command line program used for testing the eventlog \n"); + printf("USAGE:\n"); + printf("\tEL <ServerName> [Function] <FunctionOptions...> \n\n"); + printf("\tThe option <server> has the form \"\\\\ServerName\"\n"); + printf("\tFurther help on Functions can be obtained by typing: \"el [Function]\"\n"); + printf("\tFunctions:\n" + "\t AddReg-----------Creates a registry entry for an event source.\n" + "\t DelReg-----------Deletes a registry entry.\n" + "\t WriteEvent-------Writes an event.\n" + "\t ReadLog----------Reads from the logfile.\n" + "\t GetNumEvents-----Gets the number of events in the specified log.\n" + "\t GetOldest--------Gets the record number for the oldest record" + "\t in the log\n" + "\t ClearLog---------Clears the specified Log.\n" + "\t Backup-----------Copies the specified log to a new file.\n" + "\t RegisterSource---Registers a name for the event source.\n" + "\t The handle is stored internally.\n" + "\t DeRegisterSource-Closes handle opened with RegSource.\n" + "\t NotifyChange-----A thread is created which gets notified of EL changes.\n"); + + printf("\n"); +} + +VOID +AddRegUsage(VOID) +{ + + printf("\nAdds a subkey under one of the logfiles listed in the registry.\n"); + printf("SYNTAX: \n eltest addreg <ServerName> logfile <SubKeyName> <option1> <option2>...\n"); + printf("ADDREG OPTIONS:\n"); + printf("NOTE: The option name includes the equal sign.\n"); + + printf(" MsgFile= Name of Event Message File\n" + " CatFile= Name of Category Message File\n" + " ParamFile= Name of Parameter Message File\n" + " CatCount= Category Count\n" + " Type= <error|warning|information|AuditSuccess|AuditFailure|All>\n"); + printf("EXAMPLE:\n eltest addreg application myapp MsgFile= MyMsgs.dll" + " Type= error Type= warning\n"); + +} + +VOID +ConfigUsage(VOID) +{ + printf("Modifies a service entry in the registry and Service Database.\n"); + printf("SYNTAX: \nsc config <service> <option1> <option2>...\n"); + printf("CONFIG OPTIONS:\n"); + printf("NOTE: The option name includes the equal sign.\n" + " type= <own|share|kernel|filesys|rec|adapt|error>\n" + " start= <boot|system|auto|demand|disabled|error>\n" + " error= <normal|severe|critical|error|ignore>\n" + " binPath= <BinaryPathName>\n" + " group= <LoadOrderGroup>\n" + " tag= <yes|no>\n" + " depend= <Dependencies(space seperated)>\n" + " obj= <AccountName|ObjectName>\n" + " DisplayName= <display name>\n" + " password= <password> \n"); +} +VOID +CreateUsage(VOID) +{ + printf("Creates a service entry in the registry and Service Database.\n"); + printf("SYNTAX: \nsc create <service> <option1> <option2>...\n"); + printf("CREATE OPTIONS:\n"); + printf("NOTE: The option name includes the equal sign.\n" + " type= <own|share|kernel|filesys|rec|error>\n" + " start= <boot|system|auto|demand|disabled|error>\n" + " error= <normal|severe|critical|error|ignore>\n" + " binPath= <BinaryPathName>\n" + " group= <LoadOrderGroup>\n" + " tag= <yes|no>\n" + " depend= <Dependencies(space seperated)>\n" + " obj= <AccountName|ObjectName>\n" + " DisplayName= <display name>\n" + " password= <password> \n"); +} + +VOID +ReadLogUsage(VOID) +{ + + printf("\nReads a logfile and dumps the contents.\n"); + printf("SYNTAX: \n eltest readlog <ServerName> logfile <option1> <option2>...\n"); + printf("READLOG OPTIONS:\n"); + printf("NOTE: The option name includes the equal sign.\n"); + + printf(" ReadFlag= <fwd|back|seek|seq> (default = fwd) \n" + " RecordNum= record number where read should start (default=0)\n" + " BufSize= size of the buffer (default = 10000)\n"); + printf("EXAMPLE:\n eltest addreg application myapp MsgFile= MyMsgs.dll" + " Type= error Type= warning\n"); +} + +DWORD +AddSourceToRegistry( + IN LPTSTR ServerName, + IN LPTSTR LogName, + IN LPTSTR EventSourceName, + IN LPTSTR *argv, + IN DWORD argc + ) + +/*++ + +Routine Description: + + This function writes to the registry all the information to register + this application as an event source. + +Arguments: + + +Return Value: + + +--*/ +{ + TCHAR tempName[MAX_PATH]; + HKEY hKey; + DWORD dwStatus=NO_ERROR; + HKEY hRegistry=HKEY_LOCAL_MACHINE; + + LPTSTR EventMessageFile=NULL; + LPTSTR CategoryMessageFile=NULL; + LPTSTR ParameterMessageFile=NULL; + DWORD dwTypes=0; + DWORD dwCategoryCount=0; + DWORD i; + + // + // Look at the LogName, and generate the appropriate registry key + // path for that log. + // + if (STRICMP(LogName, ApplLogName) == 0) { + STRCPY(tempName, ApplLogRegName); + } + else if (STRICMP(LogName, SysLogName) == 0) { + STRCPY(tempName, SysLogRegName); + } + else if (STRICMP(LogName, SecLogName) == 0) { + STRCPY(tempName, SecLogRegName); + } + else { + printf("AddSourceToRegistry: Invalid LogName\n"); + return(ERROR_INVALID_PARAMETER); + } + STRCAT(tempName, EventSourceName); + + + // + // Get Variable Arguments + // + for (i=0; i<argc ;i++ ) { + if (STRICMP(argv[i], TEXT("EventMsgFile=")) == 0) { + EventMessageFile = argv[i+1]; + i++; + } + if (STRICMP(argv[i], TEXT("CategoryMsgFile=")) == 0) { + CategoryMessageFile = argv[i+1]; + i++; + } + if (STRICMP(argv[i], TEXT("ParameterMsgFile=")) == 0) { + ParameterMessageFile = argv[i+1]; + i++; + } + if (STRICMP(argv[i], TEXT("Type=")) == 0) { + //-------------------------------------------------------- + // We want to allow for several arguments of type= in the + // same line. These should cause the different arguments + // to be or'd together. + //-------------------------------------------------------- + if (STRICMP(argv[i+1],TEXT("error")) == 0) { + dwTypes |= EVENTLOG_ERROR_TYPE; + } + if (STRICMP(argv[i+1],TEXT("warning")) == 0) { + dwTypes |= EVENTLOG_WARNING_TYPE; + } + if (STRICMP(argv[i+1],TEXT("information")) == 0) { + dwTypes |= EVENTLOG_INFORMATION_TYPE; + } + if (STRICMP(argv[i+1],TEXT("AuditSuccess")) == 0) { + dwTypes |= EVENTLOG_AUDIT_SUCCESS; + } + if (STRICMP(argv[i+1],TEXT("AuditFailure")) == 0) { + dwTypes |= EVENTLOG_AUDIT_FAILURE; + } + if (STRICMP(argv[i+1],TEXT("All")) == 0) { + dwTypes |= (EVENTLOG_ERROR_TYPE | EVENTLOG_WARNING_TYPE | + EVENTLOG_INFORMATION_TYPE | EVENTLOG_AUDIT_SUCCESS | + EVENTLOG_AUDIT_FAILURE); + } + else { + printf("Invalid Type\n"); + AddRegUsage(); + return(ERROR_INVALID_PARAMETER); + } + i++; + } + if (STRICMP(argv[i], TEXT("CategoryCount=")) == 0) { + dwCategoryCount = ATOL(argv[i+1]); + i++; + } + + } + + // + // Connect to the registry on the correct machine. + // + printf("Connect to Registry\n"); + dwStatus = RegConnectRegistry(ServerName, HKEY_LOCAL_MACHINE, &hRegistry); + if (dwStatus != NO_ERROR) { + printf("RegConnectRegistry Failed %d\n",GetLastError()); + return(dwStatus); + } + + // + // Create the new key for this source + // + printf("Create Key\n"); + dwStatus = RegCreateKey(hRegistry, tempName, &hKey); + if (dwStatus != ERROR_SUCCESS) { + printf("Couldn't create Source Key in registry %d\n",dwStatus); + return(dwStatus); + } + if (EventMessageFile != NULL) { + printf("Set EventMessageFile\n"); + dwStatus = RegSetValueEx( + hKey, + VALUE_EVENT_MF, + 0, + REG_EXPAND_SZ, + (LPBYTE)EventMessageFile, + STRLEN(EventMessageFile) + sizeof(TCHAR)); + + if (dwStatus != ERROR_SUCCESS) { + printf("RegSetValue (messageFile) failed %d\n",GetLastError()); + goto CleanExit; + } + } + // + // Set the Category Message File + // + if (CategoryMessageFile != NULL) { + printf("Set Category Message File\n"); + dwStatus = RegSetValueEx( + hKey, + VALUE_CATEGORY_MF, + 0, + REG_EXPAND_SZ, + (LPBYTE)CategoryMessageFile, + STRLEN(CategoryMessageFile) + sizeof(TCHAR)); + + if (dwStatus != ERROR_SUCCESS) { + printf("RegSetValue (category mf) failed %d\n",GetLastError()); + goto CleanExit; + } + } + + // + // Set the Parameter Message File + // + if (ParameterMessageFile != NULL) { + printf("Set Parameter Message File\n"); + dwStatus = RegSetValueEx( + hKey, + VALUE_PARAMETER_MF, + 0, + REG_EXPAND_SZ, + (LPBYTE)ParameterMessageFile, + STRLEN(ParameterMessageFile) + sizeof(TCHAR)); + + if (dwStatus != ERROR_SUCCESS) { + printf("RegSetValue (Parameter mf) failed %d\n",GetLastError()); + goto CleanExit; + } + } + + // + // Set the Types Supported + // + if (dwTypes != 0) { + printf("Set Types Supported\n"); + dwStatus = RegSetValueEx( + hKey, + VALUE_TYPES_SUPPORTED, + 0, + REG_DWORD, + (LPBYTE) &dwTypes, + sizeof(DWORD)); + + if (dwStatus != ERROR_SUCCESS) { + printf("RegSetValue (TypesSupported) failed %d\n",GetLastError()); + goto CleanExit; + } + + } + + // + // Set the Category Count + // + if (dwCategoryCount != 0) { + printf("Set CategoryCount\n"); + dwStatus = RegSetValueEx( + hKey, + VALUE_CATEGORY_COUNT, + 0, + REG_DWORD, + (LPBYTE) &dwCategoryCount, + sizeof(DWORD)); + + if (dwStatus != ERROR_SUCCESS) { + printf("RegSetValue (CategoryCount) failed %d\n",GetLastError()); + goto CleanExit; + } + } + dwStatus = NO_ERROR; +CleanExit: + RegCloseKey(hKey); + RegCloseKey(hRegistry); + return(dwStatus); +} + +DWORD +DelSourceInRegistry( + IN LPTSTR ServerName, + IN LPTSTR LogName, + IN LPTSTR EventSourceName + ) + +/*++ + +Routine Description: + + This function writes to the registry all the information to register + this application as an event source. + +Arguments: + + +Return Value: + + +--*/ +{ + LPTSTR tempName; + HKEY hParentKey; + BOOL status=FALSE; + DWORD dwStatus; + HKEY hRegistry=HKEY_LOCAL_MACHINE; + + + // + // Look at the LogName, and generate the appropriate registry key + // path for that log. + // + if (STRICMP(LogName, ApplLogName) == 0) { + tempName = ApplLogRegName; + } + else if (STRICMP(LogName, SysLogName) == 0) { + tempName = SysLogRegName; + } + else if (STRICMP(LogName, SecLogName) == 0) { + tempName = SecLogRegName; + } + else { + printf("AddSourceToRegistry: Invalid LogName\n"); + return(ERROR_INVALID_PARAMETER); + } + + // + // Connect to the registry on the correct machine. + // + dwStatus = RegConnectRegistry(ServerName, HKEY_LOCAL_MACHINE, &hRegistry); + if (dwStatus != NO_ERROR) { + printf("RegConnectRegistry Failed %d\n",GetLastError()); + return(status); + } + + // + // Open the Parent Key of the key we want to delete. + // + dwStatus = RegOpenKeyEx( + hRegistry, + tempName, + 0, + KEY_ALL_ACCESS, + &hParentKey); + + if (dwStatus != ERROR_SUCCESS) { + printf("Couldn't open Parent of key to be deleted. %d\n",dwStatus); + goto CleanExit; + } + // + // Delete the subkey. + // + dwStatus = RegDeleteKey(hParentKey, EventSourceName); + if (dwStatus != ERROR_SUCCESS) { + printf("Couldn't delete "FORMAT_LPTSTR" key from registry %d\n", + EventSourceName, dwStatus); + } + + RegCloseKey(hParentKey); +CleanExit: + RegCloseKey(hRegistry); + return(status); +} + +DWORD +ReadLogFile( + LPTSTR ServerName, + LPTSTR LogName, + IN LPTSTR *argv, + IN DWORD argc + ) + +/*++ + +Routine Description: + + +Arguments: + + +Return Value: + + +--*/ +{ + DWORD dwReadFlag = EVENTLOG_FORWARDS_READ; + DWORD dwRecordNum = 0; + DWORD BufSize = 10000; + DWORD numBytesRead; + DWORD numBytesReqd; + LPVOID pElBuffer = NULL; + PEVENTLOGRECORD pElRecord; + BOOL PrintTheHeader; + DWORD i; + HANDLE hEventLog=NULL; + + // + // Get Variable Arguments + // + for (i=0; i<argc ;i++ ) { + if (STRICMP(argv[i], TEXT("ReadFlag=")) == 0) { + if (STRICMP(argv[i+1],TEXT("fwd")) == 0) { + dwReadFlag |= EVENTLOG_FORWARDS_READ; + } + if (STRICMP(argv[i+1],TEXT("back")) == 0) { + dwReadFlag |= EVENTLOG_BACKWARDS_READ; + } + if (STRICMP(argv[i+1],TEXT("seek")) == 0) { + dwReadFlag |= EVENTLOG_SEEK_READ; + } + if (STRICMP(argv[i+1],TEXT("seq")) == 0) { + dwReadFlag |= EVENTLOG_SEQUENTIAL_READ; + } + i++; + } + if (STRICMP(argv[i], TEXT("RecordNum=")) == 0) { + dwRecordNum = ATOL(argv[i+1]); + i++; + } + if (STRICMP(argv[i], TEXT("BufSize=")) == 0) { + BufSize = ATOL(argv[i+1]); + i++; + } + hEventLog = OpenEventLog(ServerName,LogName); + if (hEventLog == NULL) { + printf("OpenEventLog failed %d\n",GetLastError()); + return(0); + } + pElBuffer = LocalAlloc(LPTR, BufSize); + if (pElBuffer == NULL) { + printf("ReadLogFile: LocalAlloc Failed %d\n",GetLastError()); + goto CleanExit; + } + + //--------------------------------------------------------- + // Read and Display the contents of the eventlog + //--------------------------------------------------------- + PrintTheHeader = TRUE; +TryAgain: + while(ReadEventLog( + hEventLog, + dwReadFlag, + dwRecordNum, + pElBuffer, + BufSize, + &numBytesRead, + &numBytesReqd)) { + + pElRecord = (PEVENTLOGRECORD) pElBuffer; + while ((PBYTE) pElRecord < (PBYTE) pElBuffer + numBytesRead) { + // + // Print the record to the display + // + DisplayRecord(pElRecord,PrintTheHeader); + PrintTheHeader = FALSE; + // + // Move to the next event in the buffer + // + pElRecord = (PEVENTLOGRECORD)((PBYTE) pElRecord + + pElRecord->Length); + } + } + switch(GetLastError()) { + case ERROR_INSUFFICIENT_BUFFER: + // + // Increase the size of the buffer and try again + // + if (numBytesReqd > BufSize) { + LocalFree(pElBuffer); + BufSize = numBytesReqd; + pElBuffer = LocalAlloc(LPTR, BufSize); + if (!pElBuffer) { + printf("ReadLogFile: LocalAlloc Failed %d\n",GetLastError()); + } + goto TryAgain; + } + else { + printf("ReadLogFile #1: THIS SHOULD NEVER HAPPEN\n"); + } + break; + case ERROR_EVENTLOG_FILE_CHANGED: + // + // The current read position for this handle has been overwritten. + // Reopen the file and print a message to the effect that some + // records may have been missed. + // + printf("ReadLogFile: Current Read position has been overwritten\n"); + + hEventLog = OpenEventLog(ServerName,LogName); + if (hEventLog == NULL) { + printf("OpenEventLog failed %d\n",GetLastError()); + goto CleanExit; + } + goto TryAgain; + case ERROR_HANDLE_EOF: + printf("EOF\n"); + break; + default: + printf("UnknownError: %d\n",GetLastError()); + break; + } + } +CleanExit: + if (pElBuffer != NULL) { + LocalFree(pElBuffer); + } + if (hEventLog != NULL) { + CloseEventLog(hEventLog); + } + return(0); +} + +VOID +DisplayRecord( + PEVENTLOGRECORD pElRecord, + BOOL PrintTheHeader + ) + +/*++ + +Routine Description: + + +Arguments: + + +Return Value: + + +--*/ +{ + if (PrintTheHeader) { + printf("RecNum/tTimeGen/tWriteTime/tEventID/tType/tNumStr/tCat/n"); + } + printf("%d/t%d/t%d/t%d/t%d/t%d/t%d\n", + pElRecord->RecordNumber, + pElRecord->TimeGenerated, + pElRecord->TimeWritten, + pElRecord->EventID, + pElRecord->EventType, + pElRecord->NumStrings, + pElRecord->EventCategory); +} + +LONG +wtol( + IN LPWSTR string + ) +{ + LONG value = 0; + + while((*string != L'\0') && + (*string >= L'0') && + ( *string <= L'9')) { + value = value * 10 + (*string - L'0'); + string++; + } + + return(value); +} + diff --git a/private/eventlog/eltest/makefile b/private/eventlog/eltest/makefile new file mode 100644 index 000000000..f0db8e4a7 --- /dev/null +++ b/private/eventlog/eltest/makefile @@ -0,0 +1,6 @@ +# +# DO NOT EDIT THIS LINE!!! Edit .\sources. if you want to add a new source +# file to this component. This file merely indirects to the real make file +# that is shared by all the components of NT OS/2 +# +!INCLUDE $(NTMAKEENV)\makefile.def diff --git a/private/eventlog/eltest/sources b/private/eventlog/eltest/sources new file mode 100644 index 000000000..00246b41a --- /dev/null +++ b/private/eventlog/eltest/sources @@ -0,0 +1,45 @@ +!IF 0 + +Copyright (c) 1989-92 Microsoft Corporation + +Module Name: + + sources for ELTEST.EXE + +Abstract: + + This file specifies the target component being built and the list of + sources files needed to build that component. Also specifies optional + compiler switches and libraries that are unique for the component being + built. + + +Author: + + Dan Lafferty (danl) 5-May-1991 + + +Revision History: + +!ENDIF + +MAJORCOMP = private +MINORCOMP = eventlog +TARGETNAME= eltest + + +TARGETPATH=obj +TARGETTYPE=PROGRAM + +TARGETLIBS= \ + $(BASEDIR)\public\sdk\lib\*\user32.lib \ + $(BASEDIR)\public\sdk\lib\*\advapi32.lib \ + $(BASEDIR)\public\sdk\lib\*\ntdll.lib \ + +INCLUDES=.;..\..\inc + + +SOURCES= eltest.c + +UMTYPE=console + diff --git a/private/eventlog/event.h b/private/eventlog/event.h new file mode 100644 index 000000000..b735df5ca --- /dev/null +++ b/private/eventlog/event.h @@ -0,0 +1,59 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + EVENT.H + +Abstract: + + Contains the common data structures that should be put in one + place in the tree. + +Author: + + Rajen Shah (rajens) 21-Aug-1991 + +Revision History: + +--*/ + +// +// Switch to using the commonly defined (in ntdef.h) UNICODE_STRING +// Do a munge to fix this if it works ok +// + +typedef UNICODE_STRING RPC_UNICODE_STRING, *PRPC_UNICODE_STRING; + + +// +// RPC definition of the SID structure. Note the use of the [size_is()] +// qualifier to specify the number of elements in the variable size +// imbedded SubAuthorityCount array at runtime. +// +// BUGBUG - This is stolen from samrpc.idl, and should really be placed +// in a common place for all to use. +// +typedef struct _RPC_SID { + UCHAR Revision; + UCHAR SubAuthorityCount; + SID_IDENTIFIER_AUTHORITY IdentifierAuthority; + [size_is(SubAuthorityCount)] ULONG SubAuthority[*]; +} RPC_SID, *PRPC_SID, **PPRPC_SID; + +// +// ANSI counted string +// + +typedef struct _RPC_STRING { + USHORT Length; + USHORT MaximumLength; +// [size_is(MaximumLength+0), length_is(Length+1)] PCHAR Buffer; + [size_is(MaximumLength)] PCHAR Buffer; +} RPC_STRING, *PRPC_STRING, RPC_ANSI_STRING, *PRPC_ANSI_STRING; + +typedef struct _RPC_CLIENT_ID { + ULONG UniqueProcess; + ULONG UniqueThread; +} RPC_CLIENT_ID, *PRPC_CLIENT_ID; diff --git a/private/eventlog/imports.h b/private/eventlog/imports.h new file mode 100644 index 000000000..e09e76be2 --- /dev/null +++ b/private/eventlog/imports.h @@ -0,0 +1,2 @@ +#include <nt.h> +#include <windef.h> diff --git a/private/eventlog/imports.idl b/private/eventlog/imports.idl new file mode 100644 index 000000000..b7ed62591 --- /dev/null +++ b/private/eventlog/imports.idl @@ -0,0 +1,60 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + imports.idl + +Abstract: + + This file is useful for creating RPC interfaces that require the use + of types defined in other header files. The .idl file for the RPC + product should contain a line in the interface body that imports this + file. For example: + + import "imports.idl"; + + Doing this causes the MIDL generated header file to contain the + #include lines that are in this file. + + If this technique is not used, and instead the .idl file for the RPC + product simply contains #include <windef.h>, then the contents of + windef.h will be expanded in the MIDL generated header file. This + can lead to duplicate definition problems later when the RPC client + or RPC server code needs to include both the MIDL generated header file + and a file that is included in windef.h. + +Author: + + Dan Lafferty (danl) 20-Mar-1991 + +Environment: + + User Mode - Win32 - for use with the MIDL compiler + + +Revision History: + + 03-Apr-1991 danl + created + +--*/ + + +[ + uuid(12345678-1234-ABCD-EF00-9948756789AB), +#ifdef __midl + ms_union, +#endif // __midl + version(0.0) +] +interface eventlog_imports + +{ +#define MIDL_PASS +#define UNICODE + +#include "imports.h" + +} diff --git a/private/eventlog/makefil0 b/private/eventlog/makefil0 new file mode 100644 index 000000000..d9488c71e --- /dev/null +++ b/private/eventlog/makefil0 @@ -0,0 +1,48 @@ +# +# This is the MIDL compile phase of the build process. +# +# The following is where you put the name of your .idl file without +# the .idl extension: +# + +!INCLUDE $(NTMAKEENV)\makefile.plt + +ELFIDL=elf + +CLIENT_FILES=elfclnt\$(ELFIDL)_c.c $(ELFIDL).h +SERVER_FILES=server\$(ELFIDL)_s.c +LOCAL_FILES=$(ELFIDL)_c.c $(ELFIDL)_s.c + +INCS= -I$(BASEDIR)\public\sdk\inc -I$(BASEDIR)\public\sdk\inc\crt + +ELFMIDLARGS=-oldnames -error allocation -error ref -ms_ext -c_ext \ + -cpp_cmd "$(MIDL_CPP)" $(MIDL_FLAGS) $(INCS) + +# +# Define Products and Dependencies +# + +all: $(CLIENT_FILES) $(SERVER_FILES) del_elf_sources +!IF "$(BUILDMSG)" != "" + @ech ; $(BUILDMSG) ; +!ENDIF + +clean: delete_source all + +delete_source: + -erase $(CLIENT_FILES) $(SERVER_FILES) $(LOCAL_FILES) + +# +# MIDL COMPILE +# + +$(CLIENT_FILES): $(ELFIDL).idl + midl -Oi $(ELFMIDLARGS) $(ELFIDL).idl + copy $(ELFIDL)_c.c elfclnt\$(ELFIDL)_c.c + +$(SERVER_FILES): $(ELFIDL).idl + midl -client none $(ELFMIDLARGS) $(ELFIDL).idl + copy $(ELFIDL)_s.c server\$(ELFIDL)_s.c + +del_elf_sources: + -del $(LOCAL_FILES) 1> NUL 2>NUL diff --git a/private/eventlog/misc/dirs b/private/eventlog/misc/dirs new file mode 100644 index 000000000..076ccc941 --- /dev/null +++ b/private/eventlog/misc/dirs @@ -0,0 +1,4 @@ + +DIRS= + +OPTIONAL_DIRS= diff --git a/private/eventlog/misc/logalert.c b/private/eventlog/misc/logalert.c new file mode 100644 index 000000000..2b5e5f760 --- /dev/null +++ b/private/eventlog/misc/logalert.c @@ -0,0 +1,204 @@ +/*++ + +Copyright (c) 1995 Microsoft Corporation + +Module Name: + + LOGALERT.C + +Abstract: + + This file contains the routine to log a Cairo alert in the system log. + + +Author: + + Ravi Rudrappa (ravir) 18-Jan-1995 + + +Revision History: + + 18-Jan-1995 RaviR + Created + +--*/ + +#ifdef _CAIRO_ + +#include <elfclntp.h> + + +NTSTATUS +ElfLogCairoAlertInSystemLog( + IN HANDLE hLogHandle, + IN LARGE_INTEGER liEventTime, + IN USHORT usEventType, + IN USHORT usEventCategory, + IN ULONG ulEventID, + IN USHORT usNumStrings, + IN ULONG ulDataSize, + IN WCHAR *pwszComputerName, + IN WCHAR **ppwszStrings, + IN PBYTE pbData + ) +/*++ + +Routine Description: + + This routine logs the given Cairo Alert in the given log, through the + ElfrReportEventW function. + +Arguments: + + +Return Value: + + Returns an NTSTATUS code. + +Note: + + +--*/ +{ + NTSTATUS s = STATUS_SUCCESS; + ULONG ulEventTime; + PRPC_SID psidUser = NULL; + USHORT usFlags; + PUNICODE_STRING pusComputerName = NULL; + PUNICODE_STRING *ppusStrings = NULL; + ULONG i; + ULONG ulNumofAllocatedStrings = 0; + LPBYTE pbString = NULL; + + // + // parameter validation + // + + if ((hLogHandle == NULL) || + (pwszComputerName == NULL) || + ((usNumStrings > 0) && (ppwszStrings == NULL)) || + ((ulDataSize > 0) && (pbData == NULL))) + { + return STATUS_INVALID_PARAMETER; + } + + // + // user Sid + // + + psidUser = NULL; // BUGBUG: is this ok? + + // + // Map creation time + // + + RtlTimeToSecondsSince1970(&liEventTime, &ulEventTime); + + // + // Convert the array of Alert description insert strings + // to an array of UNICODE_STRINGs. + // + + if (usNumStrings > 0) + { + LPBYTE pbPtr; + // + // allocate memory in one shot. + // + + pbPtr = pbString = MIDL_user_allocate( + sizeof(PUNICODE_STRING) * usNumStrings + + sizeof(UNICODE_STRING) * usNumStrings); + + if (pbString == NULL) + { + s = STATUS_NO_MEMORY; + goto LCleanUp; + } + + ppusStrings = (PUNICODE_STRING *)pbPtr; + + pbPtr += sizeof(PUNICODE_STRING) * usNumStrings; + + // + // For each string passed in, allocate a UNICODE_STRING structure + // and set it to the matching string. + // + for (i = 0; i < usNumStrings; i++) + { + ppusStrings[i] = (PUNICODE_STRING)pbPtr; + + pbPtr += sizeof(UNICODE_STRING); + + RtlInitUnicodeString(ppusStrings[i], ppwszStrings[i]); + } + } + + // + // Map the ComputerName to UNICODE_STRING. + // + + pusComputerName = MIDL_user_allocate(sizeof(UNICODE_STRING)); + + if (pusComputerName == NULL) + { + s = STATUS_NO_MEMORY; + goto LCleanUp; + } + + RtlInitUnicodeString(pusComputerName, pwszComputerName); + + + // + // Do the RPC call with an exception handler since RPC will raise an + // exception if anything fails. It is up to us to figure out what + // to do once the exception is raised. + // + RpcTryExcept { + + // Call service + + s = ElfrReportEventW ( + (IELF_HANDLE)hLogHandle, + ulEventTime, + usEventType, + usEventCategory, + ulEventID, + usNumStrings, + ulDataSize, + (PRPC_UNICODE_STRING)pusComputerName, + psidUser, + (PRPC_UNICODE_STRING *)ppusStrings, + pbData, + 0, // Flags, + NULL, // RecordNumber, + NULL); // TimeWritten + + } + RpcExcept (1) { + + s = I_RpcMapWin32Status(RpcExceptionCode()); + } + RpcEndExcept + +LCleanUp: + + // + // Free the space allocated for the inserts + // and then free the space for ComputerName. + // + if (pbString) + { + MIDL_user_free(pbString); + } + + if (pusComputerName) + { + MIDL_user_free(pusComputerName); + } + + return (s); + +} + +#endif // _CAIRO_ diff --git a/private/eventlog/netevent/dummy.c b/private/eventlog/netevent/dummy.c new file mode 100644 index 000000000..537f11ef3 --- /dev/null +++ b/private/eventlog/netevent/dummy.c @@ -0,0 +1,4 @@ +void +DummyEntryPoint(void) +{ +} diff --git a/private/eventlog/netevent/event.rc b/private/eventlog/netevent/event.rc new file mode 100644 index 000000000..658dbbd75 --- /dev/null +++ b/private/eventlog/netevent/event.rc @@ -0,0 +1,11 @@ +#include <windows.h> +#include <ntverp.h> + +#define VER_FILETYPE VFT_DLL +#define VER_FILESUBTYPE VFT2_UNKNOWN +#define VER_FILEDESCRIPTION_STR "Net Event Handler" +#define VER_INTERNALNAME_STR "NetEvent.Dll" +#define VER_ORIGINALFILENAME_STR "NetEvent.Dll" + +#include "common.ver" +#include "netevent.rc" diff --git a/private/eventlog/netevent/makefile b/private/eventlog/netevent/makefile new file mode 100644 index 000000000..6ee4f43fa --- /dev/null +++ b/private/eventlog/netevent/makefile @@ -0,0 +1,6 @@ +# +# DO NOT EDIT THIS FILE!!! Edit .\sources. if you want to add a new source +# file to this component. This file merely indirects to the real make file +# that is shared by all the components of NT OS/2 +# +!INCLUDE $(NTMAKEENV)\makefile.def diff --git a/private/eventlog/netevent/makefile.inc b/private/eventlog/netevent/makefile.inc new file mode 100644 index 000000000..387f6df16 --- /dev/null +++ b/private/eventlog/netevent/makefile.inc @@ -0,0 +1 @@ +event.rc: netevent.rc MSG00001.bin diff --git a/private/eventlog/netevent/netevent.def b/private/eventlog/netevent/netevent.def new file mode 100644 index 000000000..5f3a626e8 --- /dev/null +++ b/private/eventlog/netevent/netevent.def @@ -0,0 +1,7 @@ +LIBRARY NETEVENT + +DESCRIPTION 'Network event messages' + +EXPORTS + + DummyEntryPoint diff --git a/private/eventlog/netevent/sources b/private/eventlog/netevent/sources new file mode 100644 index 000000000..76dbce398 --- /dev/null +++ b/private/eventlog/netevent/sources @@ -0,0 +1,20 @@ +MAJORCOMP=evenlog +MINORCOMP=netevent + +TARGETNAME=netevent +TARGETPATH=$(BASEDIR)\public\sdk\lib +TARGETTYPE=DYNLINK + +INCLUDES=. + +!IFNDEF DISABLE_NET_UNICODE +UNICODE=1 +NET_C_DEFINES=-DUNICODE +!ENDIF + +SOURCES=dummy.c \ + event.rc + +UMRES=obj\*\event.res + +NTTARGETFILE0=event.rc diff --git a/private/eventlog/ntsdexts/elfexts.c b/private/eventlog/ntsdexts/elfexts.c new file mode 100644 index 000000000..69fb5f25c --- /dev/null +++ b/private/eventlog/ntsdexts/elfexts.c @@ -0,0 +1,767 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + elfexts.c + +Abstract: + + This function contains the eventlog ntsd debugger extensions + +Author: + + Dan Hinsley (DanHi) 22-May-1993 + +Revision History: + +--*/ + +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> +#include <windows.h> +#include <ntsdexts.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <malloc.h> +#include <time.h> +#include <elf.h> +#include <elfdef.h> +#include <elfcommn.h> +#include <elfproto.h> +#include <svcs.h> +#include <elfextrn.h> + +//#define DbgPrint(_x_) (lpOutputRoutine) _x_ +#define DbgPrint(_x_) +#define MAX_NAME 256 +#define printf (lpOutputRoutine) +#define GET_DATA(DebugeeAddr, LocalAddr, Length) \ + Status = ReadProcessMemory( \ + GlobalhCurrentProcess, \ + (LPVOID)DebugeeAddr, \ + LocalAddr, \ + Length, \ + NULL \ + ); + +PNTSD_OUTPUT_ROUTINE lpOutputRoutine; +PNTSD_GET_EXPRESSION lpGetExpressionRoutine; +PNTSD_CHECK_CONTROL_C lpCheckControlCRoutine; + +HANDLE GlobalhCurrentProcess; +BOOL Status; + +// +// Initialize the global function pointers +// + +VOID +InitFunctionPointers( + HANDLE hCurrentProcess, + PNTSD_EXTENSION_APIS lpExtensionApis + ) +{ + // + // Load these to speed access if we haven't already + // + + if (!lpOutputRoutine) { + lpOutputRoutine = lpExtensionApis->lpOutputRoutine; + lpGetExpressionRoutine = lpExtensionApis->lpGetExpressionRoutine; + lpCheckControlCRoutine = lpExtensionApis->lpCheckControlCRoutine; + } + + // + // Stick this in a global + // + + GlobalhCurrentProcess = hCurrentProcess; +} + +LPWSTR +GetUnicodeString( + PUNICODE_STRING pUnicodeString + ) +{ + DWORD Pointer; + UNICODE_STRING UnicodeString; + + GET_DATA(pUnicodeString, &UnicodeString, sizeof(UNICODE_STRING)) + Pointer = (DWORD) UnicodeString.Buffer; + UnicodeString.Buffer = (LPWSTR) LocalAlloc(LMEM_ZEROINIT, + UnicodeString.Length + sizeof(WCHAR)); + GET_DATA(Pointer, UnicodeString.Buffer, UnicodeString.Length) + + return(UnicodeString.Buffer); +} + +DWORD +GetLogFileAddress( + LPSTR LogFileName, + PLOGFILE LogFile + ) +{ + ANSI_STRING AnsiString; + UNICODE_STRING UnicodeString; + DWORD Pointer; + DWORD LogFileAnchor; + LPWSTR ModuleName; + + // + // Convert the string to UNICODE + // + + RtlInitAnsiString(&AnsiString, LogFileName); + RtlAnsiStringToUnicodeString(&UnicodeString, &AnsiString, TRUE); + + // + // Walk the logfile list looking for a match + // + + LogFileAnchor = (lpGetExpressionRoutine)("LogFilesHead"); + + GET_DATA(LogFileAnchor, &Pointer, sizeof(DWORD)) + + while (Pointer != LogFileAnchor) { + GET_DATA(Pointer, LogFile, sizeof(LOGFILE)) + ModuleName = GetUnicodeString(LogFile->LogModuleName); + if (!wcsicmp(ModuleName, UnicodeString.Buffer)) { + break; + } + LocalFree(ModuleName); + Pointer = (DWORD) LogFile->FileList.Flink; + } + + RtlFreeUnicodeString(&UnicodeString); + + if (Pointer == LogFileAnchor) { + return(0); + } + else { + LocalFree(ModuleName); + return(Pointer); + } +} + +// +// Dump an individual record +// + +DWORD +DumpRecord( + DWORD Record, + DWORD RecordNumber, + DWORD StartOfFile, + DWORD EndOfFile + ) +{ + DWORD BufferLen; + PCHAR TimeBuffer; + PEVENTLOGRECORD EventLogRecord; + LPWSTR Module; + LPWSTR Computer; + DWORD FirstPiece = 0; + + GET_DATA(Record, &BufferLen, sizeof(DWORD)) + + // + // See if it's a ELF_SKIP_DWORD, and if it is, return the top of the + // file + // + + if (BufferLen == ELF_SKIP_DWORD) { + return(StartOfFile + sizeof(ELF_LOGFILE_HEADER)); + } + + // + // See if it's the EOF record + // + + if (BufferLen == ELFEOFRECORDSIZE) { + return(0); + } + + BufferLen += sizeof(DWORD); // get room for length of next record + EventLogRecord = (PEVENTLOGRECORD) LocalAlloc(LMEM_ZEROINIT, BufferLen); + + // + // If the record wraps, grab it piecemeal + // + + if (EndOfFile && BufferLen + Record > EndOfFile) { + FirstPiece = EndOfFile - Record; + GET_DATA(Record, EventLogRecord, FirstPiece); + GET_DATA((StartOfFile + sizeof(ELF_LOGFILE_HEADER)), + ((PBYTE) EventLogRecord + FirstPiece), BufferLen - FirstPiece) + } + else { + GET_DATA(Record, EventLogRecord, BufferLen) + } + + // + // If it's greater than the starting record, print it out + // + + if (EventLogRecord->RecordNumber >= RecordNumber) { + printf("\nRecord %d is %d [0x%X] bytes long starting at 0x%X\n", + EventLogRecord->RecordNumber, EventLogRecord->Length, + EventLogRecord->Length, Record); + Module = (LPWSTR)(EventLogRecord+1); + Computer = (LPWSTR)((PBYTE) Module + ((wcslen(Module) + 1) * sizeof(WCHAR))); + printf("\tGenerated by %ws from system %ws\n", Module, Computer); + + TimeBuffer = ctime((time_t *)&(EventLogRecord->TimeGenerated)); + if (TimeBuffer) { + printf("\tGenerated at %s", TimeBuffer); + } + else { + printf("\tGenerated time field is blank\n"); + } + TimeBuffer = ctime((time_t *)&(EventLogRecord->TimeWritten)); + if (TimeBuffer) { + printf("\tWritten at %s", TimeBuffer); + } + else { + printf("\tTime written field is blank\n"); + } + + printf("\tEvent Id = %d\n", EventLogRecord->EventID); + printf("\tEventType = "); + switch (EventLogRecord->EventType) { + case EVENTLOG_SUCCESS: + printf("Success\n"); + break; + case EVENTLOG_ERROR_TYPE: + printf("Error\n"); + break; + case EVENTLOG_WARNING_TYPE: + printf("Warning\n"); + break; + case EVENTLOG_INFORMATION_TYPE: + printf("Information\n"); + break; + case EVENTLOG_AUDIT_SUCCESS: + printf("Audit Success\n"); + break; + case EVENTLOG_AUDIT_FAILURE: + printf("Audit Failure\n"); + break; + default: + printf("Invalid value 0x%X\n", EventLogRecord->EventType); + } + printf("\t%d strings at offset 0x%X\n", EventLogRecord->NumStrings, + EventLogRecord->StringOffset); + printf("\t%d bytes of data at offset 0x%X\n", EventLogRecord->DataLength, + EventLogRecord->DataOffset); + } + + if (FirstPiece) { + Record = StartOfFile + sizeof(ELF_LOGFILE_HEADER) + BufferLen - + FirstPiece; + } + else { + Record += EventLogRecord->Length; + } + + LocalFree(EventLogRecord); + return(Record); +} + +// +// Dump a record, or all records, or n records +// + +VOID +record( + HANDLE hCurrentProcess, + HANDLE hCurrentThread, + DWORD dwCurrentPc, + PNTSD_EXTENSION_APIS lpExtensionApis, + LPSTR lpArgumentString + ) +{ + DWORD Pointer; + LOGFILE LogFile; + DWORD StartOfFile; + DWORD EndOfFile = 0; + DWORD RecordNumber = 0; + + InitFunctionPointers(hCurrentProcess, lpExtensionApis); + + // + // Evaluate the argument string to get the address of + // the record to dump. + // + + if (lpArgumentString && *lpArgumentString) { + if (*lpArgumentString == '.') { + if (GetLogFileAddress(lpArgumentString+1, &LogFile) == 0) { + printf("Logfile %s not found\n", lpArgumentString+1); + return; + } + Pointer = ((DWORD) (LogFile.BaseAddress)) + LogFile.BeginRecord; + } + else if (*lpArgumentString == '#') { + RecordNumber = atoi(lpArgumentString + 1); + printf("Dumping records starting at record #%d\n", RecordNumber); + lpArgumentString = NULL; + } + else if (*lpArgumentString) { + Pointer = (lpGetExpressionRoutine)(lpArgumentString); + } + else { + printf("Invalid lead character 0x%02X\n", *lpArgumentString); + return; + } + } + + if (!lpArgumentString || *lpArgumentString) { + if (GetLogFileAddress("system", &LogFile) == 0) { + printf("System Logfile not found\n"); + return; + } + Pointer = ((DWORD) (LogFile.BaseAddress)) + LogFile.BeginRecord; + } + + StartOfFile = (DWORD) LogFile.BaseAddress; + EndOfFile = (DWORD) LogFile.BaseAddress + LogFile.ActualMaxFileSize; + + // + // Dump records starting wherever they told us to + // + + while (Pointer < EndOfFile && Pointer && !(lpCheckControlCRoutine)()) { + Pointer = DumpRecord(Pointer, RecordNumber, StartOfFile, EndOfFile); + } + + + return; +} + +// +// Dump a single LogModule structure if it matches MatchName (NULL matches +// all) +// + +PLIST_ENTRY +DumpLogModule( + HANDLE hCurrentProcess, + DWORD pLogModule, + LPWSTR MatchName + ) +{ + LOGMODULE LogModule; + WCHAR ModuleName[MAX_NAME / sizeof(WCHAR)]; + + GET_DATA(pLogModule, &LogModule, sizeof(LogModule)) + GET_DATA(LogModule.ModuleName, &ModuleName, MAX_NAME) + + if (!MatchName || !wcsicmp(MatchName, ModuleName)) { + printf("\tModule Name %ws\n", ModuleName); + printf("\tModule Atom 0x%X\n", LogModule.ModuleAtom); + printf("\tPointer to LogFile 0x%X\n", LogModule.LogFile); + } + + return (LogModule.ModuleList.Flink); +} + +// +// Dump selected, or all, LogModule structures +// + +VOID +logmodule( + HANDLE hCurrentProcess, + HANDLE hCurrentThread, + DWORD dwCurrentPc, + PNTSD_EXTENSION_APIS lpExtensionApis, + LPSTR lpArgumentString + ) +{ + DWORD pLogModule; + DWORD LogModuleAnchor; + LPWSTR wArgumentString = NULL; + ANSI_STRING AnsiString; + UNICODE_STRING UnicodeString; + + InitFunctionPointers(hCurrentProcess, lpExtensionApis); + UnicodeString.Buffer = NULL; + + // + // Evaluate the argument string to get the address of + // the logmodule to dump. If no parm, dump them all. + // + + if (lpArgumentString && *lpArgumentString == '.') { + lpArgumentString++; + RtlInitAnsiString(&AnsiString, lpArgumentString); + RtlAnsiStringToUnicodeString(&UnicodeString, &AnsiString, TRUE); + } + else if (lpArgumentString && *lpArgumentString) { + pLogModule = (lpGetExpressionRoutine)(lpArgumentString); + DumpLogModule(hCurrentProcess, pLogModule, NULL); + return; + } + + LogModuleAnchor = (lpGetExpressionRoutine)("LogModuleHead"); + + GET_DATA(LogModuleAnchor, &pLogModule, sizeof(DWORD)) + + while (pLogModule != LogModuleAnchor && !(lpCheckControlCRoutine)()) { + pLogModule = + (DWORD) DumpLogModule(hCurrentProcess, pLogModule, + UnicodeString.Buffer); + if (!UnicodeString.Buffer) { + printf("\n"); + } + } + if (UnicodeString.Buffer) { + RtlFreeUnicodeString(&UnicodeString); + } + + return; +} + +// +// Dump a single LogFile structure if it matches MatchName (NULL matches +// all) +// + +PLIST_ENTRY +DumpLogFile( + HANDLE hCurrentProcess, + DWORD pLogFile, + LPWSTR MatchName + ) +{ + LOGFILE LogFile; + LPWSTR UnicodeName; + + // + // Get the fixed part of the structure + // + + GET_DATA(pLogFile, &LogFile, sizeof(LogFile)) + + // + // Get the Default module name + // + + UnicodeName = GetUnicodeString(LogFile.LogModuleName); + + // + // See if we're just looking for a particular one. If we are and + // this isn't it, bail out. + // + + if (MatchName && wcsicmp(MatchName, UnicodeName)) { + LocalFree(UnicodeName); + return (LogFile.FileList.Flink); + } + + // + // Otherwise print it out + // + + printf("%ws", UnicodeName); + LocalFree(UnicodeName); + + // + // Now the file name of this logfile + // + + UnicodeName = GetUnicodeString(LogFile.LogFileName); + printf(" : %ws\n", UnicodeName); + LocalFree(UnicodeName); + + if (LogFile.Notifiees.Flink == LogFile.Notifiees.Blink) { + printf("\tNo active ChangeNotifies on this log\n"); + } + else { + printf("\tActive Change Notify! Dump of this list not implemented\n"); + } + + printf("\tReference Count: %d\n\tFlags: ", LogFile.RefCount); + if (LogFile.Flags == 0) { + printf("No flags set "); + } + else { + if (LogFile.Flags & ELF_LOGFILE_HEADER_DIRTY) { + printf("Dirty "); + } + if (LogFile.Flags & ELF_LOGFILE_HEADER_WRAP) { + printf("Wrapped "); + } + if (LogFile.Flags & ELF_LOGFILE_LOGFULL_WRITTEN) { + printf("Logfull Written "); + } + } + printf("\n"); + + printf("\tMax Files Sizes [Cfg:Curr:Next] 0x%X : 0x%X : 0x%X\n", + LogFile.ConfigMaxFileSize, LogFile.ActualMaxFileSize, + LogFile.NextClearMaxFileSize); + + printf("\tRecord Numbers [Oldest:Curr] %d : %d\n", + LogFile.OldestRecordNumber, LogFile.CurrentRecordNumber); + + printf("\tRetention period in days: %d\n", LogFile.Retention / 86400); + + printf("\tBase Address: 0x%X\n", LogFile.BaseAddress); + + printf("\tView size: 0x%X\n", LogFile.ViewSize); + + printf("\tOffset of beginning record: 0x%X\n", LogFile.BeginRecord); + + printf("\tOffset of ending record: 0x%X\n", LogFile.EndRecord); + + return (LogFile.FileList.Flink); +} + +// +// Dump selected, or all, LogFile structures +// + +VOID +logfile( + HANDLE hCurrentProcess, + HANDLE hCurrentThread, + DWORD dwCurrentPc, + PNTSD_EXTENSION_APIS lpExtensionApis, + LPSTR lpArgumentString + ) +{ + DWORD pLogFile; + DWORD LogFileAnchor; + LPWSTR wArgumentString = NULL; + ANSI_STRING AnsiString; + UNICODE_STRING UnicodeString; + BOOL AllocateString = FALSE; + + InitFunctionPointers(hCurrentProcess, lpExtensionApis); + UnicodeString.Buffer = NULL; + + // + // Evaluate the argument string to get the address of + // the logfile to dump. If no parm, dump them all. + // + + if (lpArgumentString && *lpArgumentString) { + if(*lpArgumentString == '.') { + lpArgumentString++; + RtlInitAnsiString(&AnsiString, lpArgumentString); + RtlAnsiStringToUnicodeString(&UnicodeString, &AnsiString, TRUE); + } + else { + pLogFile = (lpGetExpressionRoutine)(lpArgumentString); + DumpLogFile(hCurrentProcess, pLogFile, NULL); + return; + } + } + + LogFileAnchor = (lpGetExpressionRoutine)("LogFilesHead"); + + GET_DATA(LogFileAnchor, &pLogFile, sizeof(DWORD)) + + while (pLogFile != LogFileAnchor) { + pLogFile = + (DWORD) DumpLogFile(hCurrentProcess, pLogFile, + UnicodeString.Buffer); + if (!UnicodeString.Buffer) { + printf("\n"); + } + } + + if (UnicodeString.Buffer) { + RtlFreeUnicodeString(&UnicodeString); + } + + return; +} + +// +// Dump a request packet structure +// + +VOID +request( + HANDLE hCurrentProcess, + HANDLE hCurrentThread, + DWORD dwCurrentPc, + PNTSD_EXTENSION_APIS lpExtensionApis, + LPSTR lpArgumentString + ) +{ + ELF_REQUEST_RECORD Request; + DWORD Pointer; + DWORD RecordSize; + WRITE_PKT WritePkt; + READ_PKT ReadPkt; + CLEAR_PKT ClearPkt; + BACKUP_PKT BackupPkt; + LPWSTR FileName; + CHAR Address[18]; + + InitFunctionPointers(hCurrentProcess, lpExtensionApis); + + // + // Evaluate the argument string to get the address of + // the request packet to dump. + // + + if (lpArgumentString && *lpArgumentString) { + Pointer = (lpGetExpressionRoutine)(lpArgumentString); + } + else { + printf("Must supply a request packet address\n"); + return; + } + + GET_DATA(Pointer, &Request, sizeof(ELF_REQUEST_RECORD)) + + switch (Request.Command ) { + case ELF_COMMAND_READ: + printf("\nRead packet\n"); + GET_DATA(Request.Pkt.ReadPkt, &ReadPkt, sizeof(READ_PKT)) + printf("\tLast Seek Position = %d\n", ReadPkt.LastSeekPos); + printf("\tLast Seek Record = %d\n", ReadPkt.LastSeekRecord); + printf("\tStart at record number %d\n", ReadPkt.RecordNumber); + printf("\tRead %d bytes into buffer at 0x%X\n", + ReadPkt.BufferSize, ReadPkt.Buffer); + if (ReadPkt.Flags & ELF_IREAD_UNICODE) { + printf("\tReturn in ANSI\n"); + } + else { + printf("\tReturn in UNICODE\n"); + } + printf("\tRead flags: "); + if (ReadPkt.ReadFlags & EVENTLOG_SEQUENTIAL_READ) { + printf("Sequential "); + } + if (ReadPkt.ReadFlags & EVENTLOG_SEEK_READ) { + printf("Seek "); + } + if (ReadPkt.ReadFlags & EVENTLOG_FORWARDS_READ) { + printf("Forward "); + } + if (ReadPkt.ReadFlags & EVENTLOG_BACKWARDS_READ) { + printf("Backwards "); + } + printf("\n"); + break; + + case ELF_COMMAND_WRITE: + printf("\nWrite packet\n"); + if (Request.Flags == ELF_FORCE_OVERWRITE) { + printf("with ELF_FORCE_OVERWRITE enabled\n"); + } + else { + printf("\n"); + } + GET_DATA(Request.Pkt.WritePkt, &WritePkt, sizeof(WRITE_PKT)) + RecordSize = (WritePkt.Datasize); + DumpRecord((DWORD)WritePkt.Buffer, 0, 0, 0); + break; + + case ELF_COMMAND_CLEAR: + printf("\nClear packet\n"); + GET_DATA(Request.Pkt.ClearPkt, &ClearPkt, sizeof(CLEAR_PKT)) + FileName = GetUnicodeString(ClearPkt.BackupFileName); + printf("Backup filename = %ws\n", FileName); + LocalFree(FileName); + break; + + case ELF_COMMAND_BACKUP: + printf("\nBackup packet\n"); + GET_DATA(Request.Pkt.BackupPkt, &BackupPkt, sizeof(BACKUP_PKT)) + FileName = GetUnicodeString(BackupPkt.BackupFileName); + printf("Backup filename = %ws\n", FileName); + LocalFree(FileName); + break; + + case ELF_COMMAND_WRITE_QUEUED: + printf("\nQueued Write packet\n"); + if (Request.Flags == ELF_FORCE_OVERWRITE) { + printf("with ELF_FORCE_OVERWRITE enabled\n"); + } + else { + printf("\n"); + } + printf("NtStatus = 0x%X\n", Request.Status); + break; + + default: + printf("\nInvalid packet\n"); + } + + printf("\nLogFile for this packet:\n\n"); + itoa((DWORD) Request.LogFile, Address, 16); + logfile(hCurrentProcess, hCurrentThread, dwCurrentPc, lpExtensionApis, + Address); + + printf("\nLogModule for this packet:\n\n"); + itoa((DWORD)Request.Module, Address, 16); + logmodule(hCurrentProcess, hCurrentThread, dwCurrentPc, lpExtensionApis, + Address); + + return; +} + +// +// Online help +// + +VOID +help( + HANDLE hCurrentProcess, + HANDLE hCurrentThread, + DWORD dwCurrentPc, + PNTSD_EXTENSION_APIS lpExtensionApis, + LPSTR lpArgumentString + ) +{ + InitFunctionPointers(hCurrentProcess, lpExtensionApis); + + printf("\nEventlog NTSD Extensions\n"); + + if (!lpArgumentString || *lpArgumentString == '\0' || + *lpArgumentString == '\n' || *lpArgumentString == '\r') { + printf("\tlogmodule - dump a logmodule structure\n"); + printf("\tlogfile - dump a logfile structure\n"); + printf("\trequest - dump a request record\n"); + printf("\trecord - dump a eventlog record\n"); + printf("\n\tEnter help <cmd> for detailed help on a command\n"); + } + else { + if (!stricmp(lpArgumentString, "logmodule")) { + printf("\tlogmodule <arg>, where <arg> can be one of:\n"); + printf("\t\tno argument - dump all logmodule structures\n"); + printf("\t\taddress - dump the logmodule at specified address\n"); + printf("\t\t.string - dump the logmodule with name string\n"); + } + else if (!stricmp(lpArgumentString, "logfile")) { + printf("\tlogfile <arg>, where <arg> can be one of:\n"); + printf("\t\tno argument - dump all logfile structures\n"); + printf("\t\taddress - dump the logfile at specified address\n"); + printf("\t\t.string - dump the logfile with name string\n"); + } + else if (!stricmp(lpArgumentString, "record")) { + printf("\trecord <arg>, where <arg> can be one of:\n"); + printf("\t\tno argument - dump all records in system log\n"); + printf("\t\taddress - dump records starting at specified address\n"); + printf("\t\t.string - dump all records in the <string> log\n"); + printf("\t\t#<nnn> - dumps records starting at nnn in system log\n"); + printf("\t\t#<nnn> .string - dumps records starting at nnn in <string> log\n"); + } + else if (!stricmp(lpArgumentString, "request")) { + printf("\trequest - dump the request record at specified address\n"); + } + else { + printf("\tInvalid command [%s]\n", lpArgumentString); + } + } +} diff --git a/private/eventlog/ntsdexts/elfexts.def b/private/eventlog/ntsdexts/elfexts.def new file mode 100644 index 000000000..bfe2048d3 --- /dev/null +++ b/private/eventlog/ntsdexts/elfexts.def @@ -0,0 +1,10 @@ +LIBRARY NTSDEXTS + +DESCRIPTION 'Eventlog Default NTSD Extensions' + +EXPORTS + help + logmodule + logfile + request + record diff --git a/private/eventlog/ntsdexts/elfexts.rc b/private/eventlog/ntsdexts/elfexts.rc new file mode 100644 index 000000000..e351edd4b --- /dev/null +++ b/private/eventlog/ntsdexts/elfexts.rc @@ -0,0 +1,9 @@ +#include <windows.h> +#include <ntverp.h> + +#define VER_FILETYPE VFT_DLL +#define VER_FILESUBTYPE VFT2_UNKNOWN +#define VER_FILEDESCRIPTION_STR "Eventlog Symbolic Debugger Extensions" +#define VER_INTERNALNAME_STR "elfexts\0" + +#include "common.ver" diff --git a/private/eventlog/ntsdexts/makefile b/private/eventlog/ntsdexts/makefile new file mode 100644 index 000000000..6ee4f43fa --- /dev/null +++ b/private/eventlog/ntsdexts/makefile @@ -0,0 +1,6 @@ +# +# DO NOT EDIT THIS FILE!!! Edit .\sources. if you want to add a new source +# file to this component. This file merely indirects to the real make file +# that is shared by all the components of NT OS/2 +# +!INCLUDE $(NTMAKEENV)\makefile.def diff --git a/private/eventlog/ntsdexts/sources b/private/eventlog/ntsdexts/sources new file mode 100644 index 000000000..34f6a132d --- /dev/null +++ b/private/eventlog/ntsdexts/sources @@ -0,0 +1,40 @@ +!IF 0 + +Copyright (c) 1989 Microsoft Corporation + +Module Name: + + sources. + +Abstract: + + This file specifies the target component being built and the list of + sources files needed to build that component. Also specifies optional + compiler switches and libraries that are unique for the component being + built. + + +Author: + + Dan Hinsley (DanHi) 22-Mar-1993 + +NOTE: Commented description of this file is in \nt\bak\bin\sources.tpl + +!ENDIF + +MAJORCOMP=eventlog +MINORCOMP=ntsdexts + +TARGETNAME=elfexts +TARGETPATH=obj +TARGETTYPE=DYNLINK +TARGETLIBS=\ + $(BASEDIR)\public\sdk\lib\*\kernel32.lib \ + $(BASEDIR)\public\sdk\lib\*\libc.lib + +INCLUDES=..;..\server;..\..\inc; +SOURCES=elfexts.c \ + elfexts.rc + +UMTYPE=console +DLLBASE=0x66100000 diff --git a/private/eventlog/readme.txt b/private/eventlog/readme.txt new file mode 100644 index 000000000..34c9b1d22 --- /dev/null +++ b/private/eventlog/readme.txt @@ -0,0 +1,103 @@ +This is a description of the contents of each file in the eventlog +project. +Ignore the test and enumsvc directories. They contain test programs. + + +eventlog +-------- +dirs The directories to build. + +elf.acf The ACF file for RPC. + +elf.h Generated by MIDL using elf.idl. + +elf.idl The IDL descriptions of the APIs and the data structures. + +elfcommn.h Common defines/declarations used by the server and the client + sides. + +event.h Data structures that should be placed in a common location in the + nt source tree. + +imports.h +imports.idl Import files used by MIDL. + +makefil0 Makefile to make the RPC client and server side files. + + +elfclnt +------- + +apistub.c The stubs for the ELF APIs. + +elf_c.c Generated by MIDL. +elf_x.c + +elfapi.def The APIs that are exported in the DLL. + +elfclntp.h Private header file. + +rpcbind.c Bind routines that are called by the RPC run times. + +makefile +sources + + +server +------ + +config.c Routines that deal with the registry and configuration for the + service. Contains the main registry monitor thread. + +control.c Routines that deal with control calls from the service controller. + +elf_s.c Generated by MIDL. +elf_y.c + +elfapi.c The server side of the APIs. + +elfcfg.h Header file for configuration related data. + +elfdata.c Global data. + +elfdebug.c DEBUG routines. These should go away in the final version. + +elfdef.h Data structure definitions and #defines used in the service. + +elfextrn.h Extern declarations of the global data. + +elflpc.c Routines that deal with the LPC port and with fielding packets + from the device driver. + +elflpc.h Header file for elflpc.c. + +elfproto.h Procedure prototypes. + +elfrpc.c RPC-related routines to clean up the context handle. + +elfutil.c Various low-level utility routines. + +eventlog.c Main entry point for service. All the initialization code. + +eventp.h Private header file for server end. + +file.c Routines to manage the log files. + +memory.c Alloc/Free. + +operate.c All the low-level routines to perform the API requests. + +terminat.c Routines for terminating the service, and cleaning up. + +makefile +sources + + +winbase - these changes will go into \nt\private\windows\base\client +------- + +base.def Define the Win32 event logging APIs. + +eventapi.c Entry points for the APIs. + +sources diff --git a/private/eventlog/server/alert.c b/private/eventlog/server/alert.c new file mode 100644 index 000000000..3751b91b2 --- /dev/null +++ b/private/eventlog/server/alert.c @@ -0,0 +1,147 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + ALERT.C + +Abstract: + + This file contains the routine that sends the alert to the admin. + +Author: + + Rajen Shah (rajens) 28-Aug-1991 + + +Revision History: + + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <string.h> +#include <lmalert.h> // LAN Manager alert structures + + + +BOOL +SendAdminAlert ( + ULONG MessageID, + ULONG NumStrings, + UNICODE_STRING *pStrings + ) + + +/*++ + +Routine Description: + + This routine raises an ADMIN alert with the message specified. + + +Arguments: + + MessageID - Message ID. + NumStrings - Number of replacement strings. + pStrings - Array of UNICODE_STRING Replacement strings. + +Return Value: + + NONE + +Note: + + This routine dynamically links to netapi32.dll to avoid a build + dependency. + +--*/ +{ + + typedef DWORD (*ALERT_FNC_PTR)( + IN LPTSTR AlertEventName, + IN LPVOID VariableInfo, + IN DWORD VariableInfoSize, + IN LPTSTR ServiceName + ); + + + NET_API_STATUS NetStatus; + + BYTE AlertBuffer[ELF_ADMIN_ALERT_BUFFER_SIZE + sizeof(ADMIN_OTHER_INFO)]; + ADMIN_OTHER_INFO UNALIGNED *VariableInfo = (PADMIN_OTHER_INFO) AlertBuffer; + + DWORD DataSize; + DWORD i; + LPWSTR pReplaceString; + + HANDLE dllHandle; + ALERT_FNC_PTR AlertFunction; + + // + // Dynamically link to netapi.dll. If it's not there just return. Return + // TRUE so we won't try to send this alert again. + // + + dllHandle = LoadLibraryA("NetApi32.Dll"); + if ( dllHandle == INVALID_HANDLE_VALUE ) { + ElfDbgPrint(("[ELF] Failed to load DLL NetApi32.Dll: %ld\n", + GetLastError())); + return(TRUE); + } + + // + // Get the address of the service's main entry point. This + // entry point has a well-known name. + // + + AlertFunction = (ALERT_FNC_PTR)GetProcAddress( + dllHandle, + "NetAlertRaiseEx" + ); + if (AlertFunction == NULL ) { + ElfDbgPrint(("[ELF] Can't find entry NetAlertRaiseEx in NetApi32.Dll: %ld\n", + GetLastError())); + return(TRUE); + + } + + VariableInfo->alrtad_errcode = MessageID; + VariableInfo->alrtad_numstrings = NumStrings; + + pReplaceString = (LPWSTR)(AlertBuffer + sizeof(ADMIN_OTHER_INFO)); + + // + // Copy over the replacement strings + // + + for (i = 0; i < NumStrings; i++) { + RtlMoveMemory(pReplaceString, pStrings[i].Buffer, + pStrings[i].MaximumLength); + pReplaceString = (LPWSTR) ((PBYTE) pReplaceString + + pStrings[i].MaximumLength); + } + + DataSize = (PBYTE) pReplaceString - (PBYTE) AlertBuffer; + + NetStatus = (*AlertFunction)(ALERT_ADMIN_EVENT, AlertBuffer, DataSize, + wname_Eventlogsvc); + + if (NetStatus != NERR_Success) { + ElfDbgPrint(("[ELF] NetAlertRaiseEx failed with %d\n", NetStatus)); + ElfDbgPrint(("[ELF] Attempted to raise alert %d\n", MessageID)); + + // + // Probably just not started yet, try again later + // + + return(FALSE); + } + + return(TRUE); +} diff --git a/private/eventlog/server/cairo.c b/private/eventlog/server/cairo.c new file mode 100644 index 000000000..200049be1 --- /dev/null +++ b/private/eventlog/server/cairo.c @@ -0,0 +1,471 @@ +/*++ + +Copyright (c) 1995 Microsoft Corporation + +Module Name: + + CAIRO.C + +Abstract: + + This file contains Cairo alert extensions to the NT event log. + +Author: + + Mark Blanford (markbl) 02-Nov-1994 New routines: + + GetSourceAlertValuesFromRegistry + RaiseCairoAlert + TestSeverityFilter + + With this check-in, it is possible for an NT event written to the 'System' + log to be raised as a Cairo alert. Further, it is possible for any + 'System' log source to have the NT events it writes be raised as Cairo + alerts (subject to a filter) by simply supplying two key values: + 'AlertCategory' & 'SeverityFilter' with their source name key under the + ...\EventLog\System portion of the registry. + + The 'AlertCategory' key value specifies the alert category value used in + the alerts created from the source's NT events. + + The 'SeverityFilter' key value is a bit mask specifying the severity of + NT events to be converted to Cairo alerts. Note: alert severity values are + a superset of the NT event types information, warning & error. For + example: assume the "Srv" source has specified alert category and severity + key values, and the severity value, a bit mask, is set to warning | error. + The NT events "Srv" subsequently writes to the 'System' log of NT event + type warning or error will be distributed as Cairo alerts. "Srv" NT events + with NT event types other than warning or error will not be raised as + Cairo alerts. + + All Cairo alerts generated as a result of this conversion, are raised to + the local computer distributor. + +[Environment:] + + User Mode - Win32, except for NTSTATUS returned by some functions. + +Revision History: + + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <ole2.h> +#include <oleext.h> +#include <sysmgmt.h> +#include <alertapi.h> + +GUID CLSID_CNTEventReport = { + 0x43750e20, + 0xfa68, + 0x11cd, + { 0x84, 0xb7, 0x00, 0xaa, 0x00, 0x4a, 0x56, 0xe1 } +}; + +static WCHAR wszAlertCategory[] = L"AlertCategory"; +static WCHAR wszSeverityFilter[] = L"SeverityFilter"; + +BOOL IsValidSeverityFilter(SHORT sSeverity); + + +/*++ + +Routine Description: + + Fetch "...\EventLog\System\<SourceName>" 'AlertCategory' and + 'SeverityFilter' registry values, if they exist. + +Arguments: + + hKeyLogFile - Registry handle to '...\EventLog\<LogName>' where + <LogName> is likely to be 'System'. + pswszSourceName - Source name registered to report events to the log + indicated above. + psAlertCategory - Returned category value. + psSeverityFilter - Returned severity value. + +Return Value: + + BOOL - TRUE if the category,severity filter was successfully read; + FALSE otherwise. + +Note: + +--*/ + +BOOL +GetSourceAlertFilterFromRegistry( + HANDLE hKeyLogFile, + UNICODE_STRING * pswszSourceName, + SHORT * psAlertCategory, + SHORT * psSeverityFilter) +{ +#define KEY_VALUE_FULL_INFO_SIZE 1024 // BUGBUG : need proper size + + BOOL fRet = FALSE; + NTSTATUS Status; + OBJECT_ATTRIBUTES ObjectAttributes; + UNICODE_STRING SubKeyName; + HANDLE hKeySource; + BYTE Buffer[KEY_VALUE_FULL_INFO_SIZE]; + PKEY_VALUE_FULL_INFORMATION KeyValue = (PKEY_VALUE_FULL_INFORMATION)Buffer; + ULONG Index = 0; + ULONG ActualSize; + SHORT sAlertCategory, sSeverityFilter; + + ASSERT(pswszSourceName != NULL); + ASSERT(psAlertCategory != NULL); + ASSERT(psSeverityFilter != NULL); + + + InitializeObjectAttributes(&ObjectAttributes, + pswszSourceName, + OBJ_CASE_INSENSITIVE, + hKeyLogFile, + NULL); + + // + // Read category,severity filter values, if they exist, for this source. + // + + Status = NtOpenKey(&hKeySource, KEY_READ, &ObjectAttributes); + + if (NT_SUCCESS(Status)) + { + // + // Fetch alert category value, if it exists. + // + + RtlInitUnicodeString(&SubKeyName, wszAlertCategory); + + Status = NtQueryValueKey(hKeySource, + &SubKeyName, + KeyValueFullInformation, + KeyValue, + KEY_VALUE_FULL_INFO_SIZE, + &ActualSize); + + if (NT_SUCCESS(Status)) + { + sAlertCategory = *((PSHORT)(Buffer + KeyValue->DataOffset)); + + // + // Fetch severity filter value, if it exists. + // + + RtlInitUnicodeString(&SubKeyName, wszSeverityFilter); + + Status = NtQueryValueKey(hKeySource, + &SubKeyName, + KeyValueFullInformation, + KeyValue, + KEY_VALUE_FULL_INFO_SIZE, + &ActualSize); + + if (NT_SUCCESS(Status)) + { + sSeverityFilter = *((PSHORT)(Buffer + KeyValue->DataOffset)); + + // + // Is the severity valid? + // + + if (!IsValidSeverityFilter(sSeverityFilter)) + { + ElfDbgPrintNC(( + "[ELF] Invalid severity filter (%02x) for " \ + "source \"%ws\"\n", + sSeverityFilter, + pswszSourceName->Buffer)); + return(FALSE); + } + } + } + + if (NT_SUCCESS(Status)) + { + *psAlertCategory = sAlertCategory; + *psSeverityFilter = sSeverityFilter; + fRet = TRUE; + } + + Status = NtClose(hKeySource); + ASSERT(NT_SUCCESS(Status)); + } + else + { + ElfDbgPrintNC(( + "[ELF] Unable to open source key %ws to fetch alert " \ + "filter (%x)\n", + pswszSourceName->Buffer, + Status)); + } + + return(fRet); +} + + +/*++ + +Routine Description: + + Bit-wise compare the passed NT event type & alert severity. + +Arguments: + + NTEventType - NT event type. + sSeverityFilter - Alert severity. + +Return Value: + + BOOL - TRUE if NTEventType has a bit in common with sSeverityFilter; + FALSE otherwise. + +Note: + +--*/ + +BOOL +TestFilter(WORD NTEventType, SHORT sSeverityFilter) +{ + // + // Mask off all bits but the alert severities. + // + + if (((ALERTSEVERITY_FATAL_ERROR | + ALERTSEVERITY_SEVERE_ERROR | + ALERTSEVERITY_ERROR | + ALERTSEVERITY_WARNING | + ALERTSEVERITY_INFORMATION) & sSeverityFilter) & NTEventType) + { + return(TRUE); + } + + return(FALSE); +} + +/*++ + +Routine Description: + + Test the severity passed for validity. No bits other than the severity + mask must be set and the severity must be non-zero. + +Arguments: + + sSeverity - Tested severity. + +Return Value: + + BOOL - TRUE if the test succeeds; + FALSE otherwise. + +Note: + +--*/ + +BOOL +IsValidSeverityFilter(SHORT sSeverity) +{ + // + // Insure the only bits set are the severity mask. + // + + if (!(sSeverity & ~(ALERTSEVERITY_FATAL_ERROR | + ALERTSEVERITY_SEVERE_ERROR | + ALERTSEVERITY_ERROR | + ALERTSEVERITY_WARNING | + ALERTSEVERITY_INFORMATION))) + { + // + // Is a severity specified at all? + // + + return(sSeverity ? TRUE : FALSE); + } + + return(FALSE); +} + + +/*++ + +Routine Description: + + Convert & raise the NT event passed as a Cairo alert to the local + computer distributor. + +Arguments: + + pLogModule - Specific log module. This structure supplies the alert + category value & the log module name. + pEventLogRecord - The NT event to be converted & raised as an alert. + +Return Value: + + HRESULT - + +Note: + +--*/ + +HRESULT +RaiseCairoAlert(PLOGMODULE pLogModule, EVENTLOGRECORD * pEventLogRecord) +{ + HRESULT hr = S_OK; + BSTR bstrLogName = NULL; + WCHAR * pwszTmp; + int i; + ALERTREPORTRECORD alertreport; + VARIANT avar[2]; + DISPID aid[2]; + WCHAR ** apwszInserts = NULL; + HINSTANCE hInstance; + + + do + { + // + // ALERTSYS.DLL & the ReportAlert entry point is linked to by hand + // in the eventlog initialization code (eventlog.c). If this global + // handle is NULL, the link attempt failed. + // + + if (ghAlertSysDll == NULL) + { + // + // BUGBUG : Log an error? + // + + return(E_FAIL); + } + + // + // Initialize mandatory properties. + // + + INITIALIZE_ALERTREPORTRECORD(alertreport, + pLogModule->AlertCategory, // Alert category + pEventLogRecord->EventType, // Alert severity + -1, // No title message no. + pEventLogRecord->EventID, // Description message no. + NULL, // No component ID + (WCHAR *)((BYTE *)pEventLogRecord + // Source name + sizeof(EVENTLOGRECORD))); + + // + // Alert report class + // + + alertreport.ReportClassID = &CLSID_CNTEventReport; + + // + // Properties specific to NT event reports... + // + // Event category + // + + aid[0] = DISPID_NTEventReport_EventCategory; + VariantInit(&avar[0]); + avar[0].vt = VT_I2; + avar[0].iVal = pEventLogRecord->EventCategory; + + // + // Log module name + // + + bstrLogName = SysAllocString(pLogModule->LogFile-> + LogModuleName->Buffer); + + if (bstrLogName == NULL) + { + ElfDbgPrintNC(( + "[ELF RaiseCairoAlert] failed to allocate log name bstr\n")); + hr = E_OUTOFMEMORY; + break; + } + + aid[1] = DISPID_NTEventReport_LogFile; + VariantInit(&avar[1]); + avar[1].vt = VT_BSTR; + avar[1].bstrVal = bstrLogName; + + // + // Description inserts; optional. + // + + if (pEventLogRecord->NumStrings > 0) + { + apwszInserts = (WCHAR **)ElfpAllocateBuffer(sizeof(WCHAR *) * + pEventLogRecord->NumStrings); + + if (apwszInserts == NULL) + { + ElfDbgPrintNC(( + "[ELF RaiseCairoAlert] failed to allocate insert " \ + "string\n")); + hr = E_OUTOFMEMORY; + break; + } + + for (i = 0, pwszTmp = (WCHAR *)((BYTE *)pEventLogRecord + + pEventLogRecord->StringOffset); + (pwszTmp != NULL) && (i < pEventLogRecord->NumStrings); i++) + { + apwszInserts[i] = pwszTmp; + pwszTmp += wcslen(pwszTmp) + 1; + } + + alertreport.cDescrMessageInserts = i; + alertreport.DescrMessageInserts = apwszInserts; + } + + alertreport.cAdditionalArguments = 2; + alertreport.AdditionalArgumentNames = aid; + alertreport.AdditionalArguments = avar; + + // + // Alert data; optional, as well. + // + + if (pEventLogRecord->DataLength > 0) + { + alertreport.cBytesAlertData = pEventLogRecord->DataLength; + alertreport.AlertData = (BYTE *)pEventLogRecord + + pEventLogRecord->DataOffset; + } + + // + // Finally, raise the alert. + // + + hr = gpfReportAlert(&alertreport, RA_REPORT); + + if (FAILED(hr)) + { + ElfDbgPrintNC(( + "[ELF RaiseCairoAlert] ReportAlert failed HRESULT(%x)\n", + hr)); + break; + } + + } while (0); + + // Cleanup + + if (bstrLogName != NULL) + { + SysFreeString(bstrLogName); + } + if (apwszInserts != NULL) + { + ElfpFreeBuffer(apwszInserts); + } + + return(hr); +} diff --git a/private/eventlog/server/config.c b/private/eventlog/server/config.c new file mode 100644 index 000000000..ebf45b8b0 --- /dev/null +++ b/private/eventlog/server/config.c @@ -0,0 +1,1007 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + CONFIG.C + +Abstract: + + This file contains the routines that walk the configuration registry. + +Author: + + Rajen Shah (rajens) 1-Jul-1991 + + +Revision History: + + 29-Aug-1994 Danl + We no longer grow log files in place. Therefore, the MaxSize value + in the registery ends up being advisory only. We don't try to reserve + that much memory at init time. So it could happen that when we need + a larger file size that we may not have enough memory to allocate + MaxSize bytes. + 28-Mar-1994 Danl + ReadRegistryInfo: LogFileInfo->LogFileName wasn't getting updated + when using the default (generated) LogFileName. + 16-Mar-1994 Danl + Fixed Memory Leaks in ReadRegistryInfo(). Call to + RtlDosPathNameToNtPathName allocates memory that wasn't being free'd. + 03-Mar-1995 MarkBl + Added GuestAccessRestriction flag initialization in ReadRegistryInfo. + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <elfcfg.h> +#include <stdlib.h> +#include <malloc.h> +#include <memory.h> + +// +// STRUCTURES +// + +// +// This structure contains all the information used to setup and +// for listening to registry changes in the eventlog tree. +// +typedef struct _REG_MONITOR_INFO { + HANDLE NotifyEventHandle; + DWORD Timeout; + HANDLE WorkItemHandle; +} REG_MONITOR_INFO, *LPREG_MONITOR_INFO; + +// +// GLOBALS +// + REG_MONITOR_INFO GlRegMonitorInfo; + +// +// LOCAL FUNCTIONS +// +DWORD +ElfRegistryMonitor ( + LPVOID pParms, + DWORD dwWaitStatus + ); + +BOOL +ElfSetupMonitor( + LPREG_MONITOR_INFO pMonitorInfo + ); + + + + +VOID +ProcessChange ( + HANDLE hLogFile, + PUNICODE_STRING ModuleName, + PUNICODE_STRING LogFileName, + ULONG MaxSize, + ULONG Retention, + ULONG GuestAccessRestriction + ) + +/*++ + +Routine Description: + + This routine is called by ProcessRegistryChanges for each module. + +Arguments: + + + +Return Value: + + None + +Note: + + +--*/ +{ + + NTSTATUS Status = STATUS_SUCCESS; + PLOGMODULE pModule; + PLOGFILE pLogFile; + ULONG Size; + PVOID BaseAddress; + PUNICODE_STRING pFileNameString; + LPWSTR FileName; + PVOID FreeAddress; + + + pModule = GetModuleStruc (ModuleName); + + // + // If this module didn't exist, this was a brand new log file and + // we need to create all the structures + // + + if (pModule == ElfDefaultLogModule && + wcscmp(ModuleName->Buffer, ELF_DEFAULT_MODULE_NAME)) { + Status = SetUpDataStruct(LogFileName, MaxSize, Retention, + GuestAccessRestriction, ModuleName, hLogFile, ElfNormalLog); + return; + } + + // + // Update values + // + + pLogFile = pModule->LogFile; + pLogFile->Retention = Retention; + + // + // Check to see if the name has changed. If it has, and the log + // hasn't been used yet, then use the new name. Be sure to free + // memory that was used for the old name. + // + + if ((wcscmp(pLogFile->LogFileName->Buffer, LogFileName->Buffer) != 0) && + (pLogFile->BeginRecord == pLogFile->EndRecord)) { + + pFileNameString = ElfpAllocateBuffer( + sizeof(UNICODE_STRING) + + LogFileName->MaximumLength); + + if (pFileNameString != NULL) { + FileName = (LPWSTR)(pFileNameString+1); + wcscpy(FileName, LogFileName->Buffer); + RtlInitUnicodeString(pFileNameString, FileName); + + ElfpFreeBuffer(pLogFile->LogFileName); + pLogFile->LogFileName = pFileNameString; + } + } + + // + // The log file can only be grown dynamically. To shrink it, + // it has to be cleared. + // + + + if (pLogFile->ConfigMaxFileSize < ELFFILESIZE(MaxSize)) { + + /* + Description of recent changes. Problem and Solution: + A couple of problems exist. (1) There is no error + checking if memory can't be allocated or mapped, and + therefore, no error paths exist for handling these + situations. (2) Now that the eventlog is in services.exe + there isn't a good way to synchronize memory allocations. + + Solution: + I considered having some utility routines for managing + memory in the eventlog. These would attempt to + extend a reserved block, or get a new reserved block. + However, there are so many places where that could fail, + it seemed very cumbersome to support the reserved blocks. + So the current design only deals with mapped views. + The ConfigMaxFileSize is only used to limit the size of + the mapped view, and doesn't reserve anything. This + means you are not guaranteed to be operating with a file as + large as the MaxSize specified in the registry. But then, + you weren't guarenteed that it would even work with the + original design. + */ + + pLogFile->ConfigMaxFileSize = ELFFILESIZE(MaxSize); + pLogFile->NextClearMaxFileSize = ELFFILESIZE(MaxSize); + + } + else if (pLogFile->ConfigMaxFileSize > ELFFILESIZE(MaxSize)) { + + // + // They're shrinking the size of the log file. + // Next time we clear the log file, we'll use the new size + // and new retention. + // + + pLogFile->NextClearMaxFileSize = ELFFILESIZE(MaxSize); + + } + + // + // Now see if they've added any new modules for this log file + // + + SetUpModules(hLogFile, pLogFile, TRUE); + + return; +} + + + +VOID +ProcessRegistryChanges ( + VOID + ) + +/*++ + +Routine Description: + + This routine processes that changes that have occurred in the + eventlog node. It does this by rescanning the whole Eventlog node + and then comparing with what it has as the current configuration. + +Arguments: + + NONE. + +Return Value: + + NONE + +--*/ +{ + + NTSTATUS Status = STATUS_SUCCESS; + HANDLE hLogFile; + UNICODE_STRING SubKeyName; + ULONG Index = 0; + BYTE Buffer[ELF_MAX_REG_KEY_INFO_SIZE]; + PKEY_NODE_INFORMATION KeyBuffer = (PKEY_NODE_INFORMATION) Buffer; + ULONG ActualSize; + LOG_FILE_INFO LogFileInfo; + PWCHAR SubKeyString; + OBJECT_ATTRIBUTES ObjectAttributes; + + ElfDbgPrint(("[ELF] ProcessRegistryChanges\n")); + + // + // Take the global resource so that nobody is making changes or + // using the existing configured information. + // + + GetGlobalResource (ELF_GLOBAL_SHARED); + + // + // See if the Debug flag changed + // + + RtlInitUnicodeString(&SubKeyName, VALUE_DEBUG); + + NtQueryValueKey(hEventLogNode, &SubKeyName, + KeyValueFullInformation, KeyBuffer, + ELF_MAX_REG_KEY_INFO_SIZE, & ElfDebug); + + + // + // Loop thru the subkeys under Eventlog and set up each logfile + // + + while (NT_SUCCESS(Status)) { + + Status = NtEnumerateKey(hEventLogNode, Index++, KeyNodeInformation, + KeyBuffer, ELF_MAX_REG_KEY_INFO_SIZE, & ActualSize); + + if (NT_SUCCESS(Status)) { + + // + // It turns out the Name isn't null terminated, so we need + // to copy it somewhere and null terminate it before we use it + // + + SubKeyString = ElfpAllocateBuffer(KeyBuffer->NameLength + + sizeof (WCHAR)); + if (!SubKeyString) { + + // + // No one to notify, just give up till next time. + // + + ReleaseGlobalResource(); + return; + } + + memcpy(SubKeyString, KeyBuffer->Name, KeyBuffer->NameLength); + SubKeyString[KeyBuffer->NameLength / sizeof(WCHAR)] = L'\0' ; + + // + // Open the node for this logfile and extract the information + // required by SetupDataStruct, and then call it. + // + + RtlInitUnicodeString(&SubKeyName, SubKeyString); + + InitializeObjectAttributes(&ObjectAttributes, + &SubKeyName, + OBJ_CASE_INSENSITIVE, + hEventLogNode, + NULL + ); + + Status = NtOpenKey(&hLogFile, KEY_READ | KEY_SET_VALUE, + &ObjectAttributes); + + // + // Should always succeed since I just enum'ed it, but if it + // doesn't, just skip it + // + + if (!NT_SUCCESS(Status)) { + + ElfpFreeBuffer(SubKeyString); + Status = STATUS_SUCCESS; // to keep the enum going + continue; + + } + + Status = ReadRegistryInfo(hLogFile, &SubKeyName, & LogFileInfo); + + if (NT_SUCCESS(Status)) { + // + // Now process any changes. Any errors are dealt with + // in ProcessChange + // + + ProcessChange ( + hLogFile, + &SubKeyName, + LogFileInfo.LogFileName, + LogFileInfo.MaxFileSize, + LogFileInfo.Retention, + LogFileInfo.GuestAccessRestriction + ); + + // + // Free the buffer that was allocated in ReadRegistryInfo. + // + ElfpFreeBuffer(LogFileInfo.LogFileName); + } + + ElfpFreeBuffer(SubKeyString); + NtClose(hLogFile); + } + } + + // + // Release the global resource. + // + + ReleaseGlobalResource(); + + +} // ProcessRegistryChanges + + + + +DWORD +ElfRegistryMonitor ( + LPVOID pParms, + DWORD dwWaitStatus + ) + +/*++ + +Routine Description: + + This is the entry point for the thread that will monitor changes in + the registry. If anything changes, it will have to scan the change + and then make the appropriate changes to the data structures in the + service to reflect the new information. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + + +--*/ +{ + LPREG_MONITOR_INFO pMonitorInfo=(LPREG_MONITOR_INFO)pParms; + + ElfDbgPrint(("[ELF] Inside registry monitor thread\n")); + + + if (GetElState() == STOPPING) { + // + // If the eventlog is shutting down, then we need + // to terminate this thread. + // + ElfDbgPrint(("[ELF] ElfRegistryMonitor - Shutdown\n")); + + // + // Close the registry handle and registry event handle. + // + NtClose( hEventLogNode); + CloseHandle(pMonitorInfo->NotifyEventHandle); + + //=============================================================== + // When we return from this call, the service controller will + // decrement our reference count to 0 and unload the DLL. + // So we can't exit until all the rest of the eventlog has shutdown. + // This thread will perform the final cleanup for the eventlog. + // + ElfpCleanUp(EventFlags); + + // + // We should actually return here so that the DLL gets unloaded. + // However, RPC has a problem in that it might still call our + // context rundown routine even though we unregistered our interface. + // So we exit thread instead. This keeps our Dll loaded. + // + ExitThread(0); + } + if (dwWaitStatus == STATUS_TIMEOUT) { + + ElfDbgPrint(("[ELF] Timer popped, running queued list\n")); + + // + // Timer popped, try running the list + // + + if (!IsListEmpty(&QueuedEventListHead)) { + + // + // There are things queued up to write, do it + // + + WriteQueuedEvents(); + + } + + // + // Don't wait again + // + + pMonitorInfo->Timeout = INFINITE; + + } + else if (dwWaitStatus == WAIT_OBJECT_0) { + ElfDbgPrint(("[ELF] ElfRegistryMonitor - Notification\n")); + ProcessRegistryChanges (); + } + else { + ElfDbgPrint(("[ELF] WorkItemCallback returned %d\n", + dwWaitStatus)); + } + + if (!ElfSetupMonitor(pMonitorInfo)) { + ElfDbgPrint(("[ELF] ElfSetupMonitor Failed! Can't listen for Reg Changes\n")); + } + + ElfDbgPrint(("[ELF] ElfRegistryMonitor - returning\n")); + + return(0); + +} // ElfRegistryMonitor + + + +DWORD +InitNotify( + PVOID pData, + DWORD dwWaitStatus + ) + +/*++ + +Routine Description: + + +Arguments: + + +Return Value: + + +--*/ +{ + NTSTATUS NtStatus = STATUS_SUCCESS; + DWORD status = NO_ERROR; + DWORD Buffer; + PVOID pBuffer = & Buffer; + LPREG_MONITOR_INFO pMonitorInfo; + + static IO_STATUS_BLOCK IoStatusBlock; + + UNREFERENCED_PARAMETER(dwWaitStatus); + + ElfDbgPrint(("[ELF]In InitNotify Routine\n")); + + pMonitorInfo = (LPREG_MONITOR_INFO)pData; + + NtStatus = NtNotifyChangeKey ( + hEventLogNode, + pMonitorInfo->NotifyEventHandle, + NULL, + NULL, + &IoStatusBlock, + REG_NOTIFY_CHANGE_LAST_SET | + REG_NOTIFY_CHANGE_NAME, + TRUE, + pBuffer, + 1, + TRUE // return and wait on event + ); + + if (!NT_SUCCESS(NtStatus)) { + status = RtlNtStatusToDosError(NtStatus); + } + ElfDbgPrint(("[ELF]NtNotifyChangeKey Status = 0x%lx\n",NtStatus)); + return(status); + +} // InitNotify + + +BOOL +ElfSetupMonitor( + LPREG_MONITOR_INFO pMonitorInfo + ) + +/*++ + +Routine Description: + + This function submits a request for a registry NotifyChangeKey + and then submits a work item to the service controller thread + management system to wait for the Notification handle to become + signaled. + +Arguments: + + pMonitorInfo - This is a pointer to a MONITOR_INFO structure. This + function fills in the WorkItemHandle member of that structure + if successfully adds a new work item. + +Return Value: + + TRUE - if successful in setting up. + FALSE - if unsuccessful. A work item hasn't been submitted, and + we won't be listening for registry changes. + +--*/ +{ + NTSTATUS Status = STATUS_SUCCESS; + + // + // Call NtNotifyChange Key indirectly via the service controller + // Watcher thread. This way the thread that created the I/O + // request will always be around. + // + pMonitorInfo->WorkItemHandle = ElfGlobalData->SvcsAddWorkItem( + NULL, + InitNotify, + (PVOID)pMonitorInfo, + SVC_IMMEDIATE_CALLBACK, + INFINITE, + NULL); + + if (pMonitorInfo->WorkItemHandle == NULL) { + ElfDbgPrint(("[ELF]Couldn't Initialize Registry Notify %d\n",GetLastError())); + return(FALSE); + } + // + // Add the work item that is to be called when the + // NotifyEventHandle is signalled. + // + pMonitorInfo->WorkItemHandle = ElfGlobalData->SvcsAddWorkItem( + pMonitorInfo->NotifyEventHandle, + ElfRegistryMonitor, + (PVOID)pMonitorInfo, + SVC_QUEUE_WORK_ITEM, + pMonitorInfo->Timeout, + ElfGlobalSvcRefHandle); + + if (pMonitorInfo->WorkItemHandle == NULL) { + ElfDbgPrint(("[ELF]Couldn't add Reg Monitor work item\n")); + return(FALSE); + } + return(TRUE); + +} // ElfSetupMonitor + + +BOOL +ElfStartRegistryMonitor() + +/*++ + +Routine Description: + + This routine starts up the thread that monitors changes in the registry. + + This function calls ElfSetupMonitor() to register for the change + notification and to submit a work item to wait for the registry + change event to get signaled. When signalled, the ElfRegistryMonitor() + callback function is called by a thread from the services thread pool. + This callback function services the notification. + +Arguments: + + NONE + +Return Value: + + TRUE if thread creation succeeded, FALSE otherwise. + +Note: + + +--*/ +{ + NTSTATUS Status; + HANDLE hNotifyEvent=NULL; + + ElfDbgPrint(("[ELF] Starting registry monitor\n")); + + if (hEventLogNode == NULL) { + ElfDbgPrint(("[ELF]No EventLog node in registry - Exit Monitor")); + return(FALSE); + } + + // + // Create an event to wait on + // + + Status = NtCreateEvent (&hNotifyEvent, EVENT_ALL_ACCESS, + NULL, NotificationEvent, FALSE); + + if (!NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF]Couldn't create event for registry monitor")); + return(FALSE); + } + + // + // Fill in the Monitor info structure with the event handle + // and a 5 minute timeout. + // + + GlRegMonitorInfo.NotifyEventHandle = hNotifyEvent; + GlRegMonitorInfo.Timeout = 5 * 60 * 1000; + GlRegMonitorInfo.WorkItemHandle = NULL; + + // + // Setup for the change notify and + // submit the work item to the service controller. + // + + if (!ElfSetupMonitor(&GlRegMonitorInfo)) { + return(FALSE); + } + return(TRUE); + +} // ElfStartRegistryMonitor + + +VOID +StopRegistryMonitor () + +/*++ + +Routine Description: + + This routine wakes up the work item that has been submitted for the + purpose of monitoring registry eventlog changes. The thread created + to service that work item will actually do the clean-up of the monitor + thread. + + +Arguments: + + NONE + +Return Value: + + NONE + +--*/ + +{ + ElfDbgPrint (("[ELF] Stopping registry monitor\n")); + + // + // Wake up the RegistryMonitorThread. + // + if (GlRegMonitorInfo.NotifyEventHandle != NULL ) { + SetEvent(GlRegMonitorInfo.NotifyEventHandle); + } + + return; + +} // StopRegistryMonitor + + +NTSTATUS +ReadRegistryInfo ( + HANDLE hLogFile, + PUNICODE_STRING SubKeyName, + PLOG_FILE_INFO LogFileInfo + ) + +/*++ + +Routine Description: + + This routine reads in the information from the node pointed to by + hLogFile and stores it in the a structure so that the + necessary data structures can be set up for the service. + + ALLOCATIONS: If successful, this function allocates memory for + LogFileInfo->LogFileName. It is the responsiblilty of the caller + to free this memory. + +Arguments: + + hLogFile - A handle to the Eventlog\<somelogfile> node in the registry + KeyName - The subkey for this logfile to open + LogFileInfo - The structure to fill in with the data + +Return Value: + + NTSTATUS + +--*/ +{ + +#define EXPAND_BUFFER_SIZE 64 + + NTSTATUS Status; + BOOLEAN RegistryCorrupt = FALSE; + BYTE Buffer[ELF_MAX_REG_KEY_INFO_SIZE]; + ULONG ActualSize; + UNICODE_STRING ValueName; + UNICODE_STRING UnexpandedName; + UNICODE_STRING ExpandedName; + ULONG NumberOfBytes = 0; + BYTE ExpandNameBuffer[EXPAND_BUFFER_SIZE]; + PUNICODE_STRING FileNameString; + LPWSTR FileName; + BOOL ExpandedBufferWasAllocated=FALSE; + PKEY_VALUE_FULL_INFORMATION ValueBuffer = + (PKEY_VALUE_FULL_INFORMATION) Buffer; + + ASSERT(hLogFile); + + // MaxSize + + RtlInitUnicodeString(&ValueName, VALUE_MAXSIZE); + + Status = NtQueryValueKey(hLogFile, &ValueName, + KeyValueFullInformation, ValueBuffer, + ELF_MAX_REG_KEY_INFO_SIZE, & ActualSize); + if (!NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] - Logfile %ws Maxsize doesn't exist\n", + SubKeyName->Buffer)); + LogFileInfo->MaxFileSize = ELF_DEFAULT_MAX_FILE_SIZE; + RegistryCorrupt = TRUE; + } + else { + LogFileInfo->MaxFileSize = *((PULONG)(Buffer + + ValueBuffer->DataOffset)); + } + + + // Retention period + + RtlInitUnicodeString(&ValueName, VALUE_RETENTION); + + Status = NtQueryValueKey(hLogFile, &ValueName, + KeyValueFullInformation, ValueBuffer, + ELF_MAX_REG_KEY_INFO_SIZE, & ActualSize); + if (!NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] - Logfile %ws Retention doesn't exist\n", + SubKeyName->Buffer)); + LogFileInfo->Retention = ELF_DEFAULT_RETENTION_PERIOD; + RegistryCorrupt = TRUE; + } + else { + LogFileInfo->Retention = *((PULONG)(Buffer + + ValueBuffer->DataOffset)); + } + + + // RestrictGuestAccess + + RtlInitUnicodeString(&ValueName, VALUE_RESTRICT_GUEST_ACCESS); + + Status = NtQueryValueKey(hLogFile, &ValueName, + KeyValueFullInformation, ValueBuffer, + ELF_MAX_REG_KEY_INFO_SIZE, & ActualSize); + if (!NT_SUCCESS(Status)) { + LogFileInfo->GuestAccessRestriction = ELF_GUEST_ACCESS_UNRESTRICTED; + } + else { + if (*((PULONG)(Buffer + ValueBuffer->DataOffset)) == 1) { + LogFileInfo->GuestAccessRestriction = ELF_GUEST_ACCESS_RESTRICTED; + } + else { + LogFileInfo->GuestAccessRestriction = + ELF_GUEST_ACCESS_UNRESTRICTED; + } + } + + + // Filename + + RtlInitUnicodeString(&ValueName, VALUE_FILENAME); + + Status = NtQueryValueKey(hLogFile, &ValueName, + KeyValueFullInformation, ValueBuffer, + ELF_MAX_REG_KEY_INFO_SIZE, & ActualSize); + + if (!NT_SUCCESS(Status)) { + + // + // Allocate the buffer for the UNICODE_STRING for the filename and + // initialize it. (41 = \Systemroot\system32\config\xxxxxxxx.evt) + // + + FileNameString = ElfpAllocateBuffer(41 * sizeof(WCHAR) + + sizeof(UNICODE_STRING)); + if (!FileNameString) { + return(STATUS_NO_MEMORY); + } + + LogFileInfo->LogFileName = FileNameString; + FileName = (LPWSTR)(FileNameString + 1); + wcscpy(FileName, L"\\Systemroot\\System32\\Config\\"); + wcsncat(FileName, SubKeyName->Buffer, 8); + wcscat(FileName, L".evt"); + RtlInitUnicodeString(FileNameString, FileName); + + RegistryCorrupt = TRUE; + + } + else { + + // + // If it's a REG_EXPAND_SZ expand it + // + + if (ValueBuffer->Type == REG_EXPAND_SZ) { + + // + // Initialize the UNICODE_STRING, when the string isn't null + // terminated + // + + UnexpandedName.MaximumLength = UnexpandedName.Length = + (USHORT) ValueBuffer->DataLength; + UnexpandedName.Buffer = (PWSTR) ((PBYTE) ValueBuffer + + ValueBuffer->DataOffset); + + // + // Call the magic expand-o api + // + + ExpandedName.Length = ExpandedName.MaximumLength = + EXPAND_BUFFER_SIZE; + ExpandedName.Buffer = (LPWSTR) ExpandNameBuffer; + Status = RtlExpandEnvironmentStrings_U(NULL, &UnexpandedName, + &ExpandedName, &NumberOfBytes); + + if (NumberOfBytes > EXPAND_BUFFER_SIZE) { + + // + // The default buffer wasn't big enough. Allocate a + // bigger one and try again + // + + ExpandedName.Length = ExpandedName.MaximumLength = + (USHORT) NumberOfBytes; + ExpandedName.Buffer = ElfpAllocateBuffer(ExpandedName.Length); + if (!ExpandedName.Buffer) { + return(STATUS_NO_MEMORY); + } + ExpandedBufferWasAllocated = TRUE; + + Status = RtlExpandEnvironmentStrings_U(NULL, &UnexpandedName, + &ExpandedName, &NumberOfBytes); + } + + if (!NT_SUCCESS(Status)) { + if (ExpandedBufferWasAllocated) { + ElfpFreeBuffer(ExpandedName.Buffer); + } + return(Status); + } + } + else { + + // + // It doesn't need to be expanded, just set up the UNICODE_STRING + // for the conversion to an NT pathname + // + + ExpandedName.MaximumLength = ExpandedName.Length = + (USHORT) ValueBuffer->DataLength; + ExpandedName.Buffer = (PWSTR) ((PBYTE) ValueBuffer + + ValueBuffer->DataOffset); + } + + // + // Now convert from a DOS pathname to an NT pathname + // + // Need to allocate this since it needs to stay around + // + + // + // Translate to NtPathName. + // NOTE: this allocates a buffer for ValueName.Buffer. + // + if (!RtlDosPathNameToNtPathName_U(ExpandedName.Buffer, + &ValueName, NULL, NULL)) { + + if (ExpandedBufferWasAllocated) { + ElfpFreeBuffer(ExpandedName.Buffer); + } + return(STATUS_UNSUCCESSFUL); + } + + // + // Allocate memory for the unicode string structure and the buffer + // so that it can be free'd with a single call. + // + FileNameString = ElfpAllocateBuffer( + sizeof(UNICODE_STRING) + + ((ValueName.Length + 1) * sizeof(WCHAR))); + + if (!FileNameString) { + if (ExpandedBufferWasAllocated) { + ElfpFreeBuffer(ExpandedName.Buffer); + } + RtlFreeHeap(RtlProcessHeap(),0,ValueName.Buffer); + return(STATUS_NO_MEMORY); + } + + // + // Copy the NtPathName string into the new buffer, and initialize + // the unicode string. + // + FileName = (LPWSTR)(FileNameString + 1); + wcsncpy(FileName, ValueName.Buffer, ValueName.Length); + *(FileName+ValueName.Length) = L'\0'; + RtlInitUnicodeString(FileNameString, FileName); + + // + // Free memory allocated by RtlDosPathNAmeToNtPathName. + // + RtlFreeHeap(RtlProcessHeap(),0,ValueName.Buffer); + + // + // Clean up if I had to allocate a bigger buffer than the default + // + + if (ExpandedBufferWasAllocated) { + ElfpFreeBuffer(ExpandedName.Buffer); + } + + } + + // + // Add the LogFileName to the LogFileInfo structure. + // + LogFileInfo->LogFileName = FileNameString; + + // + // If we didn't find all the required values, tell someone + // + + if (RegistryCorrupt) { + ElfDbgPrintNC(("[ELF] Registry information for %ws invalid\n", + SubKeyName->Buffer)); + } + + return(STATUS_SUCCESS); + +} + diff --git a/private/eventlog/server/control.c b/private/eventlog/server/control.c new file mode 100644 index 000000000..6f937f510 --- /dev/null +++ b/private/eventlog/server/control.c @@ -0,0 +1,699 @@ + +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + CONTROL.C + +Abstract: + + This file contains the control handler for the eventlog service. + +Author: + + Rajen Shah (rajens) 16-Jul-1991 + +Revision History: + + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> + + +// +// GLOBALS +// + + CRITICAL_SECTION StatusCriticalSection={0}; + SERVICE_STATUS ElStatus={0}; + DWORD HintCount=0; + DWORD ElUninstallCode=0; // reason for uninstalling + DWORD ElSpecificCode=0; + DWORD ElState=STARTING; + + +VOID +ElfPrepareForPause() + +/*++ + +Routine Description: + + This routine prepares the eventlog service for pausing. Since the + caller took the global resource for exclusive access, we know that + there is no activity on any of the files. + + We just have to note somewhere that the service is paused + so that any threads that start running will know that and will not + perform any further operations until the service is CONTINUEd. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + + +--*/ +{ + NTSTATUS Status; + + ElfDbgPrint(("[ELF] Control: Prepare for service pause\n")); + + // + // Flush all files to disk. + // + Status = ElfpFlushFiles (); + + return; +} + + + +VOID +ElfPrepareForContinue() + +/*++ + +Routine Description: + + This routine restarts the eventlog service after a pause operation. + It will signal the relevant event(s) for all the threads to start + running. + + The caller ensures that it has exclusive access to the global resource + so that there is no thread inside the service that is doing operations + on the log file(s) or the data structures while the control request + is being handled. + +Arguments: + + +Return Value: + + NONE + +Note: + + +--*/ +{ + ElfDbgPrint(("[ELF] Control: Prepare for service continue\n")); + + // + // Signal the "continue" event. + // + + + return; +} + + + +VOID +ElfControlResponse( + DWORD opCode + ) + +{ + DWORD state; + + ElfDbgPrint(("[ELF] Inside control handler. Control = %ld\n", opCode)); + + // + // Determine the type of service control message and modify the + // service status, if necessary. + // + switch(opCode) { + + case SERVICE_CONTROL_SHUTDOWN: + case SERVICE_CONTROL_STOP: + + + // + // If the service is installed, shut it down and exit. + // + + ElfStatusUpdate(STOPPING); + + GetGlobalResource (ELF_GLOBAL_EXCLUSIVE); + + // + // Log an event that says we're stopping + // + +#if DBG + ElfpCreateElfEvent(EVENT_EventlogStopped, + EVENTLOG_INFORMATION_TYPE, + 0, // EventCategory + 0, // NumberOfStrings + NULL, // Strings + NULL, // Data + 0, // Datalength + 0 // flags + ); + + // + // Now force it to be written before we shut down + // + + WriteQueuedEvents(); +#endif + ReleaseGlobalResource(); + // + // If the RegistryMonitor is started, wakeup that + // worker thread and have it handle the rest of the + // shutdown. + // + // Otherwise The main thread should pick up the + // fact that a shutdown during startup is occuring. + // + if (EventFlags & ELF_STARTED_REGISTRY_MONITOR) { + StopRegistryMonitor(); + } + + break ; + + case SERVICE_CONTROL_PAUSE: + + // + // If the service is not already paused, pause it. + // + state = GetElState(); + if ((state != PAUSED) && (state != PAUSING)) { + + GetGlobalResource (ELF_GLOBAL_EXCLUSIVE); + + // NOTE: If there was any service-related pause cleanup, we'd + // set the status to PAUSE_PENDING, announce it, and + // then do the cleanup. + // + + // Announce that the service is about to be paused + ElfStatusUpdate(PAUSING); + + // Get into a decent state to pause the service. + + ElfPrepareForPause(); + + + // Set the status and announce that the service is paused + ElfStatusUpdate(PAUSED); + + ReleaseGlobalResource(); + } + + break ; + + case SERVICE_CONTROL_CONTINUE: + + // + // If the service is not already running, un-pause it. + // + + state = GetElState(); + if ((state != RUNNING) && (state != CONTINUING)) { + + GetGlobalResource (ELF_GLOBAL_EXCLUSIVE); + + // NOTE: If there was any service-related continue cleanup, we'd + // set the status to CONTINUE_PENDING, announce it, and + // then do the cleanup. + // + + // Announce that the service is about to be continued + + ElfStatusUpdate(CONTINUING); + + // Start up the service. + + ElfPrepareForContinue(); + + + // Set the status and announce that the service is no longer + // paused + // + ElfStatusUpdate(RUNNING); + + ReleaseGlobalResource(); + } + + break ; + + case SERVICE_CONTROL_INTERROGATE: + + // Do nothing; the status gets announced below + + default: + // WARNING: This should never happen. + ElfStatusUpdate(UPDATE_ONLY); + break ; + } + + return ; + +} + +DWORD +ElfBeginForcedShutdown( + IN BOOL PendingCode, + IN DWORD ExitCode, + IN DWORD ServiceSpecificCode + ) + +/*++ + +Routine Description: + + +Arguments: + + +Return Value: + + +--*/ +{ + DWORD status; + + EnterCriticalSection(&StatusCriticalSection); + + ElfDbgPrint(("BeginForcedShutdown: Errors - %d 0x%lx\n", + ExitCode, ServiceSpecificCode)); + // + // See if the eventlog is already stopping for some reason. + // It could be that the ControlHandler thread received a control to + // stop the eventlog just as we decided to stop ourselves. + // + if ((ElState != STOPPING) || (ElState != STOPPED)) { + if (PendingCode == PENDING) { + ElStatus.dwCurrentState = SERVICE_STOP_PENDING; + ElState = STOPPING; + } + else { + // + // The shutdown is to take immediate effect. + // + ElStatus.dwCurrentState = SERVICE_STOPPED; + ElStatus.dwControlsAccepted = 0; + ElStatus.dwCheckPoint = 0; + ElStatus.dwWaitHint = 0; + ElState = STOPPED; + } + + ElUninstallCode = ExitCode; + ElSpecificCode = ServiceSpecificCode; + + ElStatus.dwWin32ExitCode = ExitCode; + ElStatus.dwServiceSpecificExitCode = ServiceSpecificCode; + } + + // + // Send the new status to the service controller. + // + if (ElfServiceStatusHandle == (SERVICE_STATUS_HANDLE) NULL) { + ElfDbgPrint(("ElfBeginForcedShutdown, no handle to call SetServiceStatus\n")); + + } + else if (! SetServiceStatus( ElfServiceStatusHandle, &ElStatus )) { + + status = GetLastError(); + + if (status != NERR_Success) { + ElfDbgPrint(("ElfBeginForcedShutdown,SetServiceStatus Failed %X\n", + status)); + } + } + + status = ElState; + LeaveCriticalSection(&StatusCriticalSection); + return(status); +} + + +DWORD +ElfStatusUpdate( + IN DWORD NewState + ) + +/*++ + +Routine Description: + + Sends a status to the Service Controller via SetServiceStatus. + + The contents of the status message is controlled by this routine. + The caller simply passes in the desired state, and this routine does + the rest. For instance, if the Eventlog passes in a STARTING state, + This routine will update the hint count that it maintains, and send + the appropriate information in the SetServiceStatus call. + + This routine uses transitions in state to send determine which status + to send. For instance if the status was STARTING, and has changed + to RUNNING, this routine sends out an INSTALLED to the Service + Controller. + +Arguments: + + NewState - Can be any of the state flags: + UPDATE_ONLY - Simply send out the current status + STARTING - The Eventlog is in the process of initializing + RUNNING - The Eventlog has finished with initialization + STOPPING - The Eventlog is in the process of shutting down + STOPPED - The Eventlog has completed the shutdown. + PAUSING - + CONTINUING - + PAUSED - + + +Return Value: + + CurrentState - This may not be the same as the NewState that was + passed in. It could be that the main thread is sending in a new + install state just after the Control Handler set the state to + STOPPING. In this case, the STOPPING state will be returned so as + to inform the main thread that a shut-down is in process. + +Note: + + +--*/ + +{ + DWORD status; + BOOL inhibit = FALSE; // Used to inhibit sending the status + // to the service controller. + + EnterCriticalSection(&StatusCriticalSection); + + ElfDbgPrint(("ElfStatusUpdate (entry) NewState = %d, OldState = %d\n", + NewState,ElState)); + + if (NewState == STOPPED) { + if (ElState == STOPPED) { + // + // It was already stopped, don't send another SetServiceStatus. + // + inhibit = TRUE; + } + else { + // + // The shut down is complete, indicate that the eventlog + // has stopped. + // + ElStatus.dwCurrentState = SERVICE_STOPPED; + ElStatus.dwControlsAccepted = 0; + ElStatus.dwCheckPoint = 0; + ElStatus.dwWaitHint = 0; + + ElStatus.dwWin32ExitCode = ElUninstallCode; + ElStatus.dwServiceSpecificExitCode = ElSpecificCode; + + } + ElState = NewState; + } + else if (NewState == UPDATE_ONLY) { + inhibit = FALSE; + } + else { + // + // We are not being asked to change to the STOPPED state. + // + switch(ElState) { + + case STARTING: + if (NewState == STOPPING) { + + ElStatus.dwCurrentState = SERVICE_STOP_PENDING; + ElStatus.dwControlsAccepted = 0; + ElStatus.dwCheckPoint = HintCount++; + ElStatus.dwWaitHint = ELF_WAIT_HINT_TIME; + ElState = NewState; + + EventlogShutdown = TRUE; + } + + else if (NewState == RUNNING) { + + // + // The Eventlog Service has completed installation. + // + ElStatus.dwCurrentState = SERVICE_RUNNING; + ElStatus.dwCheckPoint = 0; + ElStatus.dwWaitHint = 0; + // + // Only stoppable/pausable if developer's build. + // +#if DBG + ElStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | + SERVICE_ACCEPT_PAUSE_CONTINUE | + SERVICE_ACCEPT_SHUTDOWN; +#else + ElStatus.dwControlsAccepted = SERVICE_ACCEPT_SHUTDOWN; +#endif + ElState = NewState; + } + + else { + // + // The NewState must be STARTING. So update the pending + // count + // + + ElStatus.dwCurrentState = SERVICE_START_PENDING; + ElStatus.dwControlsAccepted = 0; + ElStatus.dwCheckPoint = HintCount++; + ElStatus.dwWaitHint = ELF_WAIT_HINT_TIME; + } + break; + + case RUNNING: + if (NewState == STOPPING) { + + ElStatus.dwCurrentState = SERVICE_STOP_PENDING; + ElStatus.dwControlsAccepted = 0; + + EventlogShutdown = TRUE; + } + else if (NewState == PAUSING) { + ElStatus.dwCurrentState = SERVICE_PAUSE_PENDING; + } + else if (NewState == PAUSED) { + ElStatus.dwCurrentState = SERVICE_PAUSED; + } + ElStatus.dwCheckPoint = HintCount++; + ElStatus.dwWaitHint = ELF_WAIT_HINT_TIME; + ElState = NewState; + + break; + + case STOPPING: + // + // No matter what else was passed in, force the status to + // indicate that a shutdown is pending. + // + ElStatus.dwCurrentState = SERVICE_STOP_PENDING; + ElStatus.dwControlsAccepted = 0; + ElStatus.dwCheckPoint = HintCount++; + ElStatus.dwWaitHint = ELF_WAIT_HINT_TIME; + EventlogShutdown = TRUE; + + break; + + case STOPPED: + // + // We're already stopped. Therefore, an uninstalled status + // has already been sent. Do nothing. + // + inhibit = TRUE; + break; + case PAUSING: + if (NewState == PAUSED) { + ElStatus.dwCurrentState = SERVICE_PAUSED; + ElStatus.dwCheckPoint = 0; + ElStatus.dwWaitHint = 0; + } + else { + ElStatus.dwCheckPoint = HintCount++; + ElStatus.dwWaitHint = ELF_WAIT_HINT_TIME; + } + ElState = NewState; + break; + case CONTINUING: + if (NewState == RUNNING) { + // + // The Eventlog Service has completed installation. + // + ElStatus.dwCurrentState = SERVICE_RUNNING; + ElStatus.dwCheckPoint = 0; + ElStatus.dwWaitHint = 0; + // + // Only stoppable/pausable if developer's build. + // +#if DBG + ElStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | + SERVICE_ACCEPT_PAUSE_CONTINUE | + SERVICE_ACCEPT_SHUTDOWN; +#else + ElStatus.dwControlsAccepted = SERVICE_ACCEPT_SHUTDOWN; +#endif + ElState = NewState; + } + else { + ElStatus.dwCheckPoint = HintCount++; + } + break; + case PAUSED: + if (NewState == CONTINUING) { + ElStatus.dwCheckPoint = HintCount++; + ElStatus.dwWaitHint = ELF_WAIT_HINT_TIME; + ElStatus.dwCurrentState = SERVICE_CONTINUE_PENDING; + } + else if (NewState == RUNNING) { + // + // The Eventlog Service has completed installation. + // + ElStatus.dwCurrentState = SERVICE_RUNNING; + ElStatus.dwCheckPoint = 0; + ElStatus.dwWaitHint = 0; + // + // Only stoppable/pausable if developer's build. + // +#if DBG + ElStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | + SERVICE_ACCEPT_PAUSE_CONTINUE | + SERVICE_ACCEPT_SHUTDOWN; +#else + ElStatus.dwControlsAccepted = SERVICE_ACCEPT_SHUTDOWN; +#endif + ElState = NewState; + } + break; + } + } + + if (!inhibit) { + if (ElfServiceStatusHandle == (SERVICE_STATUS_HANDLE) NULL) { + ElfDbgPrint(("ElfStatusUpdate, no handle to call SetServiceStatus\n")); + + } + else if (! SetServiceStatus( ElfServiceStatusHandle, &ElStatus )) { + + status = GetLastError(); + + if (status != NERR_Success) { + ElfDbgPrint(("ElfStatusUpdate, SetServiceStatus Failed %d\n", + status)); + } + } + } + + ElfDbgPrint(("ElfStatusUpdate (exit) State = %d\n",ElState)); + status = ElState; + LeaveCriticalSection(&StatusCriticalSection); + return(status); +} + + +DWORD +GetElState ( + VOID + ) + +/*++ + +Routine Description: + + Obtains the state of the Eventlog Service. This state information + is protected as a critical section such that only one thread can + modify or read it at a time. + +Arguments: + + none + +Return Value: + + The Eventlog State is returned as the return value. + +--*/ +{ + DWORD status; + + EnterCriticalSection(&StatusCriticalSection); + status = ElState; + LeaveCriticalSection(&StatusCriticalSection); + + return(status); +} + + +VOID +ElInitStatus(VOID) + +/*++ + +Routine Description: + + Initializes the critical section that is used to guard access to the + status database. + +Arguments: + + none + +Return Value: + + none + +Note: + + +--*/ +{ + InitializeCriticalSection(&StatusCriticalSection); + + ElStatus.dwCurrentState = SERVICE_START_PENDING; + ElStatus.dwServiceType = SERVICE_WIN32; + +} + + +VOID +ElCleanupStatus(VOID) + +/*++ + +Routine Description: + + Deletes the critical section used to control access to the thread and + status database. + +Arguments: + + none + +Return Value: + + none + +Note: + + +--*/ +{ + DeleteCriticalSection(&StatusCriticalSection); +} + + diff --git a/private/eventlog/server/copy.c b/private/eventlog/server/copy.c new file mode 100644 index 000000000..3344bc3e4 --- /dev/null +++ b/private/eventlog/server/copy.c @@ -0,0 +1,196 @@ +/*++ + +Copyright (c) 1989 Microsoft Corporation + +Module Name: + + copy.c + +Abstract: + + This module contains the routine to copy a file. + +Author: + + Dan Hinsley (DanHi) 24-Feb-1991 + +Revision History: + + 02-Feb-1994 Danl + Fixed memory leak where ioBuffer wasn't getting free'd when doing + an error exit from ElfpCopyFile. + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> + + +NTSTATUS +ElfpCopyFile ( + IN HANDLE SourceHandle, + IN PUNICODE_STRING TargetFileName + ) + +/*++ + +Routine Description: + + This routine copies or appends from the source file to the target file. + If the target file already exists, the copy fails. + +Arguments: + + SourceHandle - An open handle to the source file. + + TargetFileName - The name of the file to copy to. + + +Return Value: + + NTSTATUS - STATUS_SUCCESS or error. + +--*/ + +{ + + NTSTATUS Status; + + IO_STATUS_BLOCK IoStatusBlock; + FILE_STANDARD_INFORMATION sourceStandardInfo; + + OBJECT_ATTRIBUTES ObjectAttributes; + HANDLE TargetHandle; + + PCHAR ioBuffer; + ULONG ioBufferSize; + ULONG bytesRead; + + // + // Get the size of the file so we can set the attributes of the target + // file. + // + + Status = NtQueryInformationFile( + SourceHandle, + &IoStatusBlock, + &sourceStandardInfo, + sizeof(sourceStandardInfo), + FileStandardInformation + ); + + if ( !NT_SUCCESS(Status) ) { + + return(Status); + } + + // + // Open the target file, fail if the file already exists. + // + + InitializeObjectAttributes( + &ObjectAttributes, + TargetFileName, + OBJ_CASE_INSENSITIVE, + NULL, + NULL + ); + + Status = NtCreateFile(&TargetHandle, + GENERIC_WRITE | SYNCHRONIZE, + &ObjectAttributes, + &IoStatusBlock, + &(sourceStandardInfo.EndOfFile), + FILE_ATTRIBUTE_NORMAL, + 0, // Share access + FILE_CREATE, + FILE_SYNCHRONOUS_IO_ALERT | FILE_SEQUENTIAL_ONLY, + NULL, // EA buffer + 0 // EA length + ); + + if (!NT_SUCCESS(Status)) { + return(Status); + } + + // + // Allocate a buffer to use for the data copy. + // + + ioBufferSize = 4096; + + ioBuffer = ElfpAllocateBuffer ( ioBufferSize); + + if ( ioBuffer == NULL ) { + + return (STATUS_NO_MEMORY); + } + + // + // Copy data--read from source, write to target. Do this until + // all the data is written or an error occurs. + // + + while ( TRUE ) { + + Status = NtReadFile( + SourceHandle, + NULL, // Event + NULL, // ApcRoutine + NULL, // ApcContext + &IoStatusBlock, + ioBuffer, + ioBufferSize, + NULL, // ByteOffset + NULL // Key + ); + + if ( !NT_SUCCESS(Status) && Status != STATUS_END_OF_FILE ) { + + ElfDbgPrint(("[ELF] Copy failed reading source file - %X\n", + Status)); + ElfpFreeBuffer(ioBuffer); + return (Status); + + } + + if ( IoStatusBlock.Information == 0 || + Status == STATUS_END_OF_FILE ) { + break; + } + + bytesRead = IoStatusBlock.Information; + + Status = NtWriteFile( + TargetHandle, + NULL, // Event + NULL, // ApcRoutine + NULL, // ApcContext + &IoStatusBlock, + ioBuffer, + bytesRead, + NULL, // ByteOffset + NULL // Key + ); + + if ( !NT_SUCCESS(Status) ) { + ElfDbgPrint(("[ELF] Copy failed writing target file - %X\n", + Status)); + ElfpFreeBuffer(ioBuffer); + return (Status); + } + } + + ElfpFreeBuffer ( ioBuffer ); + + Status = NtClose(TargetHandle); + + ASSERT(NT_SUCCESS(Status)); + + return STATUS_SUCCESS; + +} // ElfpCopyFile + diff --git a/private/eventlog/server/daytona/makefile b/private/eventlog/server/daytona/makefile new file mode 100644 index 000000000..6ee4f43fa --- /dev/null +++ b/private/eventlog/server/daytona/makefile @@ -0,0 +1,6 @@ +# +# DO NOT EDIT THIS FILE!!! Edit .\sources. if you want to add a new source +# file to this component. This file merely indirects to the real make file +# that is shared by all the components of NT OS/2 +# +!INCLUDE $(NTMAKEENV)\makefile.def diff --git a/private/eventlog/server/daytona/sources b/private/eventlog/server/daytona/sources new file mode 100644 index 000000000..c27140453 --- /dev/null +++ b/private/eventlog/server/daytona/sources @@ -0,0 +1,69 @@ +!IF 0 + +Copyright (c) 1989 Microsoft Corporation + +Module Name: + + sources. + +Abstract: + + This file specifies the target component being built and the list of + sources files needed to build that component. Also specifies optional + compiler switches and libraries that are unique for the component being + built. + + +Author: + + Rajen Shah (rajens) 2-Jul-1991 + + +Revision History: + +!ENDIF + +MAJORCOMP = eventlog +MINORCOMP = server + +TARGETPATH=obj +TARGETNAME= eventlog +TARGETTYPE=DYNLINK + +DLLDEF=..\eventlog.def + +TARGETLIBS= \ + $(BASEDIR)\public\sdk\lib\*\kernel32.lib \ + $(BASEDIR)\public\sdk\lib\*\advapi32.lib \ + $(BASEDIR)\public\sdk\lib\*\user32.lib \ + $(BASEDIR)\public\sdk\lib\*\rpcrt4.lib \ + $(BASEDIR)\public\sdk\lib\*\rpcndr.lib \ + $(BASEDIR)\public\sdk\lib\*\rpcutil.lib + +INCLUDES=..\;..\..;$(BASEDIR)\public\sdk\inc;$(BASEDIR)\private\inc + +SOURCES= \ + ..\eventlog.rc \ + ..\eventlog.c \ + ..\alert.c \ + ..\config.c \ + ..\control.c \ + ..\copy.c \ + ..\elfapi.c \ + ..\elfdata.c \ + ..\elflpc.c \ + ..\elfrpc.c \ + ..\elfsec.c \ + ..\elfutil.c \ + ..\elf_s.c \ + ..\file.c \ + ..\memory.c \ + ..\operate.c \ + ..\logclear.c \ + ..\terminat.c + +C_DEFINES= -DINCL_32= -DNT -DRPC_NO_WINDOWS_H + +USE_CRTDLL=1 + +UMTYPE=windows diff --git a/private/eventlog/server/dirs b/private/eventlog/server/dirs new file mode 100644 index 000000000..945735ae2 --- /dev/null +++ b/private/eventlog/server/dirs @@ -0,0 +1,25 @@ +!IF 0 + +Copyright (c) 1994 Microsoft Corporation + +Module Name: + + dirs. + +Abstract: + + This file specifies the subdirectories of the current directory that + contain component makefiles. This was necessitated by the need to + build a and nt rdr. + +Author: + + Milan Shah (April 20, 1994) + +NOTE: Commented description of this file is in \nt\bak\bin\dirs.tpl + +!ENDIF + +DIRS=daytona + +OPTIONAL_DIRS= diff --git a/private/eventlog/server/elfapi.c b/private/eventlog/server/elfapi.c new file mode 100644 index 000000000..5ffa2a2fd --- /dev/null +++ b/private/eventlog/server/elfapi.c @@ -0,0 +1,2235 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + ELFAPI.C + +Abstract: + + This module contains the server end of the Elf APIs. + + +Author: + + Rajen Shah (rajens) 29-Jul-1991 + + +Revision History: + 30-Jan-1995 MarkBl + Backup operators are allowed to _open the security log, but are only + allowed to perform backup operations on it; all other operations are + disallowed. + + 13-Oct-1993 Danl + ElfrOpenELA: Fixed Memory Leak bug where it was not calling + RtlFreeUnicodeString for pRegModuleNameU and PModuleNameU. + + 29-Jul-1991 RajenS + Created + +--*/ + + +//#include <rpcutil.h> + +#include <eventp.h> +#include <elfcfg.h> +#include <stdio.h> // sprintf +#include <stdlib.h> +#include <memory.h> + +// +// PROTOTYPES +// +NTSTATUS +ElfpOpenELW ( + IN EVENTLOG_HANDLE_W UNCServerName, + IN PRPC_UNICODE_STRING ModuleName, + IN PRPC_UNICODE_STRING RegModuleName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle, + IN ULONG DesiredAccess + ); + +NTSTATUS +ElfpOpenELA ( + IN EVENTLOG_HANDLE_A UNCServerName, + IN PRPC_STRING ModuleName, + IN PRPC_STRING RegModuleName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle, + IN ULONG DesiredAccess + ); + +VOID +FreePUStringArray ( + IN PUNICODE_STRING * pUStringArray, + IN USHORT NumStrings + ); + + +// +// These APIs only have one interface, since they don't take or return strings +// + +NTSTATUS +ElfrNumberOfRecords( + IN IELF_HANDLE LogHandle, + OUT PULONG NumberOfRecords + ) +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrCurrentRecord API. + +Arguments: + + LogHandle - The context-handle for this module's call. + + NumberOfRecords - Where to return the total number of records in the + log file. + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + + PLOGMODULE Module; + NTSTATUS Status = STATUS_SUCCESS; + + // + // This condition is TRUE iff a backup operator has opened the security + // log. In this case deny access, since backup operators are allowed + // only backup operation on the security log. + // + + if (LogHandle->GrantedAccess & ELF_LOGFILE_BACKUP) + { + return(STATUS_ACCESS_DENIED); + } + + // + // If the OldestRecordNumber is 0, that means we have an empty + // file, else we calculate the difference between the oldest + // and next record numbers + // + + Module = FindModuleStrucFromAtom (LogHandle->Atom); + if (Module != NULL) { + *NumberOfRecords = Module->LogFile->OldestRecordNumber == 0 ? 0 : + Module->LogFile->CurrentRecordNumber - + Module->LogFile->OldestRecordNumber; + } + else { + Status = STATUS_INVALID_HANDLE; + } + + return (Status); + +} + + +NTSTATUS +ElfrOldestRecord( + IN IELF_HANDLE LogHandle, + OUT PULONG OldestRecordNumber + ) +{ + PLOGMODULE Module; + NTSTATUS Status = STATUS_SUCCESS; + + // + // This condition is TRUE iff a backup operator has opened the security + // log. In this case deny access, since backup operators are allowed + // only backup operation on the security log. + // + + if (LogHandle->GrantedAccess & ELF_LOGFILE_BACKUP) + { + return(STATUS_ACCESS_DENIED); + } + + Module = FindModuleStrucFromAtom (LogHandle->Atom); + if (Module != NULL) { + *OldestRecordNumber = Module->LogFile->OldestRecordNumber; + } + else { + Status = STATUS_INVALID_HANDLE; + } + + return (Status); +} + +NTSTATUS +ElfrChangeNotify( + IN IELF_HANDLE LogHandle, + IN RPC_CLIENT_ID ClientId, + IN ULONG Event + ) +{ + + NTSTATUS Status; + OBJECT_ATTRIBUTES ObjectAttributes; + HANDLE ProcessHandle = NULL; + HANDLE EventHandle; + PLOGMODULE Module; + PNOTIFIEE Notifiee; + + // + // First make sure that this is a local call and that it is not a + // handle that was created for a backup log file + // + + if (LogHandle->Flags & ELF_LOG_HANDLE_REMOTE_HANDLE || + LogHandle->Flags & ELF_LOG_HANDLE_BACKUP_LOG) { + return(STATUS_INVALID_HANDLE); + } + + // + // This condition is TRUE iff a backup operator has opened the security + // log. In this case deny access, since backup operators are allowed + // only backup operation on the security log. + // + + if (LogHandle->GrantedAccess & ELF_LOGFILE_BACKUP) + { + return(STATUS_ACCESS_DENIED); + } + + // + // First get a handle to the process using the passed in ClientId + // + + InitializeObjectAttributes( + &ObjectAttributes, + NULL, // UNICODE string + 0, // Attributes + NULL, // Root directory + NULL); // Security descriptor + + Status = NtOpenProcess( + &ProcessHandle, + PROCESS_DUP_HANDLE, + &ObjectAttributes, + (PCLIENT_ID) &ClientId); + + if (NT_SUCCESS(Status)) { + + // + // Now dupe the handle they passed in for the event + // + + Status = NtDuplicateObject( + ProcessHandle, + (HANDLE) Event, + NtCurrentProcess(), + &EventHandle, + 0, + 0, + DUPLICATE_SAME_ACCESS); + + if (NT_SUCCESS(Status)) { + + // + // Create a new NOTIFIEE control block to link in + // + + Notifiee = ElfpAllocateBuffer(sizeof(NOTIFIEE)); + if (Notifiee) { + + // + // Fill in the fields + // + + Notifiee->Handle = LogHandle; + Notifiee->Event = EventHandle; + + // + // Find the LOGFILE associated with this handle + // + + Module = FindModuleStrucFromAtom (LogHandle->Atom); + ASSERT(Module); + + // + // Get exclusive access to the log file. This will ensure + // no one else is accessing the file. + // + + RtlAcquireResourceExclusive ( + &Module->LogFile->Resource, + TRUE // Wait until available + ); + + InsertHeadList(&Module->LogFile->Notifiees, + &Notifiee->Next); + + // + // Free the resource + // + + RtlReleaseResource ( &Module->LogFile->Resource ); + } + else { + Status = STATUS_NO_MEMORY; + } + } + } + else { + if (Status == STATUS_INVALID_CID) { + Status = STATUS_INVALID_HANDLE; + } + } + + if (ProcessHandle) { + NtClose(ProcessHandle); + } + + return (Status); +} + + +// +// UNICODE APIs +// + + + +NTSTATUS +ElfrClearELFW ( + IN IELF_HANDLE LogHandle, + IN PRPC_UNICODE_STRING BackupFileName + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrClearELFW API. + +Arguments: + + LogHandle - The context-handle for this module's call. This must + not have been returned from OpenBackupEventlog, or + this call will fail with invalid handle. + + BackupFileName - Name of the file to back up the current log file. + NULL implies not to back up the file. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS Status=STATUS_SUCCESS; + PLOGMODULE Module; + ELF_REQUEST_RECORD Request; + CLEAR_PKT ClearPkt; + DWORD status=NO_ERROR; + + // + // Can't clear a backup log + // + + if (LogHandle->Flags & ELF_LOG_HANDLE_BACKUP_LOG) { + return(STATUS_INVALID_HANDLE); + } + + // + // This condition is TRUE iff a backup operator has opened the security + // log. In this case deny access, since backup operators are allowed + // only backup operation on the security log. + // + + if (LogHandle->GrantedAccess & ELF_LOGFILE_BACKUP) + { + return(STATUS_ACCESS_DENIED); + } + + // + // Find the matching module structure + // + + Module = FindModuleStrucFromAtom (LogHandle->Atom); + + Request.Pkt.ClearPkt = &ClearPkt; + Request.Flags = 0; + + if (Module != NULL) { + + // + // Verify that the caller has clear access to this logfile + // + + if (! RtlAreAllAccessesGranted ( + LogHandle->GrantedAccess, + ELF_LOGFILE_CLEAR)) { + + Status = STATUS_ACCESS_DENIED; + } + + if (NT_SUCCESS(Status)) { + + // + // Fill in the request packet + // + + Request.Module = Module; + Request.LogFile = Module->LogFile; + Request.Command = ELF_COMMAND_CLEAR; + Request.Status = STATUS_SUCCESS; + Request.Pkt.ClearPkt->BackupFileName = + (PUNICODE_STRING)BackupFileName; + + // + // Call the worker routine to do the operation. + // + + ElfPerformRequest (&Request); + + // + // Extract status of operation from the request packet + // + + Status = Request.Status; + + // + // If this was the Security Logfile, and the clear was + // successful, then generate an audit. + // + if ((NT_SUCCESS(Status) && + (_wcsicmp(ELF_SECURITY_MODULE_NAME, Module->LogFile->LogModuleName->Buffer) == 0))) { + + // + // We just cleared the security log. Now we want to add + // a new event to that log to indicate who did it. + // + status = RpcImpersonateClient(NULL); + if (status != RPC_S_OK) { + ElfDbgPrint(("RPC IMPERSONATION FAILED %d\n",status)); + } + else { + ElfpGenerateLogClearedEvent(LogHandle); + status = RpcRevertToSelf(); + if (status != RPC_S_OK) { + DbgPrint("RPC REVERT TO SELF FAILED %d\n",status); + } + } + } + + } + } else { + Status = STATUS_INVALID_HANDLE; + } + + + return (Status); + +} + + +NTSTATUS +ElfrBackupELFW ( + IN IELF_HANDLE LogHandle, + IN PRPC_UNICODE_STRING BackupFileName + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrBackupELFW API. + +Arguments: + + LogHandle - The context-handle for this module's call. + + BackupFileName - Name of the file to back up the current log file. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS Status; + PLOGMODULE Module; + ELF_REQUEST_RECORD Request; + BACKUP_PKT BackupPkt; + + if (BackupFileName->Length == 0) { + return(STATUS_INVALID_PARAMETER); + } + + Request.Pkt.BackupPkt = &BackupPkt; + Request.Flags = 0; + + // + // Find the matching module structure + // + + Module = FindModuleStrucFromAtom (LogHandle->Atom); + + if (Module != NULL) { + + // + // Fill in the request packet + + Request.Module = Module; + Request.LogFile = Module->LogFile; + Request.Command = ELF_COMMAND_BACKUP; + Request.Status = STATUS_SUCCESS; + Request.Pkt.BackupPkt->BackupFileName = + (PUNICODE_STRING)BackupFileName; + + // + // Call the worker routine to do the operation. + // + + ElfPerformRequest (&Request); + + // + // Extract status of operation from the request packet + // + + Status = Request.Status; + + } else { + Status = STATUS_INVALID_HANDLE; + } + + return (Status); + +} + + +NTSTATUS +ElfrCloseEL ( + IN OUT PIELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrCloseEL API. + +Arguments: + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS Status; + + // + // Call the rundown routine to do all the work + // + + IELF_HANDLE_rundown(*LogHandle); + + *LogHandle = NULL; // so RPC knows it's closed + + return (STATUS_SUCCESS); +} + + +NTSTATUS +ElfrDeregisterEventSource ( + IN OUT PIELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrDeregisterEventSource API. + +Arguments: + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS Status; + + // + // This condition is TRUE iff a backup operator has opened the security + // log. In this case deny access, since backup operators are allowed + // only backup operation on the security log. + // + + if ((*LogHandle)->GrantedAccess & ELF_LOGFILE_BACKUP) + { + return(STATUS_ACCESS_DENIED); + } + + // + // Call the rundown routine to do all the work + // + + IELF_HANDLE_rundown(*LogHandle); + + *LogHandle = NULL; // so RPC knows it's closed + + return (STATUS_SUCCESS); +} + + + + +NTSTATUS +ElfrOpenBELW ( + IN EVENTLOG_HANDLE_W UNCServerName, + IN PRPC_UNICODE_STRING BackupFileName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrOpenBELW API. It creates + a module structure $BACKUPnnn where nnn is a unique number for every backup + log that is opened. It then calls ElfpOpenELW to actually open the file. + + +Arguments: + + UNCServerName - Not used. + + BackupFileName - Name of the backup log file. + + MajorVersion/MinorVersion - The version of the client. + + + LogHandle - Pointer to the place where the pointer to the + context handle structure will be placed. + +Return Value: + + Returns an NTSTATUS code and, if no error, a "handle". + + +--*/ +{ + + NTSTATUS Status; + UNICODE_STRING BackupStringW; + LPWSTR BackupModuleName; + PLOGMODULE pModule; + DWORD dwModuleNumber; + +// +// Size of buffer (in bytes) required for a UNICODE string of $BACKUPnnn +// + +#define SIZEOF_BACKUP_MODULE_NAME 64 + + UNREFERENCED_PARAMETER(UNCServerName); + + // + // Create a unique module name by incrementing a global value + // + + BackupModuleName = ElfpAllocateBuffer(SIZEOF_BACKUP_MODULE_NAME); + if (BackupModuleName == NULL) { + return(STATUS_NO_MEMORY); + } + + // + // Serialize read, increment of the global backup module number. + // Note: double-timing the log file list critical section so as to not + // require another critical section specifically dedicated to this + // operation. + // + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogFileCritSec); + + dwModuleNumber = BackupModuleNumber++; + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogFileCritSec); + + swprintf(BackupModuleName, L"$BACKUP%06d", dwModuleNumber); + RtlInitUnicodeString(&BackupStringW, BackupModuleName); + + // + // Call SetupDataStruct to build the module and log data structures + // and actually open the file. + // + // NOTE: If this call is successful, the Unicode String Buffer for + // BackupStringW (otherwise known as BackupModuleName) will be attached + // to the LogModule structure, and should not be free'd. + // + // + + Status = SetUpDataStruct( + BackupFileName, // Filename + 0, // Max size, it will use actual + 0, // retention period, not used for bkup + ELF_GUEST_ACCESS_UNRESTRICTED, // restrict guest + // access flag, inapplicable for bkup + &BackupStringW, // Module name + NULL, // Handle to registry, not used + ElfBackupLog // Log type + ); + + if (!NT_SUCCESS(Status)) { + ElfpFreeBuffer(BackupModuleName); + return(Status); + } + + // + // Call ElfOpenELW to actually open the log file and get a handle. + // + if (NT_SUCCESS(Status)) { + + Status = ElfpOpenELW(NULL, + (PRPC_UNICODE_STRING) & BackupStringW, + NULL, + MajorVersion, + MinorVersion, + LogHandle, + ELF_LOGFILE_READ); + } + + if (NT_SUCCESS(Status)) { + + // + // Mark this as a handle for a backup log, so we can clean up + // differently when it's closed, as well as disallow clear, backup + // and write operations. + // + + (*LogHandle)->Flags |= ELF_LOG_HANDLE_BACKUP_LOG; + + } + else { + // + // If we couldn't open the log file, then we need to tear down + // the DataStruct we set up with SetUpDataStruct. + // + pModule = GetModuleStruc ((PUNICODE_STRING)BackupFileName); + + Status = ElfpCloseLogFile (pModule->LogFile, ELF_LOG_CLOSE_BACKUP); + + UnlinkLogModule(pModule); + pModule->LogFile->RefCount--; + if (pModule->LogFile->RefCount == 0) { + UnlinkLogFile(pModule->LogFile); // Unlink the structure + RtlDeleteResource ( &pModule->LogFile->Resource ); + RtlDeleteSecurityObject(&pModule->LogFile->Sd); + ElfpFreeBuffer (pModule->LogFile->LogFileName); + ElfpFreeBuffer (pModule->LogFile); + } + ElfpFreeBuffer(pModule->ModuleName); + ElfpFreeBuffer(pModule); + + } + + return(Status); +} + + +NTSTATUS +ElfrRegisterEventSourceW ( + IN EVENTLOG_HANDLE_W UNCServerName, + IN PRPC_UNICODE_STRING ModuleName, + IN PRPC_UNICODE_STRING RegModuleName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrRegisterEventSourceW API. + This routine allocates a structure for the context handle, finds + the matching module name and fills in the data. It returns the + pointer to the handle structure. + + +Arguments: + + UNCServerName - Not used. + + ModuleName - Name of the module that is making this call. + + RegModuleName - Not used. + + MajorVersion/MinorVersion - The version of the client. + + + LogHandle - Pointer to the place where the pointer to the + context handle structure will be placed. + +Return Value: + + Returns an NTSTATUS code and, if no error, a "handle". + +Note: + + For now, just call ElfpOpenELW. + + +--*/ +{ + PLOGMODULE Module; + + Module = GetModuleStruc ((PUNICODE_STRING)ModuleName); + + return(ElfpOpenELW(UNCServerName, ModuleName, RegModuleName, + MajorVersion, MinorVersion, LogHandle, ELF_LOGFILE_WRITE)); +} + +NTSTATUS +ElfrOpenELW ( + IN EVENTLOG_HANDLE_W UNCServerName, + IN PRPC_UNICODE_STRING ModuleName, + IN PRPC_UNICODE_STRING RegModuleName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrOpenELW API. + This routine allocates a structure for the context handle, finds + the matching module name and fills in the data. It returns the + pointer to the handle structure. + + +Arguments: + + UNCServerName - Not used. + + ModuleName - Name of the module that is making this call. + + RegModuleName - Not used. + + MajorVersion/MinorVersion - The version of the client. + + + LogHandle - Pointer to the place where the pointer to the + context handle structure will be placed. + +Return Value: + + Returns an NTSTATUS code and, if no error, a "handle". + + +--*/ +{ + return( ElfpOpenELW ( + UNCServerName, + ModuleName, + RegModuleName, + MajorVersion, + MinorVersion, + LogHandle, + ELF_LOGFILE_READ)); +} + +NTSTATUS +ElfpOpenELW ( + IN EVENTLOG_HANDLE_W UNCServerName, + IN PRPC_UNICODE_STRING ModuleName, + IN PRPC_UNICODE_STRING RegModuleName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle, + IN ULONG DesiredAccess + ) + +/*++ + +Routine Description: + + Looks alot like ElfrOpenELW but also gets passed a DesiredAccess. + +Arguments: + + UNCServerName - Not used. + + ModuleName - Name of the module that is making this call. + + RegModuleName - Not used. + + MajorVersion/MinorVersion - The version of the client. + + + LogHandle - Pointer to the place where the pointer to the + context handle structure will be placed. + + DesiredAccess - Indicates the access desired for this logfile. + +Return Value: + + Returns an NTSTATUS code and, if no error, a "handle". + + +--*/ +{ + NTSTATUS Status = STATUS_SUCCESS; + PLOGMODULE Module; + IELF_HANDLE LogIHandle; + BOOL ForSecurityLog = FALSE; + + // + // Allocate a new structure for the context handle + // + + LogIHandle = (IELF_HANDLE) ElfpAllocateBuffer ( + sizeof (*LogIHandle) + + ModuleName->Length + + sizeof (WCHAR) + ); + + if (LogIHandle) { + + // + // Find the module structure in order to pull out the Atom. + // + // GetModuleStruc *always* succeeds! (returns default if module + // not found). + // + + Module = GetModuleStruc ((PUNICODE_STRING)ModuleName); + + // + // Validate the caller has appropriate access to this logfile. + // If this is the security log, then check privilege instead. + // + if (_wcsicmp(ELF_SECURITY_MODULE_NAME, Module->LogFile->LogModuleName->Buffer) == 0) { + ForSecurityLog = TRUE; + } + Status = ElfpAccessCheckAndAudit( + L"EventLog", // SubSystemName + L"LogFile", // ObjectTypeName + Module->ModuleName, // ObjectName + LogIHandle, // Context handle - required? + Module->LogFile->Sd, // Security Descriptor + DesiredAccess, // Requested Access + NULL, // GENERIC_MAPPING + ForSecurityLog // Indicates the check is for security log + ); + + if (NT_SUCCESS(Status)) { + + LogIHandle->Atom = Module->ModuleAtom; + + LogIHandle->NameLength = ModuleName->Length + sizeof(WCHAR); + RtlMoveMemory( LogIHandle->Name, + ModuleName->Buffer, + ModuleName->Length + ); + + LogIHandle->Name[ModuleName->Length / sizeof(WCHAR)] = L'\0'; + + LogIHandle->MajorVersion = MajorVersion; // Store the version + LogIHandle->MinorVersion = MinorVersion; // of the client + + // + // Initialize seek positions and flags to zero. + // + + LogIHandle->SeekRecordPos = 0; + LogIHandle->SeekBytePos = 0; + LogIHandle->Flags = 0; + + // + // Link in this structure to the list of context handles + // + + LogIHandle->Signature = ELF_CONTEXTHANDLE_SIGN; // DEBUG + LinkContextHandle (LogIHandle); + + *LogHandle = LogIHandle; // Set return handle + Status = STATUS_SUCCESS; // Set return status + } + else { + ElfpFreeBuffer(LogIHandle); + } + + } else { + + Status = STATUS_NO_MEMORY; + } + + return (Status); + + UNREFERENCED_PARAMETER(UNCServerName); + UNREFERENCED_PARAMETER(RegModuleName); +} + + + +NTSTATUS +w_ElfrReadEL ( + IN ULONG Flags, // ANSI or UNICODE + IN IELF_HANDLE LogHandle, + IN ULONG ReadFlags, + IN ULONG RecordNumber, + IN ULONG NumberOfBytesToRead, + IN PBYTE Buffer, + OUT PULONG NumberOfBytesRead, + OUT PULONG MinNumberOfBytesNeeded + ) + +/*++ + +Routine Description: + + This is the worker for the ElfrReadEL APIs. + +Arguments: + + Same as ElfrReadELW API except that Flags contains an indication + of whether this is ANSI or UNICODE. + +Return Value: + + Same as the main API. + +NOTES: + + We assume that the client-side has validated the flags to ensure that + only one type of each bit is set. No checking is done at the server end. + + +--*/ +{ + NTSTATUS Status; + PLOGMODULE Module; + ELF_REQUEST_RECORD Request; + READ_PKT ReadPkt; + + // + // The ELF_HANDLE_INVALID_FOR_READ flag bit would be set if the + // file changed underneath this handle. + // + + if (LogHandle->Flags & ELF_LOG_HANDLE_INVALID_FOR_READ) { + return(STATUS_EVENTLOG_FILE_CHANGED); + } + + // + // This condition is TRUE iff a backup operator has opened the security + // log. In this case deny access, since backup operators are allowed + // only backup operation on the security log. + // + + if (LogHandle->GrantedAccess & ELF_LOGFILE_BACKUP) + { + return(STATUS_ACCESS_DENIED); + } + + Request.Pkt.ReadPkt = &ReadPkt; // Set up read packet in request packet + + // + // Find the matching module structure + // + Module = FindModuleStrucFromAtom (LogHandle->Atom); + + // + // Only continue if the module was found + // + + if (Module != NULL) { + + // + // Fill in the request packet + // + Request.Module = Module; + Request.Flags = 0; + Request.LogFile = Module->LogFile; + Request.Command = ELF_COMMAND_READ; + Request.Status = STATUS_SUCCESS; + Request.Pkt.ReadPkt->MinimumBytesNeeded = *MinNumberOfBytesNeeded; + Request.Pkt.ReadPkt->BufferSize = NumberOfBytesToRead; + Request.Pkt.ReadPkt->Buffer = (PVOID)Buffer; + Request.Pkt.ReadPkt->ReadFlags = ReadFlags; + Request.Pkt.ReadPkt->RecordNumber = RecordNumber; + Request.Pkt.ReadPkt->LastSeekPos = LogHandle->SeekBytePos; + Request.Pkt.ReadPkt->LastSeekRecord = LogHandle->SeekRecordPos; + Request.Pkt.ReadPkt->Flags = Flags; // Indicate UNICODE or ANSI + + // + // Pass along whether the last read was in a forward or backward + // direction (affects how we treat being at EOF). Then reset the + // bit in the handle depending on what this read is. + // + + if (LogHandle->Flags & ELF_LOG_HANDLE_LAST_READ_FORWARD) { + Request.Pkt.ReadPkt->Flags |= ELF_LAST_READ_FORWARD; + } + + if (ReadFlags & EVENTLOG_FORWARDS_READ) { + LogHandle->Flags |= ELF_LOG_HANDLE_LAST_READ_FORWARD; + } + else { + LogHandle->Flags &= ~(ELF_LOG_HANDLE_LAST_READ_FORWARD); + } + + + // + // Perform the operation + // + ElfPerformRequest( &Request ); + + // + // Update current seek positions + // + LogHandle->SeekRecordPos = Request.Pkt.ReadPkt->LastSeekRecord; + LogHandle->SeekBytePos = Request.Pkt.ReadPkt->LastSeekPos; + + // + // Set up return values + // + *NumberOfBytesRead = Request.Pkt.ReadPkt->BytesRead; + *MinNumberOfBytesNeeded = Request.Pkt.ReadPkt->MinimumBytesNeeded; + + Status = Request.Status; + + } else { + Status = STATUS_INVALID_HANDLE; + // + // Set the NumberOfBytesNeeded to zero since there are no bytes to + // transfer. + // + *NumberOfBytesRead = 0; + *MinNumberOfBytesNeeded = 0; + } + + return (Status); +} + + +NTSTATUS +ElfrReadELW ( + IN IELF_HANDLE LogHandle, + IN ULONG ReadFlags, + IN ULONG RecordNumber, + IN ULONG NumberOfBytesToRead, + IN PBYTE Buffer, + OUT PULONG NumberOfBytesRead, + OUT PULONG MinNumberOfBytesNeeded + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrReadELW API. + +Arguments: + + + +Return Value: + + Returns an NTSTATUS code, NumberOfBytesRead if the read was successful + and MinNumberOfBytesNeeded if the buffer was not big enough. + + +--*/ +{ + NTSTATUS Status; + + // + // Call the worker with the UNICODE flag + // + + return(w_ElfrReadEL ( + ELF_IREAD_UNICODE, + LogHandle, + ReadFlags, + RecordNumber, + NumberOfBytesToRead, + Buffer, + NumberOfBytesRead, + MinNumberOfBytesNeeded + )); + +} + + + +NTSTATUS +ElfrReportEventW ( + IN IELF_HANDLE LogHandle, + IN ULONG EventTime, + IN USHORT EventType, + IN USHORT EventCategory OPTIONAL, + IN ULONG EventID, + IN USHORT NumStrings, + IN ULONG DataSize, + IN PRPC_UNICODE_STRING ComputerName, + IN PRPC_SID UserSid, + IN PRPC_UNICODE_STRING *Strings, + IN PBYTE Data, + IN USHORT Flags, + IN OUT PULONG RecordNumber OPTIONAL, + IN OUT PULONG TimeWritten OPTIONAL + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrReportEventW API. + +Arguments: + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS Status; + PLOGMODULE Module; + ELF_REQUEST_RECORD Request; + WRITE_PKT WritePkt; + + ULONG RecordLength; + ULONG StringOffset, DataOffset; + ULONG StringsSize; + USHORT i; + PVOID EventBuffer; + PEVENTLOGRECORD EventLogRecord; + PWSTR ReplaceStrings, SrcString; + PBYTE BinaryData; + PUNICODE_STRING UComputerName; + PWSTR UModuleName; + ULONG PadSize; + ULONG UserSidLength = 0; // Init to zero + ULONG UserSidOffset; + ULONG ModuleNameLen, ComputerNameLen; // Length in bytes + ULONG zero = 0; // For pad bytes + LARGE_INTEGER Time; + ULONG LogTimeWritten; + + // + // These are for Security Auditing to use for paired events. This will + // not be implemented in Product 1 + // + + UNREFERENCED_PARAMETER(RecordNumber); + UNREFERENCED_PARAMETER(TimeWritten); + + // + // This condition is TRUE iff a backup operator has opened the security + // log. In this case deny access, since backup operators are allowed + // only backup operation on the security log. + // + + if (LogHandle->GrantedAccess & ELF_LOGFILE_BACKUP) + { + return(STATUS_ACCESS_DENIED); + } + + // + // Make sure the SID passed in is valid + // + + if (ARGUMENT_PRESENT(UserSid)) { + if (!IsValidSid(UserSid)) { + return(STATUS_INVALID_PARAMETER); + } + } + + // + // Make sure strings are null terminated on this side of the RPC call + // (RPC doesn't pass the null terminator) + + for (i = 0; i < NumStrings; i++ ) { + if (Strings[i]) { + if (Strings[i]->MaximumLength >= Strings[i]->Length + + sizeof(WCHAR)) { + Strings[i]->Buffer[Strings[i]->Length / sizeof(WCHAR)] + = L'\0'; + } + } + + } + + // + // Can't write to a backup log + // + + if (LogHandle->Flags & ELF_LOG_HANDLE_BACKUP_LOG) { + return(STATUS_INVALID_HANDLE); + } + + // + // Make sure they didn't pass in a null pointer for the data, but tell + // me there was something there (I still think RPC should protect me from + // this!) + // + + if (!Data && DataSize != 0) { + return(STATUS_INVALID_PARAMETER); + } + + + UComputerName = (PUNICODE_STRING)ComputerName; + UModuleName = LogHandle->Name; + + Request.Pkt.WritePkt = &WritePkt; // Set up write packet in request packet + Request.Flags = 0; + + // + // Find the matching module structure + // + + Module = FindModuleStrucFromAtom (LogHandle->Atom); + + if (Module != NULL) { + + // + // Generate any additional information needed in the record. + // + // Info that we have Info to generate + // ----------------- ---------------- + // Modulename UserSidLength + // EventType Length + // EventID StringOffset + // NumStrings DataOffset + // Strings PadBytes + // DataLength LogTimeWritten + // Data + // UserSidOffset + // UserSid + // ComputerName + // TimeGenerated + // + + // LogTimeWritten + // We need to generate a time when the log is written. This + // gets written in the log so that we can use it to test the + // retention period when wrapping the file. + // + + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970( + &Time, + &LogTimeWritten + ); + + + // + // USERSIDLENTGH + // + + if (UserSid) { + UserSidLength = RtlLengthSid ((PSID)UserSid); + } + + // + // USERSIDOFFSET + // + // Extract the lengths from the STRING structure, and take care of + // the trailing NULLs. + // + + ModuleNameLen = (wcslen(UModuleName) + 1) + * sizeof (WCHAR); + ComputerNameLen = UComputerName->Length + sizeof(WCHAR); + + UserSidOffset = sizeof(EVENTLOGRECORD) + + ModuleNameLen + + ComputerNameLen; + + // + // STRING OFFSET: + // + + StringOffset = UserSidOffset + UserSidLength; + + + // + // Calculate the length of strings so that we can see how + // much space is needed for that. + // + + StringsSize = 0; + for (i=0; i<NumStrings; i++) { + if (!Strings[i] || Strings[i]->MaximumLength == 0) { + StringsSize += sizeof(WCHAR); + } + else { + StringsSize += Strings[i]->Length + sizeof(WCHAR); + } + } + + // + // DATA OFFSET: + // + + DataOffset = StringOffset + StringsSize; + + // + // Determine how big a buffer is needed for the eventlog record. + // + + RecordLength = DataOffset + + DataSize + + sizeof(RecordLength); // Size excluding pad bytes + + // + // Determine how many pad bytes are needed to align to a DWORD + // boundary. + // + + PadSize = sizeof(ULONG) - (RecordLength % sizeof(ULONG)); + + RecordLength += PadSize; // True size needed + + // + // Allocate the buffer for the Eventlog record + // + + EventBuffer = ElfpAllocateBuffer(RecordLength); + + if (EventBuffer != NULL) { + + // + // Fill up the event record + // + + EventLogRecord = (PEVENTLOGRECORD)EventBuffer; + + EventLogRecord->Length = RecordLength; + EventLogRecord->TimeGenerated = EventTime; + EventLogRecord->Reserved = ELF_LOG_FILE_SIGNATURE; + EventLogRecord->TimeWritten = LogTimeWritten; + EventLogRecord->EventID = EventID; + EventLogRecord->EventType = EventType; + EventLogRecord->EventCategory = EventCategory; + EventLogRecord->ReservedFlags = Flags; + EventLogRecord->ClosingRecordNumber = 0; + EventLogRecord->NumStrings = NumStrings; + EventLogRecord->StringOffset = StringOffset; + EventLogRecord->DataLength = DataSize; + EventLogRecord->DataOffset = DataOffset; + EventLogRecord->UserSidLength = UserSidLength; + EventLogRecord->UserSidOffset = UserSidOffset; + + // + // Fill in the variable-length fields + // + + // + // STRINGS + // + + ReplaceStrings = (PWSTR) ( (ULONG)EventLogRecord + + (ULONG)StringOffset + ); + + for (i=0; i < NumStrings; i++) { + if (!Strings[i] || Strings[i]->MaximumLength == 0) { + *ReplaceStrings = L'\0'; + ReplaceStrings++; + } + else { + SrcString = (PWSTR)Strings[i]->Buffer; + RtlMoveMemory(ReplaceStrings, SrcString, + Strings[i]->Length); + ReplaceStrings[Strings[i]->Length / sizeof(WCHAR)] = + L'\0'; + ReplaceStrings = (PWSTR)((PBYTE) ReplaceStrings + + Strings[i]->Length + sizeof(WCHAR)); + } + } + + // + // MODULENAME + // + + BinaryData = (PBYTE) EventLogRecord + sizeof(EVENTLOGRECORD); + RtlMoveMemory (BinaryData, + UModuleName, + ModuleNameLen); + + // + // COMPUTERNAME + // + + ReplaceStrings = (LPWSTR) (BinaryData + ModuleNameLen); + + RtlMoveMemory (ReplaceStrings, + UComputerName->Buffer, + UComputerName->Length); + + ReplaceStrings[UComputerName->Length / sizeof(WCHAR)] = L'\0'; + + // + // USERSID + // + + BinaryData = (PBYTE) ReplaceStrings + ComputerNameLen; + + ASSERT (BinaryData + == ((PBYTE) EventLogRecord) + UserSidOffset); + + RtlMoveMemory (BinaryData, + UserSid, + UserSidLength); + + // + // BINARY DATA + // + + BinaryData = (PBYTE) ((ULONG)EventLogRecord + DataOffset); + if (Data) { + RtlMoveMemory (BinaryData, Data, DataSize); + } + + // + // PAD - Fill with zeros + // + + BinaryData = (PBYTE) ((ULONG)BinaryData + DataSize); + RtlMoveMemory (BinaryData, &zero, PadSize); + + // + // LENGTH at end of record + // + + BinaryData = (PBYTE)((ULONG)BinaryData + PadSize);// Point after pad bytes + ((PULONG)BinaryData)[0] = RecordLength; + + // + // Make sure we are in the right place + // + + ASSERT ((ULONG)BinaryData + == (RecordLength + (ULONG)EventLogRecord) - sizeof(ULONG)); + + // + // Set up request packet. + // Link event log record into the request structure. + // + + Request.Module = Module; + Request.LogFile = Request.Module->LogFile; + Request.Command = ELF_COMMAND_WRITE; + Request.Pkt.WritePkt->Buffer = (PVOID)EventBuffer; + Request.Pkt.WritePkt->Datasize = RecordLength; + + // + // Perform the operation + // + + ElfPerformRequest( &Request ); + + // + // Free up the buffer + // + + ElfpFreeBuffer(EventBuffer); + + Status = Request.Status; // Set status of WRITE + + } else { + Status = STATUS_NO_MEMORY; + } + + } else { + Status = STATUS_INVALID_HANDLE; + } + + return (Status); +} + + + +// +// ANSI APIs +// + +NTSTATUS +ElfrClearELFA ( + IN IELF_HANDLE LogHandle, + IN PRPC_STRING BackupFileName + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrClearELFA API. + +Arguments: + + LogHandle - The context-handle for this module's call. + + BackupFileName - Name of the file to back up the current log file. + NULL implies not to back up the file. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS Status; + UNICODE_STRING BackupFileNameU; + + // + // Convert the BackupFileName to a UNICODE STRING and call the + // UNICODE API to do the work. + // + Status = RtlAnsiStringToUnicodeString ( + (PUNICODE_STRING)&BackupFileNameU, + (PANSI_STRING)BackupFileName, + TRUE + ); + + if (NT_SUCCESS(Status)) { + + Status = ElfrClearELFW ( + LogHandle, + (PRPC_UNICODE_STRING)&BackupFileNameU + ); + + RtlFreeUnicodeString (&BackupFileNameU); + } + + return (Status); + +} + + + +NTSTATUS +ElfrBackupELFA ( + IN IELF_HANDLE LogHandle, + IN PRPC_STRING BackupFileName + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrBackupELFA API. + +Arguments: + + LogHandle - The context-handle for this module's call. + + BackupFileName - Name of the file to back up the current log file. + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS Status; + UNICODE_STRING BackupFileNameU; + + // + // Convert the BackupFileName to a UNICODE STRING and call the + // UNICODE API to do the work. + // + Status = RtlAnsiStringToUnicodeString ( + (PUNICODE_STRING)&BackupFileNameU, + (PANSI_STRING)BackupFileName, + TRUE + ); + + if (NT_SUCCESS(Status)) { + + Status = ElfrBackupELFW ( + LogHandle, + (PRPC_UNICODE_STRING)&BackupFileNameU + ); + + RtlFreeUnicodeString (&BackupFileNameU); + } + + return (Status); + +} + + +NTSTATUS +ElfrRegisterEventSourceA ( + IN EVENTLOG_HANDLE_A UNCServerName, + IN PRPC_STRING ModuleName, + IN PRPC_STRING RegModuleName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrRegisterEventSourceA API. + This routine allocates a structure for the context handle, finds + the matching module name and fills in the data. It returns the + pointer to the handle structure. + + +Arguments: + + UNCServerName - Not used. + + ModuleName - Name of the module that is making this call. + + RegModuleName - Not used. + + MajorVersion/MinorVersion - The version of the client. + + + LogHandle - Pointer to the place where the pointer to the + context handle structure will be placed. + +Return Value: + + Returns an NTSTATUS code and, if no error, a "handle". + +Note: + + For now, just call ElfrOpenELA. + + +--*/ +{ + + NTSTATUS Status; + PLOGMODULE Module; + UNICODE_STRING ModuleNameU; + + Status = RtlAnsiStringToUnicodeString ( + (PUNICODE_STRING) &ModuleNameU, + (PANSI_STRING) ModuleName, + TRUE + ); + + if (!NT_SUCCESS(Status)) { + return(Status); + } + + Module = GetModuleStruc ((PUNICODE_STRING) & ModuleNameU); + + RtlFreeUnicodeString (& ModuleNameU); + + return(ElfpOpenELA(UNCServerName, ModuleName, RegModuleName, + MajorVersion, MinorVersion, LogHandle, ELF_LOGFILE_WRITE)); + +} + +NTSTATUS +ElfrOpenELA ( + IN EVENTLOG_HANDLE_A UNCServerName, + IN PRPC_STRING ModuleName, + IN PRPC_STRING RegModuleName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrOpenEL API. + This routine allocates a structure for the context handle, finds + the matching module name and fills in the data. It returns the + pointer to the handle structure. + + +Arguments: + + UNCServerName - Not used. + + ModuleName - Name of the module that is making this call. + + RegModuleName - Name of module to use to determine the log file. + + MajorVersion/MinorVersion - The version of the client. + + + LogHandle - Pointer to the place where the pointer to the + context handle structure will be placed. + +Return Value: + + Returns an NTSTATUS code and, if no error, a "handle". + + +--*/ +{ + return (ElfpOpenELA ( + UNCServerName, + ModuleName, + RegModuleName, + MajorVersion, + MinorVersion, + LogHandle, + ELF_LOGFILE_READ)); +} + +NTSTATUS +ElfpOpenELA ( + IN EVENTLOG_HANDLE_A UNCServerName, + IN PRPC_STRING ModuleName, + IN PRPC_STRING RegModuleName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle, + IN ULONG DesiredAccess + ) + +/*++ + +Routine Description: + + Looks alot loke ElfrOpenELA, only this also takes a DesiredAccess parameter. + + +Arguments: + + UNCServerName - Not used. + + ModuleName - Name of the module that is making this call. + + RegModuleName - Name of module to use to determine the log file. + + MajorVersion/MinorVersion - The version of the client. + + + LogHandle - Pointer to the place where the pointer to the + context handle structure will be placed. + +Return Value: + + Returns an NTSTATUS code and, if no error, a "handle". + +--*/ +{ + NTSTATUS Status; + UNICODE_STRING ModuleNameU; + + // + // Convert the ModuleName and RegModulename to UNICODE STRINGs and call + // the UNICODE API to do the work. + // + + Status = RtlAnsiStringToUnicodeString ( + (PUNICODE_STRING)&ModuleNameU, + (PANSI_STRING)ModuleName, + TRUE + ); + + if (NT_SUCCESS(Status)) { + + // + // We *KNOW* that the UNCServerName is not used + // by ElfpOpenELW so we save ourselves some work + // and just pass in a NULL. + // + Status = ElfpOpenELW ( + (EVENTLOG_HANDLE_W) NULL, + (PRPC_UNICODE_STRING)&ModuleNameU, + NULL, + MajorVersion, + MinorVersion, + LogHandle, + DesiredAccess + ); + + RtlFreeUnicodeString(&ModuleNameU); + } + + return (Status); + UNREFERENCED_PARAMETER(UNCServerName); +} + + + + + +NTSTATUS +ElfrOpenBELA ( + IN EVENTLOG_HANDLE_A UNCServerName, + IN PRPC_STRING FileName, + IN ULONG MajorVersion, + IN ULONG MinorVersion, + OUT PIELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrOpenBEL API. + This routine allocates a structure for the context handle, finds + the matching module name and fills in the data. It returns the + pointer to the handle structure. + + +Arguments: + + UNCServerName - Not used. + + FileName - Filename of the logfile + + MajorVersion/MinorVersion - The version of the client. + + LogHandle - Pointer to the place where the pointer to the + context handle structure will be placed. + +Return Value: + + Returns an NTSTATUS code and, if no error, a "handle". + + +--*/ +{ + NTSTATUS Status; + UNICODE_STRING FileNameU; + + // + // Convert the FileName to a UNICODE STRINGs and call + // the UNICODE API to do the work. + // + + Status = RtlAnsiStringToUnicodeString ( + (PUNICODE_STRING) &FileNameU, + (PANSI_STRING) FileName, + TRUE + ); + + if (NT_SUCCESS(Status)) { + + // + // We *KNOW* that the UNCServerName is not used + // by ElfrOpenELW so we save ourselves some work + // and just pass in a NULL. + // + + Status = ElfrOpenBELW ( + (EVENTLOG_HANDLE_W) NULL, + (PRPC_UNICODE_STRING)&FileNameU, + MajorVersion, + MinorVersion, + LogHandle + ); + + RtlFreeUnicodeString(&FileNameU); + } + + return (Status); + UNREFERENCED_PARAMETER(UNCServerName); + +} + + + +NTSTATUS +ElfrReadELA ( + IN IELF_HANDLE LogHandle, + IN ULONG ReadFlags, + IN ULONG RecordNumber, + IN ULONG NumberOfBytesToRead, + IN PBYTE Buffer, + OUT PULONG NumberOfBytesRead, + OUT PULONG MinNumberOfBytesNeeded + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrReadEL API. + +Arguments: + + + +Return Value: + + Returns an NTSTATUS code, NumberOfBytesRead if the read was successful + and MinNumberOfBytesNeeded if the buffer was not big enough. + + +--*/ +{ + NTSTATUS Status; + + // + // Call the worker with the UNICODE flag + // + + return(w_ElfrReadEL ( + ELF_IREAD_ANSI, + LogHandle, + ReadFlags, + RecordNumber, + NumberOfBytesToRead, + Buffer, + NumberOfBytesRead, + MinNumberOfBytesNeeded + )); +} + + + + +NTSTATUS +ConvertStringArrayToUnicode ( + PUNICODE_STRING *pUStringArray, + PANSI_STRING *Strings, + USHORT NumStrings + ) +/*++ + +Routine Description: + + This routine takes an array of STRINGs and generates an array of + PUNICODE_STRINGs. The destination array has already been allocated + by the caller, but the structures for the UNICODE_STRINGs will need + to be allocated by this routine. + +Arguments: + + pUStringArray - Array of PUNICODE_STRINGs. + Strings - Array of PANSI_STRINGs. + NumStrings - Number of elements in the arrays. + +Return Value: + + Returns an NTSTATUS code. + +--*/ +{ + NTSTATUS Status = STATUS_SUCCESS; + USHORT i; + + // + // For each string passed in, allocate a UNICODE_STRING buffer + // and set it to the UNICODE equivalent of the string passed in. + // + for (i=0; i<NumStrings; i++) { + + if (Strings[i]) { + + pUStringArray[i] = ElfpAllocateBuffer (sizeof (UNICODE_STRING)); + + if (pUStringArray[i]) { + + Status = RtlAnsiStringToUnicodeString ( + pUStringArray[i], + (PANSI_STRING)Strings[i], + TRUE + ); + } else { + Status = STATUS_NO_MEMORY; + } + } else { + pUStringArray[i] = NULL; + } + if (!NT_SUCCESS(Status)) + break; // Jump out of loop and return status + } + + // + // Free any allocations on failure. + // + + if (!NT_SUCCESS(Status)) { + FreePUStringArray(pUStringArray, (USHORT)(i + 1)); + } + + return (Status); +} + + + +VOID +FreePUStringArray ( + PUNICODE_STRING *pUStringArray, + USHORT NumStrings + ) +/*++ + +Routine Description: + + This routine takes the PUNICODE_STRING array that was filled in by + ConvertStringArrayToUnicode and frees the buffer portion of + each unicode string and then the UNICODE structure itseld. It handles + the case where the array may not have been filled completely due + to insufficient memory. + +Arguments: + + pUStringArray - Array of PUNICODE_STRINGs. + NumStrings - Number of elements in the array. + +Return Value: + + NONE. + +--*/ +{ + USHORT i; + + for (i=0; i<NumStrings; i++) { + + if (pUStringArray[i]) { + + if (pUStringArray[i]->Buffer) { + RtlFreeUnicodeString (pUStringArray[i]); // Free the string buffer + + ElfpFreeBuffer (pUStringArray[i]); // Free the structure itself + } + } + } +} + + + +NTSTATUS +ElfrReportEventA ( + IN IELF_HANDLE LogHandle, + IN ULONG Time, + IN USHORT EventType, + IN USHORT EventCategory OPTIONAL, + IN ULONG EventID, + IN USHORT NumStrings, + IN ULONG DataSize, + IN PRPC_STRING ComputerName, + IN PRPC_SID UserSid, + IN PRPC_STRING *Strings, + IN PBYTE Data, + IN USHORT Flags, + IN OUT PULONG RecordNumber OPTIONAL, + IN OUT PULONG TimeWritten OPTIONAL + ) + +/*++ + +Routine Description: + + This is the RPC server entry point for the ElfrReportEventA API. + +Arguments: + + +Return Value: + + Returns an NTSTATUS code. + + +--*/ +{ + NTSTATUS Status; + UNICODE_STRING ComputerNameU; + PUNICODE_STRING *pUStringArray; + + // + // Convert the ComputerName to a UNICODE STRING and call the + // UNICODE API. + // + + Status = RtlAnsiStringToUnicodeString ( + (PUNICODE_STRING)&ComputerNameU, + (PANSI_STRING)ComputerName, + TRUE + ); + + if (NT_SUCCESS(Status)) { + + if (NumStrings) { + + pUStringArray = ElfpAllocateBuffer ( + NumStrings * sizeof (PUNICODE_STRING) + ); + + // + // Convert the array of STRINGs to an array of UNICODE-STRINGs + // before calling the unicode API. + // We can just use the array of Strings passed in since we + // don't need to use it anywhere else. + // + Status = ConvertStringArrayToUnicode ( + pUStringArray, + (PANSI_STRING *)Strings, + NumStrings + ); + + } else { + pUStringArray = NULL; // No strings passed in + } + + if (NT_SUCCESS(Status)) { + + Status = ElfrReportEventW ( + LogHandle, + Time, + EventType, + EventCategory, + EventID, + NumStrings, + DataSize, + (PRPC_UNICODE_STRING)&ComputerNameU, + UserSid, + (PRPC_UNICODE_STRING*)pUStringArray, + Data, + Flags, // Flags - paired event + RecordNumber,// RecordNumber | support. not in + TimeWritten // TimeWritten _ product 1 + ); + + FreePUStringArray (pUStringArray, NumStrings); + + } + + RtlFreeUnicodeString (&ComputerNameU); + } + if (pUStringArray) + ElfpFreeBuffer (pUStringArray); + + return (Status); +} diff --git a/private/eventlog/server/elfcfg.h b/private/eventlog/server/elfcfg.h new file mode 100644 index 000000000..da8adae47 --- /dev/null +++ b/private/eventlog/server/elfcfg.h @@ -0,0 +1,66 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + elfcfg.h + +Abstract: + + This file contains default settings for the eventlog service. + +Author: + + Rajen Shah (rajens) 16-Aug-1991 + +Revision History: + +--*/ + +#ifndef _EVENTDEFAULTS_ +#define _EVENTDEFAULTS_ + +// +// Default for the Application log file +// +// + +#define ELF_DEFAULT_MODULE_NAME ELF_APPLICATION_MODULE_NAME +#define ELF_APPLICATION_DEFAULT_LOG_FILE L"\\SystemRoot\\system32\\config\\appevent.evt" +#define ELF_SYSTEM_DEFAULT_LOG_FILE L"\\SystemRoot\\system32\\config\\sysevent.evt" +#define ELF_SECURITY_DEFAULT_LOG_FILE L"\\SystemRoot\\system32\\config\\secevent.evt" +#define ELF_DEFAULT_MAX_FILE_SIZE 512*1024 +#define ELF_DEFAULT_RETENTION_PERIOD 1*24*3600 + +#define ELF_GUEST_ACCESS_UNRESTRICTED 0 +#define ELF_GUEST_ACCESS_RESTRICTED 1 + +// +// Maximum size for the buffer that will read the key values from the +// registry. +// + +#define ELF_MAX_REG_KEY_INFO_SIZE 200 + +// +// String defines for the pre-defined nodes in the registry +// These are used to get to the appropriate nodes. +// + +#define REG_EVENTLOG_NODE_PATH \ + L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Eventlog" + +// +// String defines for the values for each of the configured pieces of +// information in the eventlog\logfiles node. These exist per logfile. +// +// + +#define VALUE_FILENAME L"File" +#define VALUE_MAXSIZE L"Maxsize" +#define VALUE_RETENTION L"Retention" +#define VALUE_RESTRICT_GUEST_ACCESS L"RestrictGuestAccess" +#define VALUE_DEBUG L"DBFlags" + +#endif // ifndef _EVENTDEFAULTS_ diff --git a/private/eventlog/server/elfdata.c b/private/eventlog/server/elfdata.c new file mode 100644 index 000000000..197d577a1 --- /dev/null +++ b/private/eventlog/server/elfdata.c @@ -0,0 +1,218 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + DATA.C + +Abstract: + + Thie file contains all the global data elements of the eventlog service. + +Author: + + Rajen Shah (rajens) 10-Jul-1991 + +[Environment:] + + User Mode - Win32, except for NTSTATUS returned by some functions. + +Revision History: + + 10-Jul-1991 RajenS + created + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <elfcfg.h> + +// +// Debug flag used to control ElfDbgPrint +// +DWORD ElfDebug = 0; + +// +// Handles used for the LPC port. +// +HANDLE ElfConnectionPortHandle; +HANDLE ElfCommunicationPortHandle; + +// The heads of various linked lists +// +LIST_ENTRY LogFilesHead; // Log files + +RTL_CRITICAL_SECTION LogFileCritSec; // Accessing log files + +LIST_ENTRY LogModuleHead; // Modules registered for logging + +RTL_CRITICAL_SECTION LogModuleCritSec; // Accessing log files + +LIST_ENTRY LogHandleListHead; // Context-handles for log handles + +RTL_CRITICAL_SECTION LogHandleCritSec; // Accessing log handles + +LIST_ENTRY QueuedEventListHead; // Deferred events to write + +RTL_CRITICAL_SECTION QueuedEventCritSec; // Accessing the deferred events + +LIST_ENTRY QueuedMessageListHead; // Deferred messagebox + +RTL_CRITICAL_SECTION QueuedMessageCritSec; // Accessing the deferred mb's + +HANDLE ElfDoneEvent; // Event to wait for service termination + +// +// Service-related global data +// + +SERVICE_STATUS_HANDLE ElfServiceStatusHandle; + +LPWSTR wname_Eventlogsvc = L"EVENTLOG"; // UNICODE name +CHAR name_Eventlogsvc[] = "EVENTLOG"; // ASCII name + +// +// The following resource is used to serialize access to the resources +// of the Eventlog service at the highest level. It is used to make sure +// that the threads that write/read/clear the log file(s) do not step over +// the threads that monitor the registry and deal with service control +// operations. +// +// The threads that operate on the log file(s) have Shared access to the +// resource, since they are further serialized on the file that they are +// working on. +// +// The threads that will modify the internal data structures, or the state +// of the service, need Exclusive access to the resource so that we can +// control access to the data structures and log files. +// + +RTL_RESOURCE GlobalElfResource; + +// +// This is used by the Backup API to signify which 4K block of the log it's +// currently reading. This is used to prevent a writer from overwriting this +// block while it is reading it. The event is used to let a writer block if +// it was going to overwrite the current backup block, and get pulsed when +// the backup thread moves to the next block. + +PVOID ElfBackupPointer; +HANDLE ElfBackupEvent; + +// +// Handle for the LPC thread +// +HANDLE LPCThreadHandle; + +// +// Handle for the MessageBox thread +// +HANDLE MBThreadHandle; + +// +// Handle and ID for the registry monitor thread +// +HANDLE RegistryThreadHandle=NULL; +DWORD RegistryThreadId; + +// +// Bitmask of things that have been allocated and/or started by the +// service. When the service terminates, this is what needs to be +// cleaned. +// +ULONG EventFlags; // Keep track of what is allocated + +// +// Record used to indicate the end of the event records in the file. +// +ELF_EOF_RECORD EOFRecord = {ELFEOFRECORDSIZE, + 0x11111111, + 0x22222222, + 0x33333333, + 0x44444444, + FILEHEADERBUFSIZE, + FILEHEADERBUFSIZE, + 1, + 1, + ELFEOFRECORDSIZE + }; + +// +// Default module to use if no match is found, APPLICATION +// + +PLOGMODULE ElfDefaultLogModule; + +// +// Module for the eventlog service itself +// + +PLOGMODULE ElfModule; + +// +// Handle (key) to the event log node in the registry. +// This is set up by Elfmain(). +// + +HANDLE hEventLogNode = NULL; // Initialize to NULL + +// +// Used to create a unigue module name for backup logs +// + +DWORD BackupModuleNumber; + +// +// NT well-known SIDs +// +PSVCS_GLOBAL_DATA ElfGlobalData; + +// +// Global anonymous logon sid - used in log ACL's. The only SID allocated +// specifically by the eventlog service, all others are passed in from +// the service controller in ElfGlobalData. +// + +PSID AnonymousLogonSid = NULL; + +// +// The local computer name. Used when we generate events ourself. +// + +LPWSTR LocalComputerName = NULL; +ULONG ComputerNameLength; + +// +// Shutdown Flag +// +BOOL EventlogShutdown = FALSE; + +HANDLE ElfGlobalSvcRefHandle=NULL; + +// +// This is the string used in the title bar of the Message Box +// used to display log full messages. +// GlobalMessageBoxTitle will either point to the default string, or +// to the string allocated in the format Message function. +// +WCHAR DefaultMessageBoxTitle[]=L"Eventlog Service"; +LPWSTR GlobalAllocatedMsgTitle=NULL; +LPWSTR GlobalMessageBoxTitle=DefaultMessageBoxTitle; + +#ifdef _CAIRO_ + +// +// The eventlog service links to ALERTSYS.DLL by hand (eventlog.c) after +// eventlog initialization, since this dll's initialization code requires +// a running eventlog service. +// + +HINSTANCE ghAlertSysDll = NULL; +PREPORTALERT gpfReportAlert = NULL; + +#endif // _CAIRO_ diff --git a/private/eventlog/server/elfdef.h b/private/eventlog/server/elfdef.h new file mode 100644 index 000000000..81370a5c6 --- /dev/null +++ b/private/eventlog/server/elfdef.h @@ -0,0 +1,478 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + elfdef.h + +Abstract: + + This file contains defines for the eventlog service. + +Author: + + Rajen Shah (rajens) 1-Jul-1991 + +Revision History: + +--*/ + +#ifndef _EVENTDEF_ +#define _EVENTDEF_ + +// +// Logfile object specific access type +// +#define ELF_LOGFILE_READ 0x0001 +#define ELF_LOGFILE_WRITE 0x0002 +#define ELF_LOGFILE_CLEAR 0x0004 +#define ELF_LOGFILE_START 0x0008 +#define ELF_LOGFILE_STOP 0x000C +#define ELF_LOGFILE_CONFIGURE 0x0010 +#define ELF_LOGFILE_BACKUP 0x0020 // Set iff a backup operator + // opens the security log - + // this overrides all other + // flags. + +#define ELF_LOGFILE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ + ELF_LOGFILE_READ | \ + ELF_LOGFILE_WRITE | \ + ELF_LOGFILE_CLEAR | \ + ELF_LOGFILE_START | \ + ELF_LOGFILE_STOP | \ + ELF_LOGFILE_CONFIGURE) + +// +// Three types of logfiles are defined from a security perspective: +// +// ELF_LOGFILE_SECURITY - Only Admins/LocalSystem can RW these files +// ELF_LOGFILE_SYSTEM - Only Admins/LocalSystem can W these files +// ELF_LOGFILE_APPLICATION - World can R/W these files +// +// System and Security will be SECURE, Application will be NON_SECURE +// + +#define ELF_LOGFILE_SECURITY 0x0000 +#define ELF_LOGFILE_SYSTEM 0x0001 +#define ELF_LOGFILE_APPLICATION 0x0002 + +// +// Macro to convert a given file size into one that is "acceptable" for +// eventlogging. It basically truncates it to a 64K boundary making sure +// that it is as least 64K +// + +#define ELFFILESIZE(x) ((x & 0xFFFF0000) ? (x & 0xFFFF0000) : 65536) + +// +// Macro for debug prints +// + +#if DBG +#define ElfDbgPrint(x) if (ElfDebug) DbgPrint x +#define ElfDbgPrintNC(x) DbgPrint x +#else +#define ElfDbgPrint(x) +#define ElfDbgPrintNC(x) +#endif + +// +// The largest possible buffer we would need to hold an admin alert +// information. This primarily depends on the number and length of the +// replacement strings that would be passed with the message ID. +// + +#define ELF_ADMIN_ALERT_BUFFER_SIZE 256 + +// +// Timeout defines. +// + +#define INFINITE_WAIT_TIME -1 // Wait time for events +#define ELF_GLOBAL_RESOURCE_WAIT 2000 // 2-second timeout for global resource + +// +// Signature placed before each event record in a file. Is used to +// validate where we are in a file. +// + +#define ELF_RECORD_SIGNATURE 0x654c6652 // ASCII for eLfR + +// +// Size by which to grow a log file until it reaches the max size +// + +#define ELF_DEFAULT_LOG_SIZE 65536 + +// +// Bits for whether to take the global resource exclusively or shared. +// + +#define ELF_GLOBAL_SHARED 0x0001 +#define ELF_GLOBAL_EXCLUSIVE 0x0002 + +// +// Flag bits to keep track of what resources have been allocated at INIT time +// + +#define ELF_INIT_LOGHANDLE_CRIT_SEC 0x0001 +#define ELF_INIT_GLOBAL_RESOURCE 0x0002 +#define ELF_STARTED_LPC_THREAD 0x0004 +#define ELF_STARTED_REGISTRY_MONITOR 0x0008 +#define ELF_STARTED_RPC_SERVER 0x0010 +#define ELF_INIT_LOGFILE_CRIT_SEC 0x0020 +#define ELF_INIT_WELL_KNOWN_SIDS 0x0040 +#define ELF_INIT_QUEUED_EVENT_CRIT_SEC 0x0080 +#define ELF_INIT_QUEUED_MESSAGE_CRIT_SEC 0x0100 + +// +// Security objects +// + + +#define EVENTLOG_SUBSYSTEM_NAME L"EVENTLOG SERVICE" +#define LOG_OBJECT_TYPE_NAME L"EVENTLOG LOGFILE OBJECT" + +// +// Structure containing information on each log file +// +// ActualMaxFileSize and ConfigMaxFileSize are stored in BYTEs. +// ActualMaxFileSize is the actual size of the file on the disk. +// ConfigMaxFileSize is the configured size of the file, which may not +// be the same as the actual size of the file. +// +// CurrentRecordNumber is the next absolute record number to write +// +// OldestRecordNumber is the next one to get overwritten +// +// Retention time is stored as the number of seconds. +// +// BaseAddress points to the physical beginning of the file. +// +// ViewSize is ALWAYS the size of the file in bytes. +// +// For the Flag bits, see the ELF_LOGFILE_HEADER_xxxx bits defined below. +// + +typedef struct _LOGFILE { + LIST_ENTRY FileList; + LIST_ENTRY Notifiees; // List of ChangeNotify recipients + PUNICODE_STRING LogFileName; // Full path name of log file + PUNICODE_STRING LogModuleName; // Name of default module for this log + ULONG RefCount; // Number of modules using this file + ULONG Flags; // Autowrap, dirty, etc. - See bits below + ULONG ConfigMaxFileSize; // Max it can be + ULONG ActualMaxFileSize; // How big it is now + ULONG NextClearMaxFileSize; // Can't be shrunk on the fly + ULONG CurrentRecordNumber;// The next one to be created + ULONG OldestRecordNumber; // The next one to overwrite + ULONG Retention; // Max. Retention time + ULONG NextClearRetention; // they shrank the file when they set this + HANDLE FileHandle; // Handle to open file + HANDLE SectionHandle; // Memory mapped section handle + PVOID BaseAddress; // Map view base address + ULONG ViewSize; // Mapped view size + ULONG BeginRecord; // Offset of first log record + ULONG EndRecord; // Offset of byte after last log record + PSECURITY_DESCRIPTOR Sd; // User security object for this log7 + RTL_RESOURCE Resource; +} LOGFILE, *PLOGFILE; + +// +// Structure containing information on each module that is registered to +// log events. +// + +typedef struct _LOGMODULE { + LIST_ENTRY ModuleList; + PWSTR ModuleName; // Name of module + ATOM ModuleAtom; // Atom identifying this module + PLOGFILE LogFile; // Log file for this module +#ifdef _CAIRO_ + SHORT AlertCategory; // Cairo alert category filter + SHORT AlertSeverity; // Cairo alert severity filter +#endif // _CAIRO_ +} LOGMODULE, *PLOGMODULE; + +// +// Command codes put in the request packets. +// + +#define ELF_COMMAND_READ 1 +#define ELF_COMMAND_WRITE 2 +#define ELF_COMMAND_CLEAR 3 +#define ELF_COMMAND_BACKUP 4 +#define ELF_COMMAND_WRITE_QUEUED 5 + +// +// Structures that contain the operation-specific information. +// + +typedef struct _WRITE_PKT { + DWORD Datasize; // Size of data in the buffer + PVOID Buffer; // Contains filled event log record +} WRITE_PKT, *PWRITE_PKT; + + +// +// The following flag bits are used in the READ_PKT Flag field. +// + +#define ELF_IREAD_UNICODE 0x0001 +#define ELF_IREAD_ANSI 0x0002 +#define ELF_LAST_READ_FORWARD 0x0004 + +typedef struct _READ_PKT { + ULONG Flags; // UNICODE or ANSI + ULONG BufferSize; // Bytes to read + PVOID Buffer; // User's buffer + ULONG ReadFlags; // Sequential? Forwards? Random-access? Backwards? + ULONG RecordNumber; // Where to start the READ + ULONG MinimumBytesNeeded; // For return info if buffer too small + ULONG LastSeekPos; // Last seek position in terms of bytes + ULONG LastSeekRecord; // Last seek position in terms of records + ULONG BytesRead; // Bytes read - for return to caller + ULONG RecordsRead; +} READ_PKT, *PREAD_PKT; + +typedef struct _CLEAR_PKT { + PUNICODE_STRING BackupFileName; // File to back up current log file (or NULL) +} CLEAR_PKT, *PCLEAR_PKT; + +typedef struct _BACKUP_PKT { + PUNICODE_STRING BackupFileName; // File to back up current log file (or NULL) +} BACKUP_PKT, *PBACKUP_PKT; + +// +// Flags used in the ELF_REQUEST_RECORD +// + +#define ELF_FORCE_OVERWRITE 0x01 // Ignore retention period for this write + +// +// Structure for the packet that contains all the information needed +// to perform the request. +// + +typedef struct _ELF_REQUEST_RECORD { + USHORT Flags; + NTSTATUS Status; // To return status of operation + PLOGFILE LogFile; // File on which to operate + PLOGMODULE Module; // Information on module + USHORT Command; // Operation to be performed + union { + PWRITE_PKT WritePkt; + PREAD_PKT ReadPkt; + PCLEAR_PKT ClearPkt; + PBACKUP_PKT BackupPkt; + } Pkt; +} ELF_REQUEST_RECORD, *PELF_REQUEST_RECORD; + +typedef struct _ELF_ALERT_RECORD { + DWORD TimeOut; + DWORD MessageId; + DWORD NumberOfStrings; + // array of UNICODE_STRINGs NumberOfStringsLong + // each string +} ELF_ALERT_RECORD, * PELF_ALERT_RECORD; + +typedef struct _ELF_MESSAGE_RECORD { + DWORD MessageId; + DWORD NumberOfStrings; + // UNICODE null terminated strings +} ELF_MESSAGE_RECORD, * PELF_MESSAGE_RECORD; + +// +// Record for the linked list of deferred events (these are raised by the +// eventlog service itself for writing once the current operation is complete +// + +typedef struct _ELF_QUEUED_EVENT { + LIST_ENTRY Next; + enum _ELF_QUEUED_EVENT_TYPE { + Event, + Alert, + Message + } Type; + union _ELF_QUEUED_EVENT_DATA { + ELF_REQUEST_RECORD Request; + ELF_ALERT_RECORD Alert; + ELF_MESSAGE_RECORD Message; + } Event; +} ELF_QUEUED_EVENT, *PELF_QUEUED_EVENT; + +// +// Structure containing information on callers of ElfChangeNotify +// + +typedef struct _NOTIFIEE { + LIST_ENTRY Next; + IELF_HANDLE Handle; + HANDLE Event; +} NOTIFIEE, *PNOTIFIEE; + + +// +// Structure that describes the header that is at the beginning of the +// log files. +// +// To see if there are any records in the file, one must subtract the +// EndOffset from the StartOffset (allowing for the file having wrapped +// around) and check for a difference of greater than 1. +// +// The header size is stored at the beginning and end so that it looks +// just like any other event log record (the lengths do at any rate). +// + +typedef struct _ELF_LOGFILE_HEADER { + ULONG HeaderSize; // Size of this header + ULONG Signature; // Signature field + ULONG MajorVersion; + ULONG MinorVersion; + ULONG StartOffset; // Where the first record is located + ULONG EndOffset; // The end of the last record + 1 + ULONG CurrentRecordNumber; // The next record to create + ULONG OldestRecordNumber; // The next record to overwrite + ULONG MaxSize; // Max. size when file was created + ULONG Flags; // DIRTY, etc. + ULONG Retention; // Last Retention period. + ULONG EndHeaderSize; // Size of this header +} ELF_LOGFILE_HEADER, *PELF_LOGFILE_HEADER; + +#define FILEHEADERBUFSIZE sizeof(ELF_LOGFILE_HEADER) +#define ELF_LOG_FILE_SIGNATURE 0x654c664c // ASCII for eLfL + +// +// The following flag bits are used in ELF_LOGFILE_HEADER and in the +// LOGFILE structures' Flag fields. +// + +#define ELF_LOGFILE_HEADER_DIRTY 0x0001 // File has been written to +#define ELF_LOGFILE_HEADER_WRAP 0x0002 // The file has wrapped +#define ELF_LOGFILE_LOGFULL_WRITTEN 0x0004 // Written logfull record +#define ELF_LOGFILE_ARCHIVE_SET 0x0008 // Archive bit flag + + +// +// Structure that defines the record that identifies the end of the +// circular log file. +// This record is used to identify where the last record in the circular +// buffer is located. +// +// NOTE: It is *essential* that this record is of a size that a "normal" +// event log record can never have. There is code that relies on +// this fact to detect an "EOF" record. +// +// Care must be taken to not disturb the first part of this record. It +// is used to identify an EOF record. ELFEOFUNIQUEPART must be the +// number of bytes that are constant. +// + +typedef struct _ELF_EOF_RECORD { + ULONG RecordSizeBeginning; + ULONG One; + ULONG Two; + ULONG Three; + ULONG Four; + ULONG BeginRecord; + ULONG EndRecord; + ULONG CurrentRecordNumber; + ULONG OldestRecordNumber; + ULONG RecordSizeEnd; +} ELF_EOF_RECORD, *PELF_EOF_RECORD; + +#define ELFEOFRECORDSIZE sizeof (ELF_EOF_RECORD) + +// +// The following constant is how much of the EOF record is constant, and can +// be used to identify an EOF record +// + +#define ELFEOFUNIQUEPART 5 * sizeof(ULONG) + +// +// This is used to fill the end of a log record so that the fixed portion +// of a log record doesn't split the end of the file. It must be less than +// the minimum size of any valid record +// + +#define ELF_SKIP_DWORD sizeof(ELF_EOF_RECORD) - 1 + + +// +// Time for the sender of a start or stop request to the Eventlog +// service to wait (in milliseconds) before checking on the +// Eventlog service again to see if it is done +// + +#define ELF_WAIT_HINT_TIME 20000 // 20 seconds + + +// +// Flags used by ElfpCloseLogFile +// + +#define ELF_LOG_CLOSE_NORMAL 0x0000 +#define ELF_LOG_CLOSE_FORCE 0x0001 +#define ELF_LOG_CLOSE_BACKUP 0x0002 + +// +// Structure used to store information read from the registry +// + +typedef struct _LOG_FILE_INFO { + PUNICODE_STRING LogFileName; + ULONG MaxFileSize; + ULONG Retention; + ULONG GuestAccessRestriction; +} LOG_FILE_INFO, *PLOG_FILE_INFO; + +// +// DEBUG stuff. +// + +// +// This signature is placed in the context handle for debug purposes only, +// to track down a bug in freeing the structures. +// + +#define ELF_CONTEXTHANDLE_SIGN 0x654c6648 // ASCII for eLfH + +// +// The different file open (or create) options are based on the type of file. +// The types, and their meanings are: +// +// ElfNormalLog Normal log file, opened for cached io +// ElfSecurityLog Audit logs, opened for write-thru +// ElfBackupLog Not an active log file, opened read only, cached +// + +typedef enum _ELF_LOG_TYPE { + ElfNormalLog, + ElfSecurityLog, + ElfBackupLog +} ELF_LOG_TYPE, *PELF_LOG_TYPE; + + +// +// Eventlog States (used as return codes) +// + +#define UPDATE_ONLY 0 // no change in state - just send current status. +#define STARTING 1 // the messenger is initializing. +#define RUNNING 2 // initialization completed normally - now running +#define STOPPING 3 // uninstall pending +#define STOPPED 4 // uninstalled +#define PAUSED 5 // Paused +#define PAUSING 6 // In the process of pausing +#define CONTINUING 7 // In the process of continuing + +// +// Forced Shutdown PendingCodes +// +#define PENDING TRUE +#define IMMEDIATE FALSE + + +#endif // ifndef _EVENTDEF_ diff --git a/private/eventlog/server/elfextrn.h b/private/eventlog/server/elfextrn.h new file mode 100644 index 000000000..ddf0f1fcd --- /dev/null +++ b/private/eventlog/server/elfextrn.h @@ -0,0 +1,99 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + elfextrn.h + +Abstract: + + This file contains all the externs for the global variables. + +Author: + + Rajen Shah (rajens) 10-Jul-1991 + +Revision History: + +--*/ + +extern DWORD ElfDebug; +extern HANDLE ElfConnectionPortHandle; +extern HANDLE ElfCommunicationPortHandle; + +extern PWSTR Computername; + +extern LIST_ENTRY LogFilesHead; // Log files +extern LIST_ENTRY LogModuleHead; // Modules registered for logging +extern LIST_ENTRY LogHandleListHead; // Context-handles for log handles +extern LIST_ENTRY QueuedEventListHead; // Deferred events +extern LIST_ENTRY QueuedMessageListHead; //Deferred Messagebox + +extern RTL_CRITICAL_SECTION LogFileCritSec; +extern RTL_CRITICAL_SECTION LogModuleCritSec; +extern RTL_CRITICAL_SECTION LogHandleCritSec; +extern RTL_CRITICAL_SECTION QueuedEventCritSec; +extern RTL_CRITICAL_SECTION QueuedMessageCritSec; + +extern SERVICE_STATUS ElfServiceStatus; +extern SERVICE_STATUS_HANDLE ElfServiceStatusHandle; +extern HANDLE ElfDoneEvent; + +extern LPWSTR wname_Eventlogsvc; +extern CHAR name_Eventlogsvc[]; + +extern RTL_RESOURCE GlobalElfResource; + +extern PSID AnonymousLogonSid; + +extern PVOID ElfBackupPointer; +extern HANDLE ElfBackupEvent; + +extern HANDLE LPCThreadHandle; + +extern HANDLE MBThreadHandle; + +extern HANDLE RegistryThreadHandle; +extern DWORD RegistryThreadId; + +extern ULONG EventFlags; + +extern ELF_EOF_RECORD EOFRecord; + +extern PLOGMODULE ElfDefaultLogModule; + +extern PLOGMODULE ElfModule; + +extern HANDLE hEventLogNode; + +extern DWORD BackupModuleNumber; + +extern PSVCS_GLOBAL_DATA ElfGlobalData; // WellKnownSids + + +extern LPWSTR LocalComputerName; +extern ULONG ComputerNameLength; + +extern BOOL EventlogShutdown; + +extern HANDLE ElfGlobalSvcRefHandle; + +extern WCHAR DefaultMessageBoxTitle[]; +extern LPWSTR GlobalAllocatedMsgTitle; +extern LPWSTR GlobalMessageBoxTitle; + +#ifdef _CAIRO_ + +// +// The eventlog service links to ALERTSYS.DLL by hand (eventlog.c) after +// eventlog initialization, since this dll's initialization code requires +// a running eventlog service. +// + +typedef LONG (*PREPORTALERT)(PCALERTREPORTRECORD, DWORD); + +extern HINSTANCE ghAlertSysDll; +extern PREPORTALERT gpfReportAlert; + +#endif // _CAIRO_ diff --git a/private/eventlog/server/elflpc.c b/private/eventlog/server/elflpc.c new file mode 100644 index 000000000..36ad8bb83 --- /dev/null +++ b/private/eventlog/server/elflpc.c @@ -0,0 +1,774 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + ELFLPC.C + +Abstract: + + This file contains the routines that deal with the LPC port in the + eventlog service. + +Author: + + Rajen Shah (rajens) 10-Jul-1991 + +Revision History: + + + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <ntiolog.h> // For IO_ERROR_LOG_[MESSAGE/PACKET] +#include <elflpc.h> +#include <stdlib.h> +#include <memory.h> +#include <elfextrn.h> // Computername + +#include <nt.h> // DbgPrint prototype +#include <ntrtl.h> // DbgPrint prototype +#include <ntdef.h> +#include <ntstatus.h> +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> +#include <windef.h> +#include <winbase.h> // LocalAlloc +#include <lmcons.h> +#include <string.h> +#include <lmerr.h> + +NTSTATUS +SetUpLPCPort () + + +/*++ + +Routine Description: + + This routine sets up the LPC port for the service. + + +Arguments: + + + +Return Value: + + + +Note: + + +--*/ +{ + + NTSTATUS status; + UNICODE_STRING unicodePortName; + OBJECT_ATTRIBUTES objectAttributes; + PORT_MESSAGE connectionRequest; + + + ElfDbgPrint (("[ELF] Set up LPC port\n")); + + // Initialize the handles to zero so that we can determine what to do + // if we need to clean up. + + ElfConnectionPortHandle = NULL; + ElfCommunicationPortHandle = NULL; + + // + // Create the LPC port. + // + RtlInitUnicodeString( &unicodePortName, ELF_PORT_NAME_U ); + + InitializeObjectAttributes( + &objectAttributes, + &unicodePortName, + OBJ_CASE_INSENSITIVE, + NULL, + NULL + ); + + status = NtCreatePort( + &ElfConnectionPortHandle, + &objectAttributes, + 0, + ELF_PORT_MAX_MESSAGE_LENGTH, + ELF_PORT_MAX_MESSAGE_LENGTH * 32 + ); + + if ( !NT_SUCCESS(status) ) { + ElfDbgPrintNC(( "[ELF] Port not created\n" )); + goto exit; + } + + // + // Start listening for the system thread's connection to the port. Note + // that it is OK if it happens to call NtConnectPort first--it will + // simply block until this call to NtListenPort occurs. + // + ElfDbgPrint(( "[ELF] Listening to port.\n" )); + + connectionRequest.u1.s1.TotalLength = sizeof(connectionRequest); + connectionRequest.u1.s1.DataLength = (CSHORT)0; + status = NtListenPort( + ElfConnectionPortHandle, + &connectionRequest + ); + + if ( !NT_SUCCESS(status) ) { + ElfDbgPrintNC(( "[ELF] NtListenPort failed: %X\n", status )); + goto exit; + } + + // + // The system thread has initiated the connection. Accept the connection. + // + // BUGBUG We need some security check here. + // + ElfDbgPrint(( "[ELF] Accepting connection to port.\n" )); + + status = NtAcceptConnectPort( + &ElfCommunicationPortHandle, + NULL, // PortContext + &connectionRequest, + TRUE, // AcceptConnection + NULL, // ServerView + NULL // ClientView + ); + + if ( !NT_SUCCESS(status) ) { + ElfDbgPrintNC(( "[ELF] NtAcceptConnectPort failed: %X\n", status )); + goto exit; + } + + + // + // Complete the connection to the port, thereby releasing the system + // thread waiting in NtConnectPort. + // + + ElfDbgPrint(( "[ELF] Completing connection to port.\n" )); + + status = NtCompleteConnectPort( ElfCommunicationPortHandle ); + + if ( !NT_SUCCESS(status) ) { + ElfDbgPrintNC(( "[ELF] NtCompleteConnectPort failed: %X\n", + status )); + goto exit; + } + +exit: + + // + // Close open handles and shut down if necessary. + // + + if ( !NT_SUCCESS(status) && ElfConnectionPortHandle != NULL ) { + NtClose( ElfConnectionPortHandle ); + } + + if ( !NT_SUCCESS(status) && ElfCommunicationPortHandle != NULL ) { + NtClose( ElfConnectionPortHandle ); + } + + return(status); + +} + + + +NTSTATUS +ElfProcessLPCPacket ( PIO_ERROR_LOG_MESSAGE pIoErrorLogMessage + ) + +/*++ + +Routine Description: + + This routine takes the packet received from the LPC port and processes it. + The only thing that comes in thru the LPC port are packets generated by + device drivers and written to this port by the IO Subsystem. The packet is + an IO_ERROR_LOG_MESSAGE. The logfile will be system, the module name will + be the driver that generated the packet, the SID will always be NULL and + there will always be one string, which will be the device name. + + It extracts the information from the LPC packet, and then calls the + common routine to do the work of formatting the data into + an event record and writing it out to the log file. + + +Arguments: + + pIoErrorLogMessage - Pointer to the data portion of the packet just + received through the LPC port. + + +Return Value: + + Status of this operation. + + +--*/ + +{ + static PLOGMODULE SystemModule = NULL; + + NTSTATUS status; + ELF_REQUEST_RECORD Request; + WRITE_PKT WritePkt; + + UNICODE_STRING SystemString; + ULONG RecordLength; + PEVENTLOGRECORD EventLogRecord; + LPWSTR DestinationString, SourceString; + PBYTE BinaryData; + ULONG PadSize; + LARGE_INTEGER Time; + ULONG TimeWritten; + PULONG pEndLength; + ULONG i = 0; + PWCHAR pwch; + PWCHAR pwStart; + PWCHAR pwEnd; + ULONG StringLength; + + try { + + // + // Validate the packet, First make sure there are the correct + // number of NULL terminated strings, and remember the + // total number of bytes to copy + // + + pwStart = pwch = (PWCHAR) ((PBYTE) pIoErrorLogMessage + + pIoErrorLogMessage->EntryData.StringOffset); + + pwEnd = (PWCHAR) ((PBYTE) pIoErrorLogMessage + + pIoErrorLogMessage->Size); + + while (pwch < pwEnd && + i < pIoErrorLogMessage->EntryData.NumberOfStrings) { + if (*pwch == L'\0') { + i++; + } + pwch++; + } + StringLength = (pwch - pwStart) * sizeof(WCHAR); + + // + // Now make sure everything in the packet is true + // + + if ((i != pIoErrorLogMessage->EntryData.NumberOfStrings) + + || + + (pIoErrorLogMessage->DriverNameOffset + + pIoErrorLogMessage->DriverNameLength >= + pIoErrorLogMessage->Size) + + || + + + (pIoErrorLogMessage->EntryData.StringOffset >= + pIoErrorLogMessage->Size) + + || + + (FIELD_OFFSET(IO_ERROR_LOG_MESSAGE, EntryData) + + FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) + + pIoErrorLogMessage->EntryData.DumpDataSize >= + pIoErrorLogMessage->Size)) { + + // + // It's a bad packet, log it and return + // + + ElfDbgPrintNC(("[ELF] Bad packet from LPC port\n")); + ElfpCreateElfEvent(EVENT_BadDriverPacket, + EVENTLOG_ERROR_TYPE, + 0, // EventCategory + 0, // NumberOfStrings + NULL, // Strings + pIoErrorLogMessage, // Data + pIoErrorLogMessage->Size, // Datalength + 0 // flags + ); + return(STATUS_UNSUCCESSFUL); + } + } + except (EXCEPTION_EXECUTE_HANDLER) { + + // + // It's a bad packet, log it and return + // + + ElfDbgPrintNC(("[ELF] Bad packet from LPC port\n")); + ElfpCreateElfEvent(EVENT_BadDriverPacket, + EVENTLOG_ERROR_TYPE, + 0, // EventCategory + 0, // NumberOfStrings + NULL, // Strings + pIoErrorLogMessage, // Data + pIoErrorLogMessage->Size, // Datalength + 0 // flags + ); + return(STATUS_UNSUCCESSFUL); + + } + + // + // We're going to need this everytime, so just get it once + // + + if (!SystemModule) { + + // + // Get the system module to log driver events + // + + RtlInitUnicodeString(&SystemString, ELF_SYSTEM_MODULE_NAME); + SystemModule = GetModuleStruc (&SystemString); + ASSERT(SystemModule); // GetModuleStruc never returns NULL + + } + + // + // The packet should be an IO_ERROR_LOG_MESSAGE + // + + ASSERT(pIoErrorLogMessage->Type == IO_TYPE_ERROR_MESSAGE); + + // + // Set up write packet in request packet + // + + Request.Pkt.WritePkt = &WritePkt; + Request.Flags = 0; + + // + // Generate any additional information needed in the record. + // + + // TIMEWRITTEN + // We need to generate a time when the log is written. This + // gets written in the log so that we can use it to test the + // retention period when wrapping the file. + // + + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970( + &Time, + &TimeWritten + ); + + // + // Determine how big a buffer is needed for the eventlog record. + // + + RecordLength = sizeof(EVENTLOGRECORD) + + ComputerNameLength // computername + + 2 * sizeof(WCHAR) // term's + + pIoErrorLogMessage->Size + - FIELD_OFFSET(IO_ERROR_LOG_MESSAGE, EntryData) + + sizeof(RecordLength); // final len + + // + // Determine how many pad bytes are needed to align to a DWORD + // boundary. + // + + PadSize = sizeof(ULONG) - (RecordLength % sizeof(ULONG)); + + RecordLength += PadSize; // True size needed + + // + // Allocate the buffer for the Eventlog record + // + + EventLogRecord = (PEVENTLOGRECORD) ElfpAllocateBuffer(RecordLength); + + if (EventLogRecord != (PEVENTLOGRECORD) NULL) { + + // + // Fill up the event record + // + + EventLogRecord->Length = RecordLength; + RtlTimeToSecondsSince1970( + &pIoErrorLogMessage->TimeStamp, + &EventLogRecord->TimeGenerated + ); + EventLogRecord->Reserved = ELF_LOG_FILE_SIGNATURE; + EventLogRecord->TimeWritten = TimeWritten; + EventLogRecord->EventID = pIoErrorLogMessage->EntryData.ErrorCode; + + // set EventType based on the high order nibble of + // pIoErrorLogMessage->EntryData.ErrorCode + + if (NT_INFORMATION(pIoErrorLogMessage->EntryData.ErrorCode)) { + + EventLogRecord->EventType = EVENTLOG_INFORMATION_TYPE; + + } + else if (NT_WARNING(pIoErrorLogMessage->EntryData.ErrorCode)) { + + EventLogRecord->EventType = EVENTLOG_WARNING_TYPE; + + } + else if (NT_ERROR(pIoErrorLogMessage->EntryData.ErrorCode)) { + + EventLogRecord->EventType = EVENTLOG_ERROR_TYPE; + + } + else { + + // + // Unknown, set to error + // + + EventLogRecord->EventType = EVENTLOG_ERROR_TYPE; + + } + + EventLogRecord->NumStrings = + pIoErrorLogMessage->EntryData.NumberOfStrings; + EventLogRecord->EventCategory = + pIoErrorLogMessage->EntryData.EventCategory; + EventLogRecord->StringOffset = sizeof(EVENTLOGRECORD) + + pIoErrorLogMessage->DriverNameLength + ComputerNameLength; + EventLogRecord->DataLength = + FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) + + pIoErrorLogMessage->EntryData.DumpDataSize; + EventLogRecord->DataOffset = EventLogRecord->StringOffset + + StringLength; + EventLogRecord->UserSidLength = 0; + EventLogRecord->UserSidOffset = 0; + + // + // Fill in the variable-length fields + + // MODULENAME + // + // Use the driver name as the module name, since it's location is + // described by an offset from the start of the IO_ERROR_LOG_MESSAGE + // turn it into a pointer + // + + DestinationString = (LPWSTR)((LPBYTE)EventLogRecord + + sizeof(EVENTLOGRECORD)); + SourceString = (LPWSTR)((LPBYTE) pIoErrorLogMessage + + pIoErrorLogMessage->DriverNameOffset); + + RtlMoveMemory(DestinationString, SourceString, + pIoErrorLogMessage->DriverNameLength); + + // + // Make sure it's NULL terminated + // + + DestinationString = (LPWSTR)((LPBYTE) DestinationString + + pIoErrorLogMessage->DriverNameLength) - 1; + if (*DestinationString != L'\0') { + *(++DestinationString) = L'\0'; + } + + DestinationString++; + + // COMPUTERNAME + // + + RtlMoveMemory(DestinationString, LocalComputerName, + ComputerNameLength); + + // + // Make sure it's NULL terminated + // + + DestinationString = (LPWSTR)((LPBYTE) DestinationString + + ComputerNameLength) - 1; + if (*DestinationString != L'\0') { + *(++DestinationString) = L'\0'; + } + + DestinationString++; + + // STRING + // + + SourceString = pwStart; + + RtlMoveMemory(DestinationString, SourceString, StringLength); + + DestinationString += (StringLength / 2); + + // BINARY DATA + // + BinaryData = (LPBYTE) DestinationString; + + + RtlMoveMemory (BinaryData, & pIoErrorLogMessage->EntryData, + FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) + + pIoErrorLogMessage->EntryData.DumpDataSize); + + // LENGTH at end of record + // + + pEndLength = (PULONG)((LPBYTE) EventLogRecord + RecordLength - + sizeof(ULONG)); + *pEndLength = RecordLength; + + // + // Set up request packet. + // Link event log record into the request structure. + // + + Request.Module = SystemModule; + Request.LogFile = Request.Module->LogFile; + Request.Command = ELF_COMMAND_WRITE; + Request.Pkt.WritePkt->Buffer = (PVOID)EventLogRecord; + Request.Pkt.WritePkt->Datasize = RecordLength; + + // + // Perform the operation + // + + ElfPerformRequest( &Request ); + + // + // Free up the buffer + // + + ElfpFreeBuffer(EventLogRecord ); + + status = Request.Status; // Set status of WRITE + + } else { + status = STATUS_NO_MEMORY; + } + + return (status); +} + + + +NTSTATUS +ElfProcessLPCCalls ( + ) + +/*++ + +Routine Description: + + This routine waits for messages to come through the LPC port to + the system thread. When one does, it calls the appropriate routine to + handle the API, then replies to the system thread indicating that the + call has completed if the message was a request, if it was a datagram, + it just waits for the next message. + +Arguments: + + +Return Value: + +--*/ + +{ + NTSTATUS status; + + BOOL SendReply = FALSE; + + ELF_REPLY_MESSAGE replyMessage; + PELFIOPORTMSG receiveMessage; + + // + // Loop dispatching API requests. + // + + receiveMessage = ElfpAllocateBuffer(ELF_PORT_MAX_MESSAGE_LENGTH + + sizeof(PORT_MESSAGE)); + if (!receiveMessage) { + return(STATUS_NO_MEMORY); + } + + while ( TRUE ) { + + // + // On the first call to NtReplyWaitReceivePort, don't send a + // reply since there's nobody to reply to. However, on subsequent + // calls the reply to the message from the prior time if that message + // wasn't a LPC_DATAGRAM + // + + status = NtReplyWaitReceivePort( + ElfConnectionPortHandle, + NULL, // PortContext + (PPORT_MESSAGE)( SendReply ? &replyMessage : NULL), + (PPORT_MESSAGE) receiveMessage + ); + + if ( !NT_SUCCESS(status) ) { + ElfDbgPrintNC(( "[ELF] ElfProcessLPCCalls: NtReplyWaitReceivePort failed: %X\n", + status )); + return status; + } + + ElfDbgPrint(( "[ELF] ElfProcessLPCCalls: received message\n" )); + + // + // Take the record received and perform the operation. Strip off + // the PortMessage and just send the packet + // + + + // + // Set up the response message to be sent on the next call to + // NtReplyWaitReceivePort if this wasn't a datagram. + // 'status' contains the status to return from this call. + // Only process messages that are LPC_REQUEST or LPC_DATAGRAM + // + + if (receiveMessage->PortMessage.u2.s2.Type == LPC_REQUEST) { + status = ElfProcessLPCPacket (& receiveMessage->IoErrorLogMessage); + + replyMessage.PortMessage.u1.s1.DataLength = + sizeof(replyMessage) - sizeof(PORT_MESSAGE); + replyMessage.PortMessage.u1.s1.TotalLength = sizeof(replyMessage); + replyMessage.PortMessage.u2.ZeroInit = 0; + replyMessage.PortMessage.ClientId = + receiveMessage->PortMessage.ClientId; + replyMessage.PortMessage.MessageId = + receiveMessage->PortMessage.MessageId; + replyMessage.Status = status; + + SendReply = TRUE; + } + else if (receiveMessage->PortMessage.u2.s2.Type == LPC_DATAGRAM) { + status = ElfProcessLPCPacket (& receiveMessage->IoErrorLogMessage); + SendReply = FALSE; + } + else { + // + // We received a message type we didn't expect, probably due to + // error. BUGBUG - write an event + // + + ElfDbgPrintNC(("[ELF] Unexpected message type received on LPC port\n")); + ElfDbgPrintNC(("[ELF] Messaage type = %d\n", + receiveMessage->PortMessage.u2.s2.Type)); + + } + } + +} // ElfProcessLPCCalls + + + +DWORD +MainLPCThread ( + LPVOID LPCThreadParm + ) + +/*++ + +Routine Description: + + This is the main thread that monitors the LPC port from the I/O system. + It takes care of creating the LPC port, and waiting for input, which + it then transforms into the right operation on the event log. + + +Arguments: + + NONE + +Return Value: + + NONE + +--*/ + +{ + NTSTATUS Status; + + ElfDbgPrint(( "[ELF] Inside LPC thread\n" )); + + Status = SetUpLPCPort(); + + if (NT_SUCCESS(Status)) { + + // + // Loop forever. This thread will be killed when the service terminates. + // + while (TRUE) { + + Status = ElfProcessLPCCalls (); + + } + + } + ElfDbgPrintNC (("[ELF] Error from SetUpLPCPort. Status = %lx\n", Status)); + + return (Status); + + UNREFERENCED_PARAMETER ( LPCThreadParm ); +} + + + +BOOL +StartLPCThread () + +/*++ + +Routine Description: + + This routine starts up the thread that monitors the LPC port. + +Arguments: + + NONE + +Return Value: + + TRUE if thread creation succeeded, FALSE otherwise. + +Note: + + +--*/ +{ + DWORD error; + DWORD ThreadId; + + ElfDbgPrint(( "[ELF] Start up the LPC thread\n" )); + + // + // Start up the actual thread. + // + + LPCThreadHandle = CreateThread( + NULL, // lpThreadAttributes + 4096, // dwStackSize + MainLPCThread, // lpStartAddress + NULL, // lpParameter + 0L, // dwCreationFlags + &ThreadId // lpThreadId + ); + + if ( LPCThreadHandle == NULL ) { + error = GetLastError(); + ElfDbgPrintNC(( "[ELF]: LPCThread - CreateThread failed: %ld\n", error )); + return (FALSE); + } + return (TRUE); +} diff --git a/private/eventlog/server/elflpc.h b/private/eventlog/server/elflpc.h new file mode 100644 index 000000000..e11f526cc --- /dev/null +++ b/private/eventlog/server/elflpc.h @@ -0,0 +1,54 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + elflpc.h + +Abstract: + + This file contains defines for LPC for the eventlog service + +Author: + + Rajen Shah (rajens) 10-Jul-1991 + +Revision History: + +--*/ + +#ifndef _ELFLPC_ +#define _ELFLPC_ + +// Name of the LPC port for kernel objects to communicate with the eventlog +// service +#define ELF_PORT_NAME "\\ErrorLogPort" +#define ELF_PORT_NAME_U L"\\ErrorLogPort" + +// +// Max size of data sent to the eventlogging service through the LPC port. +// + +#define ELF_PORT_MAX_MESSAGE_LENGTH IO_ERROR_LOG_MESSAGE_LENGTH + +// +// Structure that is passed in from the system thread to the LPC port +// + +typedef struct _ELFIOPORTMSG { + PORT_MESSAGE PortMessage; + IO_ERROR_LOG_MESSAGE IoErrorLogMessage; +} ELFIOPORTMSG, *PELFIOPORTMSG; + +// +// Structure for the message as a reply from the eventlogging service to +// the LPC client. +// + +typedef struct _ELF_REPLY_MESSAGE { + PORT_MESSAGE PortMessage; + NTSTATUS Status; +} ELF_REPLY_MESSAGE, *PELF_REPLY_MESSAGE; + +#endif // ifndef _ELFLPC_ diff --git a/private/eventlog/server/elfproto.h b/private/eventlog/server/elfproto.h new file mode 100644 index 000000000..a6a28fa42 --- /dev/null +++ b/private/eventlog/server/elfproto.h @@ -0,0 +1,384 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + elfproto.h + +Abstract: + + This file contains the prototypes for the Eventlog service. + +Author: + + Rajen Shah (rajens) 12-Aug-1991 + +Revision History: + +--*/ + +#ifndef _ELFPROTO_ +#define _ELFPROTO + +// +// Other prototypes +// +PVOID +ElfpAllocateBuffer (ULONG size); + +VOID +ElfpFreeBuffer (PVOID BufPtr); + +VOID +ElfPerformRequest( PELF_REQUEST_RECORD Request); + + +PLOGMODULE +GetModuleStruc( PUNICODE_STRING ModuleName ); + +PLOGMODULE +FindModuleStrucFromAtom ( ATOM Atom ); + + +VOID +ElfControlResponse( + DWORD); + +VOID +ElfAnnounceServiceStatus(); + +VOID +Elfmain ( + DWORD argc, + LPWSTR argv[] + ); + +VOID +ElfPrepareForPause(); + +VOID +ElfPrepareForContinue(); + +VOID +IELF_HANDLE_rundown( + IELF_HANDLE ElfHandle + ); + +VOID +LinkContextHandle( + IELF_HANDLE LogHandle + ); + +VOID +UnlinkContextHandle ( + IELF_HANDLE LogHandle + ); + +VOID +LinkLogModule ( + PLOGMODULE pLogModule, + ANSI_STRING * pModuleNameA + ); + +VOID +UnlinkLogModule ( + PLOGMODULE pLogModule + ); + +VOID +LinkLogFile ( + PLOGFILE pLogFile + ); + +VOID +UnlinkLogFile ( + PLOGFILE pLogFile + ); + +VOID +GetGlobalResource (DWORD Type + ); + +VOID +ReleaseGlobalResource(); + +NTSTATUS +SetUpDataStruct ( + PUNICODE_STRING LogFileName, + ULONG MaxFileSize, + ULONG Retention, + ULONG GuestAccessRestriction, + PUNICODE_STRING ModuleName, + HANDLE hLogFile, + ELF_LOG_TYPE LogType + ); + +NTSTATUS +SetUpModules ( + HANDLE hLogFile, + PLOGFILE pLogFile, + BOOLEAN bAllowDupes + ); + +BOOL +StartLPCThread (); + +VOID +StopLPCThread (); + +BOOL +ElfStartRegistryMonitor (); + +VOID +StopRegistryMonitor (); + +NTSTATUS +ElfImpersonateClient( + VOID + ); + +NTSTATUS +ElfRevertToSelf( + VOID + ); + +NTSTATUS +ReadRegistryInfo ( + HANDLE hLogFiles, + PUNICODE_STRING SubKeyName, + PLOG_FILE_INFO LogFileInfo + ); + +NTSTATUS +ElfOpenLogFile ( + PLOGFILE pLogFile, + ELF_LOG_TYPE LogType + ); + +NTSTATUS +ElfpCloseLogFile ( + PLOGFILE pLogFile, + DWORD Flags + ); + +BOOL +ValidFilePos ( + PVOID Position, + PVOID BeginningRecord, + PVOID EndingRecord, + PVOID PhysicalEOF, + PVOID BaseAddress + ); + +VOID +ElfpCleanUp ( + ULONG EventFlags + ); + +NTSTATUS +ElfpCopyFile ( + IN HANDLE SourceHandle, + IN PUNICODE_STRING TargetFileName + ); + +VOID +FreeModuleAndLogFileStructs (VOID); + +NTSTATUS +ElfpFlushFiles (VOID); + + +VOID +InvalidateContextHandlesForLogFile ( + PLOGFILE pLogFile + ); + +VOID +FixContextHandlesForRecord ( + DWORD RecordOffset, + DWORD NewRecordOffset + ); + +PLOGFILE +FindLogFileFromName ( + PUNICODE_STRING LogFileName + ); + +BOOL +SendAdminAlert ( + ULONG MessageID, + ULONG NumStrings, + UNICODE_STRING *pStrings + ); + +PVOID +NextRecordPosition ( + ULONG ReadFlags, + PVOID CurrPosition, + ULONG CurrRecordLength, + PVOID BeginRecord, + PVOID EndRecord, + PVOID PhysicalEOF, + PVOID PhysStart + ); + +VOID +NotifyChange ( + PLOGFILE pLogFile + ); + + +VOID +WriteQueuedEvents ( + ); + +VOID +FlushQueuedEvents ( + ); + +VOID +PerformWriteRequest ( PELF_REQUEST_RECORD Request + ); + +NTSTATUS +ElfpCreateLogFileObject( + PLOGFILE LogFile, + DWORD Type, + ULONG GuestAccessRestriction + ); + +VOID +ElfpDeleteLogFileObject( + PLOGFILE LogFile + ); + +VOID +ElfpCloseAudit( + IN LPWSTR SubsystemName, + IN IELF_HANDLE ContextHandle + ); + +NTSTATUS +ElfpAccessCheckAndAudit( + IN LPWSTR SubsystemName, + IN LPWSTR ObjectTypeName, + IN LPWSTR ObjectName, + IN OUT IELF_HANDLE ContextHandle, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN ACCESS_MASK DesiredAccess, + IN PGENERIC_MAPPING GenericMapping, + IN BOOL ForSecurityLog + ); + +NTSTATUS +ElfCreateWellKnownSids( + VOID + ); + +VOID +ElfFreeWellKnownSids( + VOID + ); + +NTSTATUS +ElfCreateAndSetSD( + IN PRTL_ACE_DATA AceData, + IN ULONG AceCount, + IN PSID OwnerSid OPTIONAL, + IN PSID GroupSid OPTIONAL, + OUT PSECURITY_DESCRIPTOR *NewDescriptor + ); + +NTSTATUS +ElfCreateUserSecurityObject( + IN PRTL_ACE_DATA AceData, + IN ULONG AceCount, + IN PSID OwnerSid, + IN PSID GroupSid, + IN BOOLEAN IsDirectoryObject, + IN PGENERIC_MAPPING GenericMapping, + OUT PSECURITY_DESCRIPTOR *NewDescriptor + ); + +VOID +ElfpCreateElfEvent( + IN ULONG EventId, + IN USHORT EventType, + IN USHORT EventCategory, + IN USHORT NumStrings, + IN LPWSTR * Strings, + IN LPVOID Data, + IN ULONG DataSize, + IN USHORT Flags + ); + + +VOID +ElfpCreateQueuedAlert( + DWORD MessageId, + DWORD NumberOfStrings, + LPWSTR Strings[] + ); + +VOID +ElfpCreateQueuedMessage( + DWORD MessageId, + DWORD NumberOfStrings, + LPWSTR Strings[] + ); + +DWORD +ElfStatusUpdate( + IN DWORD NewState + ); + +DWORD +GetElState ( + VOID + ); + +VOID +ElfpGenerateLogClearedEvent( + IELF_HANDLE LogHandle + ); + +VOID +ElInitStatus( + VOID + ); + +VOID +ElCleanupStatus( + VOID + ); + +DWORD +ElfBeginForcedShutdown( + IN BOOL PendingCode, + IN DWORD ExitCode, + IN DWORD ServiceSpecificCode + ); + +#ifdef _CAIRO_ + +BOOL +GetSourceAlertFilterFromRegistry( + HANDLE hKeyLogFile, + UNICODE_STRING * pswszSourceName, + SHORT * psCategoryFilter, + SHORT * psSeverityFilter); + +BOOL +TestFilter( + WORD NTEventType, + SHORT sAlertSeverity); + +HRESULT +RaiseCairoAlert( + PLOGMODULE pLogModule, + EVENTLOGRECORD * pEventLogRecord); + +#endif // _CAIRO_ + +#endif // ifndef _ELFPROTO_ diff --git a/private/eventlog/server/elfrpc.c b/private/eventlog/server/elfrpc.c new file mode 100644 index 000000000..0aa37dbeb --- /dev/null +++ b/private/eventlog/server/elfrpc.c @@ -0,0 +1,216 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + ELFRPC.C + +Abstract: + + This file contains the routines that handle the RPC calls to the + Eventlog service via the Elf APIs. + +Author: + + Rajen Shah (rajens) 16-Jul-1991 + +Revision History: + + 15-Feb-1995 MarkBl + Unlink the ElfHandle *prior* to unlinking the module. Otherwise, + if another thread happens to coincidentally be in the routine, + FindModuleStrucFromAtom, it's not going to get a hit for the + module atom. + + 18-May-1994 Danl + IELF_HANDLE_rundown: If the eventlog has been shutdown, then + we want to skip the code in this routine because most of the + resources will have been free'd. + + 31-Jan-1994 Danl + IELF_HANDLE_rundown: Notifiee structure was being free'd and then + referenced when it's handle was removed from the list. Now this + is fixed so it advances to the next Notifiee in the list BEFORE the + buffer is free'd. + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> + + + +extern DWORD ElState; + + +VOID +IELF_HANDLE_rundown( + IELF_HANDLE ElfHandle + ) + +/*++ + +Routine Description: + + This routine is called by the server RPC runtime to run down a + Context Handle and to free any allocated data. It also does all + the work for ElfrCloseEL. + + It has to undo whatever was done in ElfrOpenEventLog in terms of + allocating memory. + +Arguments: + + None. + +Return Value: + +--*/ + +{ + PLOGMODULE pModule; + NTSTATUS Status; + PNOTIFIEE Notifiee; + PNOTIFIEE NotifieeToDelete; + + // + // Generate an Audit if neccessary + // + ElfpCloseAudit(L"EventLog",ElfHandle); + + // + // If the eventlog service is stopped or in the process of + // stopping, then we just want to ignore this rundown and return. + // + // Note, we don't bother calling GetElState() because that uses + // a critical section which may not exist anymore is the + // eventlog service has been shutdown. + // + // The eventlog isn't designed to be shutdown (except when the + // system is shutdown), so it isn't real good at cleaning up + // its resources. + // + if (ElState == STOPPING || ElState == STOPPED) { + return; + } + + ElfDbgPrint(( "[ELF] Run down context handle - 0x%lx\n", ElfHandle )); + + if (ElfHandle->Signature != ELF_CONTEXTHANDLE_SIGN) { + ElfDbgPrint (("[ELF] Invalid context handle in rundown routine.\n")); + return; + } + + pModule = FindModuleStrucFromAtom(ElfHandle->Atom); + + // + // This shouldn't ever happen. It means that a handle got created, + // and it's module went away without the handle getting closed. + // + + if (!pModule) { + ElfDbgPrint(("[ELF] - Could not find module for Atom %d on close\n", + ElfHandle->Atom)); + return; + } + + UnlinkContextHandle (ElfHandle); // Unlink it from the linked list + + // + // If this handle was for a backup module, then we need to + // close the file and clean up the data structures. The standard logs + // (application, system and security) are never freed. + // + + if (ElfHandle->Flags & ELF_LOG_HANDLE_BACKUP_LOG) { + + Status = ElfpCloseLogFile (pModule->LogFile, ELF_LOG_CLOSE_BACKUP); + + UnlinkLogModule(pModule); + ElfpFreeBuffer(pModule->ModuleName); + + // What about DECREMENTING RefCount??? -Danl 2/9/94 + + if (pModule->LogFile->RefCount == 0) { + UnlinkLogFile(pModule->LogFile); + RtlDeleteResource ( &pModule->LogFile->Resource ); + RtlDeleteSecurityObject(&pModule->LogFile->Sd); + ElfpFreeBuffer (pModule->LogFile->LogFileName); + ElfpFreeBuffer (pModule->LogFile); + } + ElfpFreeBuffer(pModule); + + } + else { + + // + // See if this handle had a ElfChangeNotify outstanding, and if so, + // remove it from the list. ElfChangeNotify can't be called with a + // handle to a backup file. + + // + // Get exclusive access to the log file. This will ensure no one + // else is accessing the file. + // + + RtlAcquireResourceExclusive ( + &pModule->LogFile->Resource, + TRUE // Wait until available + ); + + + // + // Walk the linked list and remove any entries for this handle + // + + Notifiee = CONTAINING_RECORD ( + pModule->LogFile->Notifiees.Flink, + struct _NOTIFIEE, + Next + ); + + + while (Notifiee->Next.Flink != pModule->LogFile->Notifiees.Flink) { + + // + // If it's for this handle, remove it from the list + // + + if (Notifiee->Handle == ElfHandle) { + + RemoveEntryList(&Notifiee->Next); + NtClose(Notifiee->Event); + NotifieeToDelete = Notifiee; + + Notifiee = CONTAINING_RECORD( + Notifiee->Next.Flink, + struct _NOTIFIEE, + Next); + + ElfpFreeBuffer(NotifieeToDelete); + } + else { + + Notifiee = CONTAINING_RECORD ( + Notifiee->Next.Flink, + struct _NOTIFIEE, + Next + ); + } + } + + // + // Free the resource + // + + RtlReleaseResource ( &pModule->LogFile->Resource ); + } + + ElfpFreeBuffer (ElfHandle); // Free the context-handle structure + + return; +} diff --git a/private/eventlog/server/elfsec.c b/private/eventlog/server/elfsec.c new file mode 100644 index 000000000..5d042cb38 --- /dev/null +++ b/private/eventlog/server/elfsec.c @@ -0,0 +1,920 @@ + +/*++ + +Copyright (c) 1992 Microsoft Corporation + +Module Name: + + elfsec.c + + +Author: + + Dan Hinsley (danhi) 28-Mar-1992 + +Environment: + + Calls NT native APIs. + +Revision History: + + 27-Oct-1993 danl + Make Eventlog service a DLL and attach it to services.exe. + Removed functions that create well-known SIDs. This information + is now passed into the Elfmain as a Global data structure containing + all well-known SIDs. + 28-Mar-1992 danhi + created - based on scsec.c in svcctrl by ritaw + 03-Mar-1995 markbl + Added guest & anonymous logon log access restriction feature. + +--*/ + +#include <eventp.h> +#include <elfcfg.h> + +#define PRIVILEGE_BUF_SIZE 512 + +//-------------------------------------------------------------------// +// // +// Local function prototypes // +// // +//-------------------------------------------------------------------// + +DWORD +ElfpGetPrivilege( + IN DWORD numPrivileges, + IN PULONG pulPrivileges + ); + +DWORD +ElfpReleasePrivilege( + VOID + ); + +//-------------------------------------------------------------------// +// // +// Structure that describes the mapping of generic access rights to // +// object specific access rights for a LogFile object. // +// // +//-------------------------------------------------------------------// + +static GENERIC_MAPPING LogFileObjectMapping = { + + STANDARD_RIGHTS_READ | // Generic read + ELF_LOGFILE_READ, + + STANDARD_RIGHTS_WRITE | // Generic write + ELF_LOGFILE_WRITE, + + STANDARD_RIGHTS_EXECUTE | // Generic execute + ELF_LOGFILE_START | + ELF_LOGFILE_STOP | + ELF_LOGFILE_CONFIGURE, + + ELF_LOGFILE_ALL_ACCESS // Generic all + }; + + +//-------------------------------------------------------------------// +// // +// Functions // +// // +//-------------------------------------------------------------------// + +NTSTATUS +ElfpCreateLogFileObject( + PLOGFILE LogFile, + DWORD Type, + ULONG GuestAccessRestriction + ) +/*++ + +Routine Description: + + This function creates the security descriptor which represents + an active log file. + +Arguments: + + LogFile - pointer the the LOGFILE structure for this logfile + +Return Value: + + +--*/ +{ + NTSTATUS Status; + DWORD NumberOfAcesToUse; + +#define ELF_LOGFILE_OBJECT_ACES 10 // Number of ACEs in this DACL + + RTL_ACE_DATA AceData[ELF_LOGFILE_OBJECT_ACES] = { + + {ACCESS_DENIED_ACE_TYPE, 0, 0, + ELF_LOGFILE_ALL_ACCESS, &AnonymousLogonSid}, + + {ACCESS_DENIED_ACE_TYPE, 0, 0, + ELF_LOGFILE_ALL_ACCESS, &(ElfGlobalData->AliasGuestsSid)}, + + {ACCESS_ALLOWED_ACE_TYPE, 0, 0, + ELF_LOGFILE_ALL_ACCESS, &(ElfGlobalData->LocalSystemSid)}, + + {ACCESS_ALLOWED_ACE_TYPE, 0, 0, + ELF_LOGFILE_READ | ELF_LOGFILE_CLEAR, &(ElfGlobalData->AliasAdminsSid)}, + + {ACCESS_ALLOWED_ACE_TYPE, 0, 0, + ELF_LOGFILE_BACKUP, &(ElfGlobalData->AliasBackupOpsSid)}, + + {ACCESS_ALLOWED_ACE_TYPE, 0, 0, + ELF_LOGFILE_READ | ELF_LOGFILE_CLEAR, &(ElfGlobalData->AliasSystemOpsSid)}, + + {ACCESS_ALLOWED_ACE_TYPE, 0, 0, + ELF_LOGFILE_READ, &(ElfGlobalData->WorldSid)}, + + {ACCESS_ALLOWED_ACE_TYPE, 0, 0, + ELF_LOGFILE_WRITE, &(ElfGlobalData->AliasAdminsSid)}, + + {ACCESS_ALLOWED_ACE_TYPE, 0, 0, + ELF_LOGFILE_WRITE, &(ElfGlobalData->AliasSystemOpsSid)}, + + {ACCESS_ALLOWED_ACE_TYPE, 0, 0, + ELF_LOGFILE_WRITE, &(ElfGlobalData->WorldSid)} + }; + + PRTL_ACE_DATA pAceData = NULL; + + // + // NON_SECURE logfiles let anyone read/write to them, secure ones + // only let admins/local system do this. so for secure files we just + // don't use the last ACE + // + // Adjust the ACL start based on the passed GuestAccessRestriction flag. + // The first two aces deny all log access to guests and/or anonymous + // logons. The flag, GuestAccessRestriction, indicates that these two + // deny access aces should be applied. Note that the deny aces and the + // GuestAccessRestriction flag are not applicable to the security log, + // since users and anonymous logons, by default, do not have access. + // + + switch (Type) { + + case ELF_LOGFILE_SECURITY: + pAceData = AceData + 2; // Deny ACEs *not* applicable + NumberOfAcesToUse = 3; + break; + + case ELF_LOGFILE_SYSTEM: + if (GuestAccessRestriction == ELF_GUEST_ACCESS_RESTRICTED) { + pAceData = AceData; // Deny ACEs *applicable* + NumberOfAcesToUse = 8; + } + else { + pAceData = AceData + 2; // Deny ACEs *not* applicable + NumberOfAcesToUse = 6; + } + break; + + case ELF_LOGFILE_APPLICATION: + if (GuestAccessRestriction == ELF_GUEST_ACCESS_RESTRICTED) { + pAceData = AceData; // Deny ACEs *applicable* + NumberOfAcesToUse = 10; + } + else { + pAceData = AceData + 2; // Deny ACEs *not* applicable + NumberOfAcesToUse = 8; + } + break; + + } + Status = RtlCreateUserSecurityObject( + pAceData, + NumberOfAcesToUse, + NULL, // Owner + NULL, // Group + TRUE, // IsDirectoryObject + &LogFileObjectMapping, + &LogFile->Sd + ); + + if (! NT_SUCCESS(Status)) { + ElfDbgPrintNC(( + "[ELF] ElfpCreateLogFileObject: ElfCreateUserSecurityObject " + "failed - %X\n", Status)); + } + + return (Status); +} + + +VOID +ElfpDeleteLogFileObject( + PLOGFILE LogFile + ) +/*++ + +Routine Description: + + This function deletes the self-relative security descriptor which + represents an eventlog logfile object. + +Arguments: + + LogFile - pointer the the LOGFILE structure for this logfile + +Return Value: + + None. + +--*/ +{ + (void) RtlDeleteSecurityObject(&LogFile->Sd); +} + + +NTSTATUS +ElfpAccessCheckAndAudit( + IN LPWSTR SubsystemName, + IN LPWSTR ObjectTypeName, + IN LPWSTR ObjectName, + IN OUT IELF_HANDLE ContextHandle, + IN PSECURITY_DESCRIPTOR SecurityDescriptor, + IN ACCESS_MASK DesiredAccess, + IN PGENERIC_MAPPING GenericMapping, + IN BOOL ForSecurityLog + ) +/*++ + +Routine Description: + + This function impersonates the caller so that it can perform access + validation using NtAccessCheckAndAuditAlarm; and reverts back to + itself before returning. + +Arguments: + + SubsystemName - Supplies a name string identifying the subsystem + calling this routine. + + ObjectTypeName - Supplies the name of the type of the object being + accessed. + + ObjectName - Supplies the name of the object being accessed. + + ContextHandle - Supplies the context handle to the object. On return, the + granted access is written to the AccessGranted field of this structure + if this call succeeds. + + SecurityDescriptor - A pointer to the Security Descriptor against which + acccess is to be checked. + + DesiredAccess - Supplies desired acccess mask. This mask must have been + previously mapped to contain no generic accesses. + + GenericMapping - Supplies a pointer to the generic mapping associated + with this object type. + + ForSecurityLog - TRUE if the access check is for the security log. + This is a special case that may require a privilege check. + +Return Value: + + NT status mapped to Win32 errors. + +--*/ +{ + + NTSTATUS Status; + RPC_STATUS RpcStatus; + + UNICODE_STRING Subsystem; + UNICODE_STRING ObjectType; + UNICODE_STRING Object; + + BOOLEAN GenerateOnClose=FALSE; + NTSTATUS AccessStatus; + ACCESS_MASK GrantedAccess = 0; + HANDLE ClientToken = NULL; + PPRIVILEGE_SET pPrivilegeSet; + ULONG PrivilegeSetLength; + LUID luid = {0}; + BOOL fResult=FALSE; + ULONG privileges[1]; + + + GenericMapping = &LogFileObjectMapping; + + PrivilegeSetLength = sizeof(PRIVILEGE_SET) + (sizeof(LUID_AND_ATTRIBUTES)*10); + pPrivilegeSet = (PPRIVILEGE_SET)LocalAlloc(LMEM_FIXED, PrivilegeSetLength); + + if (pPrivilegeSet == NULL) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: LocalAlloc Failed %d\n", + GetLastError())); + return(GetLastError()); + } + + RtlInitUnicodeString(&Subsystem, SubsystemName); + RtlInitUnicodeString(&ObjectType, ObjectTypeName); + RtlInitUnicodeString(&Object, ObjectName); + + if ((RpcStatus = RpcImpersonateClient(NULL)) != RPC_S_OK) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: Failed to impersonate " + "client %08lx\n", RpcStatus)); + + LocalFree(pPrivilegeSet); + return RpcStatus; + } + + // + // Get a token handle for the client + // + Status = NtOpenThreadToken ( + NtCurrentThread(), + TOKEN_QUERY, // DesiredAccess + TRUE, // OpenAsSelf + &ClientToken); + if (!NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: NtOpenThreadToken Failed: " + "0x%lx\n",Status)); + + goto CleanExit; + } + + // + // We want to see if we can get the desired access, and if we do + // then we also want all our other accesses granted. + // MAXIMUM_ALLOWED gives us this. + // + DesiredAccess |= MAXIMUM_ALLOWED; + + Status = NtAccessCheck( + SecurityDescriptor, + ClientToken, + DesiredAccess, + GenericMapping, + pPrivilegeSet, + &PrivilegeSetLength, + &GrantedAccess, + &AccessStatus + ); + + if (! NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: Error calling " + "NtAccessCheck %08lx\n", Status)); + goto CleanExit; + } + + if (AccessStatus != STATUS_SUCCESS) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: Access status is %08lx\n", + AccessStatus)); + + // + // MarkBl 1/30/95 : Modified this code a bit to give backup operators + // the ability to open the security log for purposes + // of backup. + // + + if ((AccessStatus == STATUS_ACCESS_DENIED) && (ForSecurityLog)) + { + // + // MarkBl 1/30/95 : First, evalutate the existing code (performed + // for read or clear access), since its + // privilege check is more rigorous than mine. + // + + Status = STATUS_ACCESS_DENIED; + + if (!(DesiredAccess & ELF_LOGFILE_WRITE)) { + + // + // If read or clear access to the security log is desired, + // then we will see if this user passes the privilege check. + // + // + // Do Privilege Check for SeSecurityPrivilege + // (SE_SECURITY_NAME). + // + // MarkBl 1/30/95 : Modified code to fall through on error + // instead of the jump to 'CleanExit'. + // + + if (LookupPrivilegeValue(NULL, SE_SECURITY_NAME, &luid)) { + + pPrivilegeSet->PrivilegeCount = 1; + pPrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY; + pPrivilegeSet->Privilege[0].Luid = luid; + pPrivilegeSet->Privilege[0].Attributes = + SE_PRIVILEGE_ENABLED; + + if (PrivilegeCheck( + ClientToken, + pPrivilegeSet, + &fResult)) { + // + // If the privilege is enabled, then add READ and + // CLEAR to the granted access mask. + // + if (fResult) { + GrantedAccess |= (ELF_LOGFILE_READ | + ELF_LOGFILE_CLEAR); + Status = STATUS_SUCCESS; + } + } + else { + // + // Check Failed, Now what? + // + Status = GetLastError(); + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: " \ + "PrivilegeCheck failed. status is " \ + "%d\n",Status)); + } + } + else { + Status = GetLastError(); + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: " \ + "LookupPrivilegeValue failed. status " \ + "is %d\n",Status)); + } + } + + // + // MarkBl 1/30/95 : Finally, my code. If this user has backup + // privilege, let the open succeed. + // + + if (!NT_SUCCESS(Status)) { + + if (LookupPrivilegeValue(NULL, SE_BACKUP_NAME, &luid)) { + + pPrivilegeSet->PrivilegeCount = 1; + pPrivilegeSet->Control = PRIVILEGE_SET_ALL_NECESSARY; + pPrivilegeSet->Privilege[0].Luid = luid; + pPrivilegeSet->Privilege[0].Attributes = + SE_PRIVILEGE_ENABLED; + + if (PrivilegeCheck( + ClientToken, + pPrivilegeSet, + &fResult)) { + if (fResult) { + GrantedAccess |= ELF_LOGFILE_BACKUP; + Status = STATUS_SUCCESS; + } + } + else { + Status = GetLastError(); + goto CleanExit; + } + } + else { + Status = GetLastError(); + goto CleanExit; + } + } + } + else { + Status = AccessStatus; + } + } + + + // + // Revert to Self + // + if ((RpcStatus = RpcRevertToSelf()) != RPC_S_OK) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: Fail to revert to " + "self %08lx\n", RpcStatus)); + // + // We don't return the error status here because we don't want + // to write over the other status that is being returned. + // + + } + + // + // Get SeAuditPrivilege so I can call NtOpenObjectAuditAlarm. + // If any of this stuff fails, I don't want the status to overwrite the + // status that I got back from the access and privilege checks. + // + + privileges[0] = SE_AUDIT_PRIVILEGE; + AccessStatus = ElfpGetPrivilege( 1, privileges); + + if (!NT_SUCCESS(AccessStatus)) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: ElfpGetPrivilege " + "(Enable) failed. Status is 0x%lx\n",AccessStatus)); + } + + // + // Call the Audit Alarm function. + // + GenerateOnClose = FALSE; + AccessStatus = NtOpenObjectAuditAlarm ( + &Subsystem, + (PVOID)ContextHandle, + &ObjectType, + &Object, + SecurityDescriptor, + ClientToken, // Handle ClientToken + DesiredAccess, + GrantedAccess, + pPrivilegeSet, // PPRIVLEGE_SET + FALSE, // BOOLEAN ObjectCreation, + TRUE, // BOOLEAN AccessGranted, + &GenerateOnClose + ); + + if (!NT_SUCCESS(AccessStatus)) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: NtOpenObjectAuditAlarm " + "failed. status is 0x%lx\n",AccessStatus)); + } + else { + if (GenerateOnClose) { + ContextHandle->Flags |= ELF_LOG_HANDLE_GENERATE_ON_CLOSE; + } + } + + // + // Update the GrantedAccess in the context handle. + // + ContextHandle->GrantedAccess = GrantedAccess; + + NtClose(ClientToken); + + ElfpReleasePrivilege(); + + LocalFree(pPrivilegeSet); + + return(Status); + +CleanExit: + // + // Revert to Self + // + if ((RpcStatus = RpcRevertToSelf()) != RPC_S_OK) { + ElfDbgPrint(("[ELF] ElfpAccessCheckAndAudit: Fail to revert to " + "self %08lx\n", RpcStatus)); + // + // We don't return the error status here because we don't want + // to write over the other status that is being returned. + // + + } + if (ClientToken != NULL) { + NtClose(ClientToken); + } + + LocalFree(pPrivilegeSet); + + return(Status); +} + +VOID +ElfpCloseAudit( + IN LPWSTR SubsystemName, + IN IELF_HANDLE ContextHandle + ) + +/*++ + +Routine Description: + + If the GenerateOnClose flag in the ContextHandle is set, then this function + calls NtCloseAuditAlarm in order to generate a close audit for this handle. + +Arguments: + + ContextHandle - This is a pointer to an ELF_HANDLE structure. This is the + handle that is being closed. + +Return Value: + + none. + +--*/ +{ + UNICODE_STRING Subsystem; + NTSTATUS Status; + NTSTATUS AccessStatus; + ULONG privileges[1]; + + RtlInitUnicodeString(&Subsystem, SubsystemName); + + if (ContextHandle->Flags & ELF_LOG_HANDLE_GENERATE_ON_CLOSE) { + BOOLEAN WasEnabled = FALSE; + + // + // Get Audit Privilege + // + privileges[0] = SE_AUDIT_PRIVILEGE; + AccessStatus = ElfpGetPrivilege( 1, privileges); + + if (!NT_SUCCESS(AccessStatus)) { + ElfDbgPrint(("[ELF] ElfpCloseAudit: ElfpGetPrivilege " + "(Enable) failed. Status is 0x%lx\n",AccessStatus)); + } + + // + // Generate the Audit. + // + Status = NtCloseObjectAuditAlarm( + &Subsystem, + ContextHandle, + TRUE); + if (!NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] ElfpCloseAudit: NtCloseObjectAuditAlarm Failed: " + "0x%lx\n",Status)); + } + + ContextHandle->Flags &= (~ELF_LOG_HANDLE_GENERATE_ON_CLOSE); + + ElfpReleasePrivilege(); + +#ifdef REMOVE + // + // Release Audit Privilege + // + Status = RtlAdjustPrivilege( + SE_AUDIT_PRIVILEGE, + FALSE, // Disable + FALSE, // Use Process's token + &WasEnabled); + + if (!NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] ElfpCloseAudit: RtlAdjustPrivilege " + "(Disable) failed. Status is 0x%lx\n",Status)); + } +#endif + + } + return; +} +DWORD +ElfpGetPrivilege( + IN DWORD numPrivileges, + IN PULONG pulPrivileges + ) +/*++ + +Routine Description: + + This function alters the privilege level for the current thread. + + It does this by duplicating the token for the current thread, and then + applying the new privileges to that new token, then the current thread + impersonates with that new token. + + Privileges can be relinquished by calling ElfpReleasePrivilege(). + +Arguments: + + numPrivileges - This is a count of the number of privileges in the + array of privileges. + + pulPrivileges - This is a pointer to the array of privileges that are + desired. This is an array of ULONGs. + +Return Value: + + NO_ERROR - If the operation was completely successful. + + Otherwise, it returns mapped return codes from the various NT + functions that are called. + +--*/ +{ + DWORD status; + NTSTATUS ntStatus; + HANDLE ourToken; + HANDLE newToken; + OBJECT_ATTRIBUTES Obja; + SECURITY_QUALITY_OF_SERVICE SecurityQofS; + ULONG bufLen; + ULONG returnLen; + PTOKEN_PRIVILEGES pPreviousState; + PTOKEN_PRIVILEGES pTokenPrivilege = NULL; + DWORD i; + + // + // Initialize the Privileges Structure + // + pTokenPrivilege = (PTOKEN_PRIVILEGES) LocalAlloc( + LMEM_FIXED, + sizeof(TOKEN_PRIVILEGES) + + (sizeof(LUID_AND_ATTRIBUTES) * + numPrivileges) + ); + + if (pTokenPrivilege == NULL) { + status = GetLastError(); + ElfDbgPrint(("[ELF] ElfpGetPrivilege:LocalAlloc Failed %d\n", status)); + return(status); + } + pTokenPrivilege->PrivilegeCount = numPrivileges; + for (i=0; i<numPrivileges ;i++ ) { + pTokenPrivilege->Privileges[i].Luid = RtlConvertLongToLuid( + pulPrivileges[i]); + pTokenPrivilege->Privileges[i].Attributes = SE_PRIVILEGE_ENABLED; + + } + + // + // Initialize Object Attribute Structure. + // + InitializeObjectAttributes(&Obja,NULL,0L,NULL,NULL); + + // + // Initialize Security Quality Of Service Structure + // + SecurityQofS.Length = sizeof(SECURITY_QUALITY_OF_SERVICE); + SecurityQofS.ImpersonationLevel = SecurityImpersonation; + SecurityQofS.ContextTrackingMode = FALSE; // Snapshot client context + SecurityQofS.EffectiveOnly = FALSE; + + Obja.SecurityQualityOfService = &SecurityQofS; + + // + // Allocate storage for the structure that will hold the Previous State + // information. + // + pPreviousState = (PTOKEN_PRIVILEGES) LocalAlloc( + LMEM_FIXED, + PRIVILEGE_BUF_SIZE + ); + if (pPreviousState == NULL) { + + status = GetLastError(); + + ElfDbgPrint(("[ELF] ElfpGetPrivilege: LocalAlloc Failed %d\n", + status)); + + LocalFree(pTokenPrivilege); + return(status); + + } + + // + // Open our own Token + // + ntStatus = NtOpenProcessToken( + NtCurrentProcess(), + TOKEN_DUPLICATE, + &ourToken); + + if (!NT_SUCCESS(ntStatus)) { + ElfDbgPrint(("[ELF] ElfpGetPrivilege: NtOpenThreadToken Failed " + "0x%lx" "\n", ntStatus)); + + LocalFree(pPreviousState); + LocalFree(pTokenPrivilege); + return(RtlNtStatusToDosError(ntStatus)); + } + + // + // Duplicate that Token + // + ntStatus = NtDuplicateToken( + ourToken, + TOKEN_IMPERSONATE | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, + &Obja, + FALSE, // Duplicate the entire token + TokenImpersonation, // TokenType + &newToken); // Duplicate token + + if (!NT_SUCCESS(ntStatus)) { + ElfDbgPrint(("[ELF] ElfpGetPrivilege: NtDuplicateToken Failed " + "0x%lx" "\n", ntStatus)); + + LocalFree(pPreviousState); + LocalFree(pTokenPrivilege); + NtClose(ourToken); + return(RtlNtStatusToDosError(ntStatus)); + } + + // + // Add new privileges + // + bufLen = PRIVILEGE_BUF_SIZE; + ntStatus = NtAdjustPrivilegesToken( + newToken, // TokenHandle + FALSE, // DisableAllPrivileges + pTokenPrivilege, // NewState + bufLen, // bufferSize for previous state + pPreviousState, // pointer to previous state info + &returnLen); // numBytes required for buffer. + + if (ntStatus == STATUS_BUFFER_TOO_SMALL) { + + LocalFree(pPreviousState); + + bufLen = returnLen; + + pPreviousState = (PTOKEN_PRIVILEGES) LocalAlloc( + LMEM_FIXED, + (UINT) bufLen + ); + + ntStatus = NtAdjustPrivilegesToken( + newToken, // TokenHandle + FALSE, // DisableAllPrivileges + pTokenPrivilege, // NewState + bufLen, // bufferSize for previous state + pPreviousState, // pointer to previous state info + &returnLen); // numBytes required for buffer. + + } + if (!NT_SUCCESS(ntStatus)) { + ElfDbgPrint(("[ELF] ElfpGetPrivilege: NtAdjustPrivilegesToken Failed " + "0x%lx" "\n", ntStatus)); + + LocalFree(pPreviousState); + LocalFree(pTokenPrivilege); + NtClose(ourToken); + NtClose(newToken); + return(RtlNtStatusToDosError(ntStatus)); + } + + // + // Begin impersonating with the new token + // + ntStatus = NtSetInformationThread( + NtCurrentThread(), + ThreadImpersonationToken, + (PVOID)&newToken, + (ULONG)sizeof(HANDLE)); + + if (!NT_SUCCESS(ntStatus)) { + ElfDbgPrint(("[ELF] ElfpGetPrivilege: NtAdjustPrivilegesToken Failed " + "0x%lx" "\n", ntStatus)); + + LocalFree(pPreviousState); + LocalFree(pTokenPrivilege); + NtClose(ourToken); + NtClose(newToken); + return(RtlNtStatusToDosError(ntStatus)); + } + + // + // BUGBUG: Do I need to keep some of this around to pass to the + // ReleasePrivilege function? + // + LocalFree(pPreviousState); + LocalFree(pTokenPrivilege); + NtClose(ourToken); + NtClose(newToken); + + return(NO_ERROR); +} + +DWORD +ElfpReleasePrivilege( + VOID + ) +/*++ + +Routine Description: + + This function relinquishes privileges obtained by calling ElfpGetPrivilege(). + +Arguments: + + none + +Return Value: + + NO_ERROR - If the operation was completely successful. + + Otherwise, it returns mapped return codes from the various NT + functions that are called. + + +--*/ +{ + NTSTATUS ntStatus; + HANDLE NewToken; + + + // + // BUGBUG: Do I need to Adjust the Privileges back to what they + // were first? (if so, I need somemore info passed to this fcn) + // + + // + // Revert To Self. + // + NewToken = NULL; + + ntStatus = NtSetInformationThread( + NtCurrentThread(), + ThreadImpersonationToken, + (PVOID)&NewToken, + (ULONG)sizeof(HANDLE)); + + if ( !NT_SUCCESS(ntStatus) ) { + return(RtlNtStatusToDosError(ntStatus)); + } + + + return(NO_ERROR); +} diff --git a/private/eventlog/server/elfutil.c b/private/eventlog/server/elfutil.c new file mode 100644 index 000000000..6d46081c6 --- /dev/null +++ b/private/eventlog/server/elfutil.c @@ -0,0 +1,1737 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + ELFUTIL.C + +Abstract: + + This file contains all the utility routines for the Eventlog service. + +Author: + + Rajen Shah (rajens) 16-Jul-1991 + + +Revision History: + + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <lmalert.h> +#include <string.h> +#include <stdlib.h> + + + +PLOGMODULE +FindModuleStrucFromAtom ( ATOM Atom + ) + +/*++ + +Routine Description: + + This routine scans the list of module structures and finds the one + that matches the module atom. + +Arguments: + + Atom contains the atom matching the module name. + +Return Value: + + A pointer to the log module structure is returned. + NULL if no matching atom is found. + +Note: + +--*/ +{ + + PLOGMODULE ModuleStruc; + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogModuleCritSec); + + ModuleStruc = CONTAINING_RECORD ( + LogModuleHead.Flink, + LOGMODULE, + ModuleList + ); + + while ((ModuleStruc->ModuleList.Flink != &LogModuleHead) + && (ModuleStruc->ModuleAtom != Atom)) { + + ModuleStruc = CONTAINING_RECORD ( + ModuleStruc->ModuleList.Flink, + LOGMODULE, + ModuleList + ); + } + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogModuleCritSec); + + return (ModuleStruc->ModuleAtom == Atom ? ModuleStruc : NULL); +} + + + +PLOGMODULE +GetModuleStruc ( PUNICODE_STRING ModuleName + ) + +/*++ + +Routine Description: + + This routine returns a pointer to the log module structure for the + module specified in ModuleName. If none exists, the default structure + for application is returned. + +Arguments: + + ModuleName contains the name of the module. + +Return Value: + + A pointer to the log module structure is returned. + +Note: + + +--*/ +{ + + NTSTATUS Status; + ATOM ModuleAtom; + ANSI_STRING ModuleNameA; + + ElfDbgPrint(("[ELF] GetModuleStruc: ")); + + Status = RtlUnicodeStringToAnsiString ( + &ModuleNameA, + ModuleName, + TRUE + ); + + ASSERT (NT_SUCCESS(Status)); // This MUST NOT fail. + + // + // Guarantee that it's NULL terminated + // + + ModuleNameA.Buffer[ModuleNameA.Length] = '\0'; + + ElfDbgPrint((" Module: %Z ", &ModuleNameA)); + + ModuleAtom = FindAtomA( ModuleNameA.Buffer ); + + RtlFreeAnsiString (&ModuleNameA); + + if (ModuleAtom == (ATOM)0) { + + ElfDbgPrint((" No atom found. Defaulting to APPLICATION.\n")); + return (ElfDefaultLogModule); + + } else { + + ElfDbgPrint((" Atom = %d \n", ModuleAtom)); + + return (FindModuleStrucFromAtom( ModuleAtom )); + + } + +} + + + +VOID +UnlinkContextHandle (IELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This routine unlinks the LogHandle specified from the linked list of + context handles. + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + LogHandle points to a context handle structure. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + + + // Remove this entry + + RemoveEntryList (&LogHandle->Next); + + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + +} + + + +VOID +LinkContextHandle (IELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This routine links the LogHandle specified into the linked list of + context handles. + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + LogHandle points to a context handle structure. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + ASSERT(LogHandle->Signature == ELF_CONTEXTHANDLE_SIGN); + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + + + // Place structure at the beginning of the list. + + InsertHeadList (&LogHandleListHead, &LogHandle->Next); + + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + +} + + +VOID +UnlinkQueuedEvent (PELF_QUEUED_EVENT QueuedEvent + ) + +/*++ + +Routine Description: + + This routine unlinks the QueuedEvent specified from the linked list of + QueuedEvents. + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + QueuedEvent - The request to remove from the linked list + +Return Value: + + NONE + +Note: + + +--*/ +{ + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); + + + // Remove this entry + + RemoveEntryList (&QueuedEvent->Next); + + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); + +} + + + +VOID +LinkQueuedEvent (PELF_QUEUED_EVENT QueuedEvent + ) + +/*++ + +Routine Description: + + This routine links the QueuedEvent specified into the linked list of + QueuedEvents. + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + QueuedEvent - The request to add from the linked list + +Return Value: + + NONE + +Note: + + +--*/ +{ + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); + + + // Place structure at the beginning of the list. + + InsertHeadList (&QueuedEventListHead, &QueuedEvent->Next); + + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); + +} + + +DWORD +WINAPI +ElfpSendMessage (LPVOID UnUsed + ) + +/*++ + +Routine Description: + + This routines just uses MessageBox to pop up a message. + + This is it's own routine so we can spin a thread to do this, in case the + user doesn't hit the OK button for a while. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + +--*/ +{ + + PVOID MessageBuffer; + HANDLE hLibrary; + LPWSTR * StringPointers; + DWORD i; + PELF_QUEUED_EVENT QueuedEvent; + PELF_QUEUED_EVENT FlushEvent; + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedMessageCritSec); + + // + // First get a handle to the message file used for the message text + // + + hLibrary = LoadLibraryW(L"NETMSG.DLL"); + + // + // Walk the linked list and process each element + // + + QueuedEvent = CONTAINING_RECORD ( + QueuedMessageListHead.Flink, + struct _ELF_QUEUED_EVENT, + Next + ); + + while (QueuedEvent->Next.Flink != QueuedMessageListHead.Flink) { + + ASSERT(QueuedEvent->Type == Message); + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedMessageCritSec); + + // + // Build the array of pointers to the insertion strings + // + + StringPointers = (LPWSTR *) ElfpAllocateBuffer( + QueuedEvent->Event.Message.NumberOfStrings * sizeof(LPWSTR)); + + if (StringPointers && hLibrary) { + + // + // Build the array of pointers to the insertion string(s) + // + + if (QueuedEvent->Event.Message.NumberOfStrings) { + StringPointers[0] = (LPWSTR) + ((PBYTE) &QueuedEvent->Event.Message + + sizeof(ELF_MESSAGE_RECORD)); + + for (i = 1; i < QueuedEvent->Event.Message.NumberOfStrings; + i++) { + StringPointers[i] = StringPointers[i-1] + + wcslen(StringPointers[i-1]) + 1; + } + } + + // + // Call FormatMessage to build the message + // + + if (FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | + FORMAT_MESSAGE_ARGUMENT_ARRAY | + FORMAT_MESSAGE_FROM_HMODULE, + (LPVOID) hLibrary, + QueuedEvent->Event.Message.MessageId, + 0, // Language ID defaulted + (LPWSTR) & MessageBuffer, + 0, // Is this ignored if allocate_buffer? + (va_list *) StringPointers)) { + + // + // Now actually display it + // + + MessageBoxW(NULL, (LPWSTR) MessageBuffer, GlobalMessageBoxTitle, + MB_OK | MB_SETFOREGROUND | MB_ICONEXCLAMATION | MB_SERVICE_NOTIFICATION); + } + + ElfpFreeBuffer(StringPointers); + } + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedMessageCritSec); + + // + // Move to the next one, saving this one to delete it + // + + FlushEvent = QueuedEvent; + + QueuedEvent = CONTAINING_RECORD ( + QueuedEvent->Next.Flink, + struct _ELF_QUEUED_EVENT, + Next + ); + + // + // Now remove this from the queue and free it if we successfully + // processed it + // + + RemoveEntryList (&FlushEvent->Next); + + } + + FreeLibrary(hLibrary); + + MBThreadHandle = NULL; + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedMessageCritSec); + + return(0); +} + +VOID +LinkQueuedMessage (PELF_QUEUED_EVENT QueuedEvent + ) + +/*++ + +Routine Description: + + This routine links the QueuedEvent specified into the linked list of + QueuedMessages. If there's not already a messagebox thread running, + it starts one. + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + QueuedEvent - The request to add from the linked list + +Return Value: + + NONE + +Note: + + +--*/ +{ + + DWORD ThreadId; + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedMessageCritSec); + + + // Place structure at the end of the list. + + InsertTailList (&QueuedMessageListHead, &QueuedEvent->Next); + + if (!MBThreadHandle) { + // + // Since the user can just let this sit on their screen, + // spin a thread for this + // + + MBThreadHandle = CreateThread(NULL, // lpThreadAttributes + 4096, // dwStackSize + ElfpSendMessage, // lpStartAddress + NULL, // lpParameter + 0L, // dwCreationFlags + &ThreadId // lpThreadId + ); + } + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedMessageCritSec); + +} + + +VOID +NotifyChange (PLOGFILE pLogFile + ) + +/*++ + +Routine Description: + + This routine runs the list of events that are registered with + ElfChangeNotify to be notified when a log has changed, and pulses + the event. + + In order to protect against multiple thread/process access to the + list at the same time, we use an exclusive resource. + +Arguments: + + LogHandle points to a context handle structure. + +Return Value: + + NONE + +Note: + +--*/ +{ + + // + // How frequently will I try to pulse the events? How about every + // 5 seconds + // + +#define MINIMUM_PULSE_TIME 5 + + PNOTIFIEE Notifiee; + static ULONG LastPulseTime = 0; + LARGE_INTEGER Time; + ULONG CurrentTime; + NTSTATUS Status; + + // + // Get exclusive access to the log file. This will ensure no one + // else is accessing the file. + // + + RtlAcquireResourceExclusive ( + &pLogFile->Resource, + TRUE // Wait until available + ); + // + // See if we've done this in the last MINIMUM_PULSE_TIME seconds + // + + Status = NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970(&Time, &CurrentTime); + + if (NT_SUCCESS(Status)) { + CurrentTime = CurrentTime - MINIMUM_PULSE_TIME; + if (CurrentTime > LastPulseTime) { + + // + // Remember that we pulsed + // + + LastPulseTime = CurrentTime; + + // + // Walk the linked list and and pulse any events + // + + Notifiee = CONTAINING_RECORD ( + pLogFile->Notifiees.Flink, + struct _NOTIFIEE, + Next + ); + + + while (Notifiee->Next.Flink != pLogFile->Notifiees.Flink) { + + // + // Pulse each event as we get to it. + // + + NtPulseEvent(Notifiee->Event,NULL); + + Notifiee = CONTAINING_RECORD ( + Notifiee->Next.Flink, + struct _NOTIFIEE, + Next + ); + } + } + } + + // + // Free the resource + // + + RtlReleaseResource ( &pLogFile->Resource ); +} + + + +VOID +WriteQueuedEvents ( + ) + +/*++ + +Routine Description: + + This routine runs the list of queued events and writes them. + + In order to protect against multiple thread/process access to the + list at the same time, we use an exclusive resource. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + +--*/ +{ + + PELF_QUEUED_EVENT QueuedEvent; + PELF_QUEUED_EVENT FlushEvent; + BOOLEAN bFlushEvent; + LARGE_INTEGER Time; + ULONG CurrentTime; + static ULONG LastAlertTried = 0; + static BOOLEAN LastAlertFailed = FALSE; + + // Lock the linked list, you must get the System Log File Resource + // first, it is the higher level lock + + RtlAcquireResourceExclusive ( + &ElfModule->LogFile->Resource, + TRUE // Wait until available + ); + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); + + // + // Walk the linked list and process each element + // + + QueuedEvent = CONTAINING_RECORD ( + QueuedEventListHead.Flink, + struct _ELF_QUEUED_EVENT, + Next + ); + + + while (QueuedEvent->Next.Flink != QueuedEventListHead.Flink) { + + // + // Default is to flush the event after processing + // + + bFlushEvent = TRUE; + + // + // Do the appropriate thing + // + + if (QueuedEvent->Type == Event) { + PerformWriteRequest (&QueuedEvent->Event.Request); + } + else if (QueuedEvent->Type == Alert) { + + // + // Don't even try to send failed alerts quicker than once a minute + // + + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970(&Time, &CurrentTime); + + if (!LastAlertFailed || CurrentTime > LastAlertTried + 60) { + if (!SendAdminAlert(QueuedEvent->Event.Alert.MessageId, + QueuedEvent->Event.Alert.NumberOfStrings, + (PUNICODE_STRING)((PBYTE) QueuedEvent + + FIELD_OFFSET(ELF_QUEUED_EVENT, Event) + + sizeof(ELF_ALERT_RECORD)))) { + + LastAlertFailed = TRUE; + LastAlertTried = CurrentTime; + + } + else { + LastAlertFailed = FALSE; + LastAlertTried = CurrentTime; + } + } + + // + // Only try to write it for 5 minutes, then give up (the + // alerter service may not be configured to run) + // + + if (LastAlertFailed && + QueuedEvent->Event.Alert.TimeOut > CurrentTime) { + bFlushEvent = FALSE; + } + } + + // + // Move to the next one, saving this one to delete it + // + + FlushEvent = QueuedEvent; + + QueuedEvent = CONTAINING_RECORD ( + QueuedEvent->Next.Flink, + struct _ELF_QUEUED_EVENT, + Next + ); + + // + // Now remove this from the queue and free it if we successfully + // processed it + // + + if (bFlushEvent) { + UnlinkQueuedEvent(FlushEvent); + ElfpFreeBuffer(FlushEvent); + } + } + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); + RtlReleaseResource (&ElfModule->LogFile->Resource); +} + + +VOID +FlushQueuedEvents ( + ) + +/*++ + +Routine Description: + + This routine runs the list of queued events and frees them. + + In order to protect against multiple thread/process access to the + list at the same time, we use an exclusive resource. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + +--*/ +{ + + PELF_QUEUED_EVENT QueuedEvent; + PELF_QUEUED_EVENT FlushEvent; + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); + + // + // Walk the linked list and and free the memory for any events + // + + QueuedEvent = CONTAINING_RECORD ( + QueuedEventListHead.Flink, + struct _ELF_QUEUED_EVENT, + Next + ); + + + while (QueuedEvent->Next.Flink != QueuedEventListHead.Flink) { + + // + // Free each event as we get to it. + // + + FlushEvent = QueuedEvent; + + QueuedEvent = CONTAINING_RECORD ( + QueuedEvent->Next.Flink, + struct _ELF_QUEUED_EVENT, + Next + ); + + ElfpFreeBuffer(FlushEvent); + } + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); +} + + +VOID +UnlinkLogModule (PLOGMODULE LogModule + ) + +/*++ + +Routine Description: + + This routine unlinks the LogModule specified from the linked list. + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + LogModule points to a context handle structure. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogModuleCritSec); + + + // Remove this entry + + RemoveEntryList (&LogModule->ModuleList); + + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogModuleCritSec); + +} + + + +VOID +LinkLogModule (PLOGMODULE LogModule, ANSI_STRING * pModuleNameA + ) + +/*++ + +Routine Description: + + This routine links the LogModule specified into the linked list. + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + LogModule points to a context handle structure. + ANSI LogModule name. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogModuleCritSec); + + + // Add the atom for this module. + + LogModule->ModuleAtom = AddAtomA(pModuleNameA->Buffer); + + // Place structure at the beginning of the list. + + InsertHeadList (&LogModuleHead, &LogModule->ModuleList); + + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogModuleCritSec); + +} + + +VOID +UnlinkLogFile (PLOGFILE pLogFile + ) + +/*++ + +Routine Description: + + This routine unlinks the LogFile structure specified from the linked + list of log files; + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + pLogFile points to a log file structure. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogFileCritSec); + + + // Remove this entry + + RemoveEntryList (&pLogFile->FileList); + + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogFileCritSec); + +} + + + +VOID +LinkLogFile (PLOGFILE pLogFile + ) + +/*++ + +Routine Description: + + This routine links the LogFile specified into the linked list of + log files. + In order to protect against multiple thread/process access to the + list at the same time, we use a critical section. + +Arguments: + + pLogFile points to a context handle structure. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogFileCritSec); + + + // Place structure at the beginning of the list. + + InsertHeadList (&LogFilesHead, &pLogFile->FileList); + + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogFileCritSec); + +} + + + +VOID +GetGlobalResource (DWORD Type + ) + +/*++ + +Routine Description: + + This routine takes the global resource either for shared access or + exclusive access depending on the value of Type. It waits forever for + the resource to become available. + +Arguments: + + Type is one of ELF_GLOBAL_SHARED or ELF_GLOBAL_EXCLUSIVE. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + BOOL Acquired; + + if (Type & ELF_GLOBAL_SHARED) { + + Acquired = RtlAcquireResourceShared( + &GlobalElfResource, + TRUE // Wait forever + ); + + } else { // Assume EXCLUSIVE + + Acquired = RtlAcquireResourceExclusive( + &GlobalElfResource, + TRUE // Wait forever + ); + + } + ASSERT (Acquired); // This must always be TRUE. + +} + + + +VOID +ReleaseGlobalResource() + +/*++ + +Routine Description: + + This routine releases the global resource. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + + +--*/ +{ + + RtlReleaseResource ( &GlobalElfResource ); +} + + + +NTSTATUS +ElfImpersonateClient( + VOID + ) +/*++ + +Routine Description: + + This function calls RpcImpersonateClient to impersonate the current + caller of an API. + +Arguments: + + None. + +Return Value: + + NTSTATUS (which is the same as RPC_STATUS) + +--*/ +{ + RPC_STATUS RpcStatus; + + + if ((RpcStatus = RpcImpersonateClient(NULL)) != RPC_S_OK) { + ElfDbgPrintNC(("[ELF] Fail to impersonate client %lx\n", RpcStatus)); + } + + return (I_RpcMapWin32Status(RpcStatus)); +} + + + +NTSTATUS +ElfRevertToSelf( + VOID + ) +/*++ + +Routine Description: + + This function calls RpcRevertToSelf to undo an impersonation. + +Arguments: + + None. + +Return Value: + + NTSTATUS (which is the same as RPC_STATUS) + +--*/ +{ + RPC_STATUS RpcStatus; + + + if ((RpcStatus = RpcRevertToSelf()) != RPC_S_OK) { + ElfDbgPrintNC(("[ELF] Fail to revert to self %lx\n", RpcStatus)); + ASSERT(FALSE); + } + + return (RpcStatus); +} + + + +VOID +InvalidateContextHandlesForLogFile ( + PLOGFILE pLogFile + ) +/*++ + +Routine Description: + + This routine walks through the context handles and marks the ones + that point to the LogFile passed in as "invalid for read". + +Arguments: + + Pointer to log file structure. + +Return Value: + + NONE. + +Note: + + +--*/ +{ + + IELF_HANDLE LogHandle; + PLOGMODULE pLogModule; + + // + // Lock the context handle list + // + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + + // + // Walk the linked list and mark any matching context handles as + // invalid. + // + + LogHandle = CONTAINING_RECORD ( + LogHandleListHead.Flink, + struct _IELF_HANDLE, + Next + ); + + + while (LogHandle->Next.Flink != LogHandleListHead.Flink) { + + pLogModule = FindModuleStrucFromAtom (LogHandle->Atom); + + ASSERT(pLogModule); + + if (pLogFile == pLogModule->LogFile) { + LogHandle->Flags |= ELF_LOG_HANDLE_INVALID_FOR_READ; + } + + LogHandle = CONTAINING_RECORD ( + LogHandle->Next.Flink, + struct _IELF_HANDLE, + Next + ); + } + + // + // Unlock the context handle list + // + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + +} + +VOID +FixContextHandlesForRecord ( + DWORD RecordOffset, + DWORD NewRecordOffset + ) +/*++ + +Routine Description: + + This routine makes sure that the record starting at RecordOffset isn't + the current record for any open handle. If it is, the handle is adjusted + to point to the next record. + +Arguments: + + RecordOffset - The byte offset in the log of the record that is about + to be overwritten. + NewStartingRecord - The new location to point the handle to (this is the + new first record) + +Return Value: + + NONE. + +Note: + + +--*/ +{ + + IELF_HANDLE LogHandle; + + // + // Lock the context handle list + // + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + + // + // Walk the linked list and fix any matching context handles + // + + LogHandle = CONTAINING_RECORD ( + LogHandleListHead.Flink, + struct _IELF_HANDLE, + Next + ); + + + while (LogHandle->Next.Flink != LogHandleListHead.Flink) { + + if (LogHandle->SeekBytePos == RecordOffset) { + LogHandle->SeekBytePos = NewRecordOffset; + } + + LogHandle = CONTAINING_RECORD ( + LogHandle->Next.Flink, + struct _IELF_HANDLE, + Next + ); + } + + // + // Unlock the context handle list + // + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + +} + + +PLOGFILE +FindLogFileFromName ( + PUNICODE_STRING pFileName + ) +/*++ + +Routine Description: + + This routine looks at all the log files to find one that matches + the name passed in. + +Arguments: + + Pointer to name of file. + +Return Value: + + Matching LOGFILE structure if file in use. + +Note: + + +--*/ +{ + PLOGFILE pLogFile; + + // Lock the linked list + + RtlEnterCriticalSection ((PRTL_CRITICAL_SECTION)&LogFileCritSec); + + pLogFile = CONTAINING_RECORD( + LogFilesHead.Flink, + LOGFILE, + FileList + ); + + while (pLogFile->FileList.Flink != LogFilesHead.Flink) { + if (wcscmp (pLogFile->LogFileName->Buffer, pFileName->Buffer) == 0) + break; + + pLogFile = CONTAINING_RECORD( + pLogFile->FileList.Flink, + LOGFILE, + FileList + ); + } + + // Unlock the linked list + + RtlLeaveCriticalSection ((PRTL_CRITICAL_SECTION)&LogFileCritSec); + + if (pLogFile->FileList.Flink == LogFilesHead.Flink) { + return(NULL); + } + else { + return (pLogFile); + } +} + + +VOID +ElfpCreateElfEvent( + IN ULONG EventId, + IN USHORT EventType, + IN USHORT EventCategory, + IN USHORT NumStrings, + IN LPWSTR * Strings, + IN LPVOID Data, + IN ULONG DataSize, + IN USHORT Flags + ) +/*++ + +Routine Description: + + This creates an request packet to write an event on behalf of the event + log service itself. It then queues this packet to a linked list for + writing later. + +Arguments: + + The fields to use to create the event record + + +Return Value: + + None + +Note: + + +--*/ +{ + + PELF_QUEUED_EVENT QueuedEvent; + PWRITE_PKT WritePkt; + PEVENTLOGRECORD EventLogRecord; + PBYTE BinaryData; + ULONG RecordLength; + ULONG StringOffset, DataOffset; + USHORT StringsSize; + USHORT i; + ULONG PadSize; + ULONG ModuleNameLen; // Length in bytes + ULONG zero = 0; // For pad bytes + LARGE_INTEGER Time; + ULONG LogTimeWritten; + PWSTR ReplaceStrings; + +#define ELF_MODULE_NAME L"EventLog" + + + // LogTimeWritten + // We need to generate a time when the log is written. This + // gets written in the log so that we can use it to test the + // retention period when wrapping the file. + // + + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970( + &Time, + &LogTimeWritten + ); + + // + // Figure out how big a buffer to allocate + // + + ModuleNameLen = (wcslen(ELF_MODULE_NAME) + 1) + * sizeof (WCHAR); + + StringOffset = sizeof(EVENTLOGRECORD) + + ModuleNameLen + + ComputerNameLength; + + // + // Calculate the length of strings so that we can see how + // much space is needed for that. + // + + StringsSize = 0; + for (i=0; i<NumStrings; i++) { + StringsSize += wcslen(Strings[i]) + 1; + } + + // + // DATA OFFSET: + // + + DataOffset = StringOffset + StringsSize * sizeof(WCHAR); + + // + // Determine how big a buffer is needed for the queued event record. + // + + RecordLength = sizeof(ELF_QUEUED_EVENT) + + sizeof(WRITE_PKT) + + DataOffset + + DataSize + + sizeof(RecordLength); // Size excluding pad bytes + + // + // Determine how many pad bytes are needed to align to a DWORD + // boundary. + // + + PadSize = sizeof(ULONG) - (RecordLength % sizeof(ULONG)); + + RecordLength += PadSize; // True size needed + + // + // Allocate the buffer for the Eventlog record + // + + QueuedEvent = (PELF_QUEUED_EVENT) ElfpAllocateBuffer(RecordLength); + + WritePkt = (PWRITE_PKT) (QueuedEvent + 1); + + if (QueuedEvent != NULL) { + + // + // Fill up the event record + // + + + RecordLength -= (sizeof(ELF_QUEUED_EVENT) + sizeof(WRITE_PKT)); + EventLogRecord = (PEVENTLOGRECORD) (WritePkt + 1); + + EventLogRecord->Length = RecordLength; + EventLogRecord->TimeGenerated = LogTimeWritten; + EventLogRecord->Reserved = ELF_LOG_FILE_SIGNATURE; + EventLogRecord->TimeWritten = LogTimeWritten; + EventLogRecord->EventID = EventId; + EventLogRecord->EventType = EventType; + EventLogRecord->EventCategory = EventCategory; + EventLogRecord->ReservedFlags = 0; + EventLogRecord->ClosingRecordNumber = 0; + EventLogRecord->NumStrings = NumStrings; + EventLogRecord->StringOffset = StringOffset; + EventLogRecord->DataLength = DataSize; + EventLogRecord->DataOffset = DataOffset; + EventLogRecord->UserSidLength = 0; + EventLogRecord->UserSidOffset = StringOffset; + + // + // Fill in the variable-length fields + // + + // + // STRINGS + // + + ReplaceStrings = (PWSTR) ((PBYTE) EventLogRecord + + StringOffset + ); + + for (i=0; i < NumStrings; i++) { + wcscpy (ReplaceStrings, Strings[i]); + ReplaceStrings += wcslen(Strings[i]) + 1; + } + + // + // MODULENAME + // + + BinaryData = (PBYTE) EventLogRecord + sizeof(EVENTLOGRECORD); + RtlMoveMemory (BinaryData, + ELF_MODULE_NAME, + ModuleNameLen); + + // + // COMPUTERNAME + // + + BinaryData += ModuleNameLen; // Now point to computername + + RtlMoveMemory (BinaryData, + LocalComputerName, + ComputerNameLength); + + // + // BINARY DATA + // + + BinaryData = (PBYTE) ((PBYTE) EventLogRecord + DataOffset); + RtlMoveMemory (BinaryData, Data, DataSize); + + // + // PAD - Fill with zeros + // + + BinaryData += DataSize; + RtlMoveMemory (BinaryData, &zero, PadSize); + + // + // LENGTH at end of record + // + + BinaryData += PadSize; // Point after pad bytes + ((PULONG)BinaryData)[0] = RecordLength; + + // + // Build the QueuedEvent Packet + // + + QueuedEvent->Type = Event; + QueuedEvent->Event.Request.Pkt.WritePkt = WritePkt; + QueuedEvent->Event.Request.Module = ElfModule; + QueuedEvent->Event.Request.Flags = Flags; + QueuedEvent->Event.Request.LogFile = ElfModule->LogFile; + QueuedEvent->Event.Request.Command = ELF_COMMAND_WRITE; + QueuedEvent->Event.Request.Pkt.WritePkt->Buffer = + (PVOID) EventLogRecord; + QueuedEvent->Event.Request.Pkt.WritePkt->Datasize = RecordLength; + + // + // Now Queue it on the linked list + // + + LinkQueuedEvent(QueuedEvent); + + } +} + + +VOID +ElfpCreateQueuedAlert( + DWORD MessageId, + DWORD NumberOfStrings, + LPWSTR Strings[] + ) +{ + DWORD i; + DWORD RecordLength; + PELF_QUEUED_EVENT QueuedEvent; + PUNICODE_STRING UnicodeStrings; + LPWSTR pString; + PBYTE ptr; + LARGE_INTEGER Time; + ULONG CurrentTime; + + // + // Turn the input strings into UNICODE_STRINGS and figure out how + // big to make the buffer to allocate + // + + RecordLength = sizeof(UNICODE_STRING) * NumberOfStrings; + UnicodeStrings = ElfpAllocateBuffer(RecordLength); + if (!UnicodeStrings) { + return; + } + RecordLength += FIELD_OFFSET(ELF_QUEUED_EVENT, Event) + + sizeof(ELF_ALERT_RECORD); + + for (i = 0; i < NumberOfStrings; i++) { + + RtlInitUnicodeString(&UnicodeStrings[i], Strings[i]); + RecordLength += UnicodeStrings[i].MaximumLength; + + } + + // + // Now allocate what will be the real queued event + // + + + QueuedEvent = ElfpAllocateBuffer(RecordLength); + if (!QueuedEvent) { + return; + } + + QueuedEvent->Type = Alert; + QueuedEvent->Event.Alert.MessageId = MessageId; + QueuedEvent->Event.Alert.NumberOfStrings = NumberOfStrings; + + // + // If we can't send the alert in 5 minutes, give up + // + + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970(&Time, &CurrentTime); + QueuedEvent->Event.Alert.TimeOut = CurrentTime + 300; + + // + // Move the array of UNICODE_STRINGS into the queued event and + // point UnicodeStrings at it. Then fix up the Buffer pointers. + // + + ptr = (PBYTE) QueuedEvent + FIELD_OFFSET(ELF_QUEUED_EVENT, Event) + + sizeof(ELF_ALERT_RECORD); + RtlMoveMemory(ptr, UnicodeStrings, + sizeof(UNICODE_STRING) * NumberOfStrings); + ElfpFreeBuffer(UnicodeStrings); + UnicodeStrings = (PUNICODE_STRING) ptr; + + + pString = (LPWSTR) (ptr + sizeof(UNICODE_STRING) * NumberOfStrings); + + for (i = 0; i < NumberOfStrings; i++) { + RtlMoveMemory(pString, UnicodeStrings[i].Buffer, + UnicodeStrings[i].MaximumLength); + UnicodeStrings[i].Buffer = pString; + pString = + (LPWSTR) ((PBYTE) pString + UnicodeStrings[i].MaximumLength); + } + + LinkQueuedEvent(QueuedEvent); +} + +VOID +ElfpCreateQueuedMessage( + DWORD MessageId, + DWORD NumberOfStrings, + LPWSTR Strings[] + ) +{ + DWORD i; + DWORD RecordLength = 0; + PELF_QUEUED_EVENT QueuedEvent; + LPWSTR pString; + + // + // Figure out how big to make the buffer to allocate + // + + RecordLength = sizeof(ELF_QUEUED_EVENT); + + for (i = 0; i < NumberOfStrings; i++) { + + RecordLength += (wcslen(Strings[i]) + 1) * sizeof(WCHAR); + + } + + // + // Now allocate what will be the real queued event + // + + + QueuedEvent = ElfpAllocateBuffer(RecordLength); + if (!QueuedEvent) { + return; + } + + QueuedEvent->Type = Message; + QueuedEvent->Event.Message.MessageId = MessageId; + QueuedEvent->Event.Message.NumberOfStrings = NumberOfStrings; + + // + // Move the array of UNICODE strings into the queued event + // + + pString = (LPWSTR) ((PBYTE) QueuedEvent + + FIELD_OFFSET(ELF_QUEUED_EVENT, Event) + sizeof(ELF_MESSAGE_RECORD)); + + for (i = 0; i < NumberOfStrings; i++) { + wcscpy(pString, Strings[i]); + pString += wcslen(Strings[i]) + 1; + } + + LinkQueuedMessage(QueuedEvent); +} diff --git a/private/eventlog/server/eventlog.c b/private/eventlog/server/eventlog.c new file mode 100644 index 000000000..e2a4b1058 --- /dev/null +++ b/private/eventlog/server/eventlog.c @@ -0,0 +1,1510 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + EVENTLOG.C + +Abstract: + + This file contains the main routines for the NT OS/2 Event + Logging Service. + +Author: + + Rajen Shah (rajens) 1-Jul-1991 + +[Environment:] + + User Mode - Win32, except for NTSTATUS returned by some functions. + +Revision History: + + 26-Jan-1994 Danl + SetUpModules: Fixed memory leak where the buffers for the enumerated + key names were never free'd. Also fixed problem where the size of + the MULTI_SZ buffer used for the "Sources" key was calculated by + using the names in the registry, while the copying was done + using the names in the module list. When registry keys are deleted, + the module list entry is retained until the next boot. Since the + module list is larger, it would overwrite the MULTI_SZ buffer. + 1-Nov-1993 Danl + Make Eventlog service a DLL and attach it to services.exe. + Pass in GlobalData to Elfmain. This GlobalData structure contains + all well-known SIDs and pointers to the Rpc Server (Start & Stop) + routines. Get rid of the service process main function. + 1-Jul-1991 RajenS + created + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <ntrpcp.h> +#include <elfcfg.h> +#include <string.h> +#include <stdlib.h> // getenv() +#include <tstr.h> // WCSSIZE +#include <alertmsg.h> // ALERT_ELF manifests +#include <stdio.h> // printf + +#ifdef _CAIRO_ +#include <elfextrn.h> +#endif // _CAIRO_ + +// +// Bit Flags used for Progress Reporting in SetupDataStruct(). +// +#define LOGFILE_OPENED 0x00000001 +#define MODULE_LINKED 0x00000002 +#define LOGFILE_LINKED 0x00000004 + +// +// Local Function Prorotypes +// +VOID +ElfInitMessageBoxTitle( + VOID + ); + + +NTSTATUS +ElfStartRPCServer () + +/*++ + +Routine Description: + + +Arguments: + + + +Return Value: + + NONE + +Note: + + +--*/ +{ + NTSTATUS Status; + + + ElfDbgPrint(("[ELF] Starting RPC server.\n")); + + Status = RpcpAddInterface ( + wname_Eventlogsvc, + eventlog_ServerIfHandle + ); + + if (Status != NERR_Success) { + ElfDbgPrintNC(("[ELF] RpcpAddInterface = %u\n", Status )); + + } + return (I_RpcMapWin32Status(Status)); // Return status to caller + +} + + +NTSTATUS +SetUpDataStruct ( + PUNICODE_STRING LogFileName, + ULONG MaxFileSize, + ULONG Retention, + ULONG GuestAccessRestriction, + PUNICODE_STRING ModuleName, + HANDLE hLogFile, + ELF_LOG_TYPE LogType + ) + +/*++ + +Routine Description: + + This routine sets up the information for one module. It is called from + ElfSetUpConfigDataStructs for each module to be configured. + + Module information is passed into this routine and a LOGMODULE structure + is created for it. If the logfile associated with this module doesn't + exist, a LOGFILE structure is created for it, and added to the linked + list of LOGFILE structures. The LOGMODULE is associated with the LOGFILE, + and it is added to the linked list of LOGMODULE structures. The logfile + is opened and mapped to memory. + + Finally, at the end, this function calls SetUpModules, which looks at + all the subkeys in the registry under this logfile, and adds any new ones + to the linked list, and updates the Sources MULTI_SZ for the event viewer. + +Arguments: + + LogFileName - Name of log file for this module. If this routine needs + a copy of this name it will make one, so that the caller can free + the name afterwards if that is desired. + + MaxFileSize - Max size of the log file. + Retention - Max retention for the file. + ModuleName - Name of module that this file is associated with. + RegistryHandle - Handle to the root node for this LogFile's info + in the registry. This is used to enumerate all the + modules under this key. + +Return Value: + + Pointer to Module structure that is allocated in this routine. + NTSTATUS + +Note: + + +--*/ +{ + NTSTATUS Status = STATUS_SUCCESS; + PLOGFILE pLogFile=NULL; + PLOGMODULE pModule=NULL; + ANSI_STRING ModuleNameA; + DWORD Type; + BOOL bLogFileAllocatedHere=FALSE; + PUNICODE_STRING SavedBackupFileName=NULL; + DWORD StringLength; + PLOGMODULE OldDefaultLogModule=NULL; + DWORD Progress = 0L; + + // + // Argument check. + // + + if ((LogFileName == NULL) || + (LogFileName->Buffer == NULL) || + (ModuleName == NULL)) + { + return(STATUS_INVALID_PARAMETER); + } + + // If the default log file for a module is also being used by another + // module, then we just link that same file structure with the other + // module. + // + // Truncate the maximum size of the log file to a 4K boundary. + // This is to allow for page granularity. + // + + pLogFile = FindLogFileFromName (LogFileName); + + pModule = ElfpAllocateBuffer (sizeof (LOGMODULE) ); + if (pModule == NULL) { + return(STATUS_NO_MEMORY); + } + + if (pLogFile == NULL) { + + //-------------------------------------- + // CREATE A NEW LOGFILE !! + //-------------------------------------- + // A logfile by this name doesn't exist yet. So we will create + // one so that we can add the module to it. + // + + bLogFileAllocatedHere = TRUE; + + pLogFile = ElfpAllocateBuffer (sizeof (LOGFILE) ); + + if (pLogFile == NULL) { + ElfpFreeBuffer (pModule); + return(STATUS_NO_MEMORY); + } + + ElfDbgPrint(("[ELF] Set up file data\n")); + + // + // Allocate a new LogFileName that can be attached to the + // new pLogFile structure. + // + StringLength = LogFileName->Length + sizeof(WCHAR); + SavedBackupFileName = (PUNICODE_STRING) ElfpAllocateBuffer( + sizeof(UNICODE_STRING) + StringLength); + + if (SavedBackupFileName == NULL) { + Status = STATUS_NO_MEMORY; + goto ErrorExit; + } + + SavedBackupFileName->Buffer = (LPWSTR)((LPBYTE) SavedBackupFileName + + sizeof(UNICODE_STRING)); + + SavedBackupFileName->Length = LogFileName->Length; + SavedBackupFileName->MaximumLength = (USHORT) StringLength; + RtlMoveMemory(SavedBackupFileName->Buffer, LogFileName->Buffer, + LogFileName->Length); + SavedBackupFileName->Buffer[SavedBackupFileName->Length / sizeof(WCHAR)] = + L'\0'; + + // + // This is the first user - RefCount gets incrememted below + // + pLogFile->RefCount = 0; + pLogFile->FileHandle = NULL; + pLogFile->LogFileName = SavedBackupFileName; + pLogFile->ConfigMaxFileSize = ELFFILESIZE(MaxFileSize); + pLogFile->Retention = Retention; + + + // + // Save away the default module name for this file + // + pLogFile->LogModuleName = ElfpAllocateBuffer( + sizeof(UNICODE_STRING) + ModuleName->MaximumLength); + + if (pLogFile->LogModuleName == NULL) { + Status = STATUS_NO_MEMORY; + goto ErrorExit; + } + + pLogFile->LogModuleName->MaximumLength = ModuleName->MaximumLength; + pLogFile->LogModuleName->Buffer = + (LPWSTR)(pLogFile->LogModuleName + 1); + RtlCopyUnicodeString(pLogFile->LogModuleName, ModuleName); + + InitializeListHead (&pLogFile->Notifiees); + + + pLogFile->NextClearMaxFileSize = pLogFile->ConfigMaxFileSize; + + RtlInitializeResource ( &pLogFile->Resource ); + LinkLogFile ( pLogFile ); // Link it in + + Progress |= LOGFILE_LINKED; + + } // endif (pLogfile == NULL) + + //-------------------------------------- + // ADD THE MODULE TO THE LOG MODULE LIST + //-------------------------------------- + // Set up the module data structure for the default (which is + // the same as the logfile keyname). + // + + pLogFile->RefCount++; + pModule->LogFile = pLogFile; + pModule->ModuleName = (LPWSTR) ModuleName->Buffer; + + Status = RtlUnicodeStringToAnsiString ( + &ModuleNameA, + ModuleName, + TRUE + ); + + if (!NT_SUCCESS(Status)) { + pLogFile->RefCount--; + goto ErrorExit; + } + + // + // Link the new module in. + // + + LinkLogModule(pModule, &ModuleNameA); + + RtlFreeAnsiString (&ModuleNameA); + + Progress |= MODULE_LINKED; + + // + // Open up the file and map it to memory. Impersonate the + // caller so we can use UNC names + // + + if (LogType == ElfBackupLog) ElfImpersonateClient(); + + Status = ElfOpenLogFile (pLogFile, LogType); + + if (LogType == ElfBackupLog) ElfRevertToSelf(); + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrintNC(("[ELF] Couldn't open %ws for module %ws\n", + LogFileName->Buffer, ModuleName->Buffer)); + + if (LogType != ElfBackupLog) { + ElfpCreateQueuedAlert(ALERT_ELF_LogFileNotOpened, 1, + &(ModuleName->Buffer)); + } + pLogFile->RefCount--; + goto ErrorExit; + } + + Progress |= LOGFILE_OPENED; + // + // If this is the application module, remember the pointer + // to use if a module doesn't have an entry in the registry + // + + if (!_wcsicmp(ModuleName->Buffer, ELF_DEFAULT_MODULE_NAME)) { + OldDefaultLogModule = ElfDefaultLogModule; + ElfDefaultLogModule = pModule; + } + + // + // Create the security descriptor for this logfile. Only + // the system and security modules are secured against + // reads and writes by world. + // + + if (!_wcsicmp(ModuleName->Buffer, ELF_SYSTEM_MODULE_NAME)) { + Type = ELF_LOGFILE_SYSTEM; + } + else if (!_wcsicmp(ModuleName->Buffer, ELF_SECURITY_MODULE_NAME)) { + Type = ELF_LOGFILE_SECURITY; + } + else { + Type = ELF_LOGFILE_APPLICATION; + } + + // + // Create a Security Descriptor for this Logfile + // (RtlDeleteSecurityObject() can be used to free + // pLogFile->Sd). + // + Status = ElfpCreateLogFileObject(pLogFile, Type, GuestAccessRestriction); + if (!NT_SUCCESS(Status)) { + ElfDbgPrintNC(("[ELF] Could not create the security " + "descriptor for logfile %ws\n", ModuleName->Buffer)); + + pLogFile->RefCount--; + goto ErrorExit; + } + + // + // Now that we've added the default module name, see if there are any + // modules configured to log to this file, and if so, create the module + // structures for them. + // + + SetUpModules(hLogFile, pLogFile, FALSE); + + return (STATUS_SUCCESS); + +ErrorExit: + + if (Progress & LOGFILE_OPENED) { + ElfpCloseLogFile(pLogFile, ELF_LOG_CLOSE_BACKUP); + } + + if (Progress & MODULE_LINKED) { + UnlinkLogModule(pModule); + DeleteAtom(pModule->ModuleAtom); + } + + if (bLogFileAllocatedHere) { + + if (Progress & LOGFILE_LINKED) { + UnlinkLogFile(pLogFile); + RtlDeleteResource (&pLogFile->Resource); + } + if (pLogFile->LogModuleName != NULL) { + ElfpFreeBuffer(pLogFile->LogModuleName); + } + if (SavedBackupFileName != NULL) { + ElfpFreeBuffer(SavedBackupFileName); + } + if (pLogFile != NULL) { + ElfpFreeBuffer(pLogFile); + } + } + + ElfpFreeBuffer(pModule); + + if (OldDefaultLogModule != NULL) { + ElfDefaultLogModule = OldDefaultLogModule; + } + return(Status); +} + +NTSTATUS +SetUpModules ( + HANDLE hLogFile, + PLOGFILE pLogFile, + BOOLEAN bAllowDupes + ) + +/*++ + +Routine Description: + + This routine sets up the information for all modules for a logfile. + + The subkeys under a logfile in the eventlog portion of the registry + are enumerated. For each unique subkey, a LOGMODULE structure is + created. Each new structures is added to a linked list + of modules for that logfile. + + If there was one or more unique subkeys, meaning the list has changed + since we last looked, then we go through the entire linked list of + log modules, and create a MULTI_SZ list of all the modules. This list + is stored in the Sources value for that logfile for the event viewer + to use. + + BUGBUG: + NOTE: A module is never un-linked from the linked list of log modules + even if the registry subkey for it is removed. This should probably + be done sometime. It would make the eventlog more robust. + +Arguments: + + hLogFile - Registry key for the Log File node + pLogFile - pointer to the log file structure + bAllowDupes - If true, it's ok to already have a module with the same + name (used when processing change notify of registry) + +Return Value: + + NTSTATUS - If unsuccessful, it is not a fatal error. + + Even if this status is unsuccessful, me may have been able + to store some of the new subkeys in the LogModule list. Also, we + may have been able to update the Sources MULTI_SZ list. + +Note: + + +--*/ +{ + NTSTATUS Status = STATUS_SUCCESS; + BYTE Buffer[ELF_MAX_REG_KEY_INFO_SIZE]; + PKEY_NODE_INFORMATION KeyBuffer = (PKEY_NODE_INFORMATION) Buffer; + ULONG ActualSize; + PWCHAR SubKeyString; + UNICODE_STRING NewModule; + ANSI_STRING ModuleNameA; + PLOGMODULE pModule; + ULONG Index = 0; + ATOM Atom; + PWCHAR pList; + DWORD ListLength = 0; + UNICODE_STRING ListName; + BOOLEAN ListChanged = FALSE; + PLIST_ENTRY pListEntry; +#ifdef _CAIRO_ + SHORT sCategory; + SHORT sSeverity; +#endif // _CAIRO_ + + // + // Create the module structures for all modules under this logfile. We + // don't actually need to open the key, since we don't use any information + // stored there, it's existence is all we care about here. Any data is + // used by the Event Viewer (or any viewing app). If this is used to + // setup a backup file, hLogFile is NULL since there aren't any other + // modules to map to this file. + // + + while (NT_SUCCESS(Status) && hLogFile) { + + Status = NtEnumerateKey(hLogFile, Index++, KeyNodeInformation, + KeyBuffer, ELF_MAX_REG_KEY_INFO_SIZE, & ActualSize); + + if (NT_SUCCESS(Status)) { + + // + // It turns out the Name isn't null terminated, so we need + // to copy it somewhere and null terminate it before we use it + // + + SubKeyString = ElfpAllocateBuffer(KeyBuffer->NameLength + + sizeof(WCHAR)); + if (!SubKeyString) { + return(STATUS_NO_MEMORY); + } + + memcpy(SubKeyString, KeyBuffer->Name, KeyBuffer->NameLength); + SubKeyString[KeyBuffer->NameLength / sizeof(WCHAR)] = L'\0' ; + + // + // Add the atom for this module name + // + + RtlInitUnicodeString(&NewModule, SubKeyString); + + Status = RtlUnicodeStringToAnsiString ( + &ModuleNameA, + &NewModule, + TRUE + ); + + if (!NT_SUCCESS(Status)) { + // + // We can't continue, so we will leave the modules + // we've linked so far, and move on in an attempt to + // create the Sources MULTI_SZ list. + // + ElfpFreeBuffer(SubKeyString); + break; + } + + Atom = FindAtomA (ModuleNameA.Buffer); + + // + // Make sure we've not already added one by this name + // + +#ifdef _CAIRO_ + if (pModule = FindModuleStrucFromAtom(Atom)) { +#else + if (FindModuleStrucFromAtom(Atom)) { +#endif // _CAIRO_ + + // + // We've already encountered a module by this name. If + // this is init time, it's a configuration error. Report + // it and move on. If we're processing a change notify + // from the registry, this is ok, so just press on + // + // ** NEW FOR CAIRO ** + // + // Update the module alert category & severity values. i.e., + // only upon registry change notify. + // + + if (!bAllowDupes) { + + ElfDbgPrint(("[ELF] Same module exists in two log files - " + "%ws\n", SubKeyString)); + } + +#ifdef _CAIRO_ + if (GetSourceAlertFilterFromRegistry(hLogFile, + &NewModule, + &sCategory, + &sSeverity)) + { + pModule->AlertCategory = sCategory; + pModule->AlertSeverity = sSeverity; + } +#endif // _CAIRO_ + + RtlFreeAnsiString (&ModuleNameA); + ElfpFreeBuffer(SubKeyString); + continue; + + } + + ListChanged = TRUE; + + pModule = ElfpAllocateBuffer (sizeof (LOGMODULE) ); + if (!pModule) { + ElfpFreeBuffer(SubKeyString); + return(STATUS_NO_MEMORY); + } + + // + // Set up a module data structure for this module + // + + pModule->LogFile = pLogFile; + pModule->ModuleName = SubKeyString; + +#ifdef _CAIRO_ + if (GetSourceAlertFilterFromRegistry(hLogFile, + &NewModule, + &sCategory, + &sSeverity)) + { + pModule->AlertCategory = sCategory; + pModule->AlertSeverity = sSeverity; + } + else + { + pModule->AlertCategory = pModule->AlertSeverity = 0; + } +#endif // _CAIRO_ + + if (NT_SUCCESS(Status)) { + + // + // Link the new module in. + // + + LinkLogModule(pModule, &ModuleNameA); + + RtlFreeAnsiString (&ModuleNameA); + } + } + } + + if (Status == STATUS_NO_MORE_ENTRIES) { + + // + // It's not required that there are configured modules for a log + // file. + // + + Status = STATUS_SUCCESS; + } + + // + // If the list has changed, or if we've been called during init, and not + // as the result of a changenotify on the registry (bAllowDupes == FALSE) + // then create the sources key + // + + if (hLogFile && (ListChanged || !bAllowDupes)) { + + // + // Now create a MULTI_SZ entry with all the module names for eventvwr + // + // STEP 1: Calculate amount of storage needed by running thru the + // module list, finding any module that uses this log file. + // + pListEntry = LogModuleHead.Flink; + while (pListEntry != &LogModuleHead) { + + pModule = CONTAINING_RECORD (pListEntry, LOGMODULE, ModuleList); + + if (pModule->LogFile == pLogFile) { + // + // This one is for the log we're working on, get the + // size of it's name. + // + ListLength += WCSSIZE(pModule->ModuleName); + } + pListEntry = pModule->ModuleList.Flink; + } + + // + // STEP 2: Allocate storage for the MULTI_SZ. + // + pList = ElfpAllocateBuffer(ListLength + sizeof(WCHAR)); + + // + // If I can't allocate the list, just press on + // + + if (pList) { + + // + // STEP 3: Copy all the module names for this logfile into + // the MULTI_SZ string. + // + SubKeyString = pList; // Save this away + + pListEntry = LogModuleHead.Flink; + + while (pListEntry != &LogModuleHead) { + + pModule = CONTAINING_RECORD ( + pListEntry, + LOGMODULE, + ModuleList + ); + + if (pModule->LogFile == pLogFile) { + + // + // This one is for the log we're working on, put it in the list + // + + wcscpy(pList, pModule->ModuleName); + pList += wcslen(pModule->ModuleName); + pList++; + + } + + pListEntry = pModule->ModuleList.Flink; + + } + + *pList = L'\0'; // The terminating NULL + + RtlInitUnicodeString(&ListName, L"Sources"); + + Status = NtSetValueKey(hLogFile, + &ListName, + 0, + REG_MULTI_SZ, + SubKeyString, + ListLength + sizeof(WCHAR) + ); + + ElfpFreeBuffer(SubKeyString); + } + } + + return(Status); + +} + + +NTSTATUS +ElfSetUpConfigDataStructs ( + VOID + ) + +/*++ + +Routine Description: + + This routine sets up all the necessary data structures for the eventlog + service. It enumerates the keys in the Logfiles registry node to + determine what to setup. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + + +--*/ +{ + NTSTATUS Status = STATUS_SUCCESS; + HANDLE hLogFile; + OBJECT_ATTRIBUTES ObjectAttributes; + UNICODE_STRING SubKeyName; + PUNICODE_STRING pLogFileName = NULL; + PUNICODE_STRING pModuleName = NULL; + UNICODE_STRING EventlogModuleName; + ULONG Index = 0; + BYTE Buffer[ELF_MAX_REG_KEY_INFO_SIZE]; + PKEY_NODE_INFORMATION KeyBuffer = (PKEY_NODE_INFORMATION) Buffer; + ULONG ActualSize; + LOG_FILE_INFO LogFileInfo; + PWCHAR SubKeyString; + LPWSTR ModuleName; + + ElfDbgPrint(("[ELF] Set up config data structures\n")); + + // + // Initialize the Atom table whose size is the maximum number of + // module structures possible, i.e. ELF_MAX_LOG_MODULES. + // + + if (! (InitAtomTable ( ELF_MAX_LOG_MODULES ))) { + return (STATUS_UNSUCCESSFUL); + } + + // + // Get a handle to the Logfiles subkey. If it doesn't exist, just use + // the hard-coded defaults. + // + + if (hEventLogNode) { + + // + // Loop thru the subkeys under Eventlog and set up each logfile + // + + while (NT_SUCCESS(Status)) { + + Status = NtEnumerateKey(hEventLogNode, Index++, KeyNodeInformation, + KeyBuffer, ELF_MAX_REG_KEY_INFO_SIZE, & ActualSize); + + if (NT_SUCCESS(Status)) { + + // + // It turns out the Name isn't null terminated, so we need + // to copy it somewhere and null terminate it before we use it + // + + SubKeyString = ElfpAllocateBuffer(KeyBuffer->NameLength + + sizeof(WCHAR)); + if (!SubKeyString) { + return(STATUS_NO_MEMORY); + } + + memcpy(SubKeyString, KeyBuffer->Name, KeyBuffer->NameLength); + SubKeyString[KeyBuffer->NameLength / sizeof(WCHAR)] = L'\0' ; + + // + // Open the node for this logfile and extract the information + // required by SetupDataStruct, and then call it. + // + + RtlInitUnicodeString(&SubKeyName, SubKeyString); + + InitializeObjectAttributes(&ObjectAttributes, + &SubKeyName, + OBJ_CASE_INSENSITIVE, + hEventLogNode, + NULL + ); + + Status = NtOpenKey(&hLogFile, KEY_READ | KEY_SET_VALUE, + &ObjectAttributes); + if (!NT_SUCCESS(Status)) { + // + // Unclear how this could happen since I just enum'ed + // it, but if I can't open it, I just pretend like it + // wasn't there to begin with. + // + + ElfpFreeBuffer(SubKeyString); + Status = STATUS_SUCCESS; // so we don't terminate the loop + continue; + } + + // + // Get the information from the registry + // + + Status = ReadRegistryInfo(hLogFile, &SubKeyName, + & LogFileInfo); + + if (NT_SUCCESS(Status)) { + + // + // Now set up the actual data structures. Failures are + // dealt with in the routine + // + + SetUpDataStruct(LogFileInfo.LogFileName, + LogFileInfo.MaxFileSize, + LogFileInfo.Retention, + LogFileInfo.GuestAccessRestriction, + & SubKeyName, + hLogFile, + ElfNormalLog + ); + + NtClose(hLogFile); + + } + } + + } + } // if (hEventLogNode) + else { + + // + // The information doesn't exist in the registry, set up the + // three default logs. + // + + pLogFileName = ElfpAllocateBuffer(sizeof(UNICODE_STRING)); + pModuleName = ElfpAllocateBuffer(sizeof(UNICODE_STRING)); + if (!pLogFileName || !pModuleName) { + return(STATUS_NO_MEMORY); + } + RtlInitUnicodeString(pLogFileName, + ELF_APPLICATION_DEFAULT_LOG_FILE); + RtlInitUnicodeString(pModuleName, ELF_DEFAULT_MODULE_NAME); + SetUpDataStruct(pLogFileName, + ELF_DEFAULT_MAX_FILE_SIZE, + ELF_DEFAULT_RETENTION_PERIOD, + ELF_GUEST_ACCESS_UNRESTRICTED, + pModuleName, + NULL, + ElfNormalLog + ); + + + pLogFileName = ElfpAllocateBuffer(sizeof(UNICODE_STRING)); + pModuleName = ElfpAllocateBuffer(sizeof(UNICODE_STRING)); + if (!pLogFileName || !pModuleName) { + return(STATUS_NO_MEMORY); + } + RtlInitUnicodeString(pLogFileName, + ELF_SYSTEM_DEFAULT_LOG_FILE); + RtlInitUnicodeString(pModuleName, ELF_SYSTEM_MODULE_NAME); + SetUpDataStruct(pLogFileName, + ELF_DEFAULT_MAX_FILE_SIZE, + ELF_DEFAULT_RETENTION_PERIOD, + ELF_GUEST_ACCESS_UNRESTRICTED, + pModuleName, + NULL, + ElfNormalLog + ); + + + pLogFileName = ElfpAllocateBuffer(sizeof(UNICODE_STRING)); + pModuleName = ElfpAllocateBuffer(sizeof(UNICODE_STRING)); + if (!pLogFileName || !pModuleName) { + return(STATUS_NO_MEMORY); + } + RtlInitUnicodeString(pLogFileName, + ELF_SECURITY_DEFAULT_LOG_FILE); + RtlInitUnicodeString(pModuleName, ELF_SECURITY_MODULE_NAME); + SetUpDataStruct(pLogFileName, + ELF_DEFAULT_MAX_FILE_SIZE, + ELF_DEFAULT_RETENTION_PERIOD, + ELF_GUEST_ACCESS_UNRESTRICTED, + pModuleName, + NULL, + ElfNormalLog + ); + } + + // + // If we just ran out of keys, that's OK (unless there weren't any at all) + // + + if (Status == STATUS_NO_MORE_ENTRIES && Index != 1) { + Status = STATUS_SUCCESS; + } + + if (NT_SUCCESS(Status)) { + + // + // Make sure we created the Application log file, since it is the + // default. If it wasn't created, use the first module created + // (this is at the tail of the list since I insert them at the + // head). If this happens, send an alert to the admin. + // + + if (!ElfDefaultLogModule) { + ElfDbgPrintNC(("[ELF] No Logfile entry for Application module, " + "default will be created\n")); + + if (IsListEmpty(&LogModuleHead)) { + // + // No logs were created, might as well shut down + // + + return(STATUS_EVENTLOG_CANT_START); + } + + ElfDefaultLogModule = CONTAINING_RECORD(LogModuleHead.Blink, + LOGMODULE, + ModuleList); + + ModuleName = L"Application"; + ElfpCreateQueuedAlert(ALERT_ELF_DefaultLogCorrupt, 1, + &(ElfDefaultLogModule->LogFile->LogModuleName->Buffer)); + + } + + // + // Now get the Module for the Eventlog service to use. GetModuleStruc + // always succeeds, returning the default log if the requested one + // isn't configured. + // + + RtlInitUnicodeString(&EventlogModuleName, L"eventlog"); + ElfModule = GetModuleStruc(&EventlogModuleName); + + } else { + + if (pLogFileName && pModuleName) { + ElfDbgPrintNC(("[ELF] Failure Setting up data structs for file %ws, " + "Module %ws - %X\n", pLogFileName->Buffer, pModuleName->Buffer, + Status)); + } + else { + ElfDbgPrintNC(("[ELF] Failure setting up data structs. No logs" + " defined in registry\n")); + } + } + + + return (Status); + +} + + +VOID +SVCS_ENTRY_POINT( // (ELF_main) + DWORD argc, + LPWSTR argv[], + PSVCS_GLOBAL_DATA SvcsGlobalData, + HANDLE SvcRefHandle + ) + +/*++ + +Routine Description: + + This is the main routine for the Event Logging Service. + + +Arguments: + + Command-line arguments. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + NTSTATUS Status; + OBJECT_ATTRIBUTES ObjectAttributes; + UNICODE_STRING RootRegistryNode; + ULONG Win32Error = 0; + ELF_REQUEST_RECORD FlushRequest; + UNICODE_STRING ValueName; + BYTE Buffer[ELF_MAX_REG_KEY_INFO_SIZE]; + PKEY_VALUE_FULL_INFORMATION ValueBuffer = + (PKEY_VALUE_FULL_INFORMATION) Buffer; + SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY; + + UNREFERENCED_PARAMETER(argc); + UNREFERENCED_PARAMETER(argv); + + ElfGlobalSvcRefHandle = SvcRefHandle; + ElfGlobalData = SvcsGlobalData; + + // + // Initialize the list heads for the modules and log files. + // + + InitializeListHead ( &LogFilesHead ); + InitializeListHead ( &LogModuleHead ); + InitializeListHead ( &QueuedEventListHead ); + InitializeListHead ( &QueuedMessageListHead ); + + // + // Initialize to 0 so that we can clean up before exiting + // + + EventFlags = 0; + + // + // + // Tuck away the local computer name + // + + ComputerNameLength = 0; + GetComputerNameW(LocalComputerName, &ComputerNameLength); + ComputerNameLength += sizeof(WCHAR); // account for the NULL + LocalComputerName = ElfpAllocateBuffer(ComputerNameLength * sizeof (WCHAR)); + if (!LocalComputerName || + !GetComputerNameW(LocalComputerName, &ComputerNameLength)) { + ComputerNameLength = 0; + } + ComputerNameLength = (ComputerNameLength + 1) * sizeof(WCHAR); + + // + // Initialize the status data. + // + ElInitStatus(); + + // Set up control handler + // + + ElfDbgPrint(("[ELF] Calling RegisterServiceCtrlHandler\n")); + if ((ElfServiceStatusHandle = RegisterServiceCtrlHandler( + wname_Eventlogsvc, + ElfControlResponse + )) == (SERVICE_STATUS_HANDLE) NULL) { + + Win32Error = GetLastError(); + + // + // If we got an error, we need to set status to uninstalled, and end the + // thread. + // + + ElfDbgPrintNC(("[ELF] RegisterServiceCtrlHandler = %u\n",Win32Error)); + goto cleanupandexit; + } + + // Initialize all the status fields so that subsequent calls to + // SetServiceStatus only need to update fields that changed. + // + + // + // Notify the Service Controller for the first time that we are alive + // and is in a start pending state + // + // *** UPDATE STATUS *** + ElfStatusUpdate(STARTING); + + // + // Get the localized title for message box popups. + // + ElfInitMessageBoxTitle(); + + // + // Set up the object that describes the root node for the eventlog service + // + + RtlInitUnicodeString(&RootRegistryNode, REG_EVENTLOG_NODE_PATH); + InitializeObjectAttributes(&ObjectAttributes, + &RootRegistryNode, + OBJ_CASE_INSENSITIVE, + NULL, + NULL + ); + // + // If this fails, we'll just use the defaults + // + + NtOpenKey(&hEventLogNode, KEY_READ | KEY_NOTIFY, &ObjectAttributes); + + // + // See if there's a debug key + // + + RtlInitUnicodeString(&ValueName, VALUE_DEBUG); + + NtQueryValueKey(hEventLogNode, &ValueName, + KeyValueFullInformation, ValueBuffer, + ELF_MAX_REG_KEY_INFO_SIZE, & ElfDebug); + + // + // Initialize a critical section for use when adding or removing + // LogFiles or LogModules. This must be done before we process any + // file information. + // + + Status = RtlInitializeCriticalSection( + &LogFileCritSec + ); + + if ( !NT_SUCCESS(Status) ) { + ElfDbgPrintNC(( "ELF log file crit sec init failed: %X\n", Status )); + goto cleanupandexit; + + } + Status = RtlInitializeCriticalSection( + &LogModuleCritSec + ); + + if ( !NT_SUCCESS(Status) ) { + ElfDbgPrintNC(( "ELF log file crit sec init failed: %X\n", Status )); + goto cleanupandexit; + + } + EventFlags |= ELF_INIT_LOGFILE_CRIT_SEC; + + Status = RtlInitializeCriticalSection( + &QueuedEventCritSec + ); + + if ( !NT_SUCCESS(Status) ) { + ElfDbgPrintNC(( "ELF queued event crit sec init failed: %X\n", Status )); + goto cleanupandexit; + + } + + EventFlags |= ELF_INIT_QUEUED_EVENT_CRIT_SEC; + + Status = RtlInitializeCriticalSection( + &QueuedMessageCritSec + ); + + if ( !NT_SUCCESS(Status) ) { + ElfDbgPrintNC(( "ELF queued message crit sec init failed: %X\n", Status )); + goto cleanupandexit; + + } + + EventFlags |= ELF_INIT_QUEUED_MESSAGE_CRIT_SEC; + + // + // Initialize global anonymous logon sid for use in log ACL's. + // + + Status = RtlAllocateAndInitializeSid( + &NtAuthority, + 1, + SECURITY_ANONYMOUS_LOGON_RID, + 0, 0, 0, 0, 0, 0, 0, + &AnonymousLogonSid); + + if ( !NT_SUCCESS(Status) ) { + ElfDbgPrintNC(("ELF anonymous log sid creation failed: %X\n", + Status )); + goto cleanupandexit; + } + + // + // Set up the data structures for the Logfiles and Modules. + // + + Status = ElfSetUpConfigDataStructs (); + + if ( !NT_SUCCESS(Status) ) { + goto cleanupandexit; + } + + // + // Tell service controller of that we are making progress + // + // *** UPDATE STATUS *** + ElfStatusUpdate(STARTING); + + // + // Initialize a critical section for use when adding or removing + // context-handles (LogHandles). + // + + Status = RtlInitializeCriticalSection( + &LogHandleCritSec + ); + + if ( !NT_SUCCESS(Status) ) { + ElfDbgPrintNC(( "ELF log handle crit sec init failed: %X\n", Status )); + goto cleanupandexit; + + } + EventFlags |= ELF_INIT_LOGHANDLE_CRIT_SEC; + + // + // Initialize the context handle (log handle) list. + // + + InitializeListHead( &LogHandleListHead ); + + // + // Initialize the Global Resource. + // + + RtlInitializeResource ( &GlobalElfResource ); + EventFlags |= ELF_INIT_GLOBAL_RESOURCE; + + // + // Tell service controller of that we are making progress + // + // *** UPDATE STATUS *** + ElfStatusUpdate(STARTING); + + // + // Tell service controller of that we are making progress + // + // *** UPDATE STATUS *** + ElfStatusUpdate(STARTING); + + // Create a thread for watching the LPC port. + // + + if (!StartLPCThread ()) { + Status = STATUS_UNSUCCESSFUL; + goto cleanupandexit; + } + EventFlags |= ELF_STARTED_LPC_THREAD; + + // + // Tell service controller of that we are making progress + // + // *** UPDATE STATUS *** + ElfStatusUpdate(STARTING); + +#ifdef _CAIRO_ + // + // The eventlog service links to ALERTSYS.DLL by hand (eventlog.c) after + // eventlog initialization, since this dll's initialization code requires + // a running eventlog service. + // + // By no means, fail to start this service if something fails here. + // It just won't be possible to raise NT events as Cairo alerts. + // + // BUGBUG : Should probably at least log an error. + // Should the service state be STARTING while this + // initialization is in progress? + // + + if ((ghAlertSysDll = LoadLibrary(L"ALERTSYS.DLL")) != NULL) + { + // + // Get ReportAlert API address. + // + + if ((gpfReportAlert = (PREPORTALERT)GetProcAddress( + (HMODULE)ghAlertSysDll, + "ReportAlert")) == NULL) + { + FreeLibrary(ghAlertSysDll); + ghAlertSysDll = NULL; + ElfDbgPrintNC(( + "[ELF] ReportAlert GetProAddress failed, WIN32 error(%x)\n", + GetLastError())); + } + } + else + { + ElfDbgPrintNC(( + "[ELF] LoadLibrary of ALERTSYS.DLL failed, WIN32 error(%x)\n", + GetLastError())); + } + + // + // Tell service controller of that we are making progress + // + // *** UPDATE STATUS *** + ElfStatusUpdate(STARTING); + +#endif // _CAIRO_ + + // Create a thread for watching for changes in the registry. + // + + if (!ElfStartRegistryMonitor ()) { + Status = STATUS_UNSUCCESSFUL; + goto cleanupandexit; + } + EventFlags |= ELF_STARTED_REGISTRY_MONITOR; + + // + // Write out an event that says we started + // + + ElfpCreateElfEvent(EVENT_EventlogStarted, + EVENTLOG_INFORMATION_TYPE, + 0, // EventCategory + 0, // NumberOfStrings + NULL, // Strings + NULL, // Data + 0, // Datalength + 0 // flags + ); + + // + // Write out any events that were queued up during initialization + // + + FlushRequest.Command = ELF_COMMAND_WRITE_QUEUED; + + ElfPerformRequest(&FlushRequest); + + // + // Tell service controller of that we are making progress + // + // *** UPDATE STATUS *** + ElfStatusUpdate(STARTING); + + // + // Finish setting up the RPC server + // + // NOTE: Now all RPC servers in services.exe share the same pipe name. + // However, in order to support communication with version 1.0 of WinNt, + // it is necessary for the Client Pipe name to remain the same as + // it was in version 1.0. Mapping to the new name is performed in + // the Named Pipe File System code. + // + Status = ElfGlobalData->StartRpcServer( + ElfGlobalData->SvcsRpcPipeName, + eventlog_ServerIfHandle); + + if (Status != NO_ERROR) { + ElfDbgPrint(("[ELF]StartRpcServer Failed %d\n",Status)); + goto cleanupandexit; + } + + // + // Tell service controller of that we are making progress + // + + if (ElfStatusUpdate(RUNNING) == RUNNING) { + ElfDbgPrint(("[ELF] Service Started Successfully\n")); + } + + EventFlags |= ELF_STARTED_RPC_SERVER; + + if (GetElState() == RUNNING) { + ElfDbgPrint(("[ELF] Service Running - main thread is returning\n")); + return; + } + +// +// Come here if there is cleanup necessary. +// + +cleanupandexit: + + ElfDbgPrint(("[ELF] Leaving the service\n")); + + if (!Win32Error) { + Win32Error = RtlNtStatusToDosError(Status); + } + ElfBeginForcedShutdown(PENDING,Win32Error,Status); + + // + // If the registry monitor has been initialized, then + // let it do the shutdown cleanup. All we need to do + // here is wake it up. + // Otherwise, this thread will do the cleanup. + // + if (EventFlags & ELF_STARTED_REGISTRY_MONITOR) { + StopRegistryMonitor(); + } + else { + ElfpCleanUp(EventFlags); + // + // We should actually return here so that the DLL gets unloaded. + // However, RPC has a problem in that it might still call our + // context rundown routine even though we unregistered our interface. + // So we exit thread instead. This keeps our Dll loaded. + // + ExitThread(0); + } + return; +} + +VOID +ElfInitMessageBoxTitle( + VOID + ) + +/*++ + +Routine Description: + + Obtains the title text for the message box used to display messages. + If the title is successfully obtained from the message file, then + that title is pointed to by GlobalAllocatedMsgTitle and + GlobalMessageBoxTitle. If unsuccessful, then GlobalMessageBoxTitle + left pointing to the DefaultMessageBoxTitle. + + NOTE: If successful, a buffer is allocated by this function. The + pointer stored in GlobalAllocatedMsgTitle and it should be freed when + done with this buffer. + +Arguments: + +Return Value: + + none + +--*/ +{ + LPVOID hModule; + DWORD msgSize; + DWORD status=NO_ERROR; + + GlobalAllocatedMsgTitle = NULL; + + hModule = LoadLibrary( L"netevent.dll"); + if ( hModule == NULL) { + status = GetLastError(); + ElfDbgPrint(("LoadLibrary() fails with winError = %d\n", GetLastError())); + return; + } + msgSize = FormatMessageW( + FORMAT_MESSAGE_FROM_HMODULE | // dwFlags + FORMAT_MESSAGE_ARGUMENT_ARRAY | + FORMAT_MESSAGE_ALLOCATE_BUFFER, + hModule, + TITLE_EventlogMessageBox, // MessageId + 0, // dwLanguageId + (LPWSTR)&GlobalAllocatedMsgTitle, // lpBuffer + 0, // nSize + NULL); + + if (msgSize == 0) { + status = GetLastError(); + ElfDbgPrint((ERROR,"Could not find MessageBox title in a message file %d\n", + status)); + } + else { + GlobalMessageBoxTitle = GlobalAllocatedMsgTitle; + } + + FreeLibrary(hModule); + return; +} + + + diff --git a/private/eventlog/server/eventlog.def b/private/eventlog/server/eventlog.def new file mode 100644 index 000000000..987b75f56 --- /dev/null +++ b/private/eventlog/server/eventlog.def @@ -0,0 +1,6 @@ +NAME eventlog.dll + +DESCRIPTION 'NT Event Logging Service' + +EXPORTS + ServiceEntry diff --git a/private/eventlog/server/eventlog.rc b/private/eventlog/server/eventlog.rc new file mode 100644 index 000000000..19b4d3553 --- /dev/null +++ b/private/eventlog/server/eventlog.rc @@ -0,0 +1,11 @@ +#include <windows.h> +#include <ntverp.h> + +#define VER_FILETYPE VFT_APP +#define VER_FILESUBTYPE VFT2_UNKNOWN +#define VER_FILEDESCRIPTION_STR "Event Logging Service" +#define VER_INTERNALNAME_STR "Eventlog.DLL" +#define VER_ORIGINALFILENAME_STR "Eventlog.DLL" + +#include "common.ver" + diff --git a/private/eventlog/server/eventp.h b/private/eventlog/server/eventp.h new file mode 100644 index 000000000..ccb968cce --- /dev/null +++ b/private/eventlog/server/eventp.h @@ -0,0 +1,48 @@ +/*++ + +Copyright (c) 1991 Microsoft Corporation + +Module Name: + + eventp.h + +Abstract: + + Private include file for eventlog service + +Author: + + Rajen Shah (rajens) 12-Jul-1991 + +Revision History: + +--*/ + +#ifndef _CAIRO_ +#define UNICODE // This service uses unicode APIs +#endif // _CAIRO_ + +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> +#include <ntelfapi.h> +#include <netevent.h> // Manifest constants for Events + +#include <windows.h> +#include <winsvc.h> + +#include <lmcons.h> +#include <lmerr.h> +#include <rpc.h> +#include <svcs.h> // SVCS_ENTRY_POINT, PSVCS_GLOBAL_DATA + +#ifdef _CAIRO_ +#include <wtypes.h> +#endif // _CAIRO_ + +#include <elf.h> + +#include <elfdef.h> +#include <elfcommn.h> +#include <elfproto.h> +#include <elfextrn.h> diff --git a/private/eventlog/server/file.c b/private/eventlog/server/file.c new file mode 100644 index 000000000..63bc7d025 --- /dev/null +++ b/private/eventlog/server/file.c @@ -0,0 +1,1088 @@ +/* + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + FILE.C + +Abstract: + + This file contains the routines that deal with file-related operations. + +Author: + + Rajen Shah (rajens) 07-Aug-1991 + +Revision History: + + 29-Aug-1994 Danl + We no longer grow log files in place. So there is no need to + reserve the MaxConfigSize block of memory. + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <alertmsg.h> // ALERT_ELF manifests + +// +// Macros +// + +#define IS_EOF(Ptr, Size) \ + (Ptr)->Length == ELFEOFRECORDSIZE && \ + RtlCompareMemory (Ptr, &EOFRecord, Size) == Size + +#ifdef CORRUPTED + + +BOOLEAN +VerifyLogIntegrity( + PLOGFILE pLogFile + ) +/*++ + +Routine Description: + + This routine walks the log file to verify that it isn't corrupt + + +Arguments: + + A pointer to the LOGFILE structure for the log to validate. + +Return Value: + + TRUE if log OK + FALSE if it is corrupt + +Note: + + +--*/ +{ + + PEVENTLOGRECORD pEventLogRecord; + PVOID PhysicalStart; + PVOID PhysicalEOF; + PVOID BeginRecord; + PVOID EndRecord; + + pEventLogRecord = + (PEVENTLOGRECORD)((PBYTE) pLogFile->BaseAddress + pLogFile->BeginRecord); + PhysicalStart = + (PVOID) ((PBYTE) pLogFile->BaseAddress + FILEHEADERBUFSIZE); + PhysicalEOF = + (PVOID) ((PBYTE) pLogFile->BaseAddress + pLogFile->ViewSize); + BeginRecord = (PVOID)((PBYTE) pLogFile->BaseAddress + pLogFile->BeginRecord); + EndRecord = (PVOID)((PBYTE) pLogFile->BaseAddress + pLogFile->EndRecord); + + while(pEventLogRecord->Length != ELFEOFRECORDSIZE) { + + pEventLogRecord = (PEVENTLOGRECORD) NextRecordPosition ( + EVENTLOG_FORWARDS_READ, + (PVOID) pEventLogRecord, + pEventLogRecord->Length, + BeginRecord, + EndRecord, + PhysicalEOF, + PhysicalStart + ); + + if (!pEventLogRecord || pEventLogRecord->Length == 0) { + + ElfDbgPrintNC(("[ELF] The %ws logfile is corrupt\n", + pLogFile->LogModuleName->Buffer)); + return(FALSE); + } + } + + return(TRUE); + +} + +#endif // CORRUPTED + + +NTSTATUS +FlushLogFile ( + PLOGFILE pLogFile + ) + +/*++ + +Routine Description: + + This routine flushes the file specified. It updates the file header, + and then flushes the virtual memory which causes the data to get + written to disk. + +Arguments: + + pLogFile points to the log file structure. + +Return Value: + + NONE + +Note: + + +--*/ +{ + NTSTATUS Status; + IO_STATUS_BLOCK IoStatusBlock; + PVOID BaseAddress; + ULONG RegionSize; + PELF_LOGFILE_HEADER pLogFileHeader; + + // + // If the dirty bit is set, update the file header before flushing it. + // + if (pLogFile->Flags & ELF_LOGFILE_HEADER_DIRTY) { + + pLogFileHeader = (PELF_LOGFILE_HEADER) pLogFile->BaseAddress; + + pLogFile->Flags &= ~ELF_LOGFILE_HEADER_DIRTY; // Remove dirty bit + pLogFileHeader->Flags = pLogFile->Flags; + + pLogFileHeader->StartOffset = pLogFile->BeginRecord; + pLogFileHeader->EndOffset = pLogFile->EndRecord; + pLogFileHeader->CurrentRecordNumber = pLogFile->CurrentRecordNumber; + pLogFileHeader->OldestRecordNumber = pLogFile->OldestRecordNumber; + } + + // + // Flush the memory in the section that is mapped to the file. + // + BaseAddress = pLogFile->BaseAddress; + RegionSize = pLogFile->ViewSize; + + Status = NtFlushVirtualMemory( + NtCurrentProcess(), + &BaseAddress, + &RegionSize, + &IoStatusBlock + ); + + return (Status); + +} + + + +NTSTATUS +ElfpFlushFiles ( + ) + +/*++ + +Routine Description: + + This routine flushes all the log files and forces them on disk. + It is usually called in preparation for a shutdown or a pause. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + + +--*/ + +{ + + PLOGFILE pLogFile; + NTSTATUS Status = STATUS_SUCCESS; + + // + // Make sure that there's at least one file to flush + // + + if (IsListEmpty (&LogFilesHead) ) { + return(STATUS_SUCCESS); + } + + pLogFile + = (PLOGFILE) + CONTAINING_RECORD(LogFilesHead.Flink, LOGFILE, FileList); + + // + // Go through this loop at least once. This ensures that the termination + // condition will work correctly. + // + do { + + Status = FlushLogFile (pLogFile); + + pLogFile = // Get next one + (PLOGFILE) + CONTAINING_RECORD(pLogFile->FileList.Flink, LOGFILE, FileList); + + } while ( (pLogFile->FileList.Flink != LogFilesHead.Flink) + && (NT_SUCCESS(Status)) ) ; + + return (Status); +} + + + + +NTSTATUS +ElfpCloseLogFile ( + PLOGFILE pLogFile, + DWORD Flags + ) + +/*++ + +Routine Description: + + This routine undoes whatever is done in ElfOpenLogFile. + +Arguments: + + pLogFile points to the log file structure. + +Return Value: + + NTSTATUS. + +Note: + + +--*/ +{ + NTSTATUS Status = STATUS_SUCCESS; + PELF_LOGFILE_HEADER pLogFileHeader; + PVOID BaseAddress; + ULONG Size; + + ElfDbgPrint(("[ELF] Closing and unmapping log file: %ws\n", + pLogFile->LogFileName->Buffer)); + +#ifdef CORRUPTED + + // + // Just for debugging a log corruption problem + // + + if (!VerifyLogIntegrity(pLogFile)) { + ElfDbgPrintNC(("[ELF] Integrity check failed in ElfpCloseLogFile\n")); + } + +#endif // CORRUPTED + + // + // If the dirty bit is set, update the file header before closing it. + // Check to be sure it's not a backup file that just had the dirty + // bit set when it was copied. + // + + if (pLogFile->Flags & ELF_LOGFILE_HEADER_DIRTY && + !(Flags & ELF_LOG_CLOSE_BACKUP)) { + pLogFileHeader = (PELF_LOGFILE_HEADER) pLogFile->BaseAddress; + pLogFileHeader->StartOffset = pLogFile->BeginRecord; + pLogFileHeader->EndOffset = pLogFile->EndRecord; + pLogFileHeader->CurrentRecordNumber = pLogFile->CurrentRecordNumber; + pLogFileHeader->OldestRecordNumber = pLogFile->OldestRecordNumber; + pLogFile->Flags &= ~(ELF_LOGFILE_HEADER_DIRTY | + ELF_LOGFILE_ARCHIVE_SET); // Remove dirty & + // archive bits + pLogFileHeader->Flags = pLogFile->Flags; + } + + // + // Decrement the reference count, and if it goes to zero, unmap the file + // and close the handle. Also force the close if fForceClosed is TRUE. + // + + if ((--pLogFile->RefCount == 0) || Flags & ELF_LOG_CLOSE_FORCE) { + + // + // Last user has gone. + // Close all the views and the file and section handles. Free up + // any extra memory we had reserved, and unlink any structures + // + + if (pLogFile->BaseAddress) // Unmap it if it was allocated + NtUnmapViewOfSection ( + NtCurrentProcess(), + pLogFile->BaseAddress + ); + + if (pLogFile->SectionHandle) + NtClose ( pLogFile->SectionHandle ); + + if (pLogFile->FileHandle) + NtClose ( pLogFile->FileHandle ); + } + + return (Status); + +} // ElfpCloseLogFile + + +NTSTATUS +RevalidateLogHeader ( + PELF_LOGFILE_HEADER pLogFileHeader, + PLOGFILE pLogFile + ) + + +/*++ + +Routine Description: + + This routine is called if we encounter a "dirty" log file. The + routine walks through the file until it finds a signature for a valid log + record. It then walks forward thru the file until it finds the EOF + record, or an invalid record. Then it walks backwards from the first + record it found until it finds the EOF record from the other direction. + It then rebuilds the header and writes it back to the log. If it can't + find any valid records, it rebuilds the header to reflect an empty log + file. If it finds a trashed file, it writes 256 bytes of the log out in + an event to the system log. + +Arguments: + + pLogFileHeader points to the header of the log file. + pLogFile points to the log file structure. + +Return Value: + + NTSTATUS. + +Note: + + This is an expensive routine since it scans the entire file. + + It assumes that the records are on DWORD boundaries. + +--*/ +{ + PVOID Start, End; + PDWORD pSignature; + PEVENTLOGRECORD pEvent; + PEVENTLOGRECORD FirstRecord; + PEVENTLOGRECORD FirstPhysicalRecord; + PEVENTLOGRECORD pLastGoodRecord; + NTSTATUS Status; + IO_STATUS_BLOCK IoStatusBlock; + LARGE_INTEGER ByteOffset; + ULONG Size; + + ElfDbgPrint(("[ELF] Log file had dirty bit set, revalidating\n")); + + try { + + // + // Physical start and end of log file (skipping header) + // + + Start = (PVOID) ((PBYTE)pLogFile->BaseAddress + FILEHEADERBUFSIZE); + End = (PVOID) ((PBYTE)pLogFile->BaseAddress + + pLogFile->ActualMaxFileSize); + + // + // First see if the log has wrapped. The EOFRECORDSIZE is for the one + // case where the EOF record wraps so that it's final length just replaces + // the next records starting length + // + + pEvent = (PEVENTLOGRECORD) Start; + + if (pEvent->Reserved != ELF_LOG_FILE_SIGNATURE + || pEvent->RecordNumber != 1 || pEvent->Length == ELFEOFRECORDSIZE) { + + // + // Log has already wrapped, go looking for the first valid record + // + + for (pSignature = (PDWORD) Start; (PVOID)pSignature < End; + pSignature++) { + + if (*pSignature == ELF_LOG_FILE_SIGNATURE) { + + // + // Make sure it's really a record + // + + pEvent = CONTAINING_RECORD(pSignature, EVENTLOGRECORD, + Reserved); + if (!ValidFilePos(pEvent, Start, End, End, + pLogFileHeader)) { + // + // Nope, not really, keep trying + // + + continue; + } + + // + // This is a valid record, Remember this so you can use + // it later + // + + FirstPhysicalRecord = pEvent; + + // + // Walk backwards from here (wrapping if necessary) until + // you hit the EOF record or an invalid record. + // + + while (pEvent && ValidFilePos(pEvent, Start, End, End, pLogFileHeader)) { + + // + // See if it's the EOF record + // + + if (IS_EOF(pEvent, + min (ELFEOFUNIQUEPART, + (PBYTE) End - (PBYTE) pEvent))) { + + break; + } + + pLastGoodRecord = pEvent; + pEvent = NextRecordPosition ( + EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ, + pEvent, + pEvent->Length, + 0, + 0, + End, + Start); + + // + // Make sure we're not in an infinite loop + // + + if (pEvent == FirstPhysicalRecord) { + return(STATUS_UNSUCCESSFUL); + } + } + + // + // Found the first record, now go look for the last + // + + FirstRecord = pLastGoodRecord; + break; + } + } + + if (pSignature == End) { + + // + // We couldn't find one valid record in the whole log. Give + // up and we'll set it to an empty log file + // + + return(STATUS_UNSUCCESSFUL); + } + } + else { + + // + // We haven't wrapped yet + // + + FirstPhysicalRecord = FirstRecord = Start; + } + + + // + // Now read forward looking for the last good record + // + + pEvent = FirstPhysicalRecord; + + while (pEvent && ValidFilePos(pEvent, Start, End, End, pLogFileHeader)) { + + // + // See if it's the EOF record + // + + if (IS_EOF(pEvent, min (ELFEOFUNIQUEPART, + (PBYTE) End - (PBYTE) pEvent))) { + + break; + } + + pLastGoodRecord = pEvent; + pEvent = NextRecordPosition ( + EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, + pEvent, + pEvent->Length, + 0, + 0, + End, + Start); + + // + // Make sure we're not in an infinite loop + // + + if (pEvent == FirstPhysicalRecord) { + return(STATUS_UNSUCCESSFUL); + } + } + + // + // Now we know the first record (FirstRecord) and the last record + // (pLastGoodRecord) so we can create the header an EOF record and + // write them out (EOF record gets written at pEvent) + // + // First the EOF record + // + + EOFRecord.BeginRecord = (PBYTE) FirstRecord - (PBYTE) pLogFileHeader; + EOFRecord.EndRecord = (PBYTE) pEvent - (PBYTE) pLogFileHeader; + EOFRecord.CurrentRecordNumber = + pLastGoodRecord->RecordNumber + 1; + EOFRecord.OldestRecordNumber = FirstRecord->RecordNumber; + + ByteOffset = RtlConvertUlongToLargeInteger ( + (PBYTE) pEvent - (PBYTE) pLogFileHeader); + Status = NtWriteFile( + pLogFile->FileHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + &EOFRecord, // Buffer + ELFEOFRECORDSIZE, // Length + &ByteOffset, // Byteoffset + NULL); // Key + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrint(("[ELF]: Log file header write failed 0x%lx\n", + Status)); + return (Status); + } + + // + // Now the header + // + + pLogFileHeader->StartOffset = (PBYTE) FirstRecord- (PBYTE) pLogFileHeader; + pLogFileHeader->EndOffset = (PBYTE) pEvent- (PBYTE) pLogFileHeader; + pLogFileHeader->CurrentRecordNumber = + pLastGoodRecord->RecordNumber + 1; + pLogFileHeader->OldestRecordNumber = FirstRecord->RecordNumber; + pLogFileHeader->HeaderSize = pLogFileHeader->EndHeaderSize = FILEHEADERBUFSIZE; + pLogFileHeader->Signature = ELF_LOG_FILE_SIGNATURE; + pLogFileHeader->Flags = 0; + + if (pLogFileHeader->StartOffset != FILEHEADERBUFSIZE) + pLogFileHeader->Flags |= ELF_LOGFILE_HEADER_WRAP; + + pLogFileHeader->MaxSize = pLogFile->ActualMaxFileSize; + pLogFileHeader->Retention = pLogFile->Retention; + pLogFileHeader->MajorVersion = ELF_VERSION_MAJOR; + pLogFileHeader->MinorVersion = ELF_VERSION_MINOR; + + // + // Now flush this to disk to commit it + // + + Start = pLogFile->BaseAddress; + Size = FILEHEADERBUFSIZE; + + Status = NtFlushVirtualMemory( + NtCurrentProcess(), + &Start, + &Size, + &IoStatusBlock + ); + + } + except (EXCEPTION_EXECUTE_HANDLER) { + return(STATUS_UNSUCCESSFUL); + } + + return (Status); + +} + + +NTSTATUS +ElfOpenLogFile ( + PLOGFILE pLogFile, + ELF_LOG_TYPE LogType + ) + +/*++ + +Routine Description: + + Open the log file, create it if it does not exist. + Create a section and map a view into the log file. + Write out the header to the file, if it is newly created. + If "dirty", update the "start" and "end" pointers by scanning + the file. Set AUTOWRAP if the "start" does not start right after + the file header. + +Arguments: + + pLogFile points to the log file structure, with the relevant data + filled in. + + CreateOptions are the options to be passed to NtCreateFile which + indicate whether to open an existing file, or to create it + if it does not exist. + +Return Value: + + NTSTATUS. + +Note: + + It is up to the caller to set the RefCount in the Logfile structure. + +--*/ +{ + NTSTATUS Status = STATUS_SUCCESS; + OBJECT_ATTRIBUTES ObjectAttributes; + IO_STATUS_BLOCK IoStatusBlock; + LARGE_INTEGER MaximumSizeOfSection; + LARGE_INTEGER ByteOffset; + PELF_LOGFILE_HEADER pLogFileHeader; + FILE_STANDARD_INFORMATION FileStandardInfo; + ULONG IoStatusInformation; + ULONG FileDesiredAccess; + ULONG SectionDesiredAccess; + ULONG SectionPageProtection; + ULONG CreateOptions; + ULONG CreateDisposition; + + // + // File header in a new file has the "Start" and "End" pointers the + // same since there are no records in the file. + // + + static ELF_LOGFILE_HEADER FileHeaderBuf = {FILEHEADERBUFSIZE, // Size + ELF_LOG_FILE_SIGNATURE, + ELF_VERSION_MAJOR, + ELF_VERSION_MINOR, + FILEHEADERBUFSIZE, // Start offset + FILEHEADERBUFSIZE, // End offset + 1, // Next record # + 0, // Oldest record # + 0, // Maxsize + 0, // Flags + 0, // Retention + FILEHEADERBUFSIZE // Size + }; + + // + // Set the file open and section create options based on the type of log + // file this is. + // + + switch (LogType) { + + case ElfNormalLog: + CreateDisposition = FILE_OPEN_IF; + FileDesiredAccess = GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE; + SectionDesiredAccess = SECTION_MAP_READ | SECTION_MAP_WRITE | + SECTION_QUERY | SECTION_EXTEND_SIZE; + SectionPageProtection = PAGE_READWRITE; + CreateOptions = FILE_SYNCHRONOUS_IO_NONALERT; + break; + + case ElfSecurityLog: + CreateDisposition = FILE_OPEN_IF; + FileDesiredAccess = GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE; + SectionDesiredAccess = SECTION_MAP_READ | SECTION_MAP_WRITE | + SECTION_QUERY | SECTION_EXTEND_SIZE; + SectionPageProtection = PAGE_READWRITE; + CreateOptions = FILE_WRITE_THROUGH | FILE_SYNCHRONOUS_IO_NONALERT; + break; + + case ElfBackupLog: + CreateDisposition = FILE_OPEN; + FileDesiredAccess = GENERIC_READ | SYNCHRONIZE; + SectionDesiredAccess = SECTION_MAP_READ | SECTION_QUERY; + SectionPageProtection = PAGE_READONLY; + CreateOptions = FILE_SYNCHRONOUS_IO_NONALERT; + break; + + } + + ElfDbgPrint (("[ELF] Opening and mapping %ws\n", + pLogFile->LogFileName->Buffer)); + + if (pLogFile->FileHandle != NULL) { + + // + // The log file is already in use. Do not reopen or remap it. + // + + ElfDbgPrint(("[ELF] Log file already in use by another module\n")); + + } else { + + // + // Initialize the logfile structure so that it is easier to clean + // up. + // + + pLogFile->ActualMaxFileSize = ELF_DEFAULT_LOG_SIZE; + pLogFile->Flags = 0; + pLogFile->BaseAddress = NULL; + pLogFile->SectionHandle = NULL; + + + // + // Set up the object attributes structure for the Log File + // + + InitializeObjectAttributes( + &ObjectAttributes, + pLogFile->LogFileName, + OBJ_CASE_INSENSITIVE, + NULL, + NULL + ); + + // + // Open the Log File. Create it if it does not exist and it's not + // being opened as a backup file. If creating, create a file of + // the maximum size configured. + // + + MaximumSizeOfSection = + RtlConvertUlongToLargeInteger (ELF_DEFAULT_LOG_SIZE); + + Status = NtCreateFile( + &pLogFile->FileHandle, + FileDesiredAccess, + &ObjectAttributes, + &IoStatusBlock, + &MaximumSizeOfSection, + FILE_ATTRIBUTE_NORMAL, + FILE_SHARE_READ, + CreateDisposition, + CreateOptions, + NULL, + 0); + + if (!NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] Log File Open Failed 0x%lx\n", Status)); + goto cleanup; + } + + // + // If the file already existed, get its size and use that as the + // actual size of the file. + // + + IoStatusInformation = IoStatusBlock.Information; // Save it away + + if (!( IoStatusInformation & FILE_CREATED )) { + ElfDbgPrint (("[Elf] Log file exists.\n")); + + Status = NtQueryInformationFile ( + pLogFile->FileHandle, + &IoStatusBlock, + &FileStandardInfo, + sizeof (FileStandardInfo), + FileStandardInformation + ); + + if (!NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] QueryInformation failed 0x%lx\n", Status)); + goto cleanup; + } else { + + + ElfDbgPrint(("[ELF] Use existing log file size: 0x%lx:%lx\n", + FileStandardInfo.EndOfFile.HighPart, + FileStandardInfo.EndOfFile.LowPart + )); + + MaximumSizeOfSection.LowPart = + FileStandardInfo.EndOfFile.LowPart; + MaximumSizeOfSection.HighPart = + FileStandardInfo.EndOfFile.HighPart; + + // + // Make sure that the high DWORD of the file size is ZERO. + // + + ASSERT (MaximumSizeOfSection.HighPart == 0); + + // + // If the filesize if 0, set it to the minimum size + // + + if (MaximumSizeOfSection.LowPart == 0) { + MaximumSizeOfSection.LowPart = ELF_DEFAULT_LOG_SIZE; + } + + // + // Set actual size of file + // + + pLogFile->ActualMaxFileSize = + MaximumSizeOfSection.LowPart; + + // + // If the size of the log file is reduced, a clear must + // happen for this to take effect + // + + if (pLogFile->ActualMaxFileSize > pLogFile->ConfigMaxFileSize) { + pLogFile->ConfigMaxFileSize = pLogFile->ActualMaxFileSize; + } + + } + } + + // + // Create a section mapped to the Log File just opened + // + + Status = NtCreateSection( + &pLogFile->SectionHandle, + SectionDesiredAccess, + NULL, + &MaximumSizeOfSection, + SectionPageProtection, + SEC_COMMIT, + pLogFile->FileHandle + ); + + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrintNC(("[ELF] Log Mem Section Create Failed 0x%lx\n", + Status)); + goto cleanup; + } + + // + // Map a view of the Section into the eventlog address space + // + + pLogFile->ViewSize = 0; // Initialize value to zero + + Status = NtMapViewOfSection( + pLogFile->SectionHandle, + NtCurrentProcess(), + &pLogFile->BaseAddress, + 0, + 0, + NULL, + &pLogFile->ViewSize, + ViewUnmap, + 0, + SectionPageProtection); + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrintNC(("[ELF] Log Mem Sect Map View failed 0x%lx\n", + Status)); + goto cleanup; + } + + // + // If the file was just created, write out the file header. + // + + if ( IoStatusInformation & FILE_CREATED ) { + ElfDbgPrint(("[ELF] File was created\n")); +JustCreated: + FileHeaderBuf.MaxSize = pLogFile->ActualMaxFileSize; + FileHeaderBuf.Flags = 0; + FileHeaderBuf.Retention = pLogFile->Retention; + + // + // Copy the header into the file + // + + ByteOffset = RtlConvertUlongToLargeInteger ( 0 ); + Status = NtWriteFile( + pLogFile->FileHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + &FileHeaderBuf, // Buffer + FILEHEADERBUFSIZE, // Length + &ByteOffset, // Byteoffset + NULL); // Key + + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrint(("[ELF]: Log file header write failed 0x%lx\n", + Status)); + goto cleanup; + } + + // + // Copy the "EOF" record right after the header + // + + ByteOffset = RtlConvertUlongToLargeInteger ( FILEHEADERBUFSIZE ); + Status = NtWriteFile( + pLogFile->FileHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + &EOFRecord, // Buffer + ELFEOFRECORDSIZE, // Length + &ByteOffset, // Byteoffset + NULL); // Key + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrint(("[ELF]: Log file header write failed 0x%lx\n", + Status)); + goto cleanup; + } + } + + // + // Check to ensure that this is a valid log file. We look at the + // size of the header and the signature to see if they match, as + // well as checking the version number. + // + + pLogFileHeader = (PELF_LOGFILE_HEADER)(pLogFile->BaseAddress); + + if ( (pLogFileHeader->HeaderSize != FILEHEADERBUFSIZE) + ||(pLogFileHeader->EndHeaderSize != FILEHEADERBUFSIZE) + ||(pLogFileHeader->Signature != ELF_LOG_FILE_SIGNATURE) + ||(pLogFileHeader->MajorVersion != ELF_VERSION_MAJOR) + ||(pLogFileHeader->MinorVersion != ELF_VERSION_MINOR)) { + + // + // This file is corrupt, reset it to an empty log, unless + // it's being opened as a backup file, if it is, fail the + // open + // + + ElfDbgPrint(("[ELF] Invalid file header found\n")); + + if (LogType == ElfBackupLog) { + + Status = STATUS_EVENTLOG_FILE_CORRUPT; + goto cleanup; + } + else { + ElfpCreateQueuedAlert(ALERT_ELF_LogFileCorrupt, 1, + &pLogFile->LogModuleName->Buffer); + // + // Treat it like it was just created + // + + goto JustCreated; + } + } + else { + + // + // If the "dirty" bit is set in the file header, then we need to + // revalidate the BeginRecord and EndRecord fields since we did not + // get a chance to write them out before the system was rebooted. + // If the dirty bit is set and it's a backup file, just fail the + // open. + // + + if (pLogFileHeader->Flags & ELF_LOGFILE_HEADER_DIRTY) { + + if (LogType == ElfBackupLog) { + + Status = STATUS_EVENTLOG_FILE_CORRUPT; + goto cleanup; + } + else { + Status = RevalidateLogHeader (pLogFileHeader, pLogFile); + } + } + + if (NT_SUCCESS(Status)) { + + // + // Set the beginning and end record positions in our + // data structure as well as the wrap flag if appropriate. + // + + pLogFile->EndRecord = pLogFileHeader->EndOffset; + pLogFile->BeginRecord = pLogFileHeader->StartOffset; + if (pLogFileHeader->Flags & ELF_LOGFILE_HEADER_WRAP) { + pLogFile->Flags |= ELF_LOGFILE_HEADER_WRAP; + } + + ElfDbgPrint(("[ELF] BeginRecord: 0x%lx EndRecord: 0x%lx \n", + pLogFile->BeginRecord, pLogFile->EndRecord)); + } + else { + + // + // Couldn't validate the file, treat it like it was just + // created (turn it into an empty file) + // + + goto JustCreated; + } + +#ifdef CORRUPTED + + // + // Just for debugging a log corruption problem + // + + if (!VerifyLogIntegrity(pLogFile)) { + ElfDbgPrintNC(("[ELF] Integrity check failed in ElfOpenLogFile\n")); + } +#endif // CORRUPTED + + } + + // + // Fill in the first and last record number values in the LogFile + // data structure. + // + + pLogFile->CurrentRecordNumber = pLogFileHeader->CurrentRecordNumber; + pLogFile->OldestRecordNumber = pLogFileHeader->OldestRecordNumber; + + } + + return (Status); + +cleanup: + + // Clean up anything that got allocated + + if (pLogFile->ViewSize) { + NtUnmapViewOfSection(NtCurrentProcess(), pLogFile->BaseAddress); + } + + if (pLogFile->SectionHandle) { + NtClose(pLogFile->SectionHandle); + } + + if (pLogFile->FileHandle) { + NtClose (pLogFile->FileHandle); + } + + return (Status); + +} diff --git a/private/eventlog/server/logclear.c b/private/eventlog/server/logclear.c new file mode 100644 index 000000000..a59d86748 --- /dev/null +++ b/private/eventlog/server/logclear.c @@ -0,0 +1,621 @@ +/*++ + +Copyright (c) 1991-1994 Microsoft Corporation + +Module Name: + + LOGCLEAR.C + +Abstract: + + Contains functions used to log an event indicating who cleared the log. + This is only called after the security log has been cleared. + +Author: + + Dan Lafferty (danl) 01-July-1994 + +Environment: + + User Mode -Win32 + +Revision History: + + 01-July-1994 danl & robertre + Created - Rob supplied the code which I fitted into the eventlog. + +--*/ + +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> +#include <windows.h> +#include <stdio.h> +#include <msaudite.h> +#include <eventp.h> +#include <tstr.h> + +#define NUM_STRINGS 6 + +// +// Globals +// + PUNICODE_STRING pGlobalComputerNameU = NULL; + PANSI_STRING pGlobalComputerNameA = NULL; + +// +// LOCAL FUNCTION PROTOTYPES +// +BOOL +GetUserInfo( + IN HANDLE Token, + OUT LPWSTR *UserName, + OUT LPWSTR *DomainName, + OUT LPWSTR *AuthenticationId, + OUT PSID *UserSid + ); + +NTSTATUS +ElfpGetComputerName ( + IN LPSTR *ComputerNamePtr + ); + +PUNICODE_STRING +TmpGetComputerNameW (VOID); + +VOID +w_GetComputerName ( ); + + +VOID +ElfpGenerateLogClearedEvent( + IELF_HANDLE LogHandle + ) + +/*++ + +Routine Description: + + This function generates an event indicating that the log was cleared. + +Arguments: + + LogHandle - This is a handle to the log that the event is to be placed in. + It is intended that this function only be called when the SecurityLog + has been cleared. So it is expected the LogHandle will always be + a handle to the security log. + +Return Value: + + NONE - Either it works or it doesn't. If it doesn't, there isn't much + we can do about it. + +--*/ +{ + LPWSTR UserName=NULL; + LPWSTR DomainName=NULL; + LPWSTR AuthenticationId=NULL; + LPWSTR ClientUserName=NULL; + LPWSTR ClientDomainName=NULL; + LPWSTR ClientAuthenticationId=NULL; + PSID UserSid=NULL; + PSID ClientSid=NULL; + DWORD i; + BOOL Result; + HANDLE Token; + PUNICODE_STRING StringPtrArray[NUM_STRINGS]; + UNICODE_STRING StringArray[NUM_STRINGS]; + NTSTATUS Status; + LARGE_INTEGER Time; + ULONG EventTime; + PUNICODE_STRING pComputerNameU; + + Result = OpenProcessToken( GetCurrentProcess(), TOKEN_QUERY, &Token ); + + if (!Result) { + ElfDbgPrint(("OpenProcessToken failed, error = %d",GetLastError())); + return; + } + + Result = GetUserInfo( + Token, + &UserName, + &DomainName, + &AuthenticationId, + &UserSid ); + + CloseHandle( Token ); + + if (!Result) { + ElfDbgPrint(("1st GetUserInfo ret'd %d\n",GetLastError())); + return; + } + + ElfDbgPrint(("\nGetUserInfo ret'd \nUserName = %ws, " + "\nDomainName = %ws, \nAuthenticationId = %ws\n", + UserName, DomainName, AuthenticationId )); + + Result = OpenThreadToken( GetCurrentThread(), TOKEN_QUERY, FALSE, &Token ); + + if (Result) { + + Result = GetUserInfo( + Token, + &ClientUserName, + &ClientDomainName, + &ClientAuthenticationId, + &ClientSid ); + + CloseHandle( Token ); + + if (!Result) { + ElfDbgPrint(("2nd GetUserInfo ret'd %d\n",GetLastError())); + goto CleanExit; + } + + } else { + + // + // Either got access denied or we're not impersonating. + // Use dash strings either way. + // + + ClientUserName = L"-"; + ClientDomainName = L"-"; + ClientAuthenticationId = L"-"; + } + + ElfDbgPrint(("\nGetUserInfo ret'd \nUserName = %ws, " + "\nDomainName = %ws, \nAuthenticationId = %ws\n", + ClientUserName, ClientDomainName, ClientAuthenticationId )); + + + RtlInitUnicodeString( &StringArray[0], UserName ); + RtlInitUnicodeString( &StringArray[1], DomainName ); + RtlInitUnicodeString( &StringArray[2], AuthenticationId ); + RtlInitUnicodeString( &StringArray[3], ClientUserName ); + RtlInitUnicodeString( &StringArray[4], ClientDomainName ); + RtlInitUnicodeString( &StringArray[5], ClientAuthenticationId ); + + // + // Create an array of pointers to UNICODE_STRINGs. + // + for (i=0; i<NUM_STRINGS; i++) { + StringPtrArray[i] = &StringArray[i]; + } + + // + // Generate the time of the event. This is done on the client side + // since that is where the event occurred. + // + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970(&Time, + &EventTime + ); + // + // Generate the ComputerName of the client. + // We have to do this in the client side since this call may be + // remoted to another server and we would not necessarily have + // the computer name there. + // + pComputerNameU = TmpGetComputerNameW(); + + Status = ElfrReportEventW ( + LogHandle, // Log Handle + EventTime, // Time + EVENTLOG_AUDIT_SUCCESS, // Event Type + (USHORT)SE_CATEGID_SYSTEM, // Event Category + SE_AUDITID_AUDIT_LOG_CLEARED, // EventID + NUM_STRINGS, // NumStrings + 0, // DataSize + pComputerNameU, // pComputerNameU + UserSid, // UserSid + StringPtrArray, // *Strings + NULL, // Data + 0, // Flags + NULL, // RecordNumber + NULL // TimeWritten + ); + +CleanExit: + // + // We only come down this path if we know for sure that these + // first three have been allocated. + // + ElfpFreeBuffer(UserName); + ElfpFreeBuffer(DomainName); + ElfpFreeBuffer(AuthenticationId); + + if (UserSid != NULL) { + ElfpFreeBuffer(UserSid); + } + if (ClientUserName != NULL) { + ElfpFreeBuffer(ClientUserName); + } + if (ClientDomainName != NULL) { + ElfpFreeBuffer(ClientDomainName); + } + if (ClientAuthenticationId != NULL) { + ElfpFreeBuffer(ClientAuthenticationId); + } + if (ClientSid != NULL) { + ElfpFreeBuffer(ClientSid); + } +} + +BOOL +GetUserInfo( + IN HANDLE Token, + OUT LPWSTR *UserName, + OUT LPWSTR *DomainName, + OUT LPWSTR *AuthenticationId, + OUT PSID *UserSid + ) +/*++ + +Routine Description: + + This function gathers information about the user identified with the + token. + +Arguments: + Token - This token identifies the entity for which we are gathering + information. + UserName - This is the entity's user name. + DomainName - This is the entity's domain name. + AuthenticationId - This is the entity's Authentication ID. + UserSid - This is the entity's SID. + +NOTE: + Memory is allocated by this routine for UserName, DomainName, + AuthenticationId, and UserSid. It is the caller's responsibility to + free this memory. + +Return Value: + TRUE - If the operation was successful. It is possible that + UserSid did not get allocated in the successful case. Therefore, + the caller should test prior to freeing. + FALSE - If unsuccessful. No memory is allocated in this case. + + +--*/ +{ + PTOKEN_USER Buffer=NULL; +// WCHAR User[256]; + LPWSTR Domain = NULL; + LPWSTR AccountName = NULL; + SID_NAME_USE Use; + BOOL Result; + DWORD RequiredLength; + DWORD AccountNameSize; + DWORD DomainNameSize; + TOKEN_STATISTICS Statistics; + WCHAR LogonIdString[256]; + DWORD Status=ERROR_SUCCESS; + + + *UserSid = NULL; + + Result = GetTokenInformation ( Token, TokenUser, NULL, 0, &RequiredLength ); + + if (!Result) { + + if (GetLastError() == ERROR_INSUFFICIENT_BUFFER) { + + Buffer = ElfpAllocateBuffer((RequiredLength+1)*sizeof(WCHAR) ); + + Result = GetTokenInformation ( Token, + TokenUser, + Buffer, + RequiredLength, + &RequiredLength + ); + + if (!Result) { + ElfDbgPrint(("2nd GetTokenInformation failed, " + "error = %d\n",GetLastError())); + return( FALSE ); + } + + } else { + + DbgPrint("1st GetTokenInformation failed, error = %d\n",GetLastError()); + return( FALSE ); + } + } + + + if (!Result) { + goto ErrorCleanup; + } + + AccountNameSize = 0; + DomainNameSize = 0; + + Result = LookupAccountSidW( L"", + Buffer->User.Sid, + NULL, + &AccountNameSize, + NULL, + &DomainNameSize, + &Use + ); + + if (!Result) { + + if ( GetLastError() == ERROR_INSUFFICIENT_BUFFER ) { + + AccountName = ElfpAllocateBuffer((AccountNameSize+1)*sizeof(WCHAR) ); + Domain = ElfpAllocateBuffer((DomainNameSize+1)*sizeof(WCHAR) ); + + if ( AccountName == NULL ) { + ElfDbgPrint(("LocalAlloc failed allocating %d bytes, " + "error = %d\n",AccountNameSize,GetLastError())); + goto ErrorCleanup; + } + + if ( Domain == NULL ) { + ElfDbgPrint(("LocalAlloc failed allocating %d bytes, " + "error = %d\n",DomainNameSize,GetLastError())); + goto ErrorCleanup; + } + + Result = LookupAccountSidW( L"", + Buffer->User.Sid, + AccountName, + &AccountNameSize, + Domain, + &DomainNameSize, + &Use + ); + if (!Result) { + + ElfDbgPrint(("2nd LookupAccountSid failed, " + "error = %d\n",GetLastError())); + goto ErrorCleanup; + } + + } else { + + ElfDbgPrint(("1st LookupAccountSid failed, " + "error = %d\n",GetLastError())); + goto ErrorCleanup; + } + + } else { + + ElfDbgPrint(("LookupAccountSid succeeded unexpectedly\n")); + goto ErrorCleanup; + } + + ElfDbgPrint(("Name = %ws\\%ws\n",Domain,AccountName)); + + Result = GetTokenInformation ( Token, TokenStatistics, &Statistics, sizeof( Statistics ), &RequiredLength ); + + if (!Result) { + ElfDbgPrint(("GetTokenInformation failed, error = %d\n",GetLastError())); + goto ErrorCleanup; + } + + swprintf(LogonIdString, L"(0x%X,0x%X)",Statistics.AuthenticationId.HighPart, Statistics.AuthenticationId.LowPart ); + ElfDbgPrint(("LogonIdString = %ws\n",LogonIdString)); + + *AuthenticationId = ElfpAllocateBuffer(WCSSIZE(LogonIdString)); + if (*AuthenticationId == NULL) { + ElfDbgPrint(("[ELF]GetUserInfo: Failed to allocate buffer " + "for AuthenticationId %d\n",GetLastError())); + goto ErrorCleanup; + } + wcscpy(*AuthenticationId, LogonIdString); + + // + // Return accumulated information + // + + *UserSid = ElfpAllocateBuffer(GetLengthSid( Buffer->User.Sid ) ); + + Result = CopySid( GetLengthSid( Buffer->User.Sid ), *UserSid, Buffer->User.Sid ); + + ElfpFreeBuffer(Buffer); + + *DomainName = Domain; + *UserName = AccountName; + + return( TRUE ); + +ErrorCleanup: + + if (Buffer != NULL) { + ElfpFreeBuffer( Buffer ); + } + + if (Domain != NULL) { + ElfpFreeBuffer( Domain ); + } + + if (AccountName != NULL) { + ElfpFreeBuffer( AccountName ); + } + + if (*UserSid != NULL) { + ElfpFreeBuffer( *UserSid ); + } + + if (*AuthenticationId != NULL) { + ElfpFreeBuffer( *AuthenticationId ); + } + + return( FALSE ); +} + +NTSTATUS +ElfpGetComputerName ( + IN LPSTR *ComputerNamePtr) + +/*++ + +Routine Description: + + This routine obtains the computer name from a persistent database, + by calling the GetcomputerNameA Win32 Base API + + This routine assumes the length of the computername is no greater + than MAX_COMPUTERNAME_LENGTH, space for which it allocates using + LocalAlloc. It is necessary for the user to free that space using + ElfpFreeBuffer when finished. + +Arguments: + + ComputerNamePtr - This is a pointer to the location where the pointer + to the computer name is to be placed. + +Return Value: + + NERR_Success - If the operation was successful. + + It will return assorted Net or Win32 or NT error messages if not. + +--*/ +{ + DWORD nSize = MAX_COMPUTERNAME_LENGTH + 1; + + // + // Allocate a buffer to hold the largest possible computer name. + // + + *ComputerNamePtr = ElfpAllocateBuffer(nSize); + + if (*ComputerNamePtr == NULL) { + return (GetLastError()); + } + + // + // Get the computer name string into the locally allocated buffer + // by calling the Win32 GetComputerNameA API. + // + + if (!GetComputerNameA(*ComputerNamePtr, &nSize)) { + ElfpFreeBuffer(*ComputerNamePtr); + *ComputerNamePtr = NULL; + return (GetLastError()); + } + + return (ERROR_SUCCESS); +} + +VOID +w_GetComputerName ( ) + +/*++ + +Routine Description: + + This routine gets the name of the computer. It checks the global + variable to see if the computer name has already been determined. + If not, it updates that variable with the name. + It does this for the UNICODE and the ANSI versions. + +Arguments: + + NONE + +Return Value: + + NONE + + +--*/ +{ + PUNICODE_STRING pNameU=NULL; + PANSI_STRING pNameA=NULL; + LPSTR pName; + NTSTATUS Error; + NTSTATUS Status; + + + if (pGlobalComputerNameU != NULL) { + return; + } + pNameU = ElfpAllocateBuffer (sizeof (UNICODE_STRING)); + pNameA = ElfpAllocateBuffer (sizeof (ANSI_STRING)); + + if ((pNameU != NULL) && (pNameA != NULL)) { + + if ((Error = ElfpGetComputerName (&pName)) == ERROR_SUCCESS) { + + // + // ElfpComputerName has allocated a buffer to contain the + // ASCII name of the computer. We use that for the ANSI + // string structure. + // + RtlInitAnsiString ( pNameA, pName ); + + } else { + // + // We could not get the computer name for some reason. Set up + // the golbal pointer to point to the NULL string. + // + RtlInitAnsiString ( pNameA, "\0"); + } + + // + // Set up the UNICODE_STRING structure. + // + Status = RtlAnsiStringToUnicodeString ( + pNameU, + pNameA, + TRUE + ); + + // + // If there was no error, set the global variables. + // Otherwise, free the buffer allocated by ElfpGetComputerName + // and leave the global variables unchanged. + // + if (NT_SUCCESS(Status)) { + + pGlobalComputerNameU = pNameU; // Set global variable if no error + pGlobalComputerNameA = pNameA; // Set global ANSI variable + + } else { + + ElfDbgPrint(("[ELFCLNT] GetComputerName - Error 0x%lx\n", Status)); + ElfpFreeBuffer(pName); + ElfpFreeBuffer (pNameU); // Free the buffers + ElfpFreeBuffer (pNameA); + } + + } +} + + +PUNICODE_STRING +TmpGetComputerNameW ( ) + +/*++ + +Routine Description: + + This routine gets the UNICODE name of the computer. It checks the global + variable to see if the computer name has already been determined. + If not, it calls the worker routine to do that. + +Arguments: + + NONE + +Return Value: + + Returns a pointer to the computer name, or a NULL. + + +--*/ +{ + if (pGlobalComputerNameU == NULL) { + w_GetComputerName(); + } + return (pGlobalComputerNameU); +} + + + diff --git a/private/eventlog/server/memory.c b/private/eventlog/server/memory.c new file mode 100644 index 000000000..8510786e1 --- /dev/null +++ b/private/eventlog/server/memory.c @@ -0,0 +1,149 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + MEMORY.C + +Abstract: + + This file contains the routines that deal with memory management. + +Author: + + Rajen Shah (rajens) 12-Jul-1991 + +[Environment:] + + User Mode - Win32, except for NTSTATUS returned by some functions. + +Revision History: + + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> + +// +// Implement my own tail-checking, since the system code requires a +// debugging build +// + +//#define TAIL_CHECKING +#ifdef TAIL_CHECKING +#define CHECK_HEAP_TAIL_SIZE 16 +#define CHECK_HEAP_TAIL_FILL 0xAB +#endif + + +PVOID +ElfpAllocateBuffer ( + ULONG Size + ) + +/*++ + +Routine Description: + + Allocate a buffer of the given size, and return the pointer in BufPtr. + + +Arguments: + + + +Return Value: + + Pointer to allocated buffer (or NULL). + +Note: + + +--*/ +{ + PVOID BufPtr; + +#ifdef TAIL_CHECKING + // + // Keep the offset of the pattern (so we don't have to have internal + // knowledge about the granularity of the heap block) and copy a + // known pattern after the end of the user's block + // + BufPtr = (PVOID *) MIDL_user_allocate ( Size + + CHECK_HEAP_TAIL_SIZE + sizeof(DWORD)); + *((PDWORD)BufPtr) = Size + sizeof(DWORD); + (PBYTE) BufPtr += sizeof(DWORD); + RtlFillMemory((PBYTE)BufPtr + Size, + CHECK_HEAP_TAIL_SIZE, + CHECK_HEAP_TAIL_FILL); +#else + + BufPtr = (PVOID *) MIDL_user_allocate ( Size ); + +#endif + + return (BufPtr); + +} + + + +VOID +ElfpFreeBuffer ( + PVOID BufPtr) + +/*++ + +Routine Description: + + Frees a buffer previously allocated by AllocateBuffer. + + +Arguments: + + Pointer to buffer. + +Return Value: + + NOTHING + +Note: + + +--*/ +{ + +#ifdef TAIL_CHECKING + { + DWORD i; + PBYTE pb; + + // + // Back up to real start of block + // + + (PBYTE)BufPtr -= sizeof(DWORD); + i = *((PDWORD)BufPtr); + pb = (PBYTE)BufPtr + i; + + for (i = 0; i < CHECK_HEAP_TAIL_SIZE ; i++, pb++) { + if (*pb != CHECK_HEAP_TAIL_FILL) { + ElfDbgPrint(("[ELF] Heap has been corrupted at 0x%x\n", + BufPtr)); + // Make it access violate + pb = (PBYTE) 0; + *pb = 1; + } + } + } +#endif + + MIDL_user_free ( BufPtr ); + return; + +} diff --git a/private/eventlog/server/operate.c b/private/eventlog/server/operate.c new file mode 100644 index 000000000..d8e9404c6 --- /dev/null +++ b/private/eventlog/server/operate.c @@ -0,0 +1,3117 @@ +/*++ + +Copyright (c) 1990-1994 Microsoft Corporation + +Module Name: + + OPERATE.C + +Abstract: + + This file contains all the routines to perform operations on the + log files. They are called by the thread that performs requests. + +Author: + + Rajen Shah (rajens) 16-Jul-1991 + +Revision History: + + 04-Apr-1995 MarkBl + Resets the file archive attribute on log write. The backup caller + clears it. + 29-Aug-1994 Danl + We no longer grow log files in place. Therefore, the ExtendSize + function will allocate a block that is as large as the old size plus + the size of the new block that must be added. If this allocation + succeeds, then it will free up the old block. If a failure occurs, + we continue to use the old block as if we have already grown as much + as we can. + 22-Jul-1994 Danl + ValidFilePos: Changed test for pEndRecordLen > PhysicalEOF + so that it uses >=. In the case where pEndRecordLen == PhysicalEOF, + we want to wrap to find the last DWORD at the beginning of the File + (after the header). + + 08-Jul-1994 Danl + PerformWriteRequest: Fixed overwrite logic so that in the case where + a log is set up for always-overwrite, that we never go down the branch + that indicates the log was full. Previously, it would go down that + branch if the current time was less than the log time (ie. someone + set the clock back). + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <alertmsg.h> // ALERT_ELF manifests + +#define OVERWRITE_AS_NEEDED 0x00000000 +#define NEVER_OVERWRITE 0xffffffff + +#if DBG +#define ELF_ERR_OUT(txt,code,pLogFile) (ElfErrorOut(txt,code,pLogFile)) +#else +#define ELF_ERR_OUT(txt,code,pLogFile) +#endif + +// +// Prototypes +// +BOOL +IsPositionWithinRange( + PVOID Position, + PVOID BeginningRecord, + PVOID EndingRecord); + +#if DBG +VOID +ElfErrorOut( + LPSTR ErrorText, + DWORD StatusCode, + PLOGFILE pLogFile); +#endif // DBG + + +VOID +ElfExtendFile ( + PLOGFILE pLogFile, + ULONG SpaceNeeded, + PULONG SpaceAvail + ) +/*++ + +Routine Description: + + This routine takes an open log file and extends the file and underlying + section and view if possible. If it can't be grown, it caps the file + at this size by setting the ConfigMaxFileSize to the Actual. It also + updates the SpaceAvail parm which is used in PerformWriteRequest (the + caller). + +Arguments: + + pLogFile - pointer to a LOGFILE structure for the open logfile + ExtendAmount - How much bigger to make the file/section/view + SpaceAvail - Update this with how much space was added to the section + +Return Value: + + None - If we can't extend the file, we just cap it at this size for the + duration of this boot. We'll try again the next time the eventlog + is closed and reopened. + +Note: + + ExtendAmount should always be granular to 64K. + +--*/ +{ + + LARGE_INTEGER NewSize; + NTSTATUS Status; + PVOID BaseAddress; + ULONG Size; + IO_STATUS_BLOCK IoStatusBlock; + + // + // Calculate how much to grow the file then extend the section by + // that amount. Do this in 64K chunks. + // + + SpaceNeeded = ((SpaceNeeded - *SpaceAvail) & 0xFFFF0000) + 0x10000; + + if (SpaceNeeded > (pLogFile->ConfigMaxFileSize - pLogFile->ActualMaxFileSize)) + { + + // + // We can't grow it by the full amount we need. Grow + // it to the max size and let file wrap take over. + // If there isn't any room to grow, then return; + // + + SpaceNeeded = pLogFile->ConfigMaxFileSize - + pLogFile->ActualMaxFileSize; + + if (SpaceNeeded == 0) { + return; + } + } + + NewSize = RtlConvertUlongToLargeInteger (pLogFile->ActualMaxFileSize + + SpaceNeeded); + + // + // Update the file size information, extend the section, and map the + // new section + // + + Status = NtSetInformationFile(pLogFile->FileHandle, + &IoStatusBlock, + &NewSize, + sizeof(NewSize), + FileEndOfFileInformation); + + + if (!NT_SUCCESS(Status)) { + ElfDbgPrintNC(("[EVENTLOG]ElfExtendFile: NtSetInformationFile " + "failed 0x%lx\n",Status)); + goto ErrorExit; + } + + Status = NtExtendSection(pLogFile->SectionHandle, &NewSize); + + if (!NT_SUCCESS(Status)) { + goto ErrorExit; + } + + // + // Now that the section is extended, we need to map the new section. + // + + // + // Map a view of the entire section (with the extension). + // Allow the allocator to tell us where it is located, and + // what the size is. + // + BaseAddress = NULL; + Size = 0; + Status = NtMapViewOfSection( + pLogFile->SectionHandle, + NtCurrentProcess(), + &BaseAddress, + 0, + 0, + NULL, + &Size, + ViewUnmap, + 0, + PAGE_READWRITE); + + if (!NT_SUCCESS(Status)) { + // + // If this fails, just exit, and we will continue with the + // view that we have. + // + ELF_ERR_OUT("ElfExtendFile:NtMapViewOfSection Failed", + Status, pLogFile); + goto ErrorExit; + } + + // + // Unmap the old section. + // + + Status = NtUnmapViewOfSection( + NtCurrentProcess(), + pLogFile->BaseAddress); + + if (!NT_SUCCESS(Status)) { + ELF_ERR_OUT("ElfExtendFile:NtUnmapViewOfSection Failed", + Status, pLogFile); + } + pLogFile->BaseAddress = BaseAddress; + + // + // We managed to extend the file, update the actual size + // and space available and press on. + // + + pLogFile->ViewSize += SpaceNeeded; + pLogFile->ActualMaxFileSize += SpaceNeeded; + *SpaceAvail += SpaceNeeded; + + // + // If we were wrapped, turn off the bit since now we're in a state + // that is unwrapped, except there may be some dead space after the + // header, but before the start of the first full record. This will + // be reclaimed when the file really wraps again. + // + + pLogFile->Flags &= ~ELF_LOGFILE_HEADER_WRAP; + + // + // Now flush this to disk to commit it + // + + BaseAddress = pLogFile->BaseAddress; + Size = FILEHEADERBUFSIZE; + + Status = NtFlushVirtualMemory( + NtCurrentProcess(), + &BaseAddress, + &Size, + &IoStatusBlock + ); + + if (!NT_SUCCESS(Status)) { + ELF_ERR_OUT("ElfExtendFile:NtFlushVirtualMemory Failed", + Status, pLogFile); + } + return; + +ErrorExit: + // + // Couldn't extend the section for some reason. Just wrap the file now. + // Cap the file at this size, so we don't try and extend the section on + // every write. The next time the eventlog service is started up it + // will revert to the configured max again. + // + // Generate an Alert here - BUGBUG + // + ELF_ERR_OUT("ElfExtendFile:Couldn't extend the File", + Status, pLogFile); + + pLogFile->ConfigMaxFileSize = pLogFile->ActualMaxFileSize; + + return; + +} + + +NTSTATUS +CopyUnicodeToAnsiRecord ( + PVOID Dest, + PVOID Src, + PVOID *NewBufPos, + PULONG RecordSize + ) + +/*++ + +Routine Description: + + This routine reads from the event log specified in the request packet. + + This routine uses memory mapped I/O to access the log file. This makes + it much easier to move around the file. + +Arguments: + + Dest - Points to destination buffer. + Src - Points to the UNICODE record. + NewBufPos - Gets offset in Dest buffer after record just transferred. + RecordSize - Size of this (ANSI) record. + +Return Value: + + Actual size of record copied into the Dest buffer. + +Note: + +--*/ +{ + ANSI_STRING StringA; + UNICODE_STRING StringU; + PEVENTLOGRECORD SrcRecord, DestRecord; + PWSTR pStringU; + PVOID TempPtr; + ULONG PadSize, i; + ULONG zero = 0; + WCHAR *SrcStrings, *DestStrings; + ULONG RecordLength, *pLength; + NTSTATUS Status; + + DestRecord = (PEVENTLOGRECORD)Dest; + SrcRecord = (PEVENTLOGRECORD)Src; + + DestRecord->TimeGenerated = SrcRecord->TimeGenerated; + DestRecord->Reserved = SrcRecord->Reserved; + DestRecord->RecordNumber = SrcRecord->RecordNumber; + DestRecord->TimeWritten = SrcRecord->TimeWritten; + DestRecord->EventID = SrcRecord->EventID; + DestRecord->EventType = SrcRecord->EventType; + DestRecord->EventCategory = SrcRecord->EventCategory; + DestRecord->NumStrings = SrcRecord->NumStrings; + DestRecord->UserSidLength = SrcRecord->UserSidLength; + DestRecord->DataLength = SrcRecord->DataLength; + + // + // Convert and copy over modulename + // + pStringU = (PWSTR)((ULONG)SrcRecord + sizeof(EVENTLOGRECORD)); + + RtlInitUnicodeString ( &StringU, pStringU ); + + Status = RtlUnicodeStringToAnsiString ( + &StringA, + &StringU, + TRUE + ); + + if (NT_SUCCESS(Status)) { + + TempPtr = (PVOID)((ULONG)DestRecord + sizeof(EVENTLOGRECORD)); + + RtlMoveMemory ( TempPtr, StringA.Buffer, StringA.MaximumLength ); + + TempPtr = (PVOID)((ULONG) TempPtr + StringA.MaximumLength); + + RtlFreeAnsiString(&StringA); + + // + // Convert and copy over computername + // + // TempPtr points to location in the destination for the computername + // + + pStringU = (PWSTR)((ULONG)pStringU + StringU.MaximumLength); + + RtlInitUnicodeString ( &StringU, pStringU ); + + Status = RtlUnicodeStringToAnsiString ( + &StringA, + &StringU, + TRUE + ); + + if (NT_SUCCESS(Status)) { + + RtlMoveMemory ( TempPtr, StringA.Buffer, StringA.MaximumLength ); + + TempPtr = (PVOID)((ULONG) TempPtr + StringA.MaximumLength); + + RtlFreeAnsiString(&StringA); + + } + } + if (NT_SUCCESS(Status)) { + + // TempPtr points to location after computername - i.e. UserSid. + // Before we write out the UserSid, we ensure that we pad the + // bytes so that the UserSid starts on a DWORD boundary. + // + PadSize = sizeof(ULONG) - (((ULONG)TempPtr-(ULONG)DestRecord) % sizeof(ULONG)); + + RtlMoveMemory ( + TempPtr, + &zero, + PadSize + ); + + TempPtr = (PVOID)((ULONG)TempPtr + PadSize); + // + // Copy over the UserSid. + // + RtlMoveMemory ( + TempPtr, + (PVOID)((ULONG)SrcRecord + SrcRecord->UserSidOffset), + SrcRecord->UserSidLength + ); + + DestRecord->UserSidOffset = (ULONG)( (ULONG)TempPtr + - (ULONG)DestRecord); + // + // Copy over the Strings + // + TempPtr = (PVOID)((ULONG)TempPtr + SrcRecord->UserSidLength); + SrcStrings = (WCHAR *) ((ULONG)SrcRecord + (ULONG)SrcRecord->StringOffset); + DestStrings = (WCHAR *)TempPtr; + + for (i=0; i < DestRecord->NumStrings; i++) { + + RtlInitUnicodeString (&StringU, SrcStrings); + + RtlUnicodeStringToAnsiString ( + &StringA, + &StringU, + TRUE + ); + + RtlMoveMemory ( + DestStrings, + StringA.Buffer, + StringA.MaximumLength + ); + + DestStrings = (WCHAR*)( (ULONG)DestStrings + + (ULONG)StringA.MaximumLength); + + SrcStrings = (WCHAR*)( (ULONG)SrcStrings + + (ULONG)StringU.MaximumLength); + + RtlFreeAnsiString (&StringA); + } + + DestRecord->StringOffset = (ULONG)TempPtr - (ULONG)DestRecord; + + // + // Copy over the binary Data + // + // DestStrings points to the point after the last string copied. + // + TempPtr = (PVOID)DestStrings; + DestRecord->DataOffset = (ULONG)TempPtr - (ULONG)DestRecord; + + RtlMoveMemory ( + TempPtr, + (PVOID)((ULONG)SrcRecord + SrcRecord->DataOffset), + SrcRecord->DataLength + ); + + // + // Now do the pad bytes. + // + TempPtr = (PVOID)((ULONG)TempPtr + SrcRecord->DataLength); + PadSize = sizeof(ULONG) - (((ULONG)TempPtr-(ULONG)DestRecord) % sizeof(ULONG)); + + RtlMoveMemory ( + TempPtr, + &zero, + PadSize + ); + + RecordLength = (ULONG)TempPtr + PadSize + sizeof(ULONG) - (ULONG)DestRecord; + + pLength = (PULONG)((ULONG)TempPtr + PadSize); + *pLength = RecordLength; + DestRecord->Length = RecordLength; + ASSERT (((ULONG)DestRecord + RecordLength) == ((ULONG)pLength + sizeof(ULONG))); + + // + // Set up return information + // + *NewBufPos = (PVOID)((ULONG)DestRecord + RecordLength); + *RecordSize = RecordLength; + + } + return (Status); +} // CopyUnicodeToAnsiRecord + +BOOL +ValidFilePos ( + PVOID Position, + PVOID BeginningRecord, + PVOID EndingRecord, + PVOID PhysicalEOF, + PVOID BaseAddress + ) + +/*++ + +Routine Description: + + This routine determines whether we are pointing to a valid beginning + of an event record in the event log. It does this by validating + the signature then comparing the length at the beginning of the record to + the length at the end, both of which have to be at least the size of the + fixed length portion of an eventlog record. + +Arguments: + + Position - Pointer to be verified. + BeginningRecord - Pointer to the beginning record in the file. + EndingRecord - Pointer to the byte after the ending record in the file. + PhysicalEOF - Pointer the physical end of the log. + BaseAddress - Pointer to the physical beginning of the log. + +Return Value: + + TRUE if this position is valid. + +Note: + + There is a probability of error if a record just happens to have the + ULONG at the current position the same as the value that number of + bytes further on in the record. However, this is a very slim chance. + + +--*/ +{ + PULONG pEndRecordLength; + BOOL fValid = FALSE; + PEVENTLOGRECORD pEventRecord; + + try { + pEventRecord = (PEVENTLOGRECORD)Position; + + // + // Verify that the pointer is within the range of BEGINNING->END + // + + fValid = IsPositionWithinRange(Position, + BeginningRecord, + EndingRecord); + + // + // If the offset looks OK, then examine the lengths at the beginning + // and end of the current record. If they don't match, then the position + // is invalid. + // + + if (fValid) { + + // + // Make sure the length is a multiple number of DWORDS + // + + if (pEventRecord->Length & 3) { + fValid = FALSE; + } + else { + pEndRecordLength = + (PULONG) ((PBYTE)Position + pEventRecord->Length) - 1; + + // + // If the file is wrapped, adjust the pointer to reflect the + // portion of the record that is wrapped starting after the header + // + + if ((PVOID) pEndRecordLength >= PhysicalEOF) { + pEndRecordLength = (PULONG) ((PBYTE) BaseAddress + + ((PBYTE) pEndRecordLength - (PBYTE) PhysicalEOF) + + FILEHEADERBUFSIZE); + } + + if (pEventRecord->Length == *pEndRecordLength && + (pEventRecord->Length == ELFEOFRECORDSIZE || + (pEventRecord->Length >= sizeof(EVENTLOGRECORD) && + pEventRecord->Reserved == ELF_LOG_FILE_SIGNATURE)) + ) { + + fValid = TRUE; + + } else { + fValid = FALSE; + } + } + } + } + except (EXCEPTION_EXECUTE_HANDLER) { + fValid = FALSE; + } + + return(fValid); +} + + +BOOL +IsPositionWithinRange( + PVOID Position, + PVOID BeginningRecord, + PVOID EndingRecord) +{ + // + // Verify that the pointer is within the range of BEGINNING->END + // + + if (EndingRecord > BeginningRecord) { + if ((Position >= BeginningRecord) && (Position <= EndingRecord)) + return(TRUE); + + } else if (EndingRecord < BeginningRecord) { + if ((Position >= BeginningRecord) || (Position <= EndingRecord)) + return(TRUE); + + } else { + return(FALSE); + } +} + + +PVOID +FindStartOfNextRecord ( + PVOID Position, + PVOID BeginningRecord, + PVOID EndingRecord, + PVOID PhysicalStart, + PVOID PhysicalEOF, + PVOID BaseAddress + ) + +/*++ + +Routine Description: + + This routine starts at Position, and finds the beginning of the next + valid record, wrapping around the physical end of the file if necessary. + +Arguments: + + Position - Pointer at which to start the search. + BeginningRecord - Pointer to the beginning record in the file. + EndingRecord - Pointer to the byte after the ending record in the file. + PhysicalStart - Pointer to the start of log infor (after header) + PhysicalEOF - Pointer the physical end of the log. + BaseAddress - Pointer to the physical beginning of the log. + +Return Value: + + A pointer to the start of the next valid record. NULL if there is no + valid record. + +Note: + + There is a probability of error if a record just happens to have the + ULONG at the current position the same as the value that number of + bytes further on in the record. However, this is a very slim chance. + + +--*/ +{ + + PULONG ptr; + PULONG EndOfBlock; + PULONG EndOfFile; + PVOID pRecord; + ULONG Size; + BOOL StillLooking = TRUE; + + // + // Search for a ULONG which matches a record signature + // + + ptr = (PULONG) Position; + EndOfBlock = EndOfFile = (PULONG) PhysicalEOF - 1; + + while (StillLooking) { + + // + // Check to see if it is the EOF record + // + + if (*ptr == ELFEOFRECORDSIZE) { + + // + // Only scan up to the end of the file. Just compare up the + // constant information + // + + Size = min (ELFEOFUNIQUEPART, + (PBYTE) PhysicalEOF - (PBYTE) ptr); + + pRecord = (PVOID) CONTAINING_RECORD(ptr, ELF_EOF_RECORD, + RecordSizeBeginning); + + if (RtlCompareMemory ( + pRecord, + &EOFRecord, + Size) == Size) { + // + // This is the EOF record, back up to the last record + // + + (PBYTE) pRecord -= *((PULONG) pRecord - 1); + if (pRecord < PhysicalStart) { + pRecord = (PVOID) ((PBYTE) PhysicalEOF - + ((PBYTE)PhysicalStart - (PBYTE)pRecord)); + } + + } + + if (ValidFilePos(pRecord, BeginningRecord, EndingRecord, + PhysicalEOF, BaseAddress)) { + return(pRecord); + } + } + + // + // Check to see if it is an event record + // + + if (*ptr == ELF_LOG_FILE_SIGNATURE) { + + // + // This is a signature, see if the containing record is valid + // + + pRecord = (PVOID) CONTAINING_RECORD(ptr, EVENTLOGRECORD, + Reserved); + if (ValidFilePos(pRecord, BeginningRecord, EndingRecord, + PhysicalEOF, BaseAddress)) { + return(pRecord); + } + + } + + // + // Bump to the next byte and see if we're done. + // + + ptr++; + + if (ptr >= EndOfBlock) { + + // + // Need the second test on this condition in case Position + // happens to equal PhysicalEOF - 1 (EndOfBlock initial value); + // without this, this loop would terminate prematurely. + // + + if ((EndOfBlock == (PULONG) Position) && + ((PULONG) Position != EndOfFile)) { + + // + // This was the top half, so we're done + // + + StillLooking = FALSE; + } + else { + + // + // This was the bottom half, let's look in the top half + // + + EndOfBlock = (PULONG) Position; + ptr = (PULONG) PhysicalStart; + } + } + } + + + + // + // Didn't find a valid record + // + + return(NULL); + +} + +PVOID +NextRecordPosition ( + ULONG ReadFlags, + PVOID CurrPosition, + ULONG CurrRecordLength, + PVOID BeginRecord, + PVOID EndRecord, + PVOID PhysicalEOF, + PVOID PhysStart + ) + + +/*++ + +Routine Description: + + This routine seeks to the beginning of the next record to be read + depending on the flags in the request packet. + +Arguments: + + ReadFlags - Read forwards or backwards + CurrPosition - Pointer to the current position. + CurrRecordLength - Length of the record at the last position read. + BeginRecord - Logical first record + EndRecord - Logical last record (EOF record) + PhysEOF - End of file + PhysStart - Start of file pointer (following file header). + +Return Value: + + New position or NULL if invalid record. + +Note: + + +--*/ +{ + + PVOID NewPosition; + ULONG Length; + PDWORD FillDword; + + if (ReadFlags & EVENTLOG_FORWARDS_READ) { + + // + // If we're pointing at the EOF record, just set the position to + // the first record + // + + if (CurrRecordLength == ELFEOFRECORDSIZE) { + return(BeginRecord); + } + + NewPosition = (PVOID) ((ULONG)CurrPosition + CurrRecordLength); + + // + // Take care of wrapping. + // + + if (NewPosition >= PhysicalEOF) { + NewPosition = (PVOID)((PBYTE)PhysStart + + ((PBYTE) NewPosition - (PBYTE) PhysicalEOF)); + } + + // + // If this is a ELF_SKIP_DWORD, skip to the top of the file + // + + if (*(PDWORD) NewPosition == ELF_SKIP_DWORD) { + NewPosition = PhysStart; + } + + } else { // Reading backwards. + + ASSERT (ReadFlags & EVENTLOG_BACKWARDS_READ); + + if (CurrPosition == BeginRecord) { + + // + // This is the "end of file" if we're reading backwards. + // + + return(EndRecord); + } + else if (CurrPosition == PhysStart) { + + // + // Flip to the bottom of the file, but skip and ELF_SKIP_DWORDs + // + + FillDword = (PDWORD) PhysicalEOF; // last dword + FillDword--; + while (*FillDword == ELF_SKIP_DWORD) { + FillDword--; + } + CurrPosition = (PVOID) (FillDword + 1); + } + + Length = *((PULONG) CurrPosition - 1); + if (Length < ELFEOFRECORDSIZE) { // Bogus length, must be invalid record + return(NULL); + } + + NewPosition = (PVOID)((PBYTE) CurrPosition - Length); + + // + // Take care of wrapping + // + + if (NewPosition < PhysStart) { + NewPosition = (PVOID)((PBYTE) PhysicalEOF - + ((PBYTE) PhysStart - (PBYTE) NewPosition)); + } + } + return (NewPosition); +} // NextRecordPosition + + + +NTSTATUS +SeekToStartingRecord ( + PELF_REQUEST_RECORD Request, + PVOID *ReadPosition, + PVOID BeginRecord, + PVOID EndRecord, + PVOID PhysEOF, + PVOID PhysStart + ) + + +/*++ + +Routine Description: + + This routine seeks to the correct position as indicated in the + request packet. + +Arguments: + + Pointer to the request packet. + Pointer to a pointer where the final position after the seek is returned. + +Return Value: + + NTSTATUS and new position in file. + +Note: + + This routine ensures that it is possible to seek to the position + specified in the request packet. If not, then an error is returned + which indicates that the file probably changed between the two + READ operations, or else the record offset specified is beyond the + end of the file. + +--*/ +{ + PVOID Position; + ULONG RecordLen; + ULONG NumRecordsToSeek; + ULONG BytesPerRecord; + ULONG NumberOfRecords; + ULONG NumberOfBytes; + ULONG ReadFlags; + + // + // If the beginning and the end are the same, then there are no + // entries in this file. + // + if (BeginRecord == EndRecord) + return (STATUS_END_OF_FILE); + + // + // Find the last position (or the "beginning" if this is the first READ + // call for this handle). + // + + if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_SEQUENTIAL_READ) { + + if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_FORWARDS_READ) { + + // If this is the first READ operation, LastSeekPosition will + // be zero. In that case, we set the position to the first + // record (in terms of time) in the file. + // + if (Request->Pkt.ReadPkt->LastSeekPos == 0) { + + Position = BeginRecord; + + } else { + + Position = (PVOID)((PBYTE) Request->LogFile->BaseAddress + + Request->Pkt.ReadPkt->LastSeekPos ); + + + // + // If we're changing the direction we're reading, skip + // forward one record. This is because we're pointing at + // the "next" record based on the last read direction + // + + if (!(Request->Pkt.ReadPkt->Flags & ELF_LAST_READ_FORWARD)) { + + Position = NextRecordPosition ( + Request->Pkt.ReadPkt->ReadFlags, + Position, + ((PEVENTLOGRECORD) Position)->Length, + BeginRecord, + EndRecord, + PhysEOF, + PhysStart + ); + } + else { + // + // This *really* cheesy check exists to handle the case + // where Position could be on an ELF_SKIP_DWORD pad + // dword at end of the file. + // + // NB: Must be prepared to handle an exception since + // a somewhat unknown pointer is dereferenced. + // + // BUGBUG: The eventlog code needs to handle exceptions + // in *many* more cases! + // + + NTSTATUS Status = STATUS_SUCCESS; + + try { + if (IsPositionWithinRange(Position, + BeginRecord, + EndRecord)) + { + // + // If this is a ELF_SKIP_DWORD, skip to the + // top of the file. + // + + if (*(PDWORD) Position == ELF_SKIP_DWORD) { + Position = PhysStart; + } + } else { + // + // More likely the caller's handle was invalid + // if the position was not within range. + // + + Status = STATUS_INVALID_HANDLE; + } + } + except (EXCEPTION_EXECUTE_HANDLER) { + Status = STATUS_EVENTLOG_FILE_CORRUPT; + } + + if (!NT_SUCCESS(Status)) { + *ReadPosition = NULL; + return(Status); + } + } + } + + } else { // READ backwards + + // If this is the first READ operation, LastSeekPosition will + // be zero. In that case, we set the position to the last + // record (in terms of time) in the file. + // + if (Request->Pkt.ReadPkt->LastSeekPos == 0) { + + Position = EndRecord; + + // + // Subtract the length of the last record from the current + // position to get to the beginning of the record. + // + // If that moves beyond the physical beginning of the file, + // then we need to wrap around to the physical end of the file. + // + + Position = (PVOID)((PBYTE)Position - *((PULONG)Position - 1)); + + if (Position < PhysStart) { + Position = (PVOID)((PBYTE)PhysEOF + - ((PBYTE)PhysStart - (PBYTE)Position)); + } + } else { + + Position = (PVOID)((PBYTE) Request->LogFile->BaseAddress + + Request->Pkt.ReadPkt->LastSeekPos ); + + // + // If we're changing the direction we're reading, skip + // forward one record. This is because we're pointing at + // the "next" record based on the last read direction + // + + if (Request->Pkt.ReadPkt->Flags & ELF_LAST_READ_FORWARD) { + + Position = NextRecordPosition ( + Request->Pkt.ReadPkt->ReadFlags, + Position, + 0, // not used if reading backwards + BeginRecord, + EndRecord, + PhysEOF, + PhysStart + ); + } + } + } + + } else if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_SEEK_READ) { + + // + // Make sure the record number passed in is valid + // + + if (Request->Pkt.ReadPkt->RecordNumber < + Request->LogFile->OldestRecordNumber || + Request->Pkt.ReadPkt->RecordNumber >= + Request->LogFile->CurrentRecordNumber) { + + return(STATUS_INVALID_PARAMETER); + } + + // + // We're seeking to an absolute record number, so use the following + // algorhythm: + // + // There are two defines that control the process: + // + // MAX_WALKING_DISTANCE - when we get this close to the record, + // we just sequentially read records till we find the right one + // + // MAX_TRIES - we'll only try this many times to get within + // walking distance by calculation using average record size, + // after this, we'll just brute force it from where we are + // + // Calculate the average number of bytes per record + // + // Based on this number seek to where the record should start + // + // Find the start of the next record in the file + // + // If it's within "walking distance" move forward sequentially + // to the right record + // + // If it's not, recalcuate average bytes per record for the records + // between the start and the current record, and repeat + // + // Have a max number of tries at this, then just walk from wherever + // we are to the right record + // + +#define MAX_WALKING_DISTANCE 5 +#define MAX_TRIES 5 + + // + // Calculate the average number of bytes per record + // + + NumberOfRecords = Request->LogFile->CurrentRecordNumber - + Request->LogFile->OldestRecordNumber; + NumberOfBytes = Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP ? + Request->LogFile->ActualMaxFileSize : + Request->LogFile->EndRecord; + NumberOfBytes -= FILEHEADERBUFSIZE; + BytesPerRecord = NumberOfBytes / NumberOfRecords; + + // + // Calcuate the first guess as to what the offset of the desired + // record should be + // + + Position = (PVOID) ((PBYTE) Request->LogFile->BaseAddress + + Request->LogFile->BeginRecord + + BytesPerRecord * + (Request->Pkt.ReadPkt->RecordNumber - + Request->LogFile->OldestRecordNumber)); + + // + // Align the position to a ULONG bountry. + // + + Position = (PVOID) (((ULONG) Position + sizeof(ULONG) - 1) & + ~(sizeof(ULONG) - 1)); + + // + // Take care of file wrap + // + + if (Position >= PhysEOF) { + + Position = (PVOID)((PBYTE)PhysStart + + ((PBYTE) Position - (PBYTE) PhysEOF)); + } + // + // Get to the start of the next record after position + // + + Position = FindStartOfNextRecord(Position, BeginRecord, EndRecord, + PhysStart, PhysEOF, Request->LogFile->BaseAddress); + + ASSERT(Position); + + if (Request->Pkt.ReadPkt->RecordNumber > + ((PEVENTLOGRECORD) Position)->RecordNumber) { + + NumRecordsToSeek = Request->Pkt.ReadPkt->RecordNumber - + ((PEVENTLOGRECORD) Position)->RecordNumber; + ReadFlags = EVENTLOG_FORWARDS_READ; + } + + else { + + NumRecordsToSeek = ((PEVENTLOGRECORD) Position)->RecordNumber - + Request->Pkt.ReadPkt->RecordNumber; + ReadFlags = EVENTLOG_BACKWARDS_READ; + } + + ElfDbgPrint(("[ELF] Walking %d records\n", NumRecordsToSeek)); + + while (NumRecordsToSeek--) { + + RecordLen = ((PEVENTLOGRECORD) Position)->Length; + + Position = NextRecordPosition ( + ReadFlags, + Position, + RecordLen, + BeginRecord, + EndRecord, + PhysEOF, + PhysStart + ); + } + + } // if SEEK_READ + + *ReadPosition = Position; // This is the new seek position + + if (!Position) { // The record was invalid + return(STATUS_EVENTLOG_FILE_CORRUPT); + } + else { + return (STATUS_SUCCESS); + } + +} // SeekToStartingRecord + + +NTSTATUS +ReadFromLog ( PELF_REQUEST_RECORD Request ) + +/*++ + +Routine Description: + + This routine reads from the event log specified in the request packet. + + This routine uses memory mapped I/O to access the log file. This makes + it much easier to move around the file. + +Arguments: + + Pointer to the request packet. + +Return Value: + + NTSTATUS. + +Note: + + When we come here, we are impersonating the client. If we get a + fault accessing the user's buffer, the fault goes to the user, + not the service. + +--*/ +{ + NTSTATUS Status; + PVOID ReadPosition; // Current read position in file + PVOID XferPosition; // Position from where to copy bytes + PVOID BufferPosition; // Current position in user's buffer + ULONG BytesToMove; // Number of bytes to move + ULONG TotalBytesRead; // Total Bytes transferred + ULONG TotalRecordsRead; // Total records transferred + ULONG BytesInBuffer; // Bytes remaining in buffer + ULONG RecordSize; // Size of event record + PVOID PhysicalEOF; // Physical end of file + PVOID PhysStart; // Physical start of file (after file hdr) + PVOID BeginRecord; // Points to first record + PVOID EndRecord; // Points to byte after last record + PVOID TempBuf, TempBufferPosition; + ULONG RecordBytesTransferred; + + // + // Initialize variables. + // + + BytesInBuffer = Request->Pkt.ReadPkt->BufferSize; + BufferPosition = Request->Pkt.ReadPkt->Buffer; + TotalBytesRead = 0; + TotalRecordsRead = 0; + PhysicalEOF = (PVOID) ((LPBYTE) Request->LogFile->BaseAddress + + Request->LogFile->ViewSize); + + PhysStart = (PVOID) ((LPBYTE)Request->LogFile->BaseAddress + + FILEHEADERBUFSIZE); + + BeginRecord = (PVOID) ((LPBYTE) Request->LogFile->BaseAddress + + Request->LogFile->BeginRecord );// Start at first record + + EndRecord = (PVOID) ((LPBYTE)Request->LogFile->BaseAddress + + Request->LogFile->EndRecord);// Byte after end of last record + + // + // "Seek" to the starting record depending on either the last seek + // position, or the starting record offset passed in. + // + + Status = SeekToStartingRecord ( + Request, + &ReadPosition, + BeginRecord, + EndRecord, + PhysicalEOF, + PhysStart + ); + + if (NT_SUCCESS (Status) ) { + + // + // Make sure the record is valid + // + + if (!ValidFilePos(ReadPosition, + BeginRecord, + EndRecord, + PhysicalEOF, + Request->LogFile->BaseAddress + )) + { + + Request->Pkt.ReadPkt->BytesRead = 0; + Request->Pkt.ReadPkt->RecordsRead = 0; + + return (STATUS_INVALID_HANDLE); + + } + + RecordSize = *((PULONG)ReadPosition); + + if (!NT_SUCCESS(Status)) { + return(Status); + } + + // While there are records to be read, and more space in the buffer, + // keep on reading records into the buffer. + // + + while ( (RecordSize <= BytesInBuffer) + && (RecordSize != ELFEOFRECORDSIZE)) { + + // + // If we were called by an ANSI API, then we need to read the + // next record into a temporary buffer, process the data in + // that record and copy it over to the real buffer as ANSI + // strings (rather than UNICODE). + // + + if (Request->Pkt.ReadPkt->Flags & ELF_IREAD_ANSI) { + + TempBuf = ElfpAllocateBuffer (RecordSize); + + if (TempBuf == NULL) { + return(STATUS_NO_MEMORY); + } + + TempBufferPosition = BufferPosition; // Save this away + BufferPosition = TempBuf; // Read into TempBuf + } + + // + // If the number of bytes to the end of the file is less than the + // size of the record, then part of the record has wrapped to the + // beginning of the file - transfer the bytes piece-meal. + // + // Otherwise, transfer the whole record. + // + + BytesToMove = min (RecordSize, (ULONG) + ((PBYTE)(PhysicalEOF) - + (PBYTE)(ReadPosition))); + + XferPosition = ReadPosition; + + if ( BytesToMove < RecordSize) { + + // + // We need to copy the bytes up to the end of the file, + // and then wrap around and copy the remaining bytes of + // this record. + // + + ASSERT (BytesToMove + TotalBytesRead <= + Request->Pkt.ReadPkt->BufferSize); + RtlMoveMemory ( BufferPosition, + XferPosition, + BytesToMove + ); + + // + // Advance user buffer pointer. + // Move read position to the beginning of the file, past the + // file header. + // Update bytes remaining to be moved for this record. + // + + BufferPosition = (PVOID) ((PBYTE)BufferPosition + + BytesToMove); + + XferPosition = PhysStart; + + BytesToMove = RecordSize - BytesToMove; // Remaining bytes + + } + + // + // Move the remaining bytes of the record OR the full record. + // + + ASSERT (RecordSize + TotalBytesRead <= + Request->Pkt.ReadPkt->BufferSize); + RtlMoveMemory ( BufferPosition, + XferPosition, + BytesToMove + ); + + // + // Update to new read positions + // + + BufferPosition = (PVOID) ((PBYTE)BufferPosition + + BytesToMove); + + // + // If we were called by an ANSI API, then we need to take the + // record read into TempBuf and transfer it over to the user's + // buffer while converting any UNICODE strings to ANSI. + // + + if (Request->Pkt.ReadPkt->Flags & ELF_IREAD_ANSI) { + + Status = CopyUnicodeToAnsiRecord ( + TempBufferPosition, + TempBuf, + &BufferPosition, + &RecordBytesTransferred + ); + + // RecordBytesTransferred contains the bytes actually + // copied into the user's buffer. + // BufferPosition points to the point in the user's buffer + // just after this record. + // + ElfpFreeBuffer (TempBuf); // Free the temp buffer + + if (!NT_SUCCESS(Status)) { + break; // Exit this loop + } + + } else { + + RecordBytesTransferred = RecordSize; + } + + // + // Update the byte and record counts + // + + TotalRecordsRead++; + TotalBytesRead += RecordBytesTransferred; + BytesInBuffer -= RecordBytesTransferred; + + ReadPosition = NextRecordPosition ( + Request->Pkt.ReadPkt->ReadFlags, + ReadPosition, + RecordSize, + BeginRecord, + EndRecord, + PhysicalEOF, + PhysStart + ); + + if (!ReadPosition) { + return(STATUS_EVENTLOG_FILE_CORRUPT); + } + + RecordSize = *(PULONG)ReadPosition; + + } // while + + // + // If we got to the end and did not read in any records, return + // an error indicating that the user's buffer is too small if + // we're not at the EOF record, or end of file if we are. + // + + if (TotalRecordsRead == 0) { + if (RecordSize == ELFEOFRECORDSIZE) { + Status = STATUS_END_OF_FILE; + } + + else { + + // + // We didn't read any records, and we're not at EOF, so + // the buffer was too small + // + + Status = STATUS_BUFFER_TOO_SMALL; + Request->Pkt.ReadPkt->MinimumBytesNeeded = RecordSize; + } + } + + // + // Update the current file position. + // + + Request->Pkt.ReadPkt->LastSeekPos = + (ULONG)ReadPosition + - (ULONG)Request->LogFile->BaseAddress; + Request->Pkt.ReadPkt->LastSeekRecord += TotalRecordsRead; + + } + + // + // Set the bytes read in the request packet for return to client. + // + + Request->Pkt.ReadPkt->BytesRead = TotalBytesRead; + Request->Pkt.ReadPkt->RecordsRead = TotalRecordsRead; + + return (Status); + +} // ReadFromLog + + + + +VOID +PerformReadRequest ( PELF_REQUEST_RECORD Request ) + +/*++ + +Routine Description: + + This routine performs the READ request. + It first grabs the log file structure resource and then proceeds + to read from the file. If the resource is not available, it will + block until it is. + + This routine impersonates the client in order to ensure that the correct + access control is uesd. If the client does not have permission to read + the file, the operation will fail. + +Arguments: + + Pointer to the request packet. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + // + // Get shared access to the log file. This will allow multiple + // readers to get to the file together. + // + + RtlAcquireResourceShared ( + &Request->Module->LogFile->Resource, + TRUE // Wait until available + ); + + + // + // Set status field in the request packet. + // + + Request->Status = (NTSTATUS) ReadFromLog ( Request ); + + // + // Free the resource + // + + RtlReleaseResource ( &Request->Module->LogFile->Resource ); + + +} // PerformReadRequest + + + +WCHAR wszAltDosDevices[] = L"\\DosDevices\\"; +WCHAR wszDosDevices[] = L"\\??\\"; +#define DOSDEVICES_LEN ((sizeof(wszDosDevices) / sizeof(WCHAR)) - 1) +#define ALTDOSDEVICES_LEN ((sizeof(wszAltDosDevices) / sizeof(WCHAR)) - 1) + + +VOID +WriteToLog ( + PLOGFILE pLogFile, + PVOID Buffer, + ULONG BufSize, + PULONG Destination, + ULONG PhysEOF, + ULONG PhysStart + ) + +/*++ + +Routine Description: + + This routine writes the record into the log file, allowing for wrapping + around the end of the file. + + It assumes that the caller has serialized access to the file, and has + ensured that there is enough space in the file for the record. + +Arguments: + + Buffer - Pointer to the buffer containing the event record. + BufSize - Size of the record to be written. + Destination - Pointer to the destination - which is in the log file. + PhysEOF - Physical end of file. + PhysStart - Physical beginning of file (past the file header). + +Return Value: + + NONE. + +Note: + + +--*/ +{ + ULONG BytesToCopy; + ULONG NewDestination; + NTSTATUS Status; + LARGE_INTEGER ByteOffset; + IO_STATUS_BLOCK IoStatusBlock; + PVOID BaseAddress; + LPWSTR pwszLogFileName; + + BytesToCopy = min (PhysEOF - *Destination, BufSize); + + ByteOffset = RtlConvertUlongToLargeInteger (*Destination) ; + Status = NtWriteFile( + pLogFile->FileHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + Buffer, // Buffer + BytesToCopy, // Length + &ByteOffset, // Byteoffset + NULL); // Key + + NewDestination = *Destination + BytesToCopy; + + if (BytesToCopy != BufSize) { + + // + // Wrap around to the beginning of the file and copy the + // rest of the data. + // + + Buffer = (PVOID)((PBYTE) Buffer + BytesToCopy); + + BytesToCopy = BufSize - BytesToCopy; + + ByteOffset = RtlConvertUlongToLargeInteger (PhysStart); + Status = NtWriteFile( + pLogFile->FileHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + Buffer, // Buffer + BytesToCopy, // Length + &ByteOffset, // Byteoffset + NULL); // Key + + NewDestination = PhysStart + BytesToCopy; + + // + // Set "wrap" bit in log file structure + // + + pLogFile->Flags |= ELF_LOGFILE_HEADER_WRAP; + + // + // Now flush this to disk to commit it + // + + BaseAddress = pLogFile->BaseAddress; + BytesToCopy = FILEHEADERBUFSIZE; + + Status = NtFlushVirtualMemory( + NtCurrentProcess(), + &BaseAddress, + &BytesToCopy, + &IoStatusBlock + ); + } + + *Destination = NewDestination; // Return new destination + + // + // Providing all succeeded above, if not set, set the archive file + // attribute on this log. + // + + if (NT_SUCCESS(Status) && !(pLogFile->Flags & ELF_LOGFILE_ARCHIVE_SET)) { + + // + // Advance past prefix string, '\??\' or '\DosDevices\' + // + + if ((pLogFile->LogFileName->Length / 2) >= DOSDEVICES_LEN && + !_wcsnicmp(wszDosDevices, pLogFile->LogFileName->Buffer, + DOSDEVICES_LEN)) { + pwszLogFileName = pLogFile->LogFileName->Buffer + DOSDEVICES_LEN; + } + else + if ((pLogFile->LogFileName->Length / 2) >= ALTDOSDEVICES_LEN && + !_wcsnicmp(wszAltDosDevices, pLogFile->LogFileName->Buffer, + ALTDOSDEVICES_LEN)) { + pwszLogFileName = pLogFile->LogFileName->Buffer + ALTDOSDEVICES_LEN; + } + else { + pwszLogFileName = pLogFile->LogFileName->Buffer; + } + + if (SetFileAttributes(pwszLogFileName, FILE_ATTRIBUTE_ARCHIVE)) { + pLogFile->Flags |= ELF_LOGFILE_ARCHIVE_SET; + } + else { + ElfDbgPrintNC(("[ELF] SetFileAttributes on file (%ws) failed, " + "WIN32 error = 0x%lx\n", + pwszLogFileName, + GetLastError())); + } + } + +} // WriteToLog + + + +VOID +PerformWriteRequest ( PELF_REQUEST_RECORD Request) + +/*++ + +Routine Description: + + This routine writes the event log entry to the log file specified in + the request packet. + There is no need to impersonate the client since we want all clients + to have access to writing to the log file. + + This routine does not use memory mapped I/O to access the log file. This + is so the changes can be immediately committed to disk if that was how + the log file was opened. + +Arguments: + + Pointer to the request packet. + +Return Value: + + NONE + +Note: + +--*/ +{ + static ULONG LastAlertWritten = 0; // Don't Generate alerts too often + NTSTATUS Status; + ULONG WritePos; // Position to write record + LARGE_INTEGER Time; + ULONG SpaceNeeded; // Record size + "buffer" size + ULONG CurrentTime; + PEVENTLOGRECORD EventRecord; + ULONG RecordSize; + ULONG DeletedRecordOffset; + ULONG SpaceAvail; + ULONG EarliestTime; + PLOGFILE pLogFile; // For optimized access to structure + PELF_LOGFILE_HEADER pFileHeader; + PVOID BaseAddress; + IO_STATUS_BLOCK IoStatusBlock; + PEVENTLOGRECORD pEventLogRecord; + PDWORD FillDword; + ULONG OverwrittenEOF = 0; +#ifdef _CAIRO_ + BOOL fRaiseAlert = FALSE; +#endif // _CAIRO_ + + pLogFile = Request->LogFile; // Set local variable + + // + // Get exclusive access to the log file. This will ensure no one + // else is accessing the file. + // + + RtlAcquireResourceExclusive ( + &pLogFile->Resource, + TRUE // Wait until available + ); + + // + // Put in the record number + // + + pEventLogRecord = (PEVENTLOGRECORD) Request->Pkt.WritePkt->Buffer; + pEventLogRecord->RecordNumber = pLogFile->CurrentRecordNumber; + + // + // Now, go to the end of the file and look for empty space. + // + // If there is enough space to write out the record, just + // write it out and update the pointers. + // + // If there isn't enough space, then we need to check if we can + // wrap around the file without overwriting any records that are + // within the time retention period. + // If we cannot find any room, then we have to return an error + // that the file is full (and alert the administrator). + // + + RecordSize = Request->Pkt.WritePkt->Datasize; + + SpaceNeeded = RecordSize + ELFEOFRECORDSIZE; + + if (pLogFile->EndRecord > pLogFile->BeginRecord) { + + // + // The current write position is after the position of the first + // record, then we can write up to the end of the file without + // worrying about overwriting existing records. + // + + SpaceAvail = pLogFile->ActualMaxFileSize - (pLogFile->EndRecord - + pLogFile->BeginRecord + FILEHEADERBUFSIZE); + + + } else if (pLogFile->EndRecord == pLogFile->BeginRecord + && !(pLogFile->Flags & ELF_LOGFILE_HEADER_WRAP)) { + + // + // If the write position is equal to the position of the first + // record, and we have't wrapped yet, then the file is "empty" + // and so we have room to the physical end of the file. + // + + SpaceAvail = pLogFile->ActualMaxFileSize - FILEHEADERBUFSIZE; + + } else { + + // + // If our write position is before the position of the first record, then + // the file has wrapped and we need to deal with overwriting existing + // records in the file. + // + + SpaceAvail = pLogFile->BeginRecord - pLogFile->EndRecord; + + } + + // + // We now have the number of bytes available to write the record + // WITHOUT overwriting any existing records - in SpaceAvail. + // If that amount is not sufficient, then we need to create more space + // by "deleting" existing records that are older than the retention + // time that was configured for this file. + // + // We check the retention time against the time when the log was + // written since that is consistent at the server. We cannot use the + // client's time since that may vary if the clients are in different + // time zones. + // + + NtQuerySystemTime(&Time); + RtlTimeToSecondsSince1970(&Time, &CurrentTime); + + EarliestTime = CurrentTime - pLogFile->Retention; + + Status = STATUS_SUCCESS; // Initialize for return to caller + + // + // Check to see if the file hasn't reached it's maximum allowable + // size yet, and also hasn't wrapped. If not, grow it by as much as + // needed, in 64K chunks. + // + + if (pLogFile->ActualMaxFileSize < pLogFile->ConfigMaxFileSize && + SpaceNeeded > SpaceAvail && + !(pLogFile->Flags & ELF_LOGFILE_HEADER_WRAP)) + { + + // + // Extend it. This call cannot fail. If it can't extend it, it + // just caps it at the current size by changing + // pLogFile->ConfigMaxFileSize + // + + ElfExtendFile(pLogFile, SpaceNeeded, &SpaceAvail); + } + + // + // We don't want to split the fixed portion of a record across the + // physical end of the file, it makes it difficult when referencing + // these fields later (you have to check before you touch each one + // to make sure it's not after the physical EOF). So, if there's + // not enough room at the end of the file for the fixed portion, + // we fill it with a known byte pattern ELF_SKIP_DWORD that will + // be skipped if it's found at the start of a record (as long as + // it's less than the minimum record size, then we know it's not + // the start of a valid record). + // + + if (pLogFile->ActualMaxFileSize - pLogFile->EndRecord < + sizeof(EVENTLOGRECORD)) { + + // + // Save the EndRecord pointer in case we don't have the space + // to write another record, we'll need to rewrite the EOF where + // it was + // + + OverwrittenEOF = pLogFile->EndRecord; + + FillDword = (PDWORD)((PBYTE) pLogFile->BaseAddress + + pLogFile->EndRecord); + while (FillDword < (PDWORD)((LPBYTE) pLogFile->BaseAddress + + pLogFile->ActualMaxFileSize)) { + *FillDword = ELF_SKIP_DWORD; + FillDword++; + } + + pLogFile->EndRecord = FILEHEADERBUFSIZE; + SpaceAvail = pLogFile->BeginRecord - FILEHEADERBUFSIZE; + pLogFile->Flags |= ELF_LOGFILE_HEADER_WRAP; + } + + EventRecord = (PEVENTLOGRECORD)((PBYTE) pLogFile->BaseAddress + + pLogFile->BeginRecord); + + while ( SpaceNeeded > SpaceAvail ) { + + // + // If this logfile can be overwrite-as-needed, or if it has + // an overwrite time limit and the time hasn't expired, then + // allow the new event to overwrite an older event. + // + + if ((pLogFile->Retention == OVERWRITE_AS_NEEDED) || + ((pLogFile->Retention != NEVER_OVERWRITE) && + ((EventRecord->TimeWritten < EarliestTime) || + (Request->Flags & ELF_FORCE_OVERWRITE)) )) { // OK to overwrite + + DeletedRecordOffset = pLogFile->BeginRecord; + + pLogFile->BeginRecord += EventRecord->Length; + + if (pLogFile->BeginRecord >= pLogFile->ActualMaxFileSize) { + + // + // We're about to wrap around the end of the file. If we + // have room to grow it do it now, but still move the + // pointer to the first record to be the next one in the file. + // + + pLogFile->BeginRecord = FILEHEADERBUFSIZE + + ( pLogFile->BeginRecord - + pLogFile->ActualMaxFileSize); + + // + // Check to see if the file has reached it's maximum allowable + // size yet. If not, grow it by as much as needed, in 64K + // chunks. + // + + if (pLogFile->ActualMaxFileSize < pLogFile->ConfigMaxFileSize) + { + + // + // Extend it. This call cannot fail. If it can't + // extend it, it just caps it at the current size by + // changing pLogFile->ConfigMaxFileSize + // + + ElfExtendFile(pLogFile, SpaceNeeded, &SpaceAvail); + + // + // Since extending the file will cause it to be moved, we + // need to re-establish the address for the EventRecord. + // + EventRecord = (PEVENTLOGRECORD)((PBYTE) pLogFile->BaseAddress + + DeletedRecordOffset); + } + } + + // + // Make sure no handle points to the record that we're getting + // ready to overwrite, it one does, correct it to point to the + // new first record. + // + + FixContextHandlesForRecord(DeletedRecordOffset, + pLogFile->BeginRecord); + + SpaceAvail += EventRecord->Length; + + // + // Bump to the next record, file wrap was handled above + // + + // + // If these are ELF_SKIP_DWORDs, just move past them + // + + FillDword = (PDWORD)((PBYTE) pLogFile->BaseAddress + + pLogFile->BeginRecord); + + if (*FillDword == ELF_SKIP_DWORD) { + SpaceAvail += pLogFile->ActualMaxFileSize - + pLogFile->BeginRecord; + pLogFile->BeginRecord = FILEHEADERBUFSIZE; + } + + EventRecord = (PEVENTLOGRECORD)((PBYTE) pLogFile->BaseAddress + + pLogFile->BeginRecord); + + } else { // All records within retention period + + ElfDbgPrint(("[ELF] Log file is full\n")); + + // + // Hang an event on the queuedevent list for later writing + // if we haven't just written a log full event for this log + // + + if (!(pLogFile->Flags & ELF_LOGFILE_LOGFULL_WRITTEN)) { + + // + // Don't generate log full events/alerts more often than + // once every hour + // + + if (!LastAlertWritten || + CurrentTime > LastAlertWritten + 60 * 60) { + + pLogFile->Flags |= ELF_LOGFILE_LOGFULL_WRITTEN; + + // + // Per bug #4960, it is considered a C2 security breach + // if a "security log full" message is posted to the + // system log *and* the current user's console. An admin + // alert is OK. + // + + if (_wcsicmp(pLogFile->LogModuleName->Buffer, + ELF_SECURITY_MODULE_NAME) != 0) { + + ElfpCreateElfEvent( + EVENT_LOG_FULL, + EVENTLOG_ERROR_TYPE, + 0, // EventCategory + 1, // NumberOfStrings + &Request->LogFile->LogModuleName-> + Buffer, // Strings + NULL, // Data + 0, // Datalength + ELF_FORCE_OVERWRITE); // Overwrite if necc. + + ElfpCreateQueuedMessage(ALERT_ELF_LogOverflow, 1, + &Request->Module->LogFile->LogModuleName->Buffer); + } + + LastAlertWritten = CurrentTime; + ElfpCreateQueuedAlert(ALERT_ELF_LogOverflow, 1, + &Request->Module->LogFile->LogModuleName->Buffer); + } + } + if (OverwrittenEOF) { + + // + // The EOF record was at the end of the physical file, + // and we overwrote it with ELF_SKIP_DWORDs, so we need + // to put it back since we're not going to be able to + // write a record. We also need to turn the wrap bit + // back off + // + + pLogFile->Flags &= ~(ELF_LOGFILE_HEADER_WRAP); + pLogFile->EndRecord = OverwrittenEOF; + WritePos = OverwrittenEOF; + + // + // Write out the EOF record + // + + WriteToLog ( pLogFile, + (PVOID) &EOFRecord, + ELFEOFRECORDSIZE, + &WritePos, + pLogFile->ActualMaxFileSize, + FILEHEADERBUFSIZE + ); + } + + Status = STATUS_LOG_FILE_FULL; + break; // Get out of while loop + + } + } + + if (NT_SUCCESS (Status)) { + + // + // We have enough room to write the record and the EOF record. + // + + // + // Update OldestRecordNumber to reflect the records that were + // overwritten amd increment the CurrentRecordNumber + // + // Make sure that the log isn't empty, if it is, the oldestrecord + // is 1 + // + + if (pLogFile->BeginRecord == pLogFile->EndRecord) { + pLogFile->OldestRecordNumber = 1; + } + else { + pLogFile->OldestRecordNumber = EventRecord->RecordNumber; + } + pLogFile->CurrentRecordNumber++; + + // + // If the dirty bit is not set, then this is the first time that + // we have written to the file since we started. In that case, + // set the dirty bit in the file header as well so that we will + // know that the contents have changed. + // + + if ( !(pLogFile->Flags & ELF_LOGFILE_HEADER_DIRTY) ) { + ULONG HeaderSize; + + pLogFile->Flags |= ELF_LOGFILE_HEADER_DIRTY; + + pFileHeader = (PELF_LOGFILE_HEADER)(pLogFile->BaseAddress); + pFileHeader->Flags |= ELF_LOGFILE_HEADER_DIRTY; + + // + // Now flush this to disk to commit it + // + + BaseAddress = pLogFile->BaseAddress; + HeaderSize = FILEHEADERBUFSIZE; + + Status = NtFlushVirtualMemory( + NtCurrentProcess(), + &BaseAddress, + &HeaderSize, + &IoStatusBlock + ); + } + + // + // Now write out the record + // + + WriteToLog ( pLogFile, + Request->Pkt.WritePkt->Buffer, + RecordSize, + &(pLogFile->EndRecord), + pLogFile->ActualMaxFileSize, + FILEHEADERBUFSIZE + ); + + // + // Use a separate variable for the position,since we don't want + // it updated. + // + + WritePos = pLogFile->EndRecord; + if (WritePos > pLogFile->ActualMaxFileSize) { + WritePos -= pLogFile->ActualMaxFileSize - + FILEHEADERBUFSIZE; + } + + // + // Update the EOF record fields + // + + EOFRecord.BeginRecord = pLogFile->BeginRecord; + EOFRecord.EndRecord = WritePos; + EOFRecord.CurrentRecordNumber = pLogFile->CurrentRecordNumber; + EOFRecord.OldestRecordNumber = pLogFile->OldestRecordNumber; + + // + // Write out the EOF record + // + + WriteToLog ( pLogFile, + (PVOID) &EOFRecord, + ELFEOFRECORDSIZE, + &WritePos, + pLogFile->ActualMaxFileSize, + FILEHEADERBUFSIZE + ); + + + // + // If we had just written a logfull record, turn the bit off. + // Since we just wrote a record, technically it's not full anymore + // + + if (!(Request->Flags & ELF_FORCE_OVERWRITE)) { + pLogFile->Flags &= ~(ELF_LOGFILE_LOGFULL_WRITTEN); + } + + // + // See if there are any ElfChangeNotify callers to notify, and if + // there are, pulse their event + // + + NotifyChange(pLogFile); + +#ifdef _CAIRO_ + // + // ** NEW FOR CAIRO ** + // + // Test if this event should be raised as a Cairo alert. Notice this + // test is performed within logfile resource exclusion while actual + // raise of the event as a Cairo alert is performed outside of + // it - there is no need to serialize access to the logfile while + // raising the event as an alert. + // + // Raise *only* events written to the System log. + // + + if (_wcsicmp(ELF_SYSTEM_MODULE_NAME, + Request->LogFile->LogModuleName->Buffer) == 0) + { + fRaiseAlert = TestFilter(pEventLogRecord->EventType, + Request->Module->AlertSeverity); + } +#endif // _CAIRO_ + } + + // + // Set status field in the request packet. + // + + Request->Status = (NTSTATUS) Status; + + // + // Free the resource + // + + RtlReleaseResource ( &pLogFile->Resource ); + +#ifdef _CAIRO_ + // + // ** NEW FOR CAIRO ** + // + // Raise the event as a Cairo alert to the local computer distributor + // object if the filter match test succeeded above. + // + // Note: this is done outside of log resource exclusion since raise has + // nothing to do with the log and its data structures. + // + + if (fRaiseAlert) + { + // + // Don't care if this fails right now. + // + + RaiseCairoAlert(Request->Module, pEventLogRecord); + } +#endif // _CAIRO_ + +} // PerformWriteRequest + + +VOID +PerformClearRequest( PELF_REQUEST_RECORD Request) + +/*++ + +Routine Description: + + This routine will optionally back up the log file specified, and will + delete it. + +Arguments: + + Pointer to the request packet. + +Return Value: + + NONE + +Note: + + On the exit path, when we do some "cleanup" work, we discard the + status and instead return the status of the operation that is being + performed. + This is necessary since we wish to return any error condition that is + directly related to the clear operation. For other errors, we will + fail at a later stage. + +--*/ +{ + NTSTATUS Status, IStatus; + PUNICODE_STRING FileName; + IO_STATUS_BLOCK IoStatusBlock; + PFILE_RENAME_INFORMATION NewName = NULL; + OBJECT_ATTRIBUTES ObjectAttributes; + HANDLE ClearHandle; + FILE_DISPOSITION_INFORMATION DeleteInfo = {TRUE}; + ULONG FileRefCount; + BOOLEAN FileRenamed = FALSE; + + // + // Get exclusive access to the log file. This will ensure no one + // else is accessing the file. + // + + RtlAcquireResourceExclusive ( + &Request->Module->LogFile->Resource, + TRUE // Wait until available + ); + + // + // We have exclusive access to the file. + // + // We force the file to be closed, and store away the ref count + // so that we can set it back when we reopen the file. + // This is a little *sleazy* but we have exclusive access to the + // logfile structure so we can play these games. + // + + FileRefCount = Request->LogFile->RefCount; // Store this away + ElfpCloseLogFile ( Request->LogFile, ELF_LOG_CLOSE_FORCE ); + Request->LogFile->FileHandle = NULL; // For use later + + // + // Open the file with delete access in order to rename it. + // + + InitializeObjectAttributes( + &ObjectAttributes, + Request->LogFile->LogFileName, + OBJ_CASE_INSENSITIVE, + NULL, + NULL + ); + + Status = NtOpenFile(&ClearHandle, + GENERIC_READ | DELETE | SYNCHRONIZE, + &ObjectAttributes, + &IoStatusBlock, + FILE_SHARE_DELETE, + FILE_SYNCHRONOUS_IO_NONALERT + ); + + if (NT_SUCCESS(Status)) { + + // If the backup file name has been specified and is not NULL, + // then we move the current file to the new file. If that fails, + // then fail the whole operation. + // + + if ( (Request->Pkt.ClearPkt->BackupFileName != NULL) + && (Request->Pkt.ClearPkt->BackupFileName->Length != 0)) { + + FileName = Request->Pkt.ClearPkt->BackupFileName; + + // + // Set up the rename information structure with the new name + // + + NewName = ElfpAllocateBuffer( + FileName->Length + sizeof(WCHAR) + sizeof(*NewName)); + if (NewName) { + RtlMoveMemory( NewName->FileName, + FileName->Buffer, + FileName->Length + ); + + // + // Guarantee that it's NULL terminated + // + + NewName->FileName[FileName->Length / sizeof(WCHAR)] = L'\0'; + + NewName->ReplaceIfExists = FALSE; + NewName->RootDirectory = NULL; + NewName->FileNameLength = FileName->Length; + + Status = NtSetInformationFile( + ClearHandle, + &IoStatusBlock, + NewName, + FileName->Length+sizeof(*NewName), + FileRenameInformation + ); + + if (Status == STATUS_NOT_SAME_DEVICE) { + + // + // They want the backup file to be on a different + // device. We need to copy this one, and then delete + // it. + // + + ElfDbgPrint(("[ELF] Copy log file\n")); + + Status = ElfpCopyFile(ClearHandle, FileName); + + if (NT_SUCCESS(Status)) { + ElfDbgPrint(("[ELF] Deleting log file\n")); + + Status = NtSetInformationFile( + ClearHandle, + &IoStatusBlock, + &DeleteInfo, + sizeof(DeleteInfo), + FileDispositionInformation + ); + + if ( !NT_SUCCESS (Status) ) { + ElfDbgPrintNC(("[ELF] Delete failed 0x%lx\n", + Status)); + } + } + } + else if ( NT_SUCCESS (Status) ) { + FileRenamed = TRUE; + } + + if (!NT_SUCCESS(Status)) { + ElfDbgPrintNC(("[ELF] Rename/Copy failed 0x%lx\n", Status)); + } + } else { + Status = STATUS_NO_MEMORY; + } + } else { // No backup to done + + // + // No backup name was specified. Just delete the log file + // (i.e. "clear it"). We can just delete it since we know + // that the first time anything is written to a log file, + // if that file does not exist, it is created and a header + // is written to it. By deleting it here, we make it cleaner + // to manage log files, and avoid having zero-length files all + // over the disk. + // + + ElfDbgPrint(("[ELF] Deleting log file\n")); + + Status = NtSetInformationFile( + ClearHandle, + &IoStatusBlock, + &DeleteInfo, + sizeof(DeleteInfo), + FileDispositionInformation + ); + + if ( !NT_SUCCESS (Status) ) { + ElfDbgPrintNC(("[ELF] Delete failed 0x%lx\n", Status)); + + } + + + } // Backup and/or Delete + + IStatus = NtClose (ClearHandle); // Discard status + ASSERT (NT_SUCCESS (IStatus)); + + } else { // The open-for-delete failed. + + ElfDbgPrintNC(("[ELF] Open-for-delete failed 0x%lx\n", Status)); + } + + // + // Now pick up any new size value that was set before but + // couldn't be used until the log was cleared (they reduced the size of + // the log file.) + // + + if (NT_SUCCESS (Status)) { + if (Request->LogFile->NextClearMaxFileSize) { + Request->LogFile->ConfigMaxFileSize = + Request->LogFile->NextClearMaxFileSize; + } + } + + // + // We need to recreate the file or if the file was just closed, + // then we reopen it. + // + + IStatus = ElfOpenLogFile ( Request->LogFile, ElfNormalLog); + if (!NT_SUCCESS(IStatus)) { + + // + // Opening the new log file failed, reopen the old log and + // return this error from the Api + // + + PFILE_RENAME_INFORMATION OldName; + UNICODE_STRING UnicodeString; + + Status = IStatus; + + // + // There shouldn't be any way to fail unless we successfully + // renamed the file, and there's no recovery if that happens. + // + + ASSERT(FileRenamed == TRUE); + + // + // Rename the file back to the original name. Reuse ClearHandle. + // + + RtlInitUnicodeString(&UnicodeString, NewName->FileName); + InitializeObjectAttributes( + &ObjectAttributes, + &UnicodeString, + OBJ_CASE_INSENSITIVE, + NULL, + NULL + ); + + IStatus = NtOpenFile(&ClearHandle, + GENERIC_READ | DELETE | SYNCHRONIZE, + &ObjectAttributes, + &IoStatusBlock, + FILE_SHARE_DELETE, + FILE_SYNCHRONOUS_IO_NONALERT + ); + + // + // This can't fail, I just created it! + // + + ASSERT(NT_SUCCESS(IStatus)); + + // + // Set up the rename information structure with the old name + // + + OldName = ElfpAllocateBuffer( + Request->LogFile->LogFileName->Length + sizeof(WCHAR) + + sizeof(*OldName)); + + if (OldName) { + RtlMoveMemory( OldName->FileName, + Request->LogFile->LogFileName->Buffer, + Request->LogFile->LogFileName->Length + ); + + + // + // Guarantee that it's NULL terminated + // + + OldName->FileName[Request->LogFile->LogFileName->Length / + sizeof(WCHAR)] = L'\0'; + + OldName->ReplaceIfExists = FALSE; + OldName->RootDirectory = NULL; + OldName->FileNameLength = Request->LogFile->LogFileName->Length; + + IStatus = NtSetInformationFile( + ClearHandle, + &IoStatusBlock, + OldName, + Request->LogFile->LogFileName->Length + + sizeof(*OldName) + sizeof(WCHAR), + FileRenameInformation + ); + ASSERT(NT_SUCCESS(IStatus)); + IStatus = NtClose(ClearHandle); + ASSERT(NT_SUCCESS(IStatus)); + + // + // Reopen the original file, this has to work + // + + IStatus = ElfOpenLogFile ( Request->LogFile, ElfNormalLog); + ASSERT(NT_SUCCESS(IStatus)); + + ElfpFreeBuffer(OldName); + } + } + + Request->LogFile->RefCount = FileRefCount; // Restore old value. + + // + // Mark any open context handles that point to this file as "invalid for + // read". This will fail any further READ operations and force the caller + // to close and reopen the handle. + // + + InvalidateContextHandlesForLogFile ( Request->LogFile ); + + + // + // Set status field in the request packet. + // + + Request->Status = Status; + + // + // Free the resource + // + + RtlReleaseResource ( &Request->Module->LogFile->Resource ); + if (NewName) { + ElfpFreeBuffer (NewName); + } + + +} // PerformClearRequest + + +VOID +PerformBackupRequest( PELF_REQUEST_RECORD Request) + +/*++ + +Routine Description: + + This routine will back up the log file specified. + + This routine impersonates the client in order to ensure that the correct + access control is used. + + This routine is entered with the ElfGlobalResource held in a shared + state and the logfile lock is acquired shared to prevent writing, but + allow people to still read. + + This copies the file in two chunks, from the first record to the end + of the file, and then from the top of the file (excluding the header) + to the end of the EOF record. + +Arguments: + + Pointer to the request packet. + +Return Value: + + NONE, status is placed in the packet for later use by the API wrapper + +--*/ +{ + NTSTATUS Status, IStatus; + IO_STATUS_BLOCK IoStatusBlock; + OBJECT_ATTRIBUTES ObjectAttributes; + LARGE_INTEGER MaximumSizeOfSection; + LARGE_INTEGER Offset; + ULONG LastRecordNumber; + ULONG OldestRecordNumber; + HANDLE BackupHandle; + PBYTE StartOfCopy; + PBYTE EndOfCopy; + ULONG BytesToCopy; + ULONG EndRecord = FILEHEADERBUFSIZE; + BOOL ImpersonatingClient = FALSE; + ELF_LOGFILE_HEADER FileHeaderBuf = { FILEHEADERBUFSIZE, // Size + ELF_LOG_FILE_SIGNATURE, + ELF_VERSION_MAJOR, + ELF_VERSION_MINOR, + FILEHEADERBUFSIZE, // Start offset + FILEHEADERBUFSIZE, // End offset + 1, // Next record # + 1, // Oldest record # + 0, // Maxsize + 0, // Flags + 0, // Retention + FILEHEADERBUFSIZE // Size + }; + + + // + // Get shared access to the log file. This will ensure no one + // else clears the file. + // + + RtlAcquireResourceShared ( + &Request->Module->LogFile->Resource, + TRUE // Wait until available + ); + + // + // Save away the next record number. We'll stop copying when we get to + // the record before this one. Also save the first record number so we + // can update the header and EOF record. + // + + LastRecordNumber = Request->LogFile->CurrentRecordNumber; + OldestRecordNumber = Request->LogFile->OldestRecordNumber; + + // + // Impersonate the client + // + + Status = ElfImpersonateClient (); + + if (NT_SUCCESS (Status)) { + + // + // Keep this info so I can only revert in 1 place + // + + ImpersonatingClient = TRUE; + + // + // Set up the object attributes structure for the backup file + // + + InitializeObjectAttributes( + &ObjectAttributes, + Request->Pkt.BackupPkt->BackupFileName, + OBJ_CASE_INSENSITIVE, + NULL, + NULL + ); + + // + // Open the backup file. Fail if a file by this name already exists. + // + + MaximumSizeOfSection = + RtlConvertUlongToLargeInteger ( + Request->LogFile->ActualMaxFileSize); + + Status = NtCreateFile( + &BackupHandle, + GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE, + &ObjectAttributes, + &IoStatusBlock, + &MaximumSizeOfSection, + FILE_ATTRIBUTE_NORMAL, + FILE_SHARE_READ, + FILE_CREATE, + FILE_WRITE_THROUGH | FILE_SYNCHRONOUS_IO_NONALERT, + NULL, + 0); + + if (!NT_SUCCESS(Status)) { + ElfDbgPrintNC(("[ELF] Open of Backup file failed - %X\n", Status)); + goto errorexit; + } + + // + // Write out the header, we'll update it later + // + + FileHeaderBuf.CurrentRecordNumber = LastRecordNumber; + FileHeaderBuf.OldestRecordNumber = OldestRecordNumber; + FileHeaderBuf.Flags = 0; + FileHeaderBuf.Retention = Request->LogFile->Retention; + + Status = NtWriteFile( + BackupHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + &FileHeaderBuf, // Buffer + FILEHEADERBUFSIZE, // Length + NULL, // Byteoffset + NULL); // Key + + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrintNC(("[ELF]: Backup file header write failed %X\n", + Status)); + goto errorexit; + } + + // + // Scan from the end of the file skipping over ELF_SKIP_DWORDs + // to figure out far to copy. If we haven't wrapped, we just + // copy to the EndRecord offset. + // + + if (Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP) { + EndOfCopy = (PBYTE) Request->LogFile->BaseAddress + + Request->LogFile->ActualMaxFileSize - sizeof(DWORD); + while (*((PDWORD)EndOfCopy) == ELF_SKIP_DWORD) { + EndOfCopy -= sizeof(DWORD); + } + EndOfCopy += sizeof(DWORD); + + } + else { + EndOfCopy = (PBYTE) Request->LogFile->BaseAddress + + Request->LogFile->EndRecord; + } + + // + // Now set the start position to be the first record and + // calculate the number of bytes to copy + // + + StartOfCopy = (PBYTE) Request->LogFile->BaseAddress + + Request->LogFile->BeginRecord; + + BytesToCopy = EndOfCopy - StartOfCopy; + EndRecord += BytesToCopy; + + Status = NtWriteFile( + BackupHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + StartOfCopy, // Buffer + BytesToCopy, // Length + NULL, // Byteoffset + NULL); // Key + + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrintNC(("[ELF]: Backup file 1st block write failed %X\n", + Status)); + goto errorexit; + } + + // + // If the file's not wrapped, we're done except for the EOF + // record. If the file is wrapped we have to copy the 2nd + // piece + // + + if (Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP) { + StartOfCopy = (PBYTE) Request->LogFile->BaseAddress + + FILEHEADERBUFSIZE; + EndOfCopy = (PBYTE) Request->LogFile->BaseAddress + + Request->LogFile->EndRecord; + + BytesToCopy = EndOfCopy - StartOfCopy; + EndRecord += BytesToCopy; + + Status = NtWriteFile( + BackupHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + StartOfCopy, // Buffer + BytesToCopy, // Length + NULL, // Byteoffset + NULL); // Key + + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrintNC(("[ELF]: Backup file 2nd block write failed %X\n", + Status)); + goto errorexit; + } + } + + // + // Write out the EOF record after updating the fields needed for + // recovery. + // + + EOFRecord.BeginRecord = FILEHEADERBUFSIZE; + EOFRecord.EndRecord = EndRecord; + EOFRecord.CurrentRecordNumber = LastRecordNumber; + EOFRecord.OldestRecordNumber = OldestRecordNumber; + + Status = NtWriteFile( + BackupHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + &EOFRecord, // Buffer + ELFEOFRECORDSIZE, // Length + NULL, // Byteoffset + NULL); // Key + + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrintNC(("[ELF]: Backup file EOF record write failed %X\n", + Status)); + goto errorexit; + } + + // + // Update the header with valid information + // + + FileHeaderBuf.EndOffset = EndRecord; + FileHeaderBuf.MaxSize = EndRecord + ELFEOFRECORDSIZE; + Offset = RtlConvertUlongToLargeInteger (0); + + Status = NtWriteFile( + BackupHandle, // Filehandle + NULL, // Event + NULL, // APC routine + NULL, // APC context + &IoStatusBlock, // IO_STATUS_BLOCK + &FileHeaderBuf, // Buffer + FILEHEADERBUFSIZE, // Length + &Offset, // Byteoffset + NULL); // Key + + + if (!NT_SUCCESS(Status)) { + + ElfDbgPrintNC(("[ELF]: Backup file header rewrite failed %X\n", + Status)); + goto errorexit; + } + + // + // Clear the LogFile flag archive bit, assuming the caller will + // clear (or has cleared) this log's archive file attribute. + // Note: No big deal if the caller didn't clear the archive + // attribute. + // + // The next write to this log tests the LogFile flag archive bit. + // If the bit is clear, the archive file attribute is set on the + // log file. + // + + Request->LogFile->Flags &= ~ELF_LOGFILE_ARCHIVE_SET; + + // + // Close the output file + // + // BUGBUG : markbl (4/6/95) shouldn't close be done on error also? + // + + NtClose(BackupHandle); + + // + // Undo the impersonation. + // + + } +errorexit: + + if (ImpersonatingClient) { + IStatus = ElfRevertToSelf (); // Discard status + ASSERT (NT_SUCCESS (IStatus)); + } + + // + // Set status field in the request packet. + // + + Request->Status = Status; + + // + // Free the resource + // + + RtlReleaseResource ( &Request->Module->LogFile->Resource ); + +} // PerformBackupRequest + + +VOID +ElfPerformRequest( PELF_REQUEST_RECORD Request) + +/*++ + +Routine Description: + + This routine takes the request packet and performs the operation + on the event log. + Before it does that, it takes the Global serialization resource + for a READ to prevent other threads from doing WRITE operations on + the resources of the service. + + After it has performed the requested operation, it writes any records + generated by the eventlog service that have been put on the queuedevent + list. + +Arguments: + + Pointer to the request packet. + +Return Value: + + NONE + +Note: + + +--*/ +{ + + BOOL Acquired = FALSE; + + // + // Acquire the global resource for shared access. If the resource is + // not immediately available (i.e. don't wait), then some other thread + // has it out for exclusive access. + // + // In that case, we can do one of two things: + // + // 1) Thread monitoring the registry + // We can wait for this thread to finish so that the + // operation can continue. + // + // 2) Control thread + // In this case, it may turn out that the service will + // be terminated or paused. We can examine the current + // status of the service and see if it is still "installed" + // (i.e. no "pending" state). If so, we loop around and try + // to get the resource again (after sleeping a bit?). We + // break out of the loop if the state of the service changes + // to PAUSED, PAUSE_PENDING, UNINSTALL_PENDING, etc. so as + // not to block the thread indefinitely. + // + + while ( (GetElState() == RUNNING) && (!Acquired)) { + + Acquired = RtlAcquireResourceShared( + &GlobalElfResource, + FALSE // Don't wait + ); + if (!Acquired) { + ElfDbgPrint(("[ELF] Sleep waiting for global resource\n" )); + Sleep (ELF_GLOBAL_RESOURCE_WAIT); + } + + } + + // If the resource was not available and the status of the service + // changed to one of the "non-working" states, then we just return + // unsuccesful. Rpc should not allow this to happen. + // + + if (!Acquired) { + + ElfDbgPrint(("[ELF] Global resource not acquired.\n" )); + Request->Status = STATUS_UNSUCCESSFUL; + + } else { + + switch ( Request->Command ) { + + case ELF_COMMAND_READ: + PerformReadRequest( Request ); + break; + + case ELF_COMMAND_WRITE: + PerformWriteRequest ( Request ); + break; + + case ELF_COMMAND_CLEAR: + PerformClearRequest( Request ); + break; + + case ELF_COMMAND_BACKUP: + PerformBackupRequest( Request ); + break; + case ELF_COMMAND_WRITE_QUEUED: + break; + } + + // + // Now run the queued event list dequeueing elements and + // writing them + // + + if (!IsListEmpty(&QueuedEventListHead)) { + + // + // There are things queued up to write, do it + // + + WriteQueuedEvents(); + } + + // + // Release the global resource. + // + + ReleaseGlobalResource(); + + } + +} // ElfPerformRequest + +#if DBG +VOID +ElfErrorOut( + LPSTR ErrorText, + DWORD StatusCode, + PLOGFILE pLogFile) +{ + DbgPrint("\n[EVENTLOG]: %s,0x%lx, \n\t%ws Log:\n" + "\tConfigMaxSize = 0x%lx, ActualMax = 0x%lx, BaseAddr = 0x%lx\n" + "\tViewSize = 0x%lx, EndRec = 0x%lx\n", + ErrorText, + StatusCode, + pLogFile->LogModuleName->Buffer, + pLogFile->ConfigMaxFileSize, + pLogFile->ActualMaxFileSize, + pLogFile->BaseAddress, + pLogFile->ViewSize, + pLogFile->EndRecord); + + //DebugBreak(); +} +#endif //DBG diff --git a/private/eventlog/server/terminat.c b/private/eventlog/server/terminat.c new file mode 100644 index 000000000..7a2f0d519 --- /dev/null +++ b/private/eventlog/server/terminat.c @@ -0,0 +1,267 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + TERMINAT.C + +Abstract: + + This file contains all the cleanup routines for the Eventlog service. + These routines are called when the service is terminating. + +Author: + + Rajen Shah (rajens) 09-Aug-1991 + + +Revision History: + + +--*/ + +// +// INCLUDES +// + +#include <eventp.h> +#include <ntrpcp.h> + + + + +VOID +StopLPCThread () + +/*++ + +Routine Description: + + This routine stops the LPC thread and cleans up LPC-related resources. + +Arguments: + + NONE + +Return Value: + + NONE + +--*/ + +{ + ElfDbgPrint(( "[ELF] Stop the LPC thread\n" )); + + // + // Close communication port handle + // + + NtClose ( ElfCommunicationPortHandle ); + + // + // Close connection port handle + // + + NtClose ( ElfConnectionPortHandle ); + + // + // Terminate the LPC thread. + // + + if (!TerminateThread(LPCThreadHandle,NO_ERROR)) { + ElfDbgPrint(("[ELF] LPC Thread termination failed %d\n",GetLastError())); + } + CloseHandle ( LPCThreadHandle ); + + return; +} + + + + +VOID +FreeModuleAndLogFileStructs ( ) + +/*++ + +Routine Description: + + This routine walks the module and log file list and frees all the + data structures. + +Arguments: + + NONE + +Return Value: + + NONE + +Note: + + The file header and ditry bits must have been dealt with before + this routine is called. Also, the file must have been unmapped and + the handle closed. + +--*/ +{ + + NTSTATUS Status; + PLOGMODULE pModule; + PLOGFILE pLogFile; + + ElfDbgPrint (("[ELF] Freeing module and log file structs\n")); + + // + // First free all the modules + // + + while (!IsListEmpty (&LogModuleHead) ) { + + pModule = (PLOGMODULE) + CONTAINING_RECORD(LogModuleHead.Flink, LOGMODULE, ModuleList); + + UnlinkLogModule(pModule); // Remove from linked list + + ElfpFreeBuffer (pModule); // Free module memory + + } + + // + // Now free all the logfiles + // + + while (!IsListEmpty (&LogFilesHead) ) { + + pLogFile = (PLOGFILE) + CONTAINING_RECORD(LogFilesHead.Flink, LOGFILE, FileList); + + Status = ElfpCloseLogFile ( pLogFile, ELF_LOG_CLOSE_NORMAL); + + UnlinkLogFile(pLogFile); // Unlink the structure + RtlDeleteResource ( &pLogFile->Resource ); + ElfpFreeBuffer (pLogFile->LogFileName); + ElfpFreeBuffer (pLogFile); + } +} + + +VOID +ElfpCleanUp ( + ULONG EventFlags + ) + +/*++ + +Routine Description: + + This routine cleans up before the service terminates. It cleans up + based on the parameter passed in (which indicates what has been allocated + and/or started. + +Arguments: + + Bit-mask indicating what needs to be cleaned up. + +Return Value: + + NONE + +Note: + It is expected that the RegistryMonitor has already + been notified of Shutdown prior to calling this routine. + +--*/ +{ + DWORD status = NO_ERROR; + + + ElfDbgPrint (("[ELF] ElfpCleanUp.\n")); + + // + // Notify the Service Controller for the first time that we are + // about to stop the service. + // + // *** STATUS UPDATE *** + ElfStatusUpdate(STOPPING); + + + // + // Stop the RPC Server + // + if (EventFlags & ELF_STARTED_RPC_SERVER) { + ElfDbgPrint (("[ELF] Stopping the RPC Server.\n")); + + status = ElfGlobalData->StopRpcServer(eventlog_ServerIfHandle); + if (status != NO_ERROR) { + ElfDbgPrint (("[ELF] Stopping RpcServer Failed %d\n",status)); + } + } + + // + // Stop the LPC thread + // + if (EventFlags & ELF_STARTED_LPC_THREAD) + StopLPCThread(); + + // + // Tell service controller that we are making progress + // + // *** STATUS UPDATE *** + ElfStatusUpdate(STOPPING); + + // + // Flush all the log files to disk. + // + ElfDbgPrint (("[ELF] Flushing Files.\n")); + ElfpFlushFiles(); + + // + // Tell service controller that we are making progress + // + ElfStatusUpdate(STOPPING); + + // + // Clean up any resources that were allocated + // + FreeModuleAndLogFileStructs(); + + // + // Free up memory + // + + if (LocalComputerName) { + ElfpFreeBuffer(LocalComputerName); + } + + // + // If we queued up any events, flush them + // + + ElfDbgPrint (("[ELF] Flushing QueuedEvents.\n")); + FlushQueuedEvents(); + + // + // Tell service controller of that we are making progress + // + ElfStatusUpdate(STOPPING); + + if (EventFlags & ELF_INIT_GLOBAL_RESOURCE) + RtlDeleteResource ( &GlobalElfResource ); + + if (EventFlags & ELF_INIT_LOGHANDLE_CRIT_SEC) + RtlDeleteCriticalSection((PRTL_CRITICAL_SECTION)&LogHandleCritSec); + + if (EventFlags & ELF_INIT_LOGFILE_CRIT_SEC) + RtlDeleteCriticalSection((PRTL_CRITICAL_SECTION)&LogFileCritSec); + + if (EventFlags & ELF_INIT_QUEUED_EVENT_CRIT_SEC) + RtlDeleteCriticalSection((PRTL_CRITICAL_SECTION)&QueuedEventCritSec); + + // *** STATUS UPDATE *** + ElfDbgPrint(("[ELF] Leaving the Eventlog service\n")); + ElfStatusUpdate(STOPPED); + ElCleanupStatus(); + return; +} diff --git a/private/eventlog/test/buildreg.dat b/private/eventlog/test/buildreg.dat new file mode 100644 index 000000000..9a74e65e5 --- /dev/null +++ b/private/eventlog/test/buildreg.dat @@ -0,0 +1,3 @@ +System,\systemroot\sysevent.log,4096,10 +Application,\systemroot\appevent.log,4096,10 +Security,\systemroot\audit.log,4096,10 diff --git a/private/eventlog/test/makefile b/private/eventlog/test/makefile new file mode 100644 index 000000000..6ee4f43fa --- /dev/null +++ b/private/eventlog/test/makefile @@ -0,0 +1,6 @@ +# +# DO NOT EDIT THIS FILE!!! Edit .\sources. if you want to add a new source +# file to this component. This file merely indirects to the real make file +# that is shared by all the components of NT OS/2 +# +!INCLUDE $(NTMAKEENV)\makefile.def diff --git a/private/eventlog/test/sources b/private/eventlog/test/sources new file mode 100644 index 000000000..226e46d04 --- /dev/null +++ b/private/eventlog/test/sources @@ -0,0 +1,89 @@ +!IF 0 + +Copyright (c) 1989 Microsoft Corporation + +Module Name: + + sources. + +Abstract: + + This file specifies the target component being built and the list of + sources files needed to build that component. Also specifies optional + compiler switches and libraries that are unique for the component being + built. + + +Author: + + Rajen Shah (rajens) 2-Jul-1991 + + +Revision History: + +!ENDIF + +# +# The TARGETNAME variable is defined by the developer. It is the name of +# the target (component) that is being built by this makefile. It +# should NOT include any path or file extension information. +# + +MAJORCOMP = eventlog +MINORCOMP = test +TARGETNAME= elftest + +# +# The TARGETPATH and TARGETTYPE varialbes are defined by the developer. +# The first specifies where the target is to be build. The second specifies +# the type of target (either PROGRAM, DYNLINK or LIBRARY) +# + +TARGETPATH=obj + +TARGETTYPE=PROGRAM + +TARGETLIBS= \ + $(BASEDIR)\public\sdk\lib\*\advapi32.lib + + +# +# The INCLUDES variable specifies any include paths that are specific to +# this source directory. Separate multiple directory paths with single +# semicolons. Relative path specifications are okay. +# + +INCLUDES=.;..;$(BASEDIR)\public\sdk\inc;$(BASEDIR)\private\net\inc + +# +# The SOURCES variable is defined by the developer. It is a list of all the +# source files for this component. Each source file should be on a separate +# line using the line continuation character. This will minimize merge +# conflicts if two developers adding source files to the same component. +# + +SOURCES= \ + test.c + + +C_DEFINES=-DNTOS2=1 + +UMTYPE=console + +# The following builds the server executable file. The client is built +# in the client directory. + +UMTYPE=console +UMTEST=testwin*testwina +UMLIBS=$(BASEDIR)\public\sdk\lib\*\kernel32.lib +OPTIONAL_UMTEST=wintest + +# +# Defining the NTTARGETFILES variable causes MAKEFILE.DEF to attempt to +# include .\makefile.inc immediately after it specifies the top +# level targets (all, clean and loc) and their dependencies. MAKEFILE.DEF +# also expands the value of the NTTARGETFILES variable at the end of the +# list of dependencies for the all target. Useful for specifying additional +# targets and dependencies that don't fit the general case covered by +# MAKEFILE.DEF +# diff --git a/private/eventlog/test/test.c b/private/eventlog/test/test.c new file mode 100644 index 000000000..bb996bf8d --- /dev/null +++ b/private/eventlog/test/test.c @@ -0,0 +1,1400 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + TEST.C + +Abstract: + + Test program for the eventlog service. This program calls the Elf + APIs to test out the operation of the service. + +Author: + + Rajen Shah (rajens) 05-Aug-1991 + +Revision History: + + +--*/ +/*----------------------*/ +/* INCLUDES */ +/*----------------------*/ +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> +#include <stdio.h> // printf +#include <string.h> // stricmp +#include <stdlib.h> +#include <process.h> // exit +#include <elfcommn.h> +#include <windows.h> +#include <ntiolog.h> +#include <malloc.h> + +#define READ_BUFFER_SIZE 1024*2 // Use 2K buffer + +#define SIZE_DATA_ARRAY 22 + +#define SET_OPERATION(x) \ + if (Operation != Invalid) { \ + printf("Only one operation at a time\n"); \ + Usage(); \ + } \ + Operation = x; + +// +// Global buffer used to emulate "binary data" when writing an event +// record. +// +ULONG Data[SIZE_DATA_ARRAY]; +enum _OPERATION_TYPE { + Invalid, + Clear, + Backup, + Read, + Write, + Notify, + LPC +} Operation = Invalid; +ULONG ReadFlags; +BOOL Verbose = FALSE; +ULONG NumberofRecords = 1; +ULONG DelayInMilliseconds = 0; +CHAR DefaultModuleName[] = "TESTAPP"; +PCHAR pModuleName = DefaultModuleName; +PCHAR pBackupFileName; +ANSI_STRING AnsiString; +UNICODE_STRING ServerName; +BOOL ReadingBackupFile = FALSE; +BOOL ReadingModule = FALSE; +BOOL WriteInvalidRecords = FALSE; +BOOL InvalidUser = FALSE; + +// Function prototypes + +VOID ParseParms(ULONG argc, PCHAR *argv); + +VOID +Initialize ( + VOID + ) +{ + ULONG i; + + // Initialize the values in the data buffer. + // + for (i=0; i< SIZE_DATA_ARRAY; i++) + Data[i] = i; + +} + + +VOID +Usage ( + VOID + ) +{ + printf( "usage: \n" ); + printf( "-c Clears the specified log\n"); + printf( "-b <filename> Backs up the log to file <filename>\n"); + printf( "-f <filename> Filename of backup log to use for read\n"); + printf( "-i Generate invalid SID\n"); + printf( "-l[i] nn Writes nn records thru LPC port [i ==> bad records]\n"); + printf( "-m <modulename> Module name to use for read/clear\n"); + printf( "-n Test out change notify\n"); + printf( "-rsb Reads nn event log records sequentially backwards\n"); + printf( "-rsf nn Reads nn event log records sequentially forwards\n"); + printf( "-rrb <record> Reads event log from <record> backwards\n"); + printf( "-rrf <record> Reads event log from <record> forwards\n"); + printf( "-s <servername> Name of server to remote calls to\n"); + printf( "-t nn Number of milliseconds to delay between read/write" + " (default 0)\n\tOnly used with -l switch\n"); + printf( "-w <count> Writes <count> records\n"); + exit(0); + +} // Usage + + +NTSTATUS +WriteLogEntry ( + HANDLE LogHandle, + ULONG EventID + ) +{ +#define NUM_STRINGS 2 +#define SIZE_TOKEN_BUFFER 512 + + NTSTATUS Status; + USHORT EventType, i; + ULONG DataSize; + PSID pUserSid; + PWSTR Strings[NUM_STRINGS] = {L"StringOne", L"StringTwo"}; + PUNICODE_STRING UStrings[NUM_STRINGS]; + HANDLE hProcess; + HANDLE hToken; + PTOKEN_USER pTokenUser; + DWORD SizeRequired; + + EventType = EVENTLOG_INFORMATION_TYPE; + DataSize = sizeof(ULONG) * SIZE_DATA_ARRAY; + + // + // Get the SID of the current user (process) + // + + pTokenUser = malloc(SIZE_TOKEN_BUFFER); + + if (!InvalidUser) { + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, + GetCurrentProcessId()); + if (!hProcess) { + printf("Couldn't open the process, rc = %d\n", GetLastError()); + return(STATUS_UNSUCCESSFUL); + } + + if (!OpenProcessToken(hProcess, TOKEN_QUERY, &hToken)) { + printf("Couldn't open the token, rc = %d\n", GetLastError()); + CloseHandle(hProcess); + return(STATUS_UNSUCCESSFUL); + } + if (!pTokenUser) { + printf("Couldn't allocate buffer for TokenUser\n"); + CloseHandle(hToken); + CloseHandle(hProcess); + return(STATUS_UNSUCCESSFUL); + } + + if (!GetTokenInformation(hToken, TokenUser, pTokenUser, SIZE_TOKEN_BUFFER, + &SizeRequired)) { + printf("Couldn't get TokenUser information, rc = %d\n", + GetLastError()); + CloseHandle(hToken); + CloseHandle(hProcess); + free(pTokenUser); + return(STATUS_UNSUCCESSFUL); + } + + CloseHandle(hToken); + CloseHandle(hProcess); + } + else { + memset(pTokenUser, 0xFADE, SIZE_TOKEN_BUFFER); + pTokenUser->User.Sid = (PSID)pUserSid; + } + + pUserSid = pTokenUser->User.Sid; + + for (i=0; i< SIZE_DATA_ARRAY; i++) + Data[i] += i; + + // Allocate space for the unicode strings in the array, and + // copy over the strings from Strings[] to that array. + // + for (i=0; i<NUM_STRINGS; i++) { + + UStrings[i] = malloc(sizeof(UNICODE_STRING)); + RtlInitUnicodeString (UStrings[i], Strings[i]); + // force this to be non-null terminated + UStrings[i]->MaximumLength = UStrings[i]->Length; + } + Status = ElfReportEventW ( + LogHandle, + EventType, + 0, // category + EventID, + pUserSid, + NUM_STRINGS, + DataSize, + UStrings, + (PVOID)Data, + 0, // Flags - paired event support + NULL, // RecordNumber | not in product 1 + NULL // TimeWritten - + ); + + for (i=0; i<NUM_STRINGS; i++) + free(UStrings[i]); + + free(pTokenUser); + return (Status); +} + + +VOID +DisplayEventRecords( PVOID Buffer, + ULONG BufSize, + PULONG NumRecords) + +{ + PEVENTLOGRECORD pLogRecord; + LPWSTR pwString; + ULONG Count = 0; + ULONG Offset = 0; + ULONG i; + + pLogRecord = (PEVENTLOGRECORD) Buffer; + + while (Offset < BufSize && Count < *NumRecords) { + + printf("\nRecord # %lu\n", pLogRecord->RecordNumber); + + printf("Length: 0x%lx TimeGenerated: 0x%lx EventID: 0x%lx EventType: 0x%x\n", + pLogRecord->Length, pLogRecord->TimeGenerated, pLogRecord->EventID, + pLogRecord->EventType); + + printf("NumStrings: 0x%x StringOffset: 0x%lx UserSidLength: 0x%lx TimeWritten: 0x%lx\n", + pLogRecord->NumStrings, pLogRecord->StringOffset, + pLogRecord->UserSidLength, pLogRecord->TimeWritten); + + printf("UserSidOffset: 0x%lx DataLength: 0x%lx DataOffset: 0x%lx Category: 0x%lx\n", + pLogRecord->UserSidOffset, pLogRecord->DataLength, + pLogRecord->DataOffset, pLogRecord->EventCategory); + + // + // Print out module name + // + + pwString = (PWSTR)((LPBYTE) pLogRecord + sizeof(EVENTLOGRECORD)); + printf("ModuleName: %ws\n", pwString); + + // + // Display ComputerName + // + pwString += wcslen(pwString) + 1; + printf("ComputerName: %ws\n", pwString); + + // + // Display strings + // + + pwString = (PWSTR)((LPBYTE)pLogRecord + pLogRecord->StringOffset); + + printf("Strings: "); + for (i=0; i<pLogRecord->NumStrings; i++) { + + printf(" %ws ", pwString); + pwString += wcslen(pwString) + 1; + } + + printf("\n"); + + // + // If verbose mode, display binary data (up to 256 bytes) + // BUGBUG - this code will hit an alignment fault on mips. + // + + if (Verbose) { + PULONG pData; + PULONG pEnd; + + if (pLogRecord->DataLength < 80) { + pEnd = (PULONG)((PBYTE) pLogRecord + pLogRecord->DataOffset + + pLogRecord->DataLength); + } + else { + pEnd = (PULONG)((PBYTE) pLogRecord + pLogRecord->DataOffset + + 256); + } + + printf("Data: \n\n"); + for (pData = (PULONG)((PBYTE) pLogRecord + pLogRecord->DataOffset); + pData < pEnd; (PBYTE) pData += 32) { + + printf("\t%08x %08x %08x %08x\n", pData[0], pData[1], pData[2], + pData[3]); + } + } + + // Get next record + // + Offset += pLogRecord->Length; + + pLogRecord = (PEVENTLOGRECORD)((ULONG)Buffer + Offset); + + Count++; + + } + + *NumRecords = Count; + +} + + +NTSTATUS +ReadFromLog ( HANDLE LogHandle, + PVOID Buffer, + PULONG pBytesRead, + ULONG ReadFlag, + ULONG Record + ) +{ + NTSTATUS Status; + ULONG MinBytesNeeded; + + Status = ElfReadEventLogW ( + LogHandle, + ReadFlag, + Record, + Buffer, + READ_BUFFER_SIZE, + pBytesRead, + &MinBytesNeeded + ); + + + if (Status == STATUS_BUFFER_TOO_SMALL) + printf("Buffer too small. Need %lu bytes min\n", MinBytesNeeded); + + return (Status); +} + + +NTSTATUS +TestReadEventLog ( + ULONG Count, + ULONG ReadFlag, + ULONG Record + ) + +{ + NTSTATUS Status, IStatus; + + HANDLE LogHandle; + UNICODE_STRING ModuleNameU; + ANSI_STRING ModuleNameA; + ULONG NumRecords, BytesReturned; + PVOID Buffer; + ULONG RecordOffset; + ULONG NumberOfRecords; + ULONG OldestRecord; + + printf("Testing ElfReadEventLog API to read %lu entries\n",Count); + + Buffer = malloc (READ_BUFFER_SIZE); + + // + // Initialize the strings + // + NumRecords = Count; + RtlInitAnsiString(&ModuleNameA, pModuleName); + RtlAnsiStringToUnicodeString(&ModuleNameU, &ModuleNameA, TRUE); + ModuleNameU.MaximumLength = ModuleNameU.Length; + + // + // Open the log handle + // + + if (ReadingBackupFile) { + printf("ElfOpenBackupEventLog - "); + Status = ElfOpenBackupEventLogW ( + &ServerName, + &ModuleNameU, + &LogHandle + ); + } + else { + printf("ElfOpenEventLog - "); + Status = ElfOpenEventLogW ( + &ServerName, + &ModuleNameU, + &LogHandle + ); + } + + if (!NT_SUCCESS(Status)) { + printf("Error - 0x%lx\n", Status); + + } else { + printf("SUCCESS\n"); + + // + // Get and print record information + // + + Status = ElfNumberOfRecords(LogHandle, & NumberOfRecords); + if (NT_SUCCESS(Status)) { + Status = ElfOldestRecord(LogHandle, & OldestRecord); + } + + if (!NT_SUCCESS(Status)) { + printf("Query of record information failed with %X", Status); + return(Status); + } + + printf("\nThere are %d records in the file, %d is the oldest" + " record number\n", NumberOfRecords, OldestRecord); + + RecordOffset = Record; + + while (Count && NT_SUCCESS(Status)) { + + printf("Read %u records\n", NumRecords); + // + // Read from the log + // + Status = ReadFromLog ( LogHandle, + Buffer, + &BytesReturned, + ReadFlag, + RecordOffset + ); + if (NT_SUCCESS(Status)) { + + printf("Bytes read = 0x%lx\n", BytesReturned); + NumRecords = Count; + DisplayEventRecords(Buffer, BytesReturned, &NumRecords); + Count -= NumRecords; + } + + } + printf("\n"); + + if (!NT_SUCCESS(Status)) { + if (Status == STATUS_END_OF_FILE) { + printf("Tried to read more records than in log file\n"); + } + else { + printf ("Error - 0x%lx. Remaining count %lu\n", Status, Count); + } + } else { + printf ("SUCCESS\n"); + } + + printf("Calling ElfCloseEventLog\n"); + IStatus = ElfCloseEventLog (LogHandle); + } + + return (Status); +} + + +NTSTATUS +TestReportEvent ( + ULONG Count + ) + +{ + NTSTATUS Status, IStatus; + HANDLE LogHandle; + UNICODE_STRING ModuleNameU; + ANSI_STRING ModuleNameA; + ULONG EventID = 99; + + printf("Testing ElfReportEvent API\n"); + + // + // Initialize the strings + // + + RtlInitAnsiString(&ModuleNameA, pModuleName); + RtlAnsiStringToUnicodeString(&ModuleNameU, &ModuleNameA, TRUE); + ModuleNameU.MaximumLength = ModuleNameU.Length; + + // + // Open the log handle + // + printf("Calling ElfRegisterEventSource for WRITE %lu times - ", Count); + Status = ElfRegisterEventSourceW ( + &ServerName, + &ModuleNameU, + &LogHandle + ); + + if (!NT_SUCCESS(Status)) { + printf("Error - 0x%lx\n", Status); + + } else { + printf("SUCCESS\n"); + + while (Count && NT_SUCCESS(Status)) { + + printf("Record # %u \n", Count); + + // + // Write an entry into the log + // + Data[0] = Count; // Make data "unique" + EventID = (EventID + Count) % 100; // Vary the eventids + Status = WriteLogEntry ( LogHandle, EventID ); + Count--; + } + printf("\n"); + + if (!NT_SUCCESS(Status)) { + if (Status == STATUS_LOG_FILE_FULL) { + printf("Log Full\n"); + } + else { + printf ("Error - 0x%lx. Remaining count %lu\n", Status, Count); + } + } else { + printf ("SUCCESS\n"); + } + + printf("Calling ElfDeregisterEventSource\n"); + IStatus = ElfDeregisterEventSource (LogHandle); + } + + return (Status); +} + + +NTSTATUS +TestElfClearLogFile( + VOID + ) + +{ + NTSTATUS Status, IStatus; + HANDLE LogHandle; + UNICODE_STRING BackupU, ModuleNameU; + ANSI_STRING ModuleNameA; + OBJECT_ATTRIBUTES ObjectAttributes; + HANDLE ClearHandle; + FILE_DISPOSITION_INFORMATION DeleteInfo = {TRUE}; + IO_STATUS_BLOCK IoStatusBlock; + BOOLEAN DontRetry = FALSE; + + printf("Testing ElfClearLogFile API\n"); + // + // Initialize the strings + // + RtlInitAnsiString( &ModuleNameA, pModuleName); + RtlAnsiStringToUnicodeString(&ModuleNameU, &ModuleNameA, TRUE); + ModuleNameU.MaximumLength = ModuleNameU.Length ; + + // + // Open the log handle + // + printf("Calling ElfOpenEventLog for CLEAR - "); + Status = ElfOpenEventLogW ( + &ServerName, + &ModuleNameU, + &LogHandle + ); + + if (!NT_SUCCESS(Status)) { + printf("Error - 0x%lx\n", Status); + + } else { + printf("SUCCESS\n"); + + // + // Clear the log file and back it up to "view.evt" + // + + RtlInitUnicodeString( &BackupU, + L"\\SystemRoot\\System32\\Config\\view.evt" ); + BackupU.MaximumLength = BackupU.Length; +retry: + printf("Calling ElfClearEventLogFile backing up to view.evt "); + Status = ElfClearEventLogFileW ( + LogHandle, + &BackupU + ); + + if (Status == STATUS_OBJECT_NAME_COLLISION) { + if (DontRetry) { + printf("Still can't backup to View.Evt\n"); + } + else { + printf("Failed.\nView.Evt already exists, deleting ...\n"); + + // + // Open the file with delete access + // + + InitializeObjectAttributes( + &ObjectAttributes, + &BackupU, + OBJ_CASE_INSENSITIVE, + NULL, + NULL + ); + + Status = NtOpenFile(&ClearHandle, + GENERIC_READ | DELETE | SYNCHRONIZE, + &ObjectAttributes, + &IoStatusBlock, + FILE_SHARE_DELETE, + FILE_SYNCHRONOUS_IO_NONALERT + ); + + Status = NtSetInformationFile( + ClearHandle, + &IoStatusBlock, + &DeleteInfo, + sizeof(DeleteInfo), + FileDispositionInformation + ); + + if (NT_SUCCESS (Status) ) { + Status = NtClose (ClearHandle); // Discard status + goto retry; + } + + printf("Delete failed 0x%lx\n",Status); + Status = NtClose (ClearHandle); // Discard status + goto JustClear; + } + } + + if (!NT_SUCCESS(Status)) { + printf ("Error - 0x%lx\n", Status); + } else { + printf ("SUCCESS\n"); + } + +JustClear: + + // + // Now just clear the file without backing it up + // + printf("Calling ElfClearEventLogFile with no backup "); + Status = ElfClearEventLogFileW ( + LogHandle, + NULL + ); + + if (!NT_SUCCESS(Status)) { + printf ("Error - 0x%lx\n", Status); + } else { + printf ("SUCCESS\n"); + } + + printf("Calling ElfCloseEventLog\n"); + IStatus = ElfCloseEventLog (LogHandle); + } + + return(Status); +} + + +NTSTATUS +TestElfBackupLogFile( + VOID + ) + +{ + NTSTATUS Status, IStatus; + HANDLE LogHandle; + UNICODE_STRING BackupU, ModuleNameU; + ANSI_STRING AnsiString; + + printf("Testing ElfBackupLogFile API\n"); + + // + // Initialize the strings + // + + RtlInitAnsiString( &AnsiString, pModuleName); + RtlAnsiStringToUnicodeString(&ModuleNameU, &AnsiString, TRUE); + ModuleNameU.MaximumLength = ModuleNameU.Length ; + + // + // Open the log handle + // + + printf("Calling ElfOpenEventLog for BACKUP - "); + Status = ElfOpenEventLogW ( + &ServerName, + &ModuleNameU, + &LogHandle + ); + + if (!NT_SUCCESS(Status)) { + printf("Error - 0x%lx\n", Status); + + } else { + printf("SUCCESS\n"); + + // + // Backup the log file + // + + printf("Calling ElfBackupEventLogFile backing up to %s ", + pBackupFileName); + + RtlInitAnsiString( &AnsiString, pBackupFileName); + RtlAnsiStringToUnicodeString(&BackupU, &AnsiString, TRUE); + BackupU.MaximumLength = BackupU.Length; + + Status = ElfBackupEventLogFileW ( + LogHandle, + &BackupU + ); + + if (!NT_SUCCESS(Status)) { + printf ("Error - 0x%lx\n", Status); + } else { + printf ("SUCCESS\n"); + } + + + printf("Calling ElfCloseEventLog - "); + IStatus = ElfCloseEventLog (LogHandle); + if (NT_SUCCESS(IStatus)) { + printf("Success\n"); + } + else { + printf("Failed with code %X\n", IStatus); + } + } + + return(Status); +} + +#define DRIVER_NAME L"FLOPPY" +#define DEVICE_NAME L"A:" +#define STRING L"Test String" + +// These include the NULL terminator, but is length in chars, not bytes +#define DRIVER_NAME_LENGTH 7 +#define DEVICE_NAME_LENGTH 3 +#define STRING_LENGTH 12 + +#define NUMBER_OF_DATA_BYTES 8 + +VOID +TestLPCWrite( + DWORD NumberOfRecords, + DWORD MillisecondsToDelay + ) +{ + + HANDLE PortHandle; + UNICODE_STRING PortName; + NTSTATUS Status; + SECURITY_QUALITY_OF_SERVICE Qos; + PIO_ERROR_LOG_MESSAGE pIoErrorLogMessage; + DWORD i; + LPWSTR pDestinationString; + PPORT_MESSAGE RequestMessage; + PORT_MESSAGE ReplyMessage; + WORD DataLength; + WORD TotalLength; + INT YorN; + CHAR NumberString[8]; + ULONG MessageId = 1; + DWORD BadType = 0; + + // + // Warn the user about how this test works + // + + printf("\nThis test doesn't end! It will write a number of\n" + "records, then prompt you to write more. This is \n" + "required since it is simulating the system thread\n" + "which never shuts down it's connection\n\n" + "Do you wish to continue with this test (y or n)? "); + + YorN = getc(stdin); + + if (YorN == 'n' || YorN == 'N') { + return; + } + + // + // Initialize the SecurityQualityofService structure + // + + Qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE); + Qos.ImpersonationLevel = SecurityImpersonation; + Qos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING; + Qos.EffectiveOnly = TRUE; + + // + // Connect to the LPC Port + // + + RtlInitUnicodeString( &PortName, L"\\ErrorLogPort" ); + + Status = NtConnectPort(& PortHandle, + & PortName, + & Qos, + NULL, + NULL, + NULL, + NULL, + NULL + ); + + if (!NT_SUCCESS(Status)) { + printf("Connect to the LPC port failed with RC %X\n", Status); + return; + } + + // + // Allocate the memory for the Message to send to the LPC port. It + // will contain a PORT_MESSAGE followed by an IO_ERROR_LOG_MESSAGE + // followed by Drivername and Devicename UNICODE strings + // + + DataLength = PORT_MAXIMUM_MESSAGE_LENGTH - + (sizeof(IO_ERROR_LOG_MESSAGE) + + DRIVER_NAME_LENGTH * sizeof(WCHAR) + + DEVICE_NAME_LENGTH * sizeof(WCHAR) + + STRING_LENGTH * sizeof(WCHAR)); + TotalLength = PORT_MAXIMUM_MESSAGE_LENGTH + (WORD) sizeof(PORT_MESSAGE); + + RequestMessage = (PPORT_MESSAGE) malloc(TotalLength); + if (RequestMessage == NULL) { + printf("Couldn't alloc %d bytes of memory for message\n", TotalLength); + NtClose(PortHandle); + return; + } + + pIoErrorLogMessage = (PIO_ERROR_LOG_MESSAGE) ((LPBYTE) RequestMessage + + sizeof(PORT_MESSAGE)); + + // + // Initialize the PORT_MESSAGE + // + + RequestMessage->u1.s1.DataLength = PORT_MAXIMUM_MESSAGE_LENGTH; + RequestMessage->u1.s1.TotalLength = TotalLength; + RequestMessage->u2.s2.Type = 0; + RequestMessage->u2.ZeroInit = 0; + RequestMessage->ClientId.UniqueProcess = GetCurrentProcess(); + RequestMessage->ClientId.UniqueThread = GetCurrentThread(); + RequestMessage->MessageId = 0x1234; + + // + // Initialize the IO_ERROR_LOG_MESSAGE + // + + pIoErrorLogMessage->Type = IO_TYPE_ERROR_MESSAGE; + pIoErrorLogMessage->Size = PORT_MAXIMUM_MESSAGE_LENGTH; + pIoErrorLogMessage->DriverNameLength = DRIVER_NAME_LENGTH * sizeof(WCHAR); + NtQuerySystemTime((PTIME) &pIoErrorLogMessage->TimeStamp); + pIoErrorLogMessage->DriverNameOffset = sizeof(IO_ERROR_LOG_MESSAGE) + + DataLength - sizeof(DWORD); + + pIoErrorLogMessage->EntryData.MajorFunctionCode = 1; + pIoErrorLogMessage->EntryData.RetryCount = 5; + pIoErrorLogMessage->EntryData.DumpDataSize = DataLength; + pIoErrorLogMessage->EntryData.NumberOfStrings = 2; + pIoErrorLogMessage->EntryData.StringOffset = sizeof(IO_ERROR_LOG_MESSAGE) + - sizeof(DWORD) + DataLength + + DRIVER_NAME_LENGTH * sizeof(WCHAR); + pIoErrorLogMessage->EntryData.EventCategory = 0; + pIoErrorLogMessage->EntryData.ErrorCode = 0xC0020008; + pIoErrorLogMessage->EntryData.UniqueErrorValue = 0x20008; + pIoErrorLogMessage->EntryData.FinalStatus = 0x1111; + pIoErrorLogMessage->EntryData.SequenceNumber = 1; + pIoErrorLogMessage->EntryData.IoControlCode = 0xFF; + pIoErrorLogMessage->EntryData.DeviceOffset = + RtlConvertUlongToLargeInteger(1); + + for (i = 0; i < DataLength ; i++ ) { + pIoErrorLogMessage->EntryData.DumpData[i] = i; + } + + // + // Copy the strings + // + + pDestinationString = (LPWSTR) ((LPBYTE) pIoErrorLogMessage + + sizeof(IO_ERROR_LOG_MESSAGE) + - sizeof(DWORD) + pIoErrorLogMessage->EntryData.DumpDataSize); + wcscpy(pDestinationString, DRIVER_NAME); + + pDestinationString += DRIVER_NAME_LENGTH; + wcscpy(pDestinationString, DEVICE_NAME); + + pDestinationString += DEVICE_NAME_LENGTH; + wcscpy(pDestinationString, STRING); + + // + // Write the packet as many times as requested, with delay, then ask + // if they want to write more + // + while (NumberOfRecords) { + + printf("\n\nWriting %d records\n", NumberOfRecords); + + while(NumberOfRecords--) { + printf("."); + + // + // Put in a unique message number + // + + RequestMessage->MessageId = MessageId++; + + // + // If they want invalid records, give them invalid records + // + + if (WriteInvalidRecords) { + switch (BadType++) { + case 0: + pIoErrorLogMessage->EntryData.DumpDataSize++; + break; + + case 1: + pIoErrorLogMessage->EntryData.NumberOfStrings++; + break; + + case 2: + pIoErrorLogMessage->EntryData.StringOffset++; + break; + + default: + BadType = 0; + } + } + + Status = NtRequestWaitReplyPort(PortHandle, + RequestMessage, + & ReplyMessage); + + if (!NT_SUCCESS(Status)) { + printf("Request to LPC port failed with RC %X\n", Status); + break; + } + + // + // Delay a little bit, if requested + // + + if (MillisecondsToDelay) { + Sleep(MillisecondsToDelay); + } + } + printf("\nEnter the number of records to write "); + + while (!gets(NumberString) || !(NumberOfRecords = atoi(NumberString))) { + printf("Enter the number of records to write "); + } + } + + // + // Clean up and exit + // + + Status = NtClose(PortHandle); + if (!NT_SUCCESS(Status)) { + printf("Close of Port failed with RC %X\n", Status); + } + + free(RequestMessage); + + return; + +} + + +VOID +TestChangeNotify( + VOID + ) +{ + + HANDLE Event; + UNICODE_STRING ModuleNameU; + ANSI_STRING ModuleNameA; + NTSTATUS Status; + HANDLE LogHandle; + OBJECT_ATTRIBUTES obja; + ULONG NumRecords; + ULONG BytesRead; + ULONG MinBytesNeeded; + PVOID Buffer; + ULONG OldestRecord; + ULONG NumberOfRecords; + + RtlInitAnsiString(&ModuleNameA, pModuleName); + RtlAnsiStringToUnicodeString(&ModuleNameU, &ModuleNameA, TRUE); + ModuleNameU.MaximumLength = ModuleNameU.Length ; + + Buffer = malloc (READ_BUFFER_SIZE); + ASSERT(Buffer); + + // + // Open the log handle + // + + printf("ElfOpenEventLog - "); + Status = ElfOpenEventLogW ( + &ServerName, + &ModuleNameU, + &LogHandle + ); + + if (!NT_SUCCESS(Status)) { + printf("Error - 0x%lx\n", Status); + return; + } + + printf("SUCCESS\n"); + + // + // Create the Event + // + + InitializeObjectAttributes( &obja, NULL, 0, NULL, NULL); + + Status = NtCreateEvent( + &Event, + SYNCHRONIZE | EVENT_QUERY_STATE | EVENT_MODIFY_STATE, + &obja, + SynchronizationEvent, + FALSE + ); + + ASSERT(NT_SUCCESS(Status)); + + // + // Get the read pointer to the end of the log + // + + Status = ElfOldestRecord(LogHandle, & OldestRecord); + ASSERT(NT_SUCCESS(Status)); + Status = ElfNumberOfRecords(LogHandle, & NumberOfRecords); + ASSERT(NT_SUCCESS(Status)); + OldestRecord += NumberOfRecords - 1; + + Status = ElfReadEventLogW ( + LogHandle, + EVENTLOG_SEEK_READ | EVENTLOG_FORWARDS_READ, + OldestRecord, + Buffer, + READ_BUFFER_SIZE, + &BytesRead, + &MinBytesNeeded + ); + + + // + // This one should hit end of file + // + + Status = ElfReadEventLogW ( + LogHandle, + EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, + 0, + Buffer, + READ_BUFFER_SIZE, + &BytesRead, + &MinBytesNeeded + ); + + if (Status != STATUS_END_OF_FILE) { + printf("Hmmm, should have hit EOF (unless there are writes going" + " on elsewhere- %X\n", Status); + } + + // + // Call ElfChangeNotify + // + + Status = ElfChangeNotify(LogHandle, Event); + ASSERT(NT_SUCCESS(Status)); + + // + // Now loop waiting for the event to get toggled + // + + while (1) { + + Status = NtWaitForSingleObject(Event, FALSE, 0); + printf("The change notify event just got kicked\n"); + + // + // Now read the new records + // + + while(1) { + + Status = ElfReadEventLogW ( + LogHandle, + EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, + 0, + Buffer, + READ_BUFFER_SIZE, + &BytesRead, + &MinBytesNeeded + ); + + if (Status == STATUS_END_OF_FILE) { + break; + } + + NumRecords = 0xffff; // should be plenty + DisplayEventRecords (Buffer, BytesRead, &NumRecords); + } + } +} + +VOID +_CRTAPI1 +main ( + IN SHORT argc, + IN PSZ argv[] + ) +{ + + Initialize(); // Init any data + + // + // Parse the command line + // + + ParseParms(argc, argv); + + switch (Operation) { + case Clear: + + TestElfClearLogFile(); + break; + + case Backup: + + TestElfBackupLogFile(); + break; + + case Read: + + if (ReadFlags & EVENTLOG_SEEK_READ) { + TestReadEventLog(1, ReadFlags, NumberofRecords) ; + } + else { + TestReadEventLog(NumberofRecords, ReadFlags, 0) ; + } + break; + + case Write: + + TestReportEvent (NumberofRecords); + break; + + case LPC: + TestLPCWrite(NumberofRecords, DelayInMilliseconds); + break; + + case Notify: + TestChangeNotify(); + break; + + default: + printf("Invalid switch from ParseParms %d\n", Operation); + } +} + + +VOID +ParseParms( + ULONG argc, + PCHAR *argv + ) +{ + + ULONG i; + PCHAR pch; + + for (i = 1; i < argc; i++) { /* for each argument */ + if (*(pch = argv[i]) == '-') { + while (*++pch) { + switch (*pch) { + case 'b': + + SET_OPERATION(Backup) + + // + // Get the file name for backup + // + + if (i+1 < argc) { + pBackupFileName = argv[++i]; + } + else { + Usage(); + } + break; + + case 'c': + + SET_OPERATION(Clear) + + break; + + case 'f': + if (i+1 < argc) { + pModuleName = argv[++i]; + ReadingBackupFile = TRUE; + } + else { + Usage(); + } + break; + + case '?': + case 'h': + case 'H': + Usage(); + break; + + case 'i': + InvalidUser = TRUE; + break; + + case 'l': + + SET_OPERATION(LPC); + + // + // See if they want invalid records + // + + if (*++pch == 'i') { + WriteInvalidRecords = TRUE; + } + + // + // See if they specified a number of records + // + + if (i + 1 < argc && argv[i+1][0] != '-') { + NumberofRecords = atoi(argv[++i]); + if (NumberofRecords == 0) { + Usage(); + } + } + + break; + + case 'm': + if (i+1 < argc) { + pModuleName = argv[++i]; + ReadingModule = TRUE; + } + else { + Usage(); + } + break; + + case 'n': + SET_OPERATION(Notify) + break; + + case 'r': + + SET_OPERATION(Read) + + // + // Different Read options + // + + if (*++pch == 's') { + ReadFlags |= EVENTLOG_SEQUENTIAL_READ; + } + else if (*pch == 'r') { + ReadFlags |= EVENTLOG_SEEK_READ; + } + else { + Usage(); + } + + if (*++pch == 'f') { + ReadFlags |= EVENTLOG_FORWARDS_READ; + } + else if (*pch == 'b') { + ReadFlags |= EVENTLOG_BACKWARDS_READ; + } + else { + Usage(); + } + + // + // See if they specified a number of records + // + + if (i + 1 < argc && argv[i+1][0] != '-') { + NumberofRecords = atoi(argv[++i]); + if (NumberofRecords == 0) { + Usage(); + } + } + + break; + + case 's': + if (i+1 >= argc) { + printf("Must supply a server name with -s\n"); + Usage(); + } + RtlInitAnsiString(&AnsiString, argv[++i]); + RtlAnsiStringToUnicodeString(&ServerName, &AnsiString, + TRUE); + break; + + case 't': + DelayInMilliseconds = atoi(argv[++i]); + break; + + case 'v': + Verbose = TRUE; + break; + + case 'w': + + SET_OPERATION(Write) + + // + // See if they specified a number of records + // + + if (i + 1 < argc && argv[i+1][0] != '-') { + NumberofRecords = atoi(argv[++i]); + if (NumberofRecords == 0) { + Usage(); + } + } + + break; + + default: /* Invalid options */ + printf("Invalid option %c\n\n", *pch); + Usage(); + break; + } + } + } + + // + // There aren't any non switch parms + // + + else { + Usage(); + } + } + + // + // Verify parms are correct + // + + + if ( Operation == Invalid) { + printf( "Must specify an operation\n"); + Usage( ); + } + + if (ReadingBackupFile && ReadingModule) { + printf("-m and -f are mutually exclusive\n"); + Usage(); + } + + if (ReadingBackupFile && Operation == Write) { + printf("You cannot write to a backup log file\n"); + Usage(); + } + if (DelayInMilliseconds && Operation != LPC) { + printf("\n\n-t switch is only used with -l\n\n"); + } +} + diff --git a/private/eventlog/test/testwin.c b/private/eventlog/test/testwin.c new file mode 100644 index 000000000..bea524159 --- /dev/null +++ b/private/eventlog/test/testwin.c @@ -0,0 +1,770 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + TESTWIN.C + +Abstract: + + Test program for the eventlog service. This program calls the Win + APIs to test out the operation of the service. + +Author: + + Rajen Shah (rajens) 05-Aug-1991 + +Revision History: + + +--*/ +/*----------------------*/ +/* INCLUDES */ +/*----------------------*/ +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> +#include <stdio.h> // printf +#include <string.h> // stricmp +#include <stdlib.h> +#include <windows.h> +#include <netevent.h> + +// +// Turn on NotifyChangeEventLog +// +#define TEST_NOTIFY 1 +//#define TEST_REMOTE 1 + +#define READ_BUFFER_SIZE 1024*2 // Use 2K buffer + +#define SIZE_DATA_ARRAY 65 + +// +// Global buffer used to emulate "binary data" when writing an event +// record. +// + DWORD Data[SIZE_DATA_ARRAY]; +// LPWSTR ServerName=L"\\\\danl2"; + LPWSTR ServerName=NULL; + + +VOID +Initialize ( + VOID + ) +{ + DWORD i; + + // Initialize the values in the data buffer. + // + for (i=0; i< SIZE_DATA_ARRAY; i++) + Data[i] = i; + +} + + +BOOL +Usage ( + VOID + ) +{ + printf( "usage: \n" ); + printf( "-b <filename> Tests BackupEventLog API\n"); + printf( "-c Tests ClearEventLog API\n"); + printf( "-n Tests NotifyChangeEventlog\n"); + printf( "-rsb Reads event log sequentially backwards\n"); + printf( "-rsf Reads event log sequentially forwards\n"); + printf( "-rrb <record> Reads event log from <record> backwards\n"); + printf( "-rrf <record> Reads event log from <record> forwards\n"); + printf( "-w <count> Tests ReportEvent API <count> times\n"); + return ERROR_INVALID_PARAMETER; + +} // Usage + + + +BOOL +WriteLogEntry ( HANDLE LogHandle, DWORD EventID ) + +{ +#define NUM_STRINGS 2 + + BOOL Status; + WORD EventType, i; + DWORD DataSize; + PSID pUserSid; + + PWSTR Strings[NUM_STRINGS] = {L"StringAOne", + L"StringATwo" + }; + + EventType = EVENTLOG_INFORMATION_TYPE; + pUserSid = NULL; + DataSize = sizeof(DWORD) * SIZE_DATA_ARRAY; + + for (i=0; i< SIZE_DATA_ARRAY; i++) + Data[i] += i; + + Status = ReportEventW ( + LogHandle, + EventType, + 0, // event category + EventID, + pUserSid, + NUM_STRINGS, + DataSize, + Strings, + (PVOID)Data + ); + + return (Status); +} + +DWORD +WriteLogEntryMsg ( HANDLE LogHandle, DWORD EventID ) +/* + This function requires a registry entry in the Applications section + of the Eventlog for TESTWINAPP, it will use the netevent.dll message file. +*/ + +{ +#define NUM_STRINGS 2 + + WORD EventType; + DWORD DataSize; + PSID pUserSid; + + PWSTR Strings[NUM_STRINGS]; + + Strings[0] = L"This is a BOGUS message for TEST purposes Ignore this substitution text"; + Strings[1] = L"GHOST SERVICE in the long string format - I wanted a long string to pass into this function"; + + EventType = EVENTLOG_INFORMATION_TYPE; + pUserSid = NULL; + DataSize = sizeof(DWORD) * SIZE_DATA_ARRAY; + + + if (!ReportEventW ( + LogHandle, + EventType, + 0, // event category + EVENT_SERVICE_START_FAILED_NONE, + pUserSid, + NUM_STRINGS, + 0, // DataSize + Strings, + (PVOID)NULL // Data + )) { + + printf("ReportEventW failed %d\n",GetLastError()); + return(GetLastError()); + } + return (NO_ERROR); +} + + +VOID +DisplayEventRecords( PVOID Buffer, + DWORD BufSize, + ULONG *NumRecords) + +{ + PEVENTLOGRECORD pLogRecord; + ANSI_STRING StringA; + UNICODE_STRING StringU; + PWSTR pwString; + DWORD Count = 0; + DWORD Offset = 0; + DWORD i; + + pLogRecord = (PEVENTLOGRECORD) Buffer; + + while ((DWORD)Offset < BufSize) { + + printf("\nRecord # %lu\n", ++Count); + + printf("Length: 0x%lx TimeGenerated: 0x%lx EventID: 0x%lx EventType: 0x%x\n", + pLogRecord->Length, pLogRecord->TimeGenerated, pLogRecord->EventID, + pLogRecord->EventType); + + printf("NumStrings: 0x%x StringOffset: 0x%lx UserSidLength: 0x%lx TimeWritten: 0x%lx\n", + pLogRecord->NumStrings, pLogRecord->StringOffset, + pLogRecord->UserSidLength, pLogRecord->TimeWritten); + + printf("UserSidOffset: 0x%lx DataLength: 0x%lx DataOffset: 0x%lx \n", + pLogRecord->UserSidOffset, pLogRecord->DataLength, + pLogRecord->DataOffset); + + // + // Print out module name + // + pwString = (PWSTR)((DWORD)pLogRecord + sizeof(EVENTLOGRECORD)); + RtlInitUnicodeString (&StringU, pwString); + RtlUnicodeStringToAnsiString (&StringA, &StringU, TRUE); + + printf("ModuleName: %s ", StringA.Buffer); + RtlFreeAnsiString (&StringA); + + // + // Display ComputerName + // + pwString = pwString + (wcslen(pwString) + 1); + + RtlInitUnicodeString (&StringU, pwString); + RtlUnicodeStringToAnsiString (&StringA, &StringU, TRUE); + + printf("ComputerName: %s\n",StringA.Buffer); + RtlFreeAnsiString (&StringA); + + // + // Display strings + // + pwString = (PWSTR)((DWORD)Buffer + pLogRecord->StringOffset); + + printf("\nStrings: \n"); + for (i=0; i<pLogRecord->NumStrings; i++) { + + RtlInitUnicodeString (&StringU, pwString); + RtlUnicodeStringToAnsiString (&StringA, &StringU, TRUE); + + printf(" %s \n",StringA.Buffer); + + RtlFreeAnsiString (&StringA); + + pwString = (PWSTR)((DWORD)pwString + StringU.MaximumLength); + } + + // Get next record + // + Offset += pLogRecord->Length; + + pLogRecord = (PEVENTLOGRECORD)((DWORD)Buffer + Offset); + + } + *NumRecords = Count; + +} + + +BOOL +ReadFromLog ( HANDLE LogHandle, + PVOID Buffer, + ULONG *pBytesRead, + DWORD ReadFlag, + DWORD Record + ) +{ + BOOL Status; + DWORD MinBytesNeeded; + DWORD ErrorCode; + + Status = ReadEventLogW ( + LogHandle, + ReadFlag, + Record, + Buffer, + READ_BUFFER_SIZE, + pBytesRead, + &MinBytesNeeded + ); + + + if (!Status) { + ErrorCode = GetLastError(); + if (ErrorCode == ERROR_HANDLE_EOF) { + Status = TRUE; + } + else if (ErrorCode == ERROR_NO_MORE_FILES) { + printf("Buffer too small. Need %lu bytes min\n", MinBytesNeeded); + } + else { + printf("Error from ReadEventLog %d \n", ErrorCode); + } + + } + + return (Status); +} + + + + +BOOL +TestReadEventLog (DWORD Count, DWORD ReadFlag, DWORD Record) + +{ + BOOL bStatus,IStatus; + DWORD status; + HANDLE LogHandle; + LPWSTR ModuleName; + DWORD NumRecords, BytesReturned; + PVOID Buffer; + DWORD RecordOffset; + DWORD NumberOfRecords; + DWORD OldestRecord; + + printf("Testing ReadEventLog API to read %lu entries\n",Count); + + Buffer = malloc (READ_BUFFER_SIZE); + + // + // Initialize the strings + // + NumRecords = Count; + ModuleName = L"TESTWINAPP"; + + // + // Open the log handle + // + printf("OpenEventLog - "); + LogHandle = OpenEventLogW ( + ServerName, + ModuleName + ); + + if (LogHandle == NULL) { + printf("Error - %d\n", GetLastError()); + + } else { + printf("SUCCESS\n"); + + // + // Get and print record information + // + + bStatus = GetNumberOfEventLogRecords(LogHandle, & NumberOfRecords); + if (bStatus) { + bStatus = GetOldestEventLogRecord(LogHandle, & OldestRecord); + } + + if (!bStatus) { + printf("Query of record information failed with %X", GetLastError()); + return(bStatus); + } + + printf("\nThere are %d records in the file, %d is the oldest" + " record number\n", NumberOfRecords, OldestRecord); + + RecordOffset = Record; + + printf("Reading %u records\r", Count); + + while (Count) { + + // + // Read from the log + // + bStatus = ReadFromLog ( LogHandle, + Buffer, + &BytesReturned, + ReadFlag, + RecordOffset + ); + if (bStatus) { + printf("Bytes read = 0x%lx\n", BytesReturned); + printf("Read %u records\n", NumRecords); + DisplayEventRecords(Buffer, BytesReturned, &NumRecords); + Count -= NumRecords; + RecordOffset += NumRecords; + } else { + break; + } + + if (BytesReturned == 0) + break; + } + printf("\n"); + + if (!bStatus) { + printf ("ReadFromLog Error - %d. Remaining count %lu\n", GetLastError(), + Count); + } else { + printf ("SUCCESS\n"); + } + + printf("Calling CloseEventLog\n"); + IStatus = CloseEventLog (LogHandle); + } + + return (bStatus); +} + + + +BOOL +TestWriteEventLog (DWORD Count) + +{ + DWORD Status=NO_ERROR; + BOOL IStatus; + HANDLE LogHandle; + LPWSTR ModuleName; + DWORD EventID = 99; + DWORD WriteCount; + DWORD DataNum=0; + + printf("Testing ReportEvent API\n"); + + // + // Initialize the strings + // + ModuleName = L"TESTWINAPP"; + + printf("Calling RegisterEventSource for WRITE %lu times\n", Count); + while ((Count > 0) && (Status== NO_ERROR)) { + // + // Open the log handle + // + LogHandle = RegisterEventSourceW ( + ServerName, + ModuleName + ); + + if (LogHandle == NULL) { + Status = GetLastError(); + printf("RegisterEventSource Failure - %d\n", Status); + return(Status); + + } else { + printf("Registered - "); + WriteCount = 5; + printf("Record # %u: ", Count); + + while ((WriteCount>0) && (Status==NO_ERROR)) { + + // + // Write an entry into the log + // + Data[0] = DataNum; // Make data "unique" + EventID = (EventID + DataNum) % 100; // Vary the eventids + Status = WriteLogEntryMsg( LogHandle, EventID ); + DataNum++; + WriteCount--; + + if (Status != NO_ERROR) { + printf ("WriteLogEntry Error - %d. Remaining count %lu\n",Status,Count); + } else { + printf ("%d,",WriteCount); + } + } + + IStatus = DeregisterEventSource (LogHandle); + printf(" - Deregistered\n"); + } + Count--; + } + + printf("\n"); + return (Status); +} + + + +BOOL +TestClearLogFile () + +{ + BOOL Status, IStatus; + HANDLE LogHandle; + LPWSTR ModuleName, BackupName; + + printf("Testing ClearLogFile API\n"); + // + // Initialize the strings + // + ModuleName = L"TESTWINAPP"; + + // + // Open the log handle + // + printf("Calling OpenEventLog for CLEAR - "); + LogHandle = OpenEventLogW ( + NULL, + ModuleName + ); + + if (LogHandle == NULL) { + printf("OpenEventLog Error - %d\n", GetLastError()); + + } else { + printf("SUCCESS\n"); + + // + // Clear the log file and back it up to "view.log" + // + + printf("Calling ClearEventLog backing up to view.log "); + BackupName = L"\\\\danhi386\\roote\\view.log"; + + Status = ClearEventLogW ( + LogHandle, + BackupName + ); + + if (!Status) { + printf ("ClearEventLog Error - %d\n", GetLastError()); + } else { + printf ("SUCCESS\n"); + } + + // + // Now just clear the file without backing it up + // + printf("Calling ClearEventLog with no backup "); + Status = ClearEventLogW ( + LogHandle, + NULL + ); + + if (!Status) { + printf ("ClearEventLogError - %d\n", GetLastError()); + } else { + printf ("SUCCESS\n"); + } + + printf("Calling CloseEventLog\n"); + IStatus = CloseEventLog (LogHandle); + } + + return(Status); +} + +BOOL +TestBackupLogFile (LPSTR BackupFileName) + +{ + BOOL Status, IStatus; + HANDLE LogHandle; + LPWSTR ModuleName; + ANSI_STRING AnsiString; + UNICODE_STRING UnicodeString; + + printf("Testing BackupLogFile API\n"); + // + // Initialize the strings + // + ModuleName = L"TESTWINAPP"; + + // + // Open the log handle + // + printf("Calling OpenEventLog for BACKUP - "); + LogHandle = OpenEventLogW ( + NULL, + ModuleName + ); + + if (LogHandle == NULL) { + printf("OpenEventLog Failure %d\n", GetLastError()); + + } else { + printf("OpenEventLog SUCCESS\n"); + + // + // Backup the log file to BackupFileName + // + + printf("Calling BackupEventLog backing up to %s ", BackupFileName); + + RtlInitAnsiString(&AnsiString, BackupFileName); + RtlAnsiStringToUnicodeString(&UnicodeString, &AnsiString, TRUE); + + Status = BackupEventLogW (LogHandle, UnicodeString.Buffer); + + if (!Status) { + printf ("BackupEventLog failure - %d\n", GetLastError()); + } else { + printf ("SUCCESS\n"); + } + + printf("Calling CloseEventLog\n"); + IStatus = CloseEventLog (LogHandle); + } + + return(Status); +} + +VOID +NotifyThread( + HANDLE hEventLog) +{ + Sleep(30000); + printf("NotifyThread: Writing an event...\n"); + if (!WriteLogEntryMsg(hEventLog,1)) { + printf("NotifyThread: WriteLogEntryMsg failed\n"); + } + else { + printf("Event was written\n"); + } + ExitThread(NO_ERROR); +} + +VOID +TestChangeNotify( + ) + +/*++ + +Routine Description: + + +Arguments: + + +Return Value: + + +--*/ +{ + HANDLE hEvent; + HANDLE hThread; + HANDLE hEventLog; + DWORD threadId; + DWORD status; + + hEvent = CreateEvent(NULL,FALSE,FALSE,NULL); + if (hEvent == NULL) { + printf("CreateEvent Failed %d\n",GetLastError()); + return; + } +#ifdef TEST_REMOTE + hEventLog = RegisterEventSourceW(L"\\\\DANL2",L"TESTWINAPP"); +#else + hEventLog = RegisterEventSourceW(NULL,L"TESTWINAPP"); +#endif + if (hEventLog == NULL) { + printf("OpenEventLog failed %d\n",GetLastError()); + } + +#ifdef TEST_NOTIFY + + if (!NotifyChangeEventLog(hEventLog,hEvent)) { + printf("NotifyChangeEventLog failed %d\n",GetLastError()); + } +#endif // TEST_NOTIFY + + hThread = CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)NotifyThread,hEventLog,0,&threadId); + if (hThread == NULL) { + printf("CreateThread Failed %d\n",GetLastError()); + CloseHandle(hEvent); + return; + } + + CloseHandle(hThread); + + printf("Wait for event to become signaled\n"); + status = WaitForSingleObject(hEvent,INFINITE); + if (status == WAIT_OBJECT_0) { + printf("The Event was signaled\n"); + } + else { + printf("The Event was NOT signaled\n"); + } + return; +} +/****************************************************************************/ +DWORD _CRTAPI1 +main ( + IN SHORT argc, + IN PSZ argv[], + IN PSZ envp[] + ) +/*++ +* +* Routine Description: +* +* +* +* Arguments: +* +* +* +* +* Return Value: +* +* +* +--*/ +/****************************************************************************/ +{ + + DWORD ReadFlags; + + Initialize(); // Init any data + + if ( argc < 2 ) { + printf( "Not enough parameters\n" ); + return Usage( ); + } + + if ( stricmp( argv[1], "-c" ) == 0 ) { + + if ( argc < 3 ) { + return TestClearLogFile(); + } + } + else if ( stricmp( argv[1], "-b" ) == 0 ) { + + if ( argc < 3 ) { + printf("You must supply a filename to backup to\n"); + return(FALSE); + } + + return TestBackupLogFile(argv[2]); + + } else if (stricmp ( argv[1], "-rsf" ) == 0 ) { + + ReadFlags = EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags,0 ); + } else { + return Usage(); + } + } else if (stricmp ( argv[1], "-rsb" ) == 0 ) { + + ReadFlags = EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags,0 ); + } else { + return Usage(); + } + } else if (stricmp ( argv[1], "-n" ) == 0 ) { + TestChangeNotify(); + + } else if (stricmp ( argv[1], "-rrf" ) == 0 ) { + + ReadFlags = EVENTLOG_SEEK_READ | EVENTLOG_FORWARDS_READ; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags ,1); + } else if (argc == 3) { + return (TestReadEventLog (1, ReadFlags, atoi(argv[2]))); + } + } else if (stricmp ( argv[1], "-rrb" ) == 0 ) { + + ReadFlags = EVENTLOG_SEEK_READ | EVENTLOG_BACKWARDS_READ; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags, 1); + } else if (argc == 3) { + return (TestReadEventLog (1, ReadFlags, atoi(argv[2]))); + } + } else if (stricmp ( argv[1], "-w" ) == 0 ) { + + if ( argc < 3 ) { + return TestWriteEventLog(1); + } else if (argc == 3) { + return (TestWriteEventLog (atoi(argv[2]))); + } + + } else { + + return Usage(); + } + + UNREFERENCED_PARAMETER(argc); + UNREFERENCED_PARAMETER(argv); + UNREFERENCED_PARAMETER(envp); + + +} diff --git a/private/eventlog/test/testwina.c b/private/eventlog/test/testwina.c new file mode 100644 index 000000000..efd558f57 --- /dev/null +++ b/private/eventlog/test/testwina.c @@ -0,0 +1,693 @@ +/*++ + +Copyright (c) 1990 Microsoft Corporation + +Module Name: + + TESTWINA.C + +Abstract: + + Test program for the eventlog service. This program calls the Win + APIs to test out the operation of the service. + +Author: + + Rajen Shah (rajens) 05-Aug-1991 + +Revision History: + + +--*/ +/*----------------------*/ +/* INCLUDES */ +/*----------------------*/ +#include <nt.h> +#include <ntrtl.h> +#include <nturtl.h> +#include <stdio.h> // printf +#include <string.h> // stricmp +#include <stdlib.h> +#include <windows.h> +#include <netevent.h> +//#include <elfcommn.h> + + +#define READ_BUFFER_SIZE 1024*2 // Use 2K buffer + +#define SIZE_DATA_ARRAY 65 + +// +// Global buffer used to emulate "binary data" when writing an event +// record. +// +DWORD Data[SIZE_DATA_ARRAY]; +BOOL bHackTestBackup = FALSE; +PCHAR pServerName = NULL; + + +VOID +Initialize ( + VOID + ) +{ + DWORD i; + + // Initialize the values in the data buffer. + // + for (i=0; i< SIZE_DATA_ARRAY; i++) + Data[i] = i; + +} + + +BOOL +Usage ( + VOID + ) +{ + printf( "usage: \n" ); + printf( "-c Tests ClearEventLog API\n"); + printf( "-b filename Tests BackupEventLog API\n"); + printf( "-rsb Reads event log sequentially backwards\n"); + printf( "-rsf Reads event log sequentially forwards\n"); + printf( "-rrb <record> Reads event log from <record> backwards\n"); + printf( "-rrf <record> Reads event log from <record> forwards\n"); + printf( "-w <count> Tests ReportEvent API <count> times\n"); + return ERROR_INVALID_PARAMETER; + +} // Usage + + + +BOOL +WriteLogEntry ( HANDLE LogHandle, DWORD EventID ) + +{ +#define NUM_STRINGS 2 +#define MAX_STRING_SIZE 32767 // Max size is FFFF/2 for ANSI strings + + BOOL Status; + WORD EventType; + DWORD i; + DWORD DataSize; + PSID pUserSid; + PCHAR BigString; + + // PSTR Strings[NUM_STRINGS] = {"StringAOne","StringATwo" }; + PSTR Strings[NUM_STRINGS]; + + Strings[0] = "StringAOne"; + + BigString = malloc(MAX_STRING_SIZE); + + for (i = 0; i < MAX_STRING_SIZE; i++) { + BigString[i] = 'A'; + } + + BigString[MAX_STRING_SIZE-1] = '\0'; + Strings[1] = BigString; + + EventType = EVENTLOG_INFORMATION_TYPE; + pUserSid = NULL; + DataSize = sizeof(DWORD) * SIZE_DATA_ARRAY; + + for (i=0; i< SIZE_DATA_ARRAY; i++) + Data[i] += i; + + Status = ReportEventA ( + LogHandle, + EventType, + 0, // event category + EventID, + pUserSid, + (WORD) NUM_STRINGS, + DataSize, + Strings, + (PVOID)Data + ); + + free(BigString); + return (Status); +} + +BOOL +WriteLogEntryMsg ( HANDLE LogHandle, DWORD EventID ) +/* + This function requires a registry entry in the Applications section + of the Eventlog for TESTWINAAPP, it will use the netevent.dll message file. +*/ +{ +#define NUM_STRINGS 2 + + BOOL Status; + WORD EventType; + DWORD DataSize; + PSID pUserSid; + PCHAR BigString; + + PSTR Strings[NUM_STRINGS]; + + Strings[0] = "This is a BOGUS message for TEST purposes Ignore this substitution text"; + Strings[1] = "GHOST SERVICE in the long string format - I wanted a long string to pass into this function"; + + EventType = EVENTLOG_INFORMATION_TYPE; + pUserSid = NULL; + DataSize = sizeof(DWORD) * SIZE_DATA_ARRAY; + + Status = ReportEventA ( + LogHandle, + EventType, + 0, // event category + EVENT_SERVICE_START_FAILED_NONE, + pUserSid, + (WORD) NUM_STRINGS, + 0, // DataSize + Strings, + (PVOID)NULL // Data + ); + + free(BigString); + return (Status); +} + + +VOID +DisplayEventRecords( PVOID Buffer, + DWORD BufSize, + ULONG *NumRecords) + +{ + PEVENTLOGRECORD pLogRecord; + PSTR pString; + DWORD Count = 0; + DWORD Offset = 0; + DWORD i; + + pLogRecord = (PEVENTLOGRECORD) Buffer; + + while ((DWORD)Offset < BufSize) { + + Count++; + + printf("\n\nRecord # %lu\n", pLogRecord->RecordNumber); + + printf("Length: 0x%lx TimeGenerated: 0x%lx EventID: 0x%lx EventType: 0x%x\n", + pLogRecord->Length, pLogRecord->TimeGenerated, pLogRecord->EventID, + pLogRecord->EventType); + + printf("NumStrings: 0x%x StringOffset: 0x%lx UserSidLength: 0x%lx TimeWritten: 0x%lx\n", + pLogRecord->NumStrings, pLogRecord->StringOffset, + pLogRecord->UserSidLength, pLogRecord->TimeWritten); + + printf("UserSidOffset: 0x%lx DataLength: 0x%lx DataOffset: 0x%lx \n", + pLogRecord->UserSidOffset, pLogRecord->DataLength, + pLogRecord->DataOffset); + + // + // Print out module name + // + pString = (PSTR)((DWORD)pLogRecord + sizeof(EVENTLOGRECORD)); + printf("ModuleName: %s ", pString); + + // + // Display ComputerName + // + pString = (PSTR)((DWORD)pString + strlen(pString) + 1); + printf("ComputerName: %s\n",pString); + + // + // Display strings + // + pString = (PSTR)((DWORD)Buffer + pLogRecord->StringOffset); + + printf("Strings: "); + for (i=0; i<pLogRecord->NumStrings; i++) { + + printf(" %s ", pString); + pString = (PSTR)((DWORD)pString + strlen(pString) + 1); + } + + // Get next record + + Offset += pLogRecord->Length; + + pLogRecord = (PEVENTLOGRECORD)((DWORD)Buffer + Offset); + + } + *NumRecords = Count; + +} + + +BOOL +ReadFromLog ( HANDLE LogHandle, + PVOID Buffer, + ULONG *pBytesRead, + DWORD ReadFlag, + DWORD Record + ) +{ + BOOL Status; + DWORD MinBytesNeeded; + DWORD ErrorCode; + + Status = ReadEventLogA ( + LogHandle, + ReadFlag, + Record, + Buffer, + READ_BUFFER_SIZE, + pBytesRead, + &MinBytesNeeded + ); + + + if (!Status) { + ErrorCode = GetLastError(); + printf("Error from ReadEventLog %d \n", ErrorCode); + if (ErrorCode == ERROR_NO_MORE_FILES) + printf("Buffer too small. Need %lu bytes min\n", MinBytesNeeded); + + } + + return (Status); +} + + + + +BOOL +TestReadEventLog (DWORD Count, DWORD ReadFlag, DWORD Record) + +{ + BOOL Status, IStatus; + + HANDLE LogHandle; + LPSTR ModuleName; + DWORD NumRecords, BytesReturned; + PVOID Buffer; + DWORD RecordOffset; + DWORD NumberOfRecords; + DWORD OldestRecord; + + printf("Testing ReadEventLog API to read %lu entries\n",Count); + + Buffer = malloc (READ_BUFFER_SIZE); + + // + // Initialize the strings + // + NumRecords = Count; + ModuleName = "TESTWINAAPP"; + + // + // Open the log handle + // + + // + // This is just a quick and dirty way to test the api to read a backup + // log, until I can fix test.c to be more general purpose. + // + + if (bHackTestBackup) { + printf("OpenBackupEventLog = "); + LogHandle = OpenBackupEventLog( + NULL, + "\\\\danhi386\\roote\\view.log" + ); + } + else { + printf("OpenEventLog - "); + LogHandle = OpenEventLog ( + pServerName, + ModuleName + ); + } + + if (LogHandle == NULL) { + printf("Error - %d\n", GetLastError()); + + } else { + printf("SUCCESS\n"); + + // + // Get and print record information + // + + Status = GetNumberOfEventLogRecords(LogHandle, & NumberOfRecords); + if (NT_SUCCESS(Status)) { + Status = GetOldestEventLogRecord(LogHandle, & OldestRecord); + } + + if (!NT_SUCCESS(Status)) { + printf("Get of record information failed with %X", Status); + return(Status); + } + + printf("\nThere are %d records in the file, %d is the oldest" + " record number\n", NumberOfRecords, OldestRecord); + + RecordOffset = Record; + + while (Count && (BytesReturned != 0)) { + + printf("Read %u records\n", NumRecords); + // + // Read from the log + // + Status = ReadFromLog ( LogHandle, + Buffer, + &BytesReturned, + ReadFlag, + RecordOffset + ); + if (Status) { + printf("Bytes read = 0x%lx\n", BytesReturned); + DisplayEventRecords(Buffer, BytesReturned, &NumRecords); + Count -= NumRecords; + RecordOffset += NumRecords; + } else { + break; + } + + } + printf("\n"); + + if (!Status) { + printf ("Error - %d. Remaining count %lu\n", GetLastError(), Count); + } else { + printf ("SUCCESS\n"); + } + + printf("Calling CloseEventLog\n"); + IStatus = CloseEventLog (LogHandle); + } + free(Buffer); + return (Status); +} + + + +BOOL +TestWriteEventLog (DWORD Count) + +{ + BOOL Status, IStatus; + HANDLE LogHandle=NULL; + LPSTR ModuleName; + DWORD EventID = 99; + DWORD WriteCount; + + printf("Testing ReportEvent API\n"); + + // + // Initialize the strings + // + ModuleName = "TESTWINAAPP"; + + // + // Open the log handle + // + while (Count && NT_SUCCESS(Status)) { + //printf("Calling RegisterEventSource for WRITE %lu times - ", Count); + LogHandle = RegisterEventSourceA ( + pServerName, + ModuleName + ); + + if (LogHandle == NULL) { + printf("Error - %d\n", GetLastError()); + + } else { + printf("Registered - "); + WriteCount = 5; + printf("Record # %u ", Count); + + while (WriteCount && NT_SUCCESS(Status)) { + + // + // Write an entry into the log + // + Data[0] = Count; // Make data "unique" + EventID = (EventID + Count) % 100; // Vary the eventids + Status = WriteLogEntryMsg ( LogHandle, EventID ); + Count--; + WriteCount--; + + if (!Status) { + printf ("Error - %d. Remaining count %lu\n", GetLastError(), Count); + } else { + printf ("%d,",WriteCount); + } + } + IStatus = DeregisterEventSource (LogHandle); + printf(" - Deregistered\n"); + } + } + + return (Status); +} + + + +BOOL +TestClearLogFile () + +{ + BOOL Status, IStatus; + HANDLE LogHandle; + LPSTR ModuleName, BackupName; + + printf("Testing ClearLogFile API\n"); + // + // Initialize the strings + // + ModuleName = "TESTWINAAPP"; + + // + // Open the log handle + // + printf("Calling OpenEventLog for CLEAR - "); + LogHandle = OpenEventLogA ( + pServerName, + ModuleName + ); + + if (!Status) { + printf("Error - %d\n", GetLastError()); + + } else { + printf("SUCCESS\n"); + + // + // Clear the log file and back it up to "view.log" + // + + printf("Calling ClearEventLog backing up to view.log "); + BackupName = "view.log"; + + Status = ClearEventLogA ( + LogHandle, + BackupName + ); + + if (!Status) { + printf ("Error - %d\n", GetLastError()); + } else { + printf ("SUCCESS\n"); + } + + // + // Now just clear the file without backing it up + // + printf("Calling ClearEventLog with no backup "); + Status = ClearEventLogA ( + LogHandle, + NULL + ); + + if (!Status) { + printf ("Error - %d\n", GetLastError()); + } else { + printf ("SUCCESS\n"); + } + + printf("Calling CloseEventLog\n"); + IStatus = CloseEventLog (LogHandle); + } + + return(Status); +} + + +BOOL +TestBackupLogFile( + LPSTR FileName + ) + +{ + HANDLE LogHandle; + + printf("Testing BackupEventLog API\n"); + + // + // Open the log handle + // + + printf("Calling ElfOpenEventLog for BACKUP - "); + LogHandle = OpenEventLogA ( + NULL, + "Application" + ); + + if (!LogHandle) { + printf("Error - %d\n", GetLastError()); + + } else { + printf("SUCCESS\n"); + + // + // Backup the log file + // + + printf("Calling BackupEventLogFile backing up to %s\n", FileName); + + if (!BackupEventLogA ( + LogHandle, + FileName + )) { + printf ("Error - %d\n", GetLastError()); + } else { + printf ("SUCCESS\n"); + } + + + printf("Calling CloseEventLog - "); + if (CloseEventLog (LogHandle)) { + printf("Success\n"); + } + else { + printf("Failed with code %d\n", GetLastError()); + } + } + + return(TRUE); +} + + +/****************************************************************************/ +BOOL +main ( + IN SHORT argc, + IN PSZ argv[], + ) +/*++ +* +* Routine Description: +* +* +* +* Arguments: +* +* +* +* +* Return Value: +* +* +* +--*/ +/****************************************************************************/ +{ + + DWORD ReadFlags; + + Initialize(); // Init any data + + // + // Just till I can replace this horrid parm parsing with my own + // + + if (getenv("REMOTE")) { + pServerName = "\\\\danhi20"; + } + + if ( argc < 2 ) { + printf( "Not enough parameters\n" ); + return Usage( ); + } + + if ( stricmp( argv[1], "-c" ) == 0 ) { + + if ( argc < 3 ) { + return TestClearLogFile(); + } + + } else if (stricmp ( argv[1], "-b" ) == 0 ) { + + if ( argc < 3 ) { + return Usage(); + } else { + return TestBackupLogFile(argv[2]); + } + + } else if (stricmp ( argv[1], "-rsf" ) == 0 ) { + + ReadFlags = EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags,0 ); + } else { + return Usage(); + } + } else if (stricmp ( argv[1], "-xsf" ) == 0 ) { + + ReadFlags = EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ; + bHackTestBackup = TRUE; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags,0 ); + } else { + return Usage(); + } + } else if (stricmp ( argv[1], "-rsb" ) == 0 ) { + + ReadFlags = EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags,0 ); + } else { + return Usage(); + } + } else if (stricmp ( argv[1], "-rrf" ) == 0 ) { + + ReadFlags = EVENTLOG_SEEK_READ | EVENTLOG_FORWARDS_READ; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags ,1); + } else if (argc == 3) { + return (TestReadEventLog (1, ReadFlags, atoi(argv[2]))); + } + } else if (stricmp ( argv[1], "-rrb" ) == 0 ) { + + ReadFlags = EVENTLOG_SEEK_READ | EVENTLOG_BACKWARDS_READ; + if ( argc < 3 ) { + return TestReadEventLog(1,ReadFlags, 1); + } else if (argc == 3) { + return (TestReadEventLog (1, ReadFlags, atoi(argv[2]))); + } + } else if (stricmp ( argv[1], "-w" ) == 0 ) { + + if ( argc < 3 ) { + return TestWriteEventLog(1); + } else if (argc == 3) { + return (TestWriteEventLog (atoi(argv[2]))); + } + + } else { + + return Usage(); + } + + UNREFERENCED_PARAMETER(argc); + UNREFERENCED_PARAMETER(argv); + + +} |