rpc.c File Reference

#include "eventlog.h"
#include <debug.h>

Include dependency graph for rpc.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
static NTSTATUS	ElfDeleteEventLogHandle (PIELF_HANDLE LogHandle)
DWORD WINAPI	RpcThreadRoutine (LPVOID lpParameter)
static NTSTATUS	ElfCreateEventLogHandle (PLOGHANDLE *LogHandle, PUNICODE_STRING LogName, BOOLEAN Create)
static NTSTATUS	ElfCreateBackupLogHandle (PLOGHANDLE *LogHandle, PUNICODE_STRING FileName)
static PLOGHANDLE	ElfGetLogHandleEntryByHandle (IELF_HANDLE EventLogHandle)
NTSTATUS WINAPI	ElfrClearELFW (IELF_HANDLE LogHandle, PRPC_UNICODE_STRING BackupFileName)
NTSTATUS WINAPI	ElfrBackupELFW (IELF_HANDLE LogHandle, PRPC_UNICODE_STRING BackupFileName)
NTSTATUS WINAPI	ElfrCloseEL (PIELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrDeregisterEventSource (PIELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrNumberOfRecords (IELF_HANDLE LogHandle, PULONG NumberOfRecords)
NTSTATUS WINAPI	ElfrOldestRecord (IELF_HANDLE LogHandle, PULONG OldestRecordNumber)
NTSTATUS WINAPI	ElfrChangeNotify (IELF_HANDLE LogHandle, RPC_CLIENT_ID ClientId, ULONG Event)
NTSTATUS WINAPI	ElfrOpenELW (EVENTLOG_HANDLE_W UNCServerName, PRPC_UNICODE_STRING ModuleName, PRPC_UNICODE_STRING RegModuleName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrRegisterEventSourceW (EVENTLOG_HANDLE_W UNCServerName, PRPC_UNICODE_STRING ModuleName, PRPC_UNICODE_STRING RegModuleName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrOpenBELW (EVENTLOG_HANDLE_W UNCServerName, PRPC_UNICODE_STRING BackupFileName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrReadELW (IELF_HANDLE LogHandle, ULONG ReadFlags, ULONG RecordOffset, RULONG NumberOfBytesToRead, PBYTE Buffer, PULONG NumberOfBytesRead, PULONG MinNumberOfBytesNeeded)
NTSTATUS	ElfrIntReportEventW (IELF_HANDLE LogHandle, ULONG Time, USHORT EventType, USHORT EventCategory, ULONG EventID, PRPC_UNICODE_STRING SourceName OPTIONAL, USHORT NumStrings, ULONG DataSize, PRPC_UNICODE_STRING ComputerName, PRPC_SID UserSID, PRPC_UNICODE_STRING Strings[], PBYTE Data, USHORT Flags, PULONG RecordNumber, PULONG TimeWritten)
NTSTATUS WINAPI	ElfrReportEventW (IELF_HANDLE LogHandle, ULONG Time, USHORT EventType, USHORT EventCategory, ULONG EventID, USHORT NumStrings, ULONG DataSize, PRPC_UNICODE_STRING ComputerName, PRPC_SID UserSID, PRPC_UNICODE_STRING Strings[], PBYTE Data, USHORT Flags, PULONG RecordNumber, PULONG TimeWritten)
NTSTATUS WINAPI	ElfrClearELFA (IELF_HANDLE LogHandle, PRPC_STRING BackupFileName)
NTSTATUS WINAPI	ElfrBackupELFA (IELF_HANDLE LogHandle, PRPC_STRING BackupFileName)
NTSTATUS WINAPI	ElfrOpenELA (EVENTLOG_HANDLE_A UNCServerName, PRPC_STRING ModuleName, PRPC_STRING RegModuleName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrRegisterEventSourceA (EVENTLOG_HANDLE_A UNCServerName, PRPC_STRING ModuleName, PRPC_STRING RegModuleName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrOpenBELA (EVENTLOG_HANDLE_A UNCServerName, PRPC_STRING BackupFileName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrReadELA (IELF_HANDLE LogHandle, ULONG ReadFlags, ULONG RecordOffset, RULONG NumberOfBytesToRead, PBYTE Buffer, PULONG NumberOfBytesRead, PULONG MinNumberOfBytesNeeded)
NTSTATUS WINAPI	ElfrReportEventA (IELF_HANDLE LogHandle, ULONG Time, USHORT EventType, USHORT EventCategory, ULONG EventID, USHORT NumStrings, ULONG DataSize, PRPC_STRING ComputerName, PRPC_SID UserSID, PRPC_STRING Strings[], PBYTE Data, USHORT Flags, PULONG RecordNumber, PULONG TimeWritten)
NTSTATUS WINAPI	ElfrRegisterClusterSvc (handle_t BindingHandle)
NTSTATUS WINAPI	ElfrDeregisterClusterSvc (handle_t BindingHandle)
NTSTATUS WINAPI	ElfrWriteClusterEvents (handle_t BindingHandle)
NTSTATUS WINAPI	ElfrGetLogInformation (IELF_HANDLE LogHandle, ULONG InfoLevel, PBYTE Buffer, ULONG cbBufSize, PULONG pcbBytesNeeded)
NTSTATUS WINAPI	ElfrFlushEL (IELF_HANDLE LogHandle)
NTSTATUS WINAPI	ElfrReportEventAndSourceW (IELF_HANDLE LogHandle, ULONG Time, USHORT EventType, USHORT EventCategory, ULONG EventID, PRPC_UNICODE_STRING SourceName, USHORT NumStrings, ULONG DataSize, PRPC_UNICODE_STRING ComputerName, PRPC_SID UserSID, PRPC_UNICODE_STRING Strings[], PBYTE Data, USHORT Flags, PULONG RecordNumber, PULONG TimeWritten)
void __RPC_FAR *__RPC_USER	midl_user_allocate (SIZE_T len)
void __RPC_USER	midl_user_free (void __RPC_FAR *ptr)
void __RPC_USER	IELF_HANDLE_rundown (IELF_HANDLE LogHandle)

Variables
static LIST_ENTRY	LogHandleListHead
static CRITICAL_SECTION	LogHandleListCs

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 15 of file rpc.c.

Function Documentation

ElfCreateBackupLogHandle()

static NTSTATUS ElfCreateBackupLogHandle ( PLOGHANDLE *  LogHandle, PUNICODE_STRING  FileName  )

static

Definition at line 177 of file rpc.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
    PLOGHANDLE pLogHandle;
 
    DPRINT("ElfCreateBackupLogHandle(%wZ)\n", FileName);
 
    *LogHandle = NULL;
 
    pLogHandle = HeapAlloc(GetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           sizeof(LOGHANDLE));
    if (pLogHandle == NULL)
    {
        DPRINT1("Failed to allocate Heap!\n");
        return STATUS_NO_MEMORY;
    }
 
    /* Create the log file */
    Status = LogfCreate(&pLogHandle->LogFile,
                        NULL,
                        FileName,
                        0,
                        0,
                        FALSE,
                        TRUE);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to create the log file! (Status 0x%08lx)\n", Status);
        goto Done;
    }
 
    /* Set the backup flag */
    pLogHandle->Flags |= LOG_HANDLE_BACKUP_FILE;
 
    /* Reset the current record */
    pLogHandle->CurrentRecord = 0;
 
Done:
    if (NT_SUCCESS(Status))
    {
        /* Append log handle */
        EnterCriticalSection(&LogHandleListCs);
        InsertTailList(&LogHandleListHead, &pLogHandle->LogHandleListEntry);
        LeaveCriticalSection(&LogHandleListCs);
        *LogHandle = pLogHandle;
    }
    else
    {
        HeapFree(GetProcessHeap(), 0, pLogHandle);
    }
 
    return Status;
}

Referenced by ElfrOpenBELA(), and ElfrOpenBELW().

ElfCreateEventLogHandle()

static NTSTATUS ElfCreateEventLogHandle ( PLOGHANDLE *  LogHandle, PUNICODE_STRING  LogName, BOOLEAN  Create  )

static

Definition at line 69 of file rpc.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
    PLOGHANDLE pLogHandle;
    PLOGFILE currentLogFile = NULL;
    DWORD i, LogsActive;
    PEVENTSOURCE pEventSource;
 
    DPRINT("ElfCreateEventLogHandle(%wZ)\n", LogName);
 
    *LogHandle = NULL;
 
    i = (LogName->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR);
    pLogHandle = HeapAlloc(GetProcessHeap(),
                           HEAP_ZERO_MEMORY,
                           FIELD_OFFSET(LOGHANDLE, szName[i]));
    if (!pLogHandle)
    {
        DPRINT1("Failed to allocate Heap!\n");
        return STATUS_NO_MEMORY;
    }
 
    StringCchCopyW(pLogHandle->szName, i, LogName->Buffer);
 
    /* Get the number of Log Files the EventLog service found */
    // NOTE: We could just as well loop only once within the list of logs
    // and retrieve what the code below that calls LogfListItemByIndex, does!!
    LogsActive = LogfListItemCount();
    if (LogsActive == 0)
    {
        DPRINT1("EventLog service reports no log files!\n");
        Status = STATUS_UNSUCCESSFUL;
        goto Done;
    }
 
    /* If Creating, default to the Application Log in case we fail, as documented on MSDN */
    if (Create)
    {
        pEventSource = GetEventSourceByName(LogName->Buffer);
        DPRINT("EventSource: %p\n", pEventSource);
        if (pEventSource)
        {
            DPRINT("EventSource LogFile: %p\n", pEventSource->LogFile);
            pLogHandle->LogFile = pEventSource->LogFile;
        }
        else
        {
            DPRINT("EventSource LogFile: Application log file\n");
            pLogHandle->LogFile = LogfListItemByName(L"Application");
        }
 
        DPRINT("LogHandle LogFile: %p\n", pLogHandle->LogFile);
    }
    else
    {
        pLogHandle->LogFile = NULL;
 
        for (i = 1; i <= LogsActive; i++)
        {
            currentLogFile = LogfListItemByIndex(i);
 
            if (_wcsicmp(LogName->Buffer, currentLogFile->LogName) == 0)
            {
                pLogHandle->LogFile = currentLogFile;
                break;
            }
        }
 
        /* Use the application log if the desired log does not exist */
        if (pLogHandle->LogFile == NULL)
        {
            pLogHandle->LogFile = LogfListItemByName(L"Application");
            if (pLogHandle->LogFile == NULL)
            {
                DPRINT1("Application log is missing!\n");
                Status = STATUS_UNSUCCESSFUL;
                goto Done;
            }
        }
 
        /* Reset the current record */
        pLogHandle->CurrentRecord = 0;
    }
 
    if (!pLogHandle->LogFile)
        Status = STATUS_UNSUCCESSFUL;
 
Done:
    if (NT_SUCCESS(Status))
    {
        /* Append log handle */
        EnterCriticalSection(&LogHandleListCs);
        InsertTailList(&LogHandleListHead, &pLogHandle->LogHandleListEntry);
        LeaveCriticalSection(&LogHandleListCs);
        *LogHandle = pLogHandle;
    }
    else
    {
        HeapFree(GetProcessHeap(), 0, pLogHandle);
    }
 
    return Status;
}

Referenced by ElfrOpenELA(), ElfrOpenELW(), ElfrRegisterEventSourceA(), and ElfrRegisterEventSourceW().

ElfDeleteEventLogHandle()

static NTSTATUS ElfDeleteEventLogHandle ( PIELF_HANDLE  LogHandle )

static

Definition at line 264 of file rpc.c.

{
    PLOGHANDLE pLogHandle;
 
    pLogHandle = ElfGetLogHandleEntryByHandle(*LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    EnterCriticalSection(&LogHandleListCs);
    RemoveEntryList(&pLogHandle->LogHandleListEntry);
    LeaveCriticalSection(&LogHandleListCs);
 
    LogfClose(pLogHandle->LogFile, FALSE);
 
    HeapFree(GetProcessHeap(), 0, pLogHandle);
 
    *LogHandle = NULL;
 
    return STATUS_SUCCESS;
}

Referenced by ElfrCloseEL(), ElfrDeregisterEventSource(), IELF_HANDLE_rundown(), and RpcThreadRoutine().

ElfGetLogHandleEntryByHandle()

static PLOGHANDLE ElfGetLogHandleEntryByHandle ( IELF_HANDLE  EventLogHandle )

static

Definition at line 235 of file rpc.c.

{
    PLIST_ENTRY CurrentEntry;
    PLOGHANDLE Handle, pLogHandle = NULL;
 
    EnterCriticalSection(&LogHandleListCs);
 
    CurrentEntry = LogHandleListHead.Flink;
    while (CurrentEntry != &LogHandleListHead)
    {
        Handle = CONTAINING_RECORD(CurrentEntry,
                                   LOGHANDLE,
                                   LogHandleListEntry);
        CurrentEntry = CurrentEntry->Flink;
 
        if (Handle == EventLogHandle)
        {
            pLogHandle = Handle;
            break;
        }
    }
 
    LeaveCriticalSection(&LogHandleListCs);
 
    return pLogHandle;
}

Referenced by ElfDeleteEventLogHandle(), ElfrBackupELFW(), ElfrClearELFW(), ElfrFlushEL(), ElfrGetLogInformation(), ElfrIntReportEventW(), ElfrNumberOfRecords(), ElfrOldestRecord(), ElfrReadELA(), and ElfrReadELW().

ElfrBackupELFA()

NTSTATUS WINAPI ElfrBackupELFA	(	IELF_HANDLE	LogHandle,
		PRPC_STRING	BackupFileName
	)

Definition at line 787 of file rpc.c.

{
    NTSTATUS Status;
    UNICODE_STRING BackupFileNameW;
 
    Status = RtlAnsiStringToUnicodeString(&BackupFileNameW,
                                          (PANSI_STRING)BackupFileName,
                                          TRUE);
    if (!NT_SUCCESS(Status))
        return Status;
 
    Status = ElfrBackupELFW(LogHandle,
                            (PRPC_UNICODE_STRING)&BackupFileNameW);
 
    RtlFreeUnicodeString(&BackupFileNameW);
 
    return Status;
}

Referenced by ElfBackupEventLogFileA().

ElfrBackupELFW()

NTSTATUS WINAPI ElfrBackupELFW	(	IELF_HANDLE	LogHandle,
		PRPC_UNICODE_STRING	BackupFileName
	)

Definition at line 313 of file rpc.c.

{
    PLOGHANDLE pLogHandle;
 
    DPRINT("ElfrBackupELFW()\n");
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    return LogfBackupFile(pLogHandle->LogFile,
                          (PUNICODE_STRING)BackupFileName);
}

Referenced by ElfBackupEventLogFileW(), and ElfrBackupELFA().

ElfrChangeNotify()

NTSTATUS WINAPI ElfrChangeNotify	(	IELF_HANDLE	LogHandle,
		RPC_CLIENT_ID	ClientId,
		ULONG	Event
	)

Definition at line 433 of file rpc.c.

{
    UNIMPLEMENTED;
    return STATUS_NOT_IMPLEMENTED;
}

Referenced by ElfChangeNotify().

ElfrClearELFA()

NTSTATUS WINAPI ElfrClearELFA	(	IELF_HANDLE	LogHandle,
		PRPC_STRING	BackupFileName
	)

Definition at line 762 of file rpc.c.

{
    NTSTATUS Status;
    UNICODE_STRING BackupFileNameW;
 
    Status = RtlAnsiStringToUnicodeString(&BackupFileNameW,
                                          (PANSI_STRING)BackupFileName,
                                          TRUE);
    if (!NT_SUCCESS(Status))
        return Status;
 
    Status = ElfrClearELFW(LogHandle,
                           (PRPC_UNICODE_STRING)&BackupFileNameW);
 
    RtlFreeUnicodeString(&BackupFileNameW);
 
    return Status;
}

Referenced by ElfClearEventLogFileA().

ElfrClearELFW()

NTSTATUS WINAPI ElfrClearELFW	(	IELF_HANDLE	LogHandle,
		PRPC_UNICODE_STRING	BackupFileName
	)

Definition at line 289 of file rpc.c.

{
    PLOGHANDLE pLogHandle;
 
    DPRINT("ElfrClearELFW()\n");
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    /* Fail, if the log file is a backup file */
    if (pLogHandle->Flags & LOG_HANDLE_BACKUP_FILE)
        return STATUS_INVALID_HANDLE;
 
    return LogfClearFile(pLogHandle->LogFile,
                         (PUNICODE_STRING)BackupFileName);
}

Referenced by ElfClearEventLogFileW(), and ElfrClearELFA().

ElfrCloseEL()

NTSTATUS WINAPI ElfrCloseEL

(

PIELF_HANDLE

LogHandle

)

Definition at line 333 of file rpc.c.

{
    return ElfDeleteEventLogHandle(LogHandle);
}

Referenced by ElfCloseEventLog().

ElfrDeregisterClusterSvc()

NTSTATUS WINAPI ElfrDeregisterClusterSvc

(

handle_t

BindingHandle

)

Definition at line 1122 of file rpc.c.

{
    UNIMPLEMENTED;
    return STATUS_NOT_IMPLEMENTED;
}

ElfrDeregisterEventSource()

NTSTATUS WINAPI ElfrDeregisterEventSource

(

PIELF_HANDLE

LogHandle

)

Definition at line 343 of file rpc.c.

{
    return ElfDeleteEventLogHandle(LogHandle);
}

Referenced by ElfDeregisterEventSource().

ElfrFlushEL()

NTSTATUS WINAPI ElfrFlushEL

(

IELF_HANDLE

LogHandle

)

Definition at line 1196 of file rpc.c.

{
    NTSTATUS Status;
    PLOGHANDLE pLogHandle;
    PLOGFILE pLogFile;
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    pLogFile = pLogHandle->LogFile;
 
    /* Lock the log file exclusive */
    RtlAcquireResourceExclusive(&pLogFile->Lock, TRUE);
 
    Status = ElfFlushFile(&pLogFile->LogFile);
 
    /* Unlock the log file */
    RtlReleaseResource(&pLogFile->Lock);
 
    return Status;
}

Referenced by ElfFlushEventLog().

ElfrGetLogInformation()

NTSTATUS WINAPI ElfrGetLogInformation	(	IELF_HANDLE	LogHandle,
		ULONG	InfoLevel,
		PBYTE	Buffer,
		ULONG	cbBufSize,
		PULONG	pcbBytesNeeded
	)

Definition at line 1144 of file rpc.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
    PLOGHANDLE pLogHandle;
    PLOGFILE pLogFile;
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    pLogFile = pLogHandle->LogFile;
 
    /* Lock the log file shared */
    RtlAcquireResourceShared(&pLogFile->Lock, TRUE);
 
    switch (InfoLevel)
    {
        case EVENTLOG_FULL_INFO:
        {
            LPEVENTLOG_FULL_INFORMATION efi = (LPEVENTLOG_FULL_INFORMATION)Buffer;
 
            *pcbBytesNeeded = sizeof(EVENTLOG_FULL_INFORMATION);
            if (cbBufSize < sizeof(EVENTLOG_FULL_INFORMATION))
            {
                Status = STATUS_BUFFER_TOO_SMALL;
                break;
            }
 
            efi->dwFull = !!(ElfGetFlags(&pLogFile->LogFile) & ELF_LOGFILE_LOGFULL_WRITTEN);
            break;
        }
 
        default:
            Status = STATUS_INVALID_LEVEL;
            break;
    }
 
    /* Unlock the log file */
    RtlReleaseResource(&pLogFile->Lock);
 
    return Status;
}

Referenced by GetEventLogInformation().

ElfrIntReportEventW()

NTSTATUS ElfrIntReportEventW	(	IELF_HANDLE	LogHandle,
		ULONG	Time,
		USHORT	EventType,
		USHORT	EventCategory,
		ULONG	EventID,
		PRPC_UNICODE_STRING SourceName	OPTIONAL,
		USHORT	NumStrings,
		ULONG	DataSize,
		PRPC_UNICODE_STRING	ComputerName,
		PRPC_SID	UserSID,
		PRPC_UNICODE_STRING	Strings[],
		PBYTE	Data,
		USHORT	Flags,
		PULONG	RecordNumber,
		PULONG	TimeWritten
	)

Definition at line 581 of file rpc.c.

{
    NTSTATUS Status;
    PLOGHANDLE pLogHandle;
    UNICODE_STRING LocalSourceName, LocalComputerName;
    PEVENTLOGRECORD LogBuffer;
    USHORT i;
    SIZE_T RecSize;
    ULONG dwStringsSize = 0;
    ULONG dwUserSidLength = 0;
    PWSTR lpStrings, str;
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    /* Flags must be 0 */
    if (Flags)
        return STATUS_INVALID_PARAMETER;
 
    for (i = 0; i < NumStrings; i++)
    {
        switch (EventType)
        {
            case EVENTLOG_SUCCESS:
                DPRINT("Success: %wZ\n", Strings[i]);
                break;
 
            case EVENTLOG_ERROR_TYPE:
                DPRINT("Error: %wZ\n", Strings[i]);
                break;
 
            case EVENTLOG_WARNING_TYPE:
                DPRINT("Warning: %wZ\n", Strings[i]);
                break;
 
            case EVENTLOG_INFORMATION_TYPE:
                DPRINT("Info: %wZ\n", Strings[i]);
                break;
 
            case EVENTLOG_AUDIT_SUCCESS:
                DPRINT("Audit Success: %wZ\n", Strings[i]);
                break;
 
            case EVENTLOG_AUDIT_FAILURE:
                DPRINT("Audit Failure: %wZ\n", Strings[i]);
                break;
 
            default:
                DPRINT1("Type %hu: %wZ\n", EventType, Strings[i]);
                break;
        }
        dwStringsSize += Strings[i]->Length + sizeof(UNICODE_NULL);
    }
 
    lpStrings = HeapAlloc(GetProcessHeap(), 0, dwStringsSize);
    if (!lpStrings)
    {
        DPRINT1("Failed to allocate heap\n");
        return STATUS_NO_MEMORY;
    }
 
    str = lpStrings;
    for (i = 0; i < NumStrings; i++)
    {
        RtlCopyMemory(str, Strings[i]->Buffer, Strings[i]->Length);
        str += Strings[i]->Length / sizeof(WCHAR);
        *str = UNICODE_NULL;
        str++;
    }
 
    if (UserSID)
        dwUserSidLength = FIELD_OFFSET(SID, SubAuthority[UserSID->SubAuthorityCount]);
 
    if (SourceName && SourceName->Buffer)
        LocalSourceName = *(PUNICODE_STRING)SourceName;
    else
        RtlInitUnicodeString(&LocalSourceName, pLogHandle->szName);
 
    LocalComputerName = *(PUNICODE_STRING)ComputerName;
 
    LogBuffer = LogfAllocAndBuildNewRecord(&RecSize,
                                           Time,
                                           EventType,
                                           EventCategory,
                                           EventID,
                                           &LocalSourceName,
                                           &LocalComputerName,
                                           dwUserSidLength,
                                           UserSID,
                                           NumStrings,
                                           lpStrings,
                                           DataSize,
                                           Data);
    if (LogBuffer == NULL)
    {
        DPRINT1("LogfAllocAndBuildNewRecord failed!\n");
        HeapFree(GetProcessHeap(), 0, lpStrings);
        return STATUS_NO_MEMORY;
    }
 
    Status = LogfWriteRecord(pLogHandle->LogFile, LogBuffer, RecSize);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("ERROR writing to event log `%S' (Status 0x%08lx)\n",
                pLogHandle->LogFile->LogName, Status);
    }
 
    if (NT_SUCCESS(Status))
    {
        /* Retrieve the two fields that were set by LogfWriteRecord into the record */
        if (RecordNumber)
            *RecordNumber = LogBuffer->RecordNumber;
        if (TimeWritten)
            *TimeWritten = LogBuffer->TimeWritten;
    }
 
    LogfFreeRecord(LogBuffer);
 
    HeapFree(GetProcessHeap(), 0, lpStrings);
 
    return Status;
}

Referenced by ElfrReportEventAndSourceW(), and ElfrReportEventW().

ElfrNumberOfRecords()

NTSTATUS WINAPI ElfrNumberOfRecords	(	IELF_HANDLE	LogHandle,
		PULONG	NumberOfRecords
	)

Definition at line 353 of file rpc.c.

{
    PLOGHANDLE pLogHandle;
    PLOGFILE pLogFile;
    ULONG OldestRecordNumber, CurrentRecordNumber;
 
    DPRINT("ElfrNumberOfRecords()\n");
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    if (!NumberOfRecords)
        return STATUS_INVALID_PARAMETER;
 
    pLogFile = pLogHandle->LogFile;
 
    /* Lock the log file shared */
    RtlAcquireResourceShared(&pLogFile->Lock, TRUE);
 
    OldestRecordNumber  = ElfGetOldestRecord(&pLogFile->LogFile);
    CurrentRecordNumber = ElfGetCurrentRecord(&pLogFile->LogFile);
 
    /* Unlock the log file */
    RtlReleaseResource(&pLogFile->Lock);
 
    DPRINT("Oldest: %lu  Current: %lu\n",
           OldestRecordNumber, CurrentRecordNumber);
 
    if (OldestRecordNumber == 0)
    {
        /* OldestRecordNumber == 0 when the log is empty */
        *NumberOfRecords = 0;
    }
    else
    {
        /* The log contains events */
        *NumberOfRecords = CurrentRecordNumber - OldestRecordNumber;
    }
 
    return STATUS_SUCCESS;
}

Referenced by ElfNumberOfRecords().

ElfrOldestRecord()

NTSTATUS WINAPI ElfrOldestRecord	(	IELF_HANDLE	LogHandle,
		PULONG	OldestRecordNumber
	)

Definition at line 402 of file rpc.c.

{
    PLOGHANDLE pLogHandle;
    PLOGFILE pLogFile;
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    if (!OldestRecordNumber)
        return STATUS_INVALID_PARAMETER;
 
    pLogFile = pLogHandle->LogFile;
 
    /* Lock the log file shared */
    RtlAcquireResourceShared(&pLogFile->Lock, TRUE);
 
    *OldestRecordNumber = ElfGetOldestRecord(&pLogFile->LogFile);
 
    /* Unlock the log file */
    RtlReleaseResource(&pLogFile->Lock);
 
    return STATUS_SUCCESS;
}

Referenced by ElfOldestRecord().

ElfrOpenBELA()

NTSTATUS WINAPI ElfrOpenBELA	(	EVENTLOG_HANDLE_A	UNCServerName,
		PRPC_STRING	BackupFileName,
		ULONG	MajorVersion,
		ULONG	MinorVersion,
		PIELF_HANDLE	LogHandle
	)

Definition at line 897 of file rpc.c.

{
    NTSTATUS Status;
    UNICODE_STRING BackupFileNameW;
 
    DPRINT("ElfrOpenBELA(%Z)\n", BackupFileName);
 
    Status = RtlAnsiStringToUnicodeString(&BackupFileNameW,
                                          (PANSI_STRING)BackupFileName,
                                          TRUE);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("RtlAnsiStringToUnicodeString failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    if ((MajorVersion != 1) || (MinorVersion != 1))
    {
        RtlFreeUnicodeString(&BackupFileNameW);
        return STATUS_INVALID_PARAMETER;
    }
 
    /* FIXME: UNCServerName must specify the server */
 
    /* FIXME: Must verify that caller has read access */
 
    Status = ElfCreateBackupLogHandle((PLOGHANDLE*)LogHandle,
                                      &BackupFileNameW);
 
    RtlFreeUnicodeString(&BackupFileNameW);
 
    return Status;
}

Referenced by ElfOpenBackupEventLogA().

ElfrOpenBELW()

NTSTATUS WINAPI ElfrOpenBELW	(	EVENTLOG_HANDLE_W	UNCServerName,
		PRPC_UNICODE_STRING	BackupFileName,
		ULONG	MajorVersion,
		ULONG	MinorVersion,
		PIELF_HANDLE	LogHandle
	)

Definition at line 506 of file rpc.c.

{
    DPRINT("ElfrOpenBELW(%wZ)\n", BackupFileName);
 
    if ((MajorVersion != 1) || (MinorVersion != 1))
        return STATUS_INVALID_PARAMETER;
 
    /* FIXME: UNCServerName must specify the server */
 
    /* FIXME: Must verify that caller has read access */
 
    return ElfCreateBackupLogHandle((PLOGHANDLE*)LogHandle,
                                    (PUNICODE_STRING)BackupFileName);
}

Referenced by ElfOpenBackupEventLogW().

ElfrOpenELA()

NTSTATUS WINAPI ElfrOpenELA	(	EVENTLOG_HANDLE_A	UNCServerName,
		PRPC_STRING	ModuleName,
		PRPC_STRING	RegModuleName,
		ULONG	MajorVersion,
		ULONG	MinorVersion,
		PIELF_HANDLE	LogHandle
	)

Definition at line 812 of file rpc.c.

{
    NTSTATUS Status;
    UNICODE_STRING ModuleNameW;
 
    if ((MajorVersion != 1) || (MinorVersion != 1))
        return STATUS_INVALID_PARAMETER;
 
    /* RegModuleName must be an empty string */
    if (RegModuleName->Length > 0)
        return STATUS_INVALID_PARAMETER;
 
    Status = RtlAnsiStringToUnicodeString(&ModuleNameW, (PANSI_STRING)ModuleName, TRUE);
    if (!NT_SUCCESS(Status))
        return Status;
 
    /* FIXME: Must verify that caller has read access */
 
    Status = ElfCreateEventLogHandle((PLOGHANDLE*)LogHandle,
                                     &ModuleNameW,
                                     FALSE);
 
    RtlFreeUnicodeString(&ModuleNameW);
 
    return Status;
}

Referenced by ElfOpenEventLogA().

ElfrOpenELW()

NTSTATUS WINAPI ElfrOpenELW	(	EVENTLOG_HANDLE_W	UNCServerName,
		PRPC_UNICODE_STRING	ModuleName,
		PRPC_UNICODE_STRING	RegModuleName,
		ULONG	MajorVersion,
		ULONG	MinorVersion,
		PIELF_HANDLE	LogHandle
	)

Definition at line 446 of file rpc.c.

{
    if ((MajorVersion != 1) || (MinorVersion != 1))
        return STATUS_INVALID_PARAMETER;
 
    /* RegModuleName must be an empty string */
    if (RegModuleName->Length > 0)
        return STATUS_INVALID_PARAMETER;
 
    /* FIXME: UNCServerName must specify the server */
 
    /* FIXME: Must verify that caller has read access */
 
    return ElfCreateEventLogHandle((PLOGHANDLE*)LogHandle,
                                   (PUNICODE_STRING)ModuleName,
                                   FALSE);
}

Referenced by ElfOpenEventLogW().

ElfrReadELA()

NTSTATUS WINAPI ElfrReadELA	(	IELF_HANDLE	LogHandle,
		ULONG	ReadFlags,
		ULONG	RecordOffset,
		RULONG	NumberOfBytesToRead,
		PBYTE	Buffer,
		PULONG	NumberOfBytesRead,
		PULONG	MinNumberOfBytesNeeded
	)

Definition at line 940 of file rpc.c.

{
    NTSTATUS Status;
    PLOGHANDLE pLogHandle;
    ULONG RecordNumber;
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    if (!Buffer)
        return STATUS_INVALID_PARAMETER;
 
    /* If sequential read, retrieve the CurrentRecord from this log handle */
    if (ReadFlags & EVENTLOG_SEQUENTIAL_READ)
    {
        RecordNumber = pLogHandle->CurrentRecord;
    }
    else // (ReadFlags & EVENTLOG_SEEK_READ)
    {
        RecordNumber = RecordOffset;
    }
 
    Status = LogfReadEvents(pLogHandle->LogFile,
                            ReadFlags,
                            &RecordNumber,
                            NumberOfBytesToRead,
                            Buffer,
                            NumberOfBytesRead,
                            MinNumberOfBytesNeeded,
                            TRUE);
 
    /* Update the handle's CurrentRecord if success */
    if (NT_SUCCESS(Status))
    {
        pLogHandle->CurrentRecord = RecordNumber;
    }
 
    return Status;
}

Referenced by ElfReadEventLogA().

ElfrReadELW()

NTSTATUS WINAPI ElfrReadELW	(	IELF_HANDLE	LogHandle,
		ULONG	ReadFlags,
		ULONG	RecordOffset,
		RULONG	NumberOfBytesToRead,
		PBYTE	Buffer,
		PULONG	NumberOfBytesRead,
		PULONG	MinNumberOfBytesNeeded
	)

Definition at line 530 of file rpc.c.

{
    NTSTATUS Status;
    PLOGHANDLE pLogHandle;
    ULONG RecordNumber;
 
    pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
    if (!pLogHandle)
        return STATUS_INVALID_HANDLE;
 
    if (!Buffer)
        return STATUS_INVALID_PARAMETER;
 
    /* If sequential read, retrieve the CurrentRecord from this log handle */
    if (ReadFlags & EVENTLOG_SEQUENTIAL_READ)
    {
        RecordNumber = pLogHandle->CurrentRecord;
    }
    else // (ReadFlags & EVENTLOG_SEEK_READ)
    {
        RecordNumber = RecordOffset;
    }
 
    Status = LogfReadEvents(pLogHandle->LogFile,
                            ReadFlags,
                            &RecordNumber,
                            NumberOfBytesToRead,
                            Buffer,
                            NumberOfBytesRead,
                            MinNumberOfBytesNeeded,
                            FALSE);
 
    /* Update the handle's CurrentRecord if success */
    if (NT_SUCCESS(Status))
    {
        pLogHandle->CurrentRecord = RecordNumber;
    }
 
    return Status;
}

Referenced by ElfReadEventLogW().

ElfrRegisterClusterSvc()

NTSTATUS WINAPI ElfrRegisterClusterSvc

(

handle_t

BindingHandle

)

Definition at line 1111 of file rpc.c.

{
    UNIMPLEMENTED;
    return STATUS_NOT_IMPLEMENTED;
}

ElfrRegisterEventSourceA()

NTSTATUS WINAPI ElfrRegisterEventSourceA	(	EVENTLOG_HANDLE_A	UNCServerName,
		PRPC_STRING	ModuleName,
		PRPC_STRING	RegModuleName,
		ULONG	MajorVersion,
		ULONG	MinorVersion,
		PIELF_HANDLE	LogHandle
	)

Definition at line 849 of file rpc.c.

{
    NTSTATUS Status;
    UNICODE_STRING ModuleNameW;
 
    Status = RtlAnsiStringToUnicodeString(&ModuleNameW,
                                          (PANSI_STRING)ModuleName,
                                          TRUE);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("RtlAnsiStringToUnicodeString failed (Status 0x%08lx)\n", Status);
        return Status;
    }
 
    /* RegModuleName must be an empty string */
    if (RegModuleName->Length > 0)
    {
        RtlFreeUnicodeString(&ModuleNameW);
        return STATUS_INVALID_PARAMETER;
    }
 
    if ((MajorVersion != 1) || (MinorVersion != 1))
    {
        RtlFreeUnicodeString(&ModuleNameW);
        return STATUS_INVALID_PARAMETER;
    }
 
    /* FIXME: Must verify that caller has write access */
 
    Status = ElfCreateEventLogHandle((PLOGHANDLE*)LogHandle,
                                     &ModuleNameW,
                                     TRUE);
 
    RtlFreeUnicodeString(&ModuleNameW);
 
    return Status;
}

Referenced by ElfRegisterEventSourceA().

ElfrRegisterEventSourceW()

NTSTATUS WINAPI ElfrRegisterEventSourceW	(	EVENTLOG_HANDLE_W	UNCServerName,
		PRPC_UNICODE_STRING	ModuleName,
		PRPC_UNICODE_STRING	RegModuleName,
		ULONG	MajorVersion,
		ULONG	MinorVersion,
		PIELF_HANDLE	LogHandle
	)

Definition at line 474 of file rpc.c.

{
    DPRINT("ElfrRegisterEventSourceW()\n");
 
    if ((MajorVersion != 1) || (MinorVersion != 1))
        return STATUS_INVALID_PARAMETER;
 
    /* RegModuleName must be an empty string */
    if (RegModuleName->Length > 0)
        return STATUS_INVALID_PARAMETER;
 
    DPRINT("ModuleName: %wZ\n", ModuleName);
 
    /* FIXME: UNCServerName must specify the server or empty for local */
 
    /* FIXME: Must verify that caller has write access */
 
    return ElfCreateEventLogHandle((PLOGHANDLE*)LogHandle,
                                   (PUNICODE_STRING)ModuleName,
                                   TRUE);
}

Referenced by ElfRegisterEventSourceW().

ElfrReportEventA()

NTSTATUS WINAPI ElfrReportEventA	(	IELF_HANDLE	LogHandle,
		ULONG	Time,
		USHORT	EventType,
		USHORT	EventCategory,
		ULONG	EventID,
		USHORT	NumStrings,
		ULONG	DataSize,
		PRPC_STRING	ComputerName,
		PRPC_SID	UserSID,
		PRPC_STRING	Strings[],
		PBYTE	Data,
		USHORT	Flags,
		PULONG	RecordNumber,
		PULONG	TimeWritten
	)

Definition at line 992 of file rpc.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
    UNICODE_STRING ComputerNameW;
    PUNICODE_STRING *StringsArrayW = NULL;
    USHORT i;
 
    DPRINT("ElfrReportEventA(%hu)\n", NumStrings);
 
#if 0
    for (i = 0; i < NumStrings; i++)
    {
        if (Strings[i] == NULL)
        {
            DPRINT1("String %hu is null\n", i);
        }
        else
        {
            DPRINT1("String %hu: %Z\n", i, Strings[i]);
        }
    }
#endif
 
    Status = RtlAnsiStringToUnicodeString((PUNICODE_STRING)&ComputerNameW,
                                          (PANSI_STRING)ComputerName,
                                          TRUE);
    if (!NT_SUCCESS(Status))
        return Status;
 
    if (NumStrings != 0)
    {
        StringsArrayW = HeapAlloc(GetProcessHeap(),
                                  HEAP_ZERO_MEMORY,
                                  NumStrings * sizeof(PUNICODE_STRING));
        if (StringsArrayW == NULL)
        {
            Status = STATUS_NO_MEMORY;
            goto Done;
        }
 
        for (i = 0; i < NumStrings; i++)
        {
            if (Strings[i] != NULL)
            {
                StringsArrayW[i] = HeapAlloc(GetProcessHeap(),
                                             HEAP_ZERO_MEMORY,
                                             sizeof(UNICODE_STRING));
                if (StringsArrayW[i] == NULL)
                {
                    Status = STATUS_NO_MEMORY;
                    break;
                }
 
                Status = RtlAnsiStringToUnicodeString(StringsArrayW[i],
                                                      (PANSI_STRING)Strings[i],
                                                      TRUE);
            }
 
            if (!NT_SUCCESS(Status))
                break;
        }
    }
 
    if (NT_SUCCESS(Status))
    {
        Status = ElfrReportEventW(LogHandle,
                                  Time,
                                  EventType,
                                  EventCategory,
                                  EventID,
                                  NumStrings,
                                  DataSize,
                                  (PRPC_UNICODE_STRING)&ComputerNameW,
                                  UserSID,
                                  (PRPC_UNICODE_STRING*)StringsArrayW,
                                  Data,
                                  Flags,
                                  RecordNumber,
                                  TimeWritten);
    }
 
Done:
    if (StringsArrayW != NULL)
    {
        for (i = 0; i < NumStrings; i++)
        {
            if ((StringsArrayW[i] != NULL) && (StringsArrayW[i]->Buffer))
            {
                RtlFreeUnicodeString(StringsArrayW[i]);
                HeapFree(GetProcessHeap(), 0, StringsArrayW[i]);
            }
        }
 
        HeapFree(GetProcessHeap(), 0, StringsArrayW);
    }
 
    RtlFreeUnicodeString(&ComputerNameW);
 
    return Status;
}

Referenced by ElfReportEventA().

ElfrReportEventAndSourceW()

NTSTATUS WINAPI ElfrReportEventAndSourceW	(	IELF_HANDLE	LogHandle,
		ULONG	Time,
		USHORT	EventType,
		USHORT	EventCategory,
		ULONG	EventID,
		PRPC_UNICODE_STRING	SourceName,
		USHORT	NumStrings,
		ULONG	DataSize,
		PRPC_UNICODE_STRING	ComputerName,
		PRPC_SID	UserSID,
		PRPC_UNICODE_STRING	Strings[],
		PBYTE	Data,
		USHORT	Flags,
		PULONG	RecordNumber,
		PULONG	TimeWritten
	)

Definition at line 1224 of file rpc.c.

{
    /* Call the helper function. The event source is specified by the caller. */
    return ElfrIntReportEventW(LogHandle,
                               Time,
                               EventType,
                               EventCategory,
                               EventID,
                               SourceName,
                               NumStrings,
                               DataSize,
                               ComputerName,
                               UserSID,
                               Strings,
                               Data,
                               Flags,
                               RecordNumber,
                               TimeWritten);
}

Referenced by ElfReportEventAndSourceW().

ElfrReportEventW()

NTSTATUS WINAPI ElfrReportEventW	(	IELF_HANDLE	LogHandle,
		ULONG	Time,
		USHORT	EventType,
		USHORT	EventCategory,
		ULONG	EventID,
		USHORT	NumStrings,
		ULONG	DataSize,
		PRPC_UNICODE_STRING	ComputerName,
		PRPC_SID	UserSID,
		PRPC_UNICODE_STRING	Strings[],
		PBYTE	Data,
		USHORT	Flags,
		PULONG	RecordNumber,
		PULONG	TimeWritten
	)

Definition at line 724 of file rpc.c.

{
    /* Call the helper function. The event source is provided via the log handle. */
    return ElfrIntReportEventW(LogHandle,
                               Time,
                               EventType,
                               EventCategory,
                               EventID,
                               NULL,
                               NumStrings,
                               DataSize,
                               ComputerName,
                               UserSID,
                               Strings,
                               Data,
                               Flags,
                               RecordNumber,
                               TimeWritten);
}

Referenced by ElfReportEventW(), and ElfrReportEventA().

ElfrWriteClusterEvents()

NTSTATUS WINAPI ElfrWriteClusterEvents

(

handle_t

BindingHandle

)

Definition at line 1133 of file rpc.c.

{
    UNIMPLEMENTED;
    return STATUS_NOT_IMPLEMENTED;
}

IELF_HANDLE_rundown()

void __RPC_USER IELF_HANDLE_rundown

(

IELF_HANDLE

LogHandle

)

Definition at line 1272 of file rpc.c.

{
    /* Close the handle */
    ElfDeleteEventLogHandle(&LogHandle); // ElfrCloseEL(&LogHandle);
}

midl_user_allocate()

void __RPC_FAR *__RPC_USER midl_user_allocate

(

SIZE_T

len

)

Definition at line 1260 of file rpc.c.

{
    return HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, len);
}

midl_user_free()

void __RPC_USER midl_user_free

(

void __RPC_FAR *

ptr

)

Definition at line 1266 of file rpc.c.

{
    HeapFree(GetProcessHeap(), 0, ptr);
}

RpcThreadRoutine()

DWORD WINAPI RpcThreadRoutine

(

LPVOID

lpParameter

)

Definition at line 26 of file rpc.c.

{
    RPC_STATUS Status;
 
    InitializeCriticalSection(&LogHandleListCs);
    InitializeListHead(&LogHandleListHead);
 
    Status = RpcServerUseProtseqEpW(L"ncacn_np", 20, L"\\pipe\\EventLog", NULL);
    if (Status != RPC_S_OK)
    {
        DPRINT("RpcServerUseProtseqEpW() failed (Status %lx)\n", Status);
        goto Quit;
    }
 
    Status = RpcServerRegisterIf(eventlog_v0_0_s_ifspec, NULL, NULL);
    if (Status != RPC_S_OK)
    {
        DPRINT("RpcServerRegisterIf() failed (Status %lx)\n", Status);
        goto Quit;
    }
 
    Status = RpcServerListen(1, RPC_C_LISTEN_MAX_CALLS_DEFAULT, FALSE);
    if (Status != RPC_S_OK)
    {
        DPRINT("RpcServerListen() failed (Status %lx)\n", Status);
    }
 
    EnterCriticalSection(&LogHandleListCs);
    while (!IsListEmpty(&LogHandleListHead))
    {
        IELF_HANDLE LogHandle = (IELF_HANDLE)CONTAINING_RECORD(LogHandleListHead.Flink, LOGHANDLE, LogHandleListEntry);
        ElfDeleteEventLogHandle(&LogHandle);
    }
    LeaveCriticalSection(&LogHandleListCs);
 
Quit:
    DeleteCriticalSection(&LogHandleListCs);
 
    return 0;
}

Variable Documentation

LogHandleListCs

CRITICAL_SECTION LogHandleListCs

static

Definition at line 19 of file rpc.c.

Referenced by ElfCreateBackupLogHandle(), ElfCreateEventLogHandle(), ElfDeleteEventLogHandle(), ElfGetLogHandleEntryByHandle(), and RpcThreadRoutine().

LogHandleListHead

LIST_ENTRY LogHandleListHead

static

Definition at line 18 of file rpc.c.

Referenced by ElfCreateBackupLogHandle(), ElfCreateEventLogHandle(), ElfGetLogHandleEntryByHandle(), and RpcThreadRoutine().