base/services/eventlog/rpc.c

   1 /*
   2  * PROJECT:         ReactOS EventLog Service
   3  * LICENSE:         GPL - See COPYING in the top level directory
   4  * FILE:            base/services/eventlog/rpc.c
   5  * PURPOSE:         RPC Port Interface support
   6  * COPYRIGHT:       Copyright 2005 Saveliy Tretiakov
   7  *                  Copyright 2008 Michael Martin
   8  *                  Copyright 2010-2011 Eric Kohl
   9  */
  10
  11 /* INCLUDES *****************************************************************/
  12
  13 #include "eventlog.h"
  14
  15 #define NDEBUG
  16 #include <debug.h>
  17
  18 static LIST_ENTRY LogHandleListHead;
  19 static CRITICAL_SECTION LogHandleListCs;
  20
  21 /* FUNCTIONS ****************************************************************/
  22
  23 static NTSTATUS
  24 ElfDeleteEventLogHandle(PIELF_HANDLE LogHandle);
  25
  26 DWORD WINAPI RpcThreadRoutine(LPVOID lpParameter)
  27 {
  28     RPC_STATUS Status;
  29
  30     InitializeCriticalSection(&LogHandleListCs);
  31     InitializeListHead(&LogHandleListHead);
  32
  33     Status = RpcServerUseProtseqEpW(L"ncacn_np", 20, L"\\pipe\\EventLog", NULL);
  34     if (Status != RPC_S_OK)
  35     {
  36         DPRINT("RpcServerUseProtseqEpW() failed (Status %lx)\n", Status);
  37         goto Quit;
  38     }
  39
  40     Status = RpcServerRegisterIf(eventlog_v0_0_s_ifspec, NULL, NULL);
  41     if (Status != RPC_S_OK)
  42     {
  43         DPRINT("RpcServerRegisterIf() failed (Status %lx)\n", Status);
  44         goto Quit;
  45     }
  46
  47     Status = RpcServerListen(1, RPC_C_LISTEN_MAX_CALLS_DEFAULT, FALSE);
  48     if (Status != RPC_S_OK)
  49     {
  50         DPRINT("RpcServerListen() failed (Status %lx)\n", Status);
  51     }
  52
  53     EnterCriticalSection(&LogHandleListCs);
  54     while (!IsListEmpty(&LogHandleListHead))
  55     {
  56         IELF_HANDLE LogHandle = (IELF_HANDLE)CONTAINING_RECORD(LogHandleListHead.Flink, LOGHANDLE, LogHandleListEntry);
  57         ElfDeleteEventLogHandle(&LogHandle);
  58     }
  59     LeaveCriticalSection(&LogHandleListCs);
  60
  61 Quit:
  62     DeleteCriticalSection(&LogHandleListCs);
  63
  64     return 0;
  65 }
  66
  67
  68 static NTSTATUS
  69 ElfCreateEventLogHandle(PLOGHANDLE* LogHandle,
  70                         PUNICODE_STRING LogName,
  71                         BOOLEAN Create)
  72 {
  73     NTSTATUS Status = STATUS_SUCCESS;
  74     PLOGHANDLE pLogHandle;
  75     PLOGFILE currentLogFile = NULL;
  76     DWORD i, LogsActive;
  77     PEVENTSOURCE pEventSource;
  78
  79     DPRINT("ElfCreateEventLogHandle(%wZ)\n", LogName);
  80
  81     *LogHandle = NULL;
  82
  83     i = (LogName->Length + sizeof(UNICODE_NULL)) / sizeof(WCHAR);
  84     pLogHandle = HeapAlloc(GetProcessHeap(),
  85                            HEAP_ZERO_MEMORY,
  86                            FIELD_OFFSET(LOGHANDLE, szName[i]));
  87     if (!pLogHandle)
  88     {
  89         DPRINT1("Failed to allocate Heap!\n");
  90         return STATUS_NO_MEMORY;
  91     }
  92
  93     StringCchCopyW(pLogHandle->szName, i, LogName->Buffer);
  94
  95     /* Get the number of Log Files the EventLog service found */
  96     // NOTE: We could just as well loop only once within the list of logs
  97     // and retrieve what the code below that calls LogfListItemByIndex, does!!
  98     LogsActive = LogfListItemCount();
  99     if (LogsActive == 0)
 100     {
 101         DPRINT1("EventLog service reports no log files!\n");
 102         Status = STATUS_UNSUCCESSFUL;
 103         goto Done;
 104     }
 105
 106     /* If Creating, default to the Application Log in case we fail, as documented on MSDN */
 107     if (Create)
 108     {
 109         pEventSource = GetEventSourceByName(LogName->Buffer);
 110         DPRINT("EventSource: %p\n", pEventSource);
 111         if (pEventSource)
 112         {
 113             DPRINT("EventSource LogFile: %p\n", pEventSource->LogFile);
 114             pLogHandle->LogFile = pEventSource->LogFile;
 115         }
 116         else
 117         {
 118             DPRINT("EventSource LogFile: Application log file\n");
 119             pLogHandle->LogFile = LogfListItemByName(L"Application");
 120         }
 121
 122         DPRINT("LogHandle LogFile: %p\n", pLogHandle->LogFile);
 123     }
 124     else
 125     {
 126         pLogHandle->LogFile = NULL;
 127
 128         for (i = 1; i <= LogsActive; i++)
 129         {
 130             currentLogFile = LogfListItemByIndex(i);
 131
 132             if (_wcsicmp(LogName->Buffer, currentLogFile->LogName) == 0)
 133             {
 134                 pLogHandle->LogFile = currentLogFile;
 135                 break;
 136             }
 137         }
 138
 139         /* Use the application log if the desired log does not exist */
 140         if (pLogHandle->LogFile == NULL)
 141         {
 142             pLogHandle->LogFile = LogfListItemByName(L"Application");
 143             if (pLogHandle->LogFile == NULL)
 144             {
 145                 DPRINT1("Application log is missing!\n");
 146                 Status = STATUS_UNSUCCESSFUL;
 147                 goto Done;
 148             }
 149         }
 150
 151         /* Reset the current record */
 152         pLogHandle->CurrentRecord = 0;
 153     }
 154
 155     if (!pLogHandle->LogFile)
 156         Status = STATUS_UNSUCCESSFUL;
 157
 158 Done:
 159     if (NT_SUCCESS(Status))
 160     {
 161         /* Append log handle */
 162         EnterCriticalSection(&LogHandleListCs);
 163         InsertTailList(&LogHandleListHead, &pLogHandle->LogHandleListEntry);
 164         LeaveCriticalSection(&LogHandleListCs);
 165         *LogHandle = pLogHandle;
 166     }
 167     else
 168     {
 169         HeapFree(GetProcessHeap(), 0, pLogHandle);
 170     }
 171
 172     return Status;
 173 }
 174
 175
 176 static NTSTATUS
 177 ElfCreateBackupLogHandle(PLOGHANDLE* LogHandle,
 178                          PUNICODE_STRING FileName)
 179 {
 180     NTSTATUS Status = STATUS_SUCCESS;
 181     PLOGHANDLE pLogHandle;
 182
 183     DPRINT("ElfCreateBackupLogHandle(%wZ)\n", FileName);
 184
 185     *LogHandle = NULL;
 186
 187     pLogHandle = HeapAlloc(GetProcessHeap(),
 188                            HEAP_ZERO_MEMORY,
 189                            sizeof(LOGHANDLE));
 190     if (pLogHandle == NULL)
 191     {
 192         DPRINT1("Failed to allocate Heap!\n");
 193         return STATUS_NO_MEMORY;
 194     }
 195
 196     /* Create the log file */
 197     Status = LogfCreate(&pLogHandle->LogFile,
 198                         NULL,
 199                         FileName,
 200                         0,
 201                         0,
 202                         FALSE,
 203                         TRUE);
 204     if (!NT_SUCCESS(Status))
 205     {
 206         DPRINT1("Failed to create the log file! (Status 0x%08lx)\n", Status);
 207         goto Done;
 208     }
 209
 210     /* Set the backup flag */
 211     pLogHandle->Flags |= LOG_HANDLE_BACKUP_FILE;
 212
 213     /* Reset the current record */
 214     pLogHandle->CurrentRecord = 0;
 215
 216 Done:
 217     if (NT_SUCCESS(Status))
 218     {
 219         /* Append log handle */
 220         EnterCriticalSection(&LogHandleListCs);
 221         InsertTailList(&LogHandleListHead, &pLogHandle->LogHandleListEntry);
 222         LeaveCriticalSection(&LogHandleListCs);
 223         *LogHandle = pLogHandle;
 224     }
 225     else
 226     {
 227         HeapFree(GetProcessHeap(), 0, pLogHandle);
 228     }
 229
 230     return Status;
 231 }
 232
 233
 234 static PLOGHANDLE
 235 ElfGetLogHandleEntryByHandle(IELF_HANDLE EventLogHandle)
 236 {
 237     PLIST_ENTRY CurrentEntry;
 238     PLOGHANDLE Handle, pLogHandle = NULL;
 239
 240     EnterCriticalSection(&LogHandleListCs);
 241
 242     CurrentEntry = LogHandleListHead.Flink;
 243     while (CurrentEntry != &LogHandleListHead)
 244     {
 245         Handle = CONTAINING_RECORD(CurrentEntry,
 246                                    LOGHANDLE,
 247                                    LogHandleListEntry);
 248         CurrentEntry = CurrentEntry->Flink;
 249
 250         if (Handle == EventLogHandle)
 251         {
 252             pLogHandle = Handle;
 253             break;
 254         }
 255     }
 256
 257     LeaveCriticalSection(&LogHandleListCs);
 258
 259     return pLogHandle;
 260 }
 261
 262
 263 static NTSTATUS
 264 ElfDeleteEventLogHandle(PIELF_HANDLE LogHandle)
 265 {
 266     PLOGHANDLE pLogHandle;
 267
 268     pLogHandle = ElfGetLogHandleEntryByHandle(*LogHandle);
 269     if (!pLogHandle)
 270         return STATUS_INVALID_HANDLE;
 271
 272     EnterCriticalSection(&LogHandleListCs);
 273     RemoveEntryList(&pLogHandle->LogHandleListEntry);
 274     LeaveCriticalSection(&LogHandleListCs);
 275
 276     LogfClose(pLogHandle->LogFile, FALSE);
 277
 278     HeapFree(GetProcessHeap(), 0, pLogHandle);
 279
 280     *LogHandle = NULL;
 281
 282     return STATUS_SUCCESS;
 283 }
 284
 285
 286 /* Function 0 */
 287 NTSTATUS
 288 WINAPI
 289 ElfrClearELFW(
 290     IELF_HANDLE LogHandle,
 291     PRPC_UNICODE_STRING BackupFileName)
 292 {
 293     PLOGHANDLE pLogHandle;
 294
 295     DPRINT("ElfrClearELFW()\n");
 296
 297     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
 298     if (!pLogHandle)
 299         return STATUS_INVALID_HANDLE;
 300
 301     /* Fail, if the log file is a backup file */
 302     if (pLogHandle->Flags & LOG_HANDLE_BACKUP_FILE)
 303         return STATUS_INVALID_HANDLE;
 304
 305     return LogfClearFile(pLogHandle->LogFile,
 306                          (PUNICODE_STRING)BackupFileName);
 307 }
 308
 309
 310 /* Function 1 */
 311 NTSTATUS
 312 WINAPI
 313 ElfrBackupELFW(
 314     IELF_HANDLE LogHandle,
 315     PRPC_UNICODE_STRING BackupFileName)
 316 {
 317     PLOGHANDLE pLogHandle;
 318
 319     DPRINT("ElfrBackupELFW()\n");
 320
 321     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
 322     if (!pLogHandle)
 323         return STATUS_INVALID_HANDLE;
 324
 325     return LogfBackupFile(pLogHandle->LogFile,
 326                           (PUNICODE_STRING)BackupFileName);
 327 }
 328
 329
 330 /* Function 2 */
 331 NTSTATUS
 332 WINAPI
 333 ElfrCloseEL(
 334     PIELF_HANDLE LogHandle)
 335 {
 336     return ElfDeleteEventLogHandle(LogHandle);
 337 }
 338
 339
 340 /* Function 3 */
 341 NTSTATUS
 342 WINAPI
 343 ElfrDeregisterEventSource(
 344     PIELF_HANDLE LogHandle)
 345 {
 346     return ElfDeleteEventLogHandle(LogHandle);
 347 }
 348
 349
 350 /* Function 4 */
 351 NTSTATUS
 352 WINAPI
 353 ElfrNumberOfRecords(
 354     IELF_HANDLE LogHandle,
 355     PULONG NumberOfRecords)
 356 {
 357     PLOGHANDLE pLogHandle;
 358     PLOGFILE pLogFile;
 359     ULONG OldestRecordNumber, CurrentRecordNumber;
 360
 361     DPRINT("ElfrNumberOfRecords()\n");
 362
 363     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
 364     if (!pLogHandle)
 365         return STATUS_INVALID_HANDLE;
 366
 367     if (!NumberOfRecords)
 368         return STATUS_INVALID_PARAMETER;
 369
 370     pLogFile = pLogHandle->LogFile;
 371
 372     /* Lock the log file shared */
 373     RtlAcquireResourceShared(&pLogFile->Lock, TRUE);
 374
 375     OldestRecordNumber  = ElfGetOldestRecord(&pLogFile->LogFile);
 376     CurrentRecordNumber = ElfGetCurrentRecord(&pLogFile->LogFile);
 377
 378     /* Unlock the log file */
 379     RtlReleaseResource(&pLogFile->Lock);
 380
 381     DPRINT("Oldest: %lu  Current: %lu\n",
 382            OldestRecordNumber, CurrentRecordNumber);
 383
 384     if (OldestRecordNumber == 0)
 385     {
 386         /* OldestRecordNumber == 0 when the log is empty */
 387         *NumberOfRecords = 0;
 388     }
 389     else
 390     {
 391         /* The log contains events */
 392         *NumberOfRecords = CurrentRecordNumber - OldestRecordNumber;
 393     }
 394
 395     return STATUS_SUCCESS;
 396 }
 397
 398
 399 /* Function 5 */
 400 NTSTATUS
 401 WINAPI
 402 ElfrOldestRecord(
 403     IELF_HANDLE LogHandle,
 404     PULONG OldestRecordNumber)
 405 {
 406     PLOGHANDLE pLogHandle;
 407     PLOGFILE pLogFile;
 408
 409     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
 410     if (!pLogHandle)
 411         return STATUS_INVALID_HANDLE;
 412
 413     if (!OldestRecordNumber)
 414         return STATUS_INVALID_PARAMETER;
 415
 416     pLogFile = pLogHandle->LogFile;
 417
 418     /* Lock the log file shared */
 419     RtlAcquireResourceShared(&pLogFile->Lock, TRUE);
 420
 421     *OldestRecordNumber = ElfGetOldestRecord(&pLogFile->LogFile);
 422
 423     /* Unlock the log file */
 424     RtlReleaseResource(&pLogFile->Lock);
 425
 426     return STATUS_SUCCESS;
 427 }
 428
 429
 430 /* Function 6 */
 431 NTSTATUS
 432 WINAPI
 433 ElfrChangeNotify(
 434     IELF_HANDLE LogHandle,
 435     RPC_CLIENT_ID ClientId,
 436     ULONG Event)
 437 {
 438     UNIMPLEMENTED;
 439     return STATUS_NOT_IMPLEMENTED;
 440 }
 441
 442
 443 /* Function 7 */
 444 NTSTATUS
 445 WINAPI
 446 ElfrOpenELW(
 447     EVENTLOG_HANDLE_W UNCServerName,
 448     PRPC_UNICODE_STRING ModuleName,
 449     PRPC_UNICODE_STRING RegModuleName,
 450     ULONG MajorVersion,
 451     ULONG MinorVersion,
 452     PIELF_HANDLE LogHandle)
 453 {
 454     if ((MajorVersion != 1) || (MinorVersion != 1))
 455         return STATUS_INVALID_PARAMETER;
 456
 457     /* RegModuleName must be an empty string */
 458     if (RegModuleName->Length > 0)
 459         return STATUS_INVALID_PARAMETER;
 460
 461     /* FIXME: UNCServerName must specify the server */
 462
 463     /* FIXME: Must verify that caller has read access */
 464
 465     return ElfCreateEventLogHandle((PLOGHANDLE*)LogHandle,
 466                                    (PUNICODE_STRING)ModuleName,
 467                                    FALSE);
 468 }
 469
 470
 471 /* Function 8 */
 472 NTSTATUS
 473 WINAPI
 474 ElfrRegisterEventSourceW(
 475     EVENTLOG_HANDLE_W UNCServerName,
 476     PRPC_UNICODE_STRING ModuleName,
 477     PRPC_UNICODE_STRING RegModuleName,
 478     ULONG MajorVersion,
 479     ULONG MinorVersion,
 480     PIELF_HANDLE LogHandle)
 481 {
 482     DPRINT("ElfrRegisterEventSourceW()\n");
 483
 484     if ((MajorVersion != 1) || (MinorVersion != 1))
 485         return STATUS_INVALID_PARAMETER;
 486
 487     /* RegModuleName must be an empty string */
 488     if (RegModuleName->Length > 0)
 489         return STATUS_INVALID_PARAMETER;
 490
 491     DPRINT("ModuleName: %wZ\n", ModuleName);
 492
 493     /* FIXME: UNCServerName must specify the server or empty for local */
 494
 495     /* FIXME: Must verify that caller has write access */
 496
 497     return ElfCreateEventLogHandle((PLOGHANDLE*)LogHandle,
 498                                    (PUNICODE_STRING)ModuleName,
 499                                    TRUE);
 500 }
 501
 502
 503 /* Function 9 */
 504 NTSTATUS
 505 WINAPI
 506 ElfrOpenBELW(
 507     EVENTLOG_HANDLE_W UNCServerName,
 508     PRPC_UNICODE_STRING BackupFileName,
 509     ULONG MajorVersion,
 510     ULONG MinorVersion,
 511     PIELF_HANDLE LogHandle)
 512 {
 513     DPRINT("ElfrOpenBELW(%wZ)\n", BackupFileName);
 514
 515     if ((MajorVersion != 1) || (MinorVersion != 1))
 516         return STATUS_INVALID_PARAMETER;
 517
 518     /* FIXME: UNCServerName must specify the server */
 519
 520     /* FIXME: Must verify that caller has read access */
 521
 522     return ElfCreateBackupLogHandle((PLOGHANDLE*)LogHandle,
 523                                     (PUNICODE_STRING)BackupFileName);
 524 }
 525
 526
 527 /* Function 10 */
 528 NTSTATUS
 529 WINAPI
 530 ElfrReadELW(
 531     IELF_HANDLE LogHandle,
 532     ULONG ReadFlags,
 533     ULONG RecordOffset,
 534     RULONG NumberOfBytesToRead,
 535     PBYTE Buffer,
 536     PULONG NumberOfBytesRead,
 537     PULONG MinNumberOfBytesNeeded)
 538 {
 539     NTSTATUS Status;
 540     PLOGHANDLE pLogHandle;
 541     ULONG RecordNumber;
 542
 543     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
 544     if (!pLogHandle)
 545         return STATUS_INVALID_HANDLE;
 546
 547     if (!Buffer)
 548         return STATUS_INVALID_PARAMETER;
 549
 550     /* If sequential read, retrieve the CurrentRecord from this log handle */
 551     if (ReadFlags & EVENTLOG_SEQUENTIAL_READ)
 552     {
 553         RecordNumber = pLogHandle->CurrentRecord;
 554     }
 555     else // (ReadFlags & EVENTLOG_SEEK_READ)
 556     {
 557         RecordNumber = RecordOffset;
 558     }
 559
 560     Status = LogfReadEvents(pLogHandle->LogFile,
 561                             ReadFlags,
 562                             &RecordNumber,
 563                             NumberOfBytesToRead,
 564                             Buffer,
 565                             NumberOfBytesRead,
 566                             MinNumberOfBytesNeeded,
 567                             FALSE);
 568
 569     /* Update the handle's CurrentRecord if success */
 570     if (NT_SUCCESS(Status))
 571     {
 572         pLogHandle->CurrentRecord = RecordNumber;
 573     }
 574
 575     return Status;
 576 }
 577
 578
 579 /* Helper function for ElfrReportEventW/A and ElfrReportEventAndSourceW */
 580 NTSTATUS
 581 ElfrIntReportEventW(
 582     IELF_HANDLE LogHandle,
 583     ULONG Time,
 584     USHORT EventType,
 585     USHORT EventCategory,
 586     ULONG EventID,
 587     PRPC_UNICODE_STRING SourceName OPTIONAL,
 588     USHORT NumStrings,
 589     ULONG DataSize,
 590     PRPC_UNICODE_STRING ComputerName,
 591     PRPC_SID UserSID,
 592     PRPC_UNICODE_STRING Strings[],
 593     PBYTE Data,
 594     USHORT Flags,
 595     PULONG RecordNumber,
 596     PULONG TimeWritten)
 597 {
 598     NTSTATUS Status;
 599     PLOGHANDLE pLogHandle;
 600     UNICODE_STRING LocalSourceName, LocalComputerName;
 601     PEVENTLOGRECORD LogBuffer;
 602     USHORT i;
 603     SIZE_T RecSize;
 604     ULONG dwStringsSize = 0;
 605     ULONG dwUserSidLength = 0;
 606     PWSTR lpStrings, str;
 607
 608     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
 609     if (!pLogHandle)
 610         return STATUS_INVALID_HANDLE;
 611
 612     /* Flags must be 0 */
 613     if (Flags)
 614         return STATUS_INVALID_PARAMETER;
 615
 616     for (i = 0; i < NumStrings; i++)
 617     {
 618         switch (EventType)
 619         {
 620             case EVENTLOG_SUCCESS:
 621                 DPRINT("Success: %wZ\n", Strings[i]);
 622                 break;
 623
 624             case EVENTLOG_ERROR_TYPE:
 625                 DPRINT("Error: %wZ\n", Strings[i]);
 626                 break;
 627
 628             case EVENTLOG_WARNING_TYPE:
 629                 DPRINT("Warning: %wZ\n", Strings[i]);
 630                 break;
 631
 632             case EVENTLOG_INFORMATION_TYPE:
 633                 DPRINT("Info: %wZ\n", Strings[i]);
 634                 break;
 635
 636             case EVENTLOG_AUDIT_SUCCESS:
 637                 DPRINT("Audit Success: %wZ\n", Strings[i]);
 638                 break;
 639
 640             case EVENTLOG_AUDIT_FAILURE:
 641                 DPRINT("Audit Failure: %wZ\n", Strings[i]);
 642                 break;
 643
 644             default:
 645                 DPRINT1("Type %hu: %wZ\n", EventType, Strings[i]);
 646                 break;
 647         }
 648         dwStringsSize += Strings[i]->Length + sizeof(UNICODE_NULL);
 649     }
 650
 651     lpStrings = HeapAlloc(GetProcessHeap(), 0, dwStringsSize);
 652     if (!lpStrings)
 653     {
 654         DPRINT1("Failed to allocate heap\n");
 655         return STATUS_NO_MEMORY;
 656     }
 657
 658     str = lpStrings;
 659     for (i = 0; i < NumStrings; i++)
 660     {
 661         RtlCopyMemory(str, Strings[i]->Buffer, Strings[i]->Length);
 662         str += Strings[i]->Length / sizeof(WCHAR);
 663         *str = UNICODE_NULL;
 664         str++;
 665     }
 666
 667     if (UserSID)
 668         dwUserSidLength = FIELD_OFFSET(SID, SubAuthority[UserSID->SubAuthorityCount]);
 669
 670     if (SourceName && SourceName->Buffer)
 671         LocalSourceName = *(PUNICODE_STRING)SourceName;
 672     else
 673         RtlInitUnicodeString(&LocalSourceName, pLogHandle->szName);
 674
 675     LocalComputerName = *(PUNICODE_STRING)ComputerName;
 676
 677     LogBuffer = LogfAllocAndBuildNewRecord(&RecSize,
 678                                            Time,
 679                                            EventType,
 680                                            EventCategory,
 681                                            EventID,
 682                                            &LocalSourceName,
 683                                            &LocalComputerName,
 684                                            dwUserSidLength,
 685                                            UserSID,
 686                                            NumStrings,
 687                                            lpStrings,
 688                                            DataSize,
 689                                            Data);
 690     if (LogBuffer == NULL)
 691     {
 692         DPRINT1("LogfAllocAndBuildNewRecord failed!\n");
 693         HeapFree(GetProcessHeap(), 0, lpStrings);
 694         return STATUS_NO_MEMORY;
 695     }
 696
 697     Status = LogfWriteRecord(pLogHandle->LogFile, LogBuffer, RecSize);
 698     if (!NT_SUCCESS(Status))
 699     {
 700         DPRINT1("ERROR writing to event log `%S' (Status 0x%08lx)\n",
 701                 pLogHandle->LogFile->LogName, Status);
 702     }
 703
 704     if (NT_SUCCESS(Status))
 705     {
 706         /* Retrieve the two fields that were set by LogfWriteRecord into the record */
 707         if (RecordNumber)
 708             *RecordNumber = LogBuffer->RecordNumber;
 709         if (TimeWritten)
 710             *TimeWritten = LogBuffer->TimeWritten;
 711     }
 712
 713     LogfFreeRecord(LogBuffer);
 714
 715     HeapFree(GetProcessHeap(), 0, lpStrings);
 716
 717     return Status;
 718 }
 719
 720
 721 /* Function 11 */
 722 NTSTATUS
 723 WINAPI
 724 ElfrReportEventW(
 725     IELF_HANDLE LogHandle,
 726     ULONG Time,
 727     USHORT EventType,
 728     USHORT EventCategory,
 729     ULONG EventID,
 730     USHORT NumStrings,
 731     ULONG DataSize,
 732     PRPC_UNICODE_STRING ComputerName,
 733     PRPC_SID UserSID,
 734     PRPC_UNICODE_STRING Strings[],
 735     PBYTE Data,
 736     USHORT Flags,
 737     PULONG RecordNumber,
 738     PULONG TimeWritten)
 739 {
 740     /* Call the helper function. The event source is provided via the log handle. */
 741     return ElfrIntReportEventW(LogHandle,
 742                                Time,
 743                                EventType,
 744                                EventCategory,
 745                                EventID,
 746                                NULL,
 747                                NumStrings,
 748                                DataSize,
 749                                ComputerName,
 750                                UserSID,
 751                                Strings,
 752                                Data,
 753                                Flags,
 754                                RecordNumber,
 755                                TimeWritten);
 756 }
 757
 758
 759 /* Function 12 */
 760 NTSTATUS
 761 WINAPI
 762 ElfrClearELFA(
 763     IELF_HANDLE LogHandle,
 764     PRPC_STRING BackupFileName)
 765 {
 766     NTSTATUS Status;
 767     UNICODE_STRING BackupFileNameW;
 768
 769     Status = RtlAnsiStringToUnicodeString(&BackupFileNameW,
 770                                           (PANSI_STRING)BackupFileName,
 771                                           TRUE);
 772     if (!NT_SUCCESS(Status))
 773         return Status;
 774
 775     Status = ElfrClearELFW(LogHandle,
 776                            (PRPC_UNICODE_STRING)&BackupFileNameW);
 777
 778     RtlFreeUnicodeString(&BackupFileNameW);
 779
 780     return Status;
 781 }
 782
 783
 784 /* Function 13 */
 785 NTSTATUS
 786 WINAPI
 787 ElfrBackupELFA(
 788     IELF_HANDLE LogHandle,
 789     PRPC_STRING BackupFileName)
 790 {
 791     NTSTATUS Status;
 792     UNICODE_STRING BackupFileNameW;
 793
 794     Status = RtlAnsiStringToUnicodeString(&BackupFileNameW,
 795                                           (PANSI_STRING)BackupFileName,
 796                                           TRUE);
 797     if (!NT_SUCCESS(Status))
 798         return Status;
 799
 800     Status = ElfrBackupELFW(LogHandle,
 801                             (PRPC_UNICODE_STRING)&BackupFileNameW);
 802
 803     RtlFreeUnicodeString(&BackupFileNameW);
 804
 805     return Status;
 806 }
 807
 808
 809 /* Function 14 */
 810 NTSTATUS
 811 WINAPI
 812 ElfrOpenELA(
 813     EVENTLOG_HANDLE_A UNCServerName,
 814     PRPC_STRING ModuleName,
 815     PRPC_STRING RegModuleName,
 816     ULONG MajorVersion,
 817     ULONG MinorVersion,
 818     PIELF_HANDLE LogHandle)
 819 {
 820     NTSTATUS Status;
 821     UNICODE_STRING ModuleNameW;
 822
 823     if ((MajorVersion != 1) || (MinorVersion != 1))
 824         return STATUS_INVALID_PARAMETER;
 825
 826     /* RegModuleName must be an empty string */
 827     if (RegModuleName->Length > 0)
 828         return STATUS_INVALID_PARAMETER;
 829
 830     Status = RtlAnsiStringToUnicodeString(&ModuleNameW, (PANSI_STRING)ModuleName, TRUE);
 831     if (!NT_SUCCESS(Status))
 832         return Status;
 833
 834     /* FIXME: Must verify that caller has read access */
 835
 836     Status = ElfCreateEventLogHandle((PLOGHANDLE*)LogHandle,
 837                                      &ModuleNameW,
 838                                      FALSE);
 839
 840     RtlFreeUnicodeString(&ModuleNameW);
 841
 842     return Status;
 843 }
 844
 845
 846 /* Function 15 */
 847 NTSTATUS
 848 WINAPI
 849 ElfrRegisterEventSourceA(
 850     EVENTLOG_HANDLE_A UNCServerName,
 851     PRPC_STRING ModuleName,
 852     PRPC_STRING RegModuleName,
 853     ULONG MajorVersion,
 854     ULONG MinorVersion,
 855     PIELF_HANDLE LogHandle)
 856 {
 857     NTSTATUS Status;
 858     UNICODE_STRING ModuleNameW;
 859
 860     Status = RtlAnsiStringToUnicodeString(&ModuleNameW,
 861                                           (PANSI_STRING)ModuleName,
 862                                           TRUE);
 863     if (!NT_SUCCESS(Status))
 864     {
 865         DPRINT1("RtlAnsiStringToUnicodeString failed (Status 0x%08lx)\n", Status);
 866         return Status;
 867     }
 868
 869     /* RegModuleName must be an empty string */
 870     if (RegModuleName->Length > 0)
 871     {
 872         RtlFreeUnicodeString(&ModuleNameW);
 873         return STATUS_INVALID_PARAMETER;
 874     }
 875
 876     if ((MajorVersion != 1) || (MinorVersion != 1))
 877     {
 878         RtlFreeUnicodeString(&ModuleNameW);
 879         return STATUS_INVALID_PARAMETER;
 880     }
 881
 882     /* FIXME: Must verify that caller has write access */
 883
 884     Status = ElfCreateEventLogHandle((PLOGHANDLE*)LogHandle,
 885                                      &ModuleNameW,
 886                                      TRUE);
 887
 888     RtlFreeUnicodeString(&ModuleNameW);
 889
 890     return Status;
 891 }
 892
 893
 894 /* Function 16 */
 895 NTSTATUS
 896 WINAPI
 897 ElfrOpenBELA(
 898     EVENTLOG_HANDLE_A UNCServerName,
 899     PRPC_STRING BackupFileName,
 900     ULONG MajorVersion,
 901     ULONG MinorVersion,
 902     PIELF_HANDLE LogHandle)
 903 {
 904     NTSTATUS Status;
 905     UNICODE_STRING BackupFileNameW;
 906
 907     DPRINT("ElfrOpenBELA(%Z)\n", BackupFileName);
 908
 909     Status = RtlAnsiStringToUnicodeString(&BackupFileNameW,
 910                                           (PANSI_STRING)BackupFileName,
 911                                           TRUE);
 912     if (!NT_SUCCESS(Status))
 913     {
 914         DPRINT1("RtlAnsiStringToUnicodeString failed (Status 0x%08lx)\n", Status);
 915         return Status;
 916     }
 917
 918     if ((MajorVersion != 1) || (MinorVersion != 1))
 919     {
 920         RtlFreeUnicodeString(&BackupFileNameW);
 921         return STATUS_INVALID_PARAMETER;
 922     }
 923
 924     /* FIXME: UNCServerName must specify the server */
 925
 926     /* FIXME: Must verify that caller has read access */
 927
 928     Status = ElfCreateBackupLogHandle((PLOGHANDLE*)LogHandle,
 929                                       &BackupFileNameW);
 930
 931     RtlFreeUnicodeString(&BackupFileNameW);
 932
 933     return Status;
 934 }
 935
 936
 937 /* Function 17 */
 938 NTSTATUS
 939 WINAPI
 940 ElfrReadELA(
 941     IELF_HANDLE LogHandle,
 942     ULONG ReadFlags,
 943     ULONG RecordOffset,
 944     RULONG NumberOfBytesToRead,
 945     PBYTE Buffer,
 946     PULONG NumberOfBytesRead,
 947     PULONG MinNumberOfBytesNeeded)
 948 {
 949     NTSTATUS Status;
 950     PLOGHANDLE pLogHandle;
 951     ULONG RecordNumber;
 952
 953     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
 954     if (!pLogHandle)
 955         return STATUS_INVALID_HANDLE;
 956
 957     if (!Buffer)
 958         return STATUS_INVALID_PARAMETER;
 959
 960     /* If sequential read, retrieve the CurrentRecord from this log handle */
 961     if (ReadFlags & EVENTLOG_SEQUENTIAL_READ)
 962     {
 963         RecordNumber = pLogHandle->CurrentRecord;
 964     }
 965     else // (ReadFlags & EVENTLOG_SEEK_READ)
 966     {
 967         RecordNumber = RecordOffset;
 968     }
 969
 970     Status = LogfReadEvents(pLogHandle->LogFile,
 971                             ReadFlags,
 972                             &RecordNumber,
 973                             NumberOfBytesToRead,
 974                             Buffer,
 975                             NumberOfBytesRead,
 976                             MinNumberOfBytesNeeded,
 977                             TRUE);
 978
 979     /* Update the handle's CurrentRecord if success */
 980     if (NT_SUCCESS(Status))
 981     {
 982         pLogHandle->CurrentRecord = RecordNumber;
 983     }
 984
 985     return Status;
 986 }
 987
 988
 989 /* Function 18 */
 990 NTSTATUS
 991 WINAPI
 992 ElfrReportEventA(
 993     IELF_HANDLE LogHandle,
 994     ULONG Time,
 995     USHORT EventType,
 996     USHORT EventCategory,
 997     ULONG EventID,
 998     USHORT NumStrings,
 999     ULONG DataSize,
1000     PRPC_STRING ComputerName,
1001     PRPC_SID UserSID,
1002     PRPC_STRING Strings[],
1003     PBYTE Data,
1004     USHORT Flags,
1005     PULONG RecordNumber,
1006     PULONG TimeWritten)
1007 {
1008     NTSTATUS Status = STATUS_SUCCESS;
1009     UNICODE_STRING ComputerNameW;
1010     PUNICODE_STRING *StringsArrayW = NULL;
1011     USHORT i;
1012
1013     DPRINT("ElfrReportEventA(%hu)\n", NumStrings);
1014
1015 #if 0
1016     for (i = 0; i < NumStrings; i++)
1017     {
1018         if (Strings[i] == NULL)
1019         {
1020             DPRINT1("String %hu is null\n", i);
1021         }
1022         else
1023         {
1024             DPRINT1("String %hu: %Z\n", i, Strings[i]);
1025         }
1026     }
1027 #endif
1028
1029     Status = RtlAnsiStringToUnicodeString((PUNICODE_STRING)&ComputerNameW,
1030                                           (PANSI_STRING)ComputerName,
1031                                           TRUE);
1032     if (!NT_SUCCESS(Status))
1033         return Status;
1034
1035     if (NumStrings != 0)
1036     {
1037         StringsArrayW = HeapAlloc(GetProcessHeap(),
1038                                   HEAP_ZERO_MEMORY,
1039                                   NumStrings * sizeof(PUNICODE_STRING));
1040         if (StringsArrayW == NULL)
1041         {
1042             Status = STATUS_NO_MEMORY;
1043             goto Done;
1044         }
1045
1046         for (i = 0; i < NumStrings; i++)
1047         {
1048             if (Strings[i] != NULL)
1049             {
1050                 StringsArrayW[i] = HeapAlloc(GetProcessHeap(),
1051                                              HEAP_ZERO_MEMORY,
1052                                              sizeof(UNICODE_STRING));
1053                 if (StringsArrayW[i] == NULL)
1054                 {
1055                     Status = STATUS_NO_MEMORY;
1056                     break;
1057                 }
1058
1059                 Status = RtlAnsiStringToUnicodeString(StringsArrayW[i],
1060                                                       (PANSI_STRING)Strings[i],
1061                                                       TRUE);
1062             }
1063
1064             if (!NT_SUCCESS(Status))
1065                 break;
1066         }
1067     }
1068
1069     if (NT_SUCCESS(Status))
1070     {
1071         Status = ElfrReportEventW(LogHandle,
1072                                   Time,
1073                                   EventType,
1074                                   EventCategory,
1075                                   EventID,
1076                                   NumStrings,
1077                                   DataSize,
1078                                   (PRPC_UNICODE_STRING)&ComputerNameW,
1079                                   UserSID,
1080                                   (PRPC_UNICODE_STRING*)StringsArrayW,
1081                                   Data,
1082                                   Flags,
1083                                   RecordNumber,
1084                                   TimeWritten);
1085     }
1086
1087 Done:
1088     if (StringsArrayW != NULL)
1089     {
1090         for (i = 0; i < NumStrings; i++)
1091         {
1092             if ((StringsArrayW[i] != NULL) && (StringsArrayW[i]->Buffer))
1093             {
1094                 RtlFreeUnicodeString(StringsArrayW[i]);
1095                 HeapFree(GetProcessHeap(), 0, StringsArrayW[i]);
1096             }
1097         }
1098
1099         HeapFree(GetProcessHeap(), 0, StringsArrayW);
1100     }
1101
1102     RtlFreeUnicodeString(&ComputerNameW);
1103
1104     return Status;
1105 }
1106
1107
1108 /* Function 19 */
1109 NTSTATUS
1110 WINAPI
1111 ElfrRegisterClusterSvc(
1112     handle_t BindingHandle)
1113 {
1114     UNIMPLEMENTED;
1115     return STATUS_NOT_IMPLEMENTED;
1116 }
1117
1118
1119 /* Function 20 */
1120 NTSTATUS
1121 WINAPI
1122 ElfrDeregisterClusterSvc(
1123     handle_t BindingHandle)
1124 {
1125     UNIMPLEMENTED;
1126     return STATUS_NOT_IMPLEMENTED;
1127 }
1128
1129
1130 /* Function 21 */
1131 NTSTATUS
1132 WINAPI
1133 ElfrWriteClusterEvents(
1134     handle_t BindingHandle)
1135 {
1136     UNIMPLEMENTED;
1137     return STATUS_NOT_IMPLEMENTED;
1138 }
1139
1140
1141 /* Function 22 */
1142 NTSTATUS
1143 WINAPI
1144 ElfrGetLogInformation(
1145     IELF_HANDLE LogHandle,
1146     ULONG InfoLevel,
1147     PBYTE Buffer,
1148     ULONG cbBufSize,
1149     PULONG pcbBytesNeeded)
1150 {
1151     NTSTATUS Status = STATUS_SUCCESS;
1152     PLOGHANDLE pLogHandle;
1153     PLOGFILE pLogFile;
1154
1155     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
1156     if (!pLogHandle)
1157         return STATUS_INVALID_HANDLE;
1158
1159     pLogFile = pLogHandle->LogFile;
1160
1161     /* Lock the log file shared */
1162     RtlAcquireResourceShared(&pLogFile->Lock, TRUE);
1163
1164     switch (InfoLevel)
1165     {
1166         case EVENTLOG_FULL_INFO:
1167         {
1168             LPEVENTLOG_FULL_INFORMATION efi = (LPEVENTLOG_FULL_INFORMATION)Buffer;
1169
1170             *pcbBytesNeeded = sizeof(EVENTLOG_FULL_INFORMATION);
1171             if (cbBufSize < sizeof(EVENTLOG_FULL_INFORMATION))
1172             {
1173                 Status = STATUS_BUFFER_TOO_SMALL;
1174                 break;
1175             }
1176
1177             efi->dwFull = !!(ElfGetFlags(&pLogFile->LogFile) & ELF_LOGFILE_LOGFULL_WRITTEN);
1178             break;
1179         }
1180
1181         default:
1182             Status = STATUS_INVALID_LEVEL;
1183             break;
1184     }
1185
1186     /* Unlock the log file */
1187     RtlReleaseResource(&pLogFile->Lock);
1188
1189     return Status;
1190 }
1191
1192
1193 /* Function 23 */
1194 NTSTATUS
1195 WINAPI
1196 ElfrFlushEL(
1197     IELF_HANDLE LogHandle)
1198 {
1199     NTSTATUS Status;
1200     PLOGHANDLE pLogHandle;
1201     PLOGFILE pLogFile;
1202
1203     pLogHandle = ElfGetLogHandleEntryByHandle(LogHandle);
1204     if (!pLogHandle)
1205         return STATUS_INVALID_HANDLE;
1206
1207     pLogFile = pLogHandle->LogFile;
1208
1209     /* Lock the log file exclusive */
1210     RtlAcquireResourceExclusive(&pLogFile->Lock, TRUE);
1211
1212     Status = ElfFlushFile(&pLogFile->LogFile);
1213
1214     /* Unlock the log file */
1215     RtlReleaseResource(&pLogFile->Lock);
1216
1217     return Status;
1218 }
1219
1220
1221 /* Function 24 */
1222 NTSTATUS
1223 WINAPI
1224 ElfrReportEventAndSourceW(
1225     IELF_HANDLE LogHandle,
1226     ULONG Time,
1227     USHORT EventType,
1228     USHORT EventCategory,
1229     ULONG EventID,
1230     PRPC_UNICODE_STRING SourceName,
1231     USHORT NumStrings,
1232     ULONG DataSize,
1233     PRPC_UNICODE_STRING ComputerName,
1234     PRPC_SID UserSID,
1235     PRPC_UNICODE_STRING Strings[],
1236     PBYTE Data,
1237     USHORT Flags,
1238     PULONG RecordNumber,
1239     PULONG TimeWritten)
1240 {
1241     /* Call the helper function. The event source is specified by the caller. */
1242     return ElfrIntReportEventW(LogHandle,
1243                                Time,
1244                                EventType,
1245                                EventCategory,
1246                                EventID,
1247                                SourceName,
1248                                NumStrings,
1249                                DataSize,
1250                                ComputerName,
1251                                UserSID,
1252                                Strings,
1253                                Data,
1254                                Flags,
1255                                RecordNumber,
1256                                TimeWritten);
1257 }
1258
1259
1260 void __RPC_FAR *__RPC_USER midl_user_allocate(SIZE_T len)
1261 {
1262     return HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, len);
1263 }
1264
1265
1266 void __RPC_USER midl_user_free(void __RPC_FAR * ptr)
1267 {
1268     HeapFree(GetProcessHeap(), 0, ptr);
1269 }
1270
1271
1272 void __RPC_USER IELF_HANDLE_rundown(IELF_HANDLE LogHandle)
1273 {
1274     /* Close the handle */
1275     ElfDeleteEventLogHandle(&LogHandle); // ElfrCloseEL(&LogHandle);
1276 }