able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/base/eventlog/server/operate.c

4573 lines
151 KiB
C
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/*++
Copyright (c) 1990-1994 Microsoft Corporation
Module Name:
operate.c
Abstract:
This file contains all the routines to perform operations on the
log files. They are called by the thread that performs requests.
Author:
Rajen Shah (rajens) 16-Jul-1991
Revision History:
04-Apr-1995 MarkBl
Resets the file archive attribute on log write. The backup caller
clears it.
29-Aug-1994 Danl
We no longer grow log files in place. Therefore, the ExtendSize
function will allocate a block that is as large as the old size plus
the size of the new block that must be added. If this allocation
succeeds, then it will free up the old block. If a failure occurs,
we continue to use the old block as if we have already grown as much
as we can.
22-Jul-1994 Danl
ValidFilePos: Changed test for pEndRecordLen > PhysicalEOF
so that it uses >=. In the case where pEndRecordLen == PhysicalEOF,
we want to wrap to find the last DWORD at the beginning of the File
(after the header).
08-Jul-1994 Danl
PerformWriteRequest: Fixed overwrite logic so that in the case where
a log is set up for always-overwrite, that we never go down the branch
that indicates the log was full. Previously, it would go down that
branch if the current time was less than the log time (ie. someone
set the clock back).
18-Apr-2001 a-jyotig
IsPositionWithinRange function changed to take 2 additional parameters
EOF and Base Address (BOF) and check if the position is between EOF
and BOF
--*/
/****
@doc EXTERNAL INTERFACES EVTLOG
****/
//
// INCLUDES
//
#include <eventp.h>
#include <alertmsg.h> // ALERT_ELF manifests
#include "elfmsg.h"
#include <strsafe.h>
#define OVERWRITE_AS_NEEDED 0x00000000
#define NEVER_OVERWRITE 0xffffffff
//
// Prototypes
//
VOID PerformClearRequest(PELF_REQUEST_RECORD Request);
BOOL
IsPositionWithinRange(
PVOID Position,
PVOID BeginningRecord,
PVOID EndingRecord,
PVOID PhysEOF,
PVOID BaseAddress
);
VOID
ElfExtendFile (
PLOGFILE pLogFile,
ULONG SpaceNeeded,
PULONG SpaceAvail
)
/*++
Routine Description:
This routine takes an open log file and extends the file and underlying
section and view if possible. If it can't be grown, it caps the file
at this size by setting the ConfigMaxFileSize to the Actual. It also
updates the SpaceAvail parm which is used in PerformWriteRequest (the
caller).
Arguments:
pLogFile - pointer to a LOGFILE structure for the open logfile
ExtendAmount - How much bigger to make the file/section/view
SpaceAvail - Update this with how much space was added to the section
Return Value:
None - If we can't extend the file, we just cap it at this size for the
duration of this boot. We'll try again the next time the eventlog
is closed and reopened.
Note:
ExtendAmount should always be granular to 64K.
--*/
{
LARGE_INTEGER NewSize;
NTSTATUS Status;
PVOID BaseAddress;
SIZE_T Size;
IO_STATUS_BLOCK IoStatusBlock;
//
// Calculate how much to grow the file then extend the section by
// that amount. Do this in 64K chunks.
//
SpaceNeeded = ((SpaceNeeded - *SpaceAvail) & 0xFFFF0000) + 0x10000;
if (SpaceNeeded > (pLogFile->ConfigMaxFileSize - pLogFile->ActualMaxFileSize))
{
//
// We can't grow it by the full amount we need. Grow
// it to the max size and let file wrap take over.
// If there isn't any room to grow, then return;
//
SpaceNeeded = pLogFile->ConfigMaxFileSize - pLogFile->ActualMaxFileSize;
if (SpaceNeeded == 0)
{
return;
}
}
NewSize = RtlConvertUlongToLargeInteger(pLogFile->ActualMaxFileSize + SpaceNeeded);
//
// Update the file size information, extend the section, and map the
// new section
//
Status = NtSetInformationFile(pLogFile->FileHandle,
&IoStatusBlock,
&NewSize,
sizeof(NewSize),
FileEndOfFileInformation);
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"ElfExtendFile: NtSetInformationFile for %ws log failed %#x\n",
pLogFile->LogModuleName->Buffer,
Status);
goto ErrorExit;
}
Status = NtExtendSection(pLogFile->SectionHandle, &NewSize);
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"ElfExtendFile: NtExtendSection for %ws log failed %#x\n",
pLogFile->LogModuleName->Buffer,
Status);
goto ErrorExit;
}
//
// Now that the section is extended, we need to map the new section.
//
//
// Map a view of the entire section (with the extension).
// Allow the allocator to tell us where it is located, and
// what the size is.
//
BaseAddress = NULL;
Size = 0;
Status = NtMapViewOfSection(pLogFile->SectionHandle,
NtCurrentProcess(),
&BaseAddress,
0,
0,
NULL,
&Size,
ViewUnmap,
0,
PAGE_READWRITE);
if (!NT_SUCCESS(Status))
{
//
// If this fails, just exit, and we will continue with the
// view that we have.
//
ELF_LOG2(ERROR,
"ElfExtendFile: NtMapViewOfSection for %ws log failed %#x\n",
pLogFile->LogModuleName->Buffer,
Status);
goto ErrorExit;
}
//
// Unmap the old section.
//
Status = NtUnmapViewOfSection(NtCurrentProcess(),
pLogFile->BaseAddress);
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"ElfExtendFile: NtUnmapeViewOfSection for %ws log failed %#x\n",
pLogFile->LogModuleName->Buffer,
Status);
}
pLogFile->BaseAddress = BaseAddress;
//
// We managed to extend the file, update the actual size
// and space available and press on.
//
if (pLogFile->Flags & ELF_LOGFILE_HEADER_WRAP)
{
//
// Since we're wrapped, we want to move the "unwrapped" portion (i.e.,
// everything from the first record to the end of the old file) down to
// be at the bottom of the new file
//
// The call below moves memory as follows:
//
// 1. Destination -- PhysicalEOF - the size of the region
// 2. Source -- Address of the start of the first record
// 3. Size -- Num. bytes in the old file -
// offset of the first record
//
//
// Note that at this point, we have the following relevant variables
//
// BaseAddress -- The base address of the mapped section
// Size -- The size of the enlarged section
// pLogFile->ViewSize -- The size of the old section
// pLogfile->BeginRecord -- The offset of the first log record
//
//
// Calculate the number of bytes to move
//
DWORD dwWrapSize = (DWORD)(pLogFile->ViewSize - pLogFile->BeginRecord);
ELF_LOG1(FILES,
"ElfExtendFile: %ws is wrapped\n",
pLogFile->LogModuleName->Buffer);
RtlMoveMemory((LPBYTE)BaseAddress + Size - dwWrapSize,
(LPBYTE)BaseAddress + pLogFile->BeginRecord,
dwWrapSize);
//
// We've moved the BeginRecord -- update the offset
//
pLogFile->BeginRecord = (ULONG)(Size - dwWrapSize);
}
pLogFile->ViewSize = (ULONG)Size;
pLogFile->ActualMaxFileSize += SpaceNeeded;
*SpaceAvail += SpaceNeeded;
//
// Now flush this to disk to commit it
//
BaseAddress = pLogFile->BaseAddress;
Size = FILEHEADERBUFSIZE;
Status = NtFlushVirtualMemory(NtCurrentProcess(),
&BaseAddress,
&Size,
&IoStatusBlock);
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"ElfExtendFile: NtFlushVirtualMemory for %ws log failed %#x\n",
pLogFile->LogModuleName->Buffer,
Status);
}
return;
ErrorExit:
//
// Couldn't extend the section for some reason. Just wrap the file now.
// Cap the file at this size, so we don't try and extend the section on
// every write. The next time the eventlog service is started up it
// will revert to the configured max again.
//
//
// BUGBUG: Generate an Alert here
//
ELF_LOG1(ERROR,
"ElfExtendFile: Couldn't extend %ws log\n",
pLogFile->LogModuleName->Buffer);
pLogFile->ConfigMaxFileSize = pLogFile->ActualMaxFileSize;
return;
}
NTSTATUS
CopyUnicodeToAnsiRecord (
OUT PVOID Dest OPTIONAL,
IN PVOID Src,
OUT PVOID *NewBufPos OPTIONAL,
OUT PULONG RecordSize
)
/*++
Routine Description:
This routine reads from the event log specified in the request packet.
This routine uses memory mapped I/O to access the log file. This makes
it much easier to move around the file.
Arguments:
Dest - Points to destination buffer. If NULL, calculate and return
the record length without copying the record.
Src - Points to the UNICODE record.
NewBufPos - Gets offset in Dest buffer after record just transferred.
If Dest is NULL, this is ignored.
RecordSize - Gets size of this (ANSI) record.
Return Value:
STATUS_SUCCESS if no errors occur. Specific NTSTATUS error otherwise.
Note:
--*/
{
ANSI_STRING StringA;
UNICODE_STRING StringU;
PEVENTLOGRECORD SrcRecord, DestRecord;
PWSTR pStringU;
PVOID TempPtr;
ULONG PadSize, i;
ULONG zero = 0;
WCHAR *SrcStrings, *DestStrings;
ULONG RecordLength, *pLength;
ULONG ulTempLength;
NTSTATUS Status = STATUS_SUCCESS;
DestRecord = (PEVENTLOGRECORD)Dest;
SrcRecord = (PEVENTLOGRECORD)Src;
if (DestRecord != NULL)
{
DestRecord->TimeGenerated = SrcRecord->TimeGenerated;
DestRecord->Reserved = SrcRecord->Reserved;
DestRecord->RecordNumber = SrcRecord->RecordNumber;
DestRecord->TimeWritten = SrcRecord->TimeWritten;
DestRecord->EventID = SrcRecord->EventID;
DestRecord->EventType = SrcRecord->EventType;
DestRecord->EventCategory = SrcRecord->EventCategory;
DestRecord->NumStrings = SrcRecord->NumStrings;
DestRecord->UserSidLength = SrcRecord->UserSidLength;
DestRecord->DataLength = SrcRecord->DataLength;
}
//
// Convert and copy over modulename
//
pStringU = (PWSTR)((ULONG_PTR)SrcRecord + sizeof(EVENTLOGRECORD));
RtlInitUnicodeString(&StringU, pStringU);
if (DestRecord != NULL)
{
Status = RtlUnicodeStringToAnsiString(&StringA,
&StringU,
TRUE);
ulTempLength = StringA.MaximumLength;
}
else
{
ulTempLength = RtlUnicodeStringToAnsiSize(&StringU);
}
if (NT_SUCCESS(Status))
{
TempPtr = (PVOID)((ULONG_PTR)DestRecord + sizeof(EVENTLOGRECORD));
if (DestRecord != NULL)
{
RtlMoveMemory ( TempPtr, StringA.Buffer, ulTempLength );
RtlFreeAnsiString(&StringA);
}
TempPtr = (PVOID)((ULONG_PTR) TempPtr + ulTempLength);
//
// Convert and copy over computername
//
// TempPtr points to location in the destination for the computername
//
pStringU = (PWSTR)((ULONG_PTR)pStringU + StringU.MaximumLength);
RtlInitUnicodeString ( &StringU, pStringU );
if (DestRecord != NULL)
{
Status = RtlUnicodeStringToAnsiString (
&StringA,
&StringU,
TRUE
);
ulTempLength = StringA.MaximumLength;
}
else
{
ulTempLength = RtlUnicodeStringToAnsiSize(&StringU);
}
if (NT_SUCCESS(Status))
{
if (DestRecord != NULL)
{
RtlMoveMemory ( TempPtr, StringA.Buffer, ulTempLength );
RtlFreeAnsiString(&StringA);
}
TempPtr = (PVOID)((ULONG_PTR) TempPtr + ulTempLength);
}
}
if (NT_SUCCESS(Status))
{
// TempPtr points to location after computername - i.e. UserSid.
// Before we write out the UserSid, we ensure that we pad the
// bytes so that the UserSid starts on a DWORD boundary.
//
PadSize = sizeof(ULONG)
- (ULONG)(((ULONG_PTR)TempPtr-(ULONG_PTR)DestRecord) % sizeof(ULONG));
if (DestRecord != NULL)
{
RtlMoveMemory (TempPtr, &zero, PadSize);
TempPtr = (PVOID)((ULONG_PTR)TempPtr + PadSize);
//
// Copy over the UserSid.
//
RtlMoveMemory(TempPtr,
(PVOID)((ULONG_PTR)SrcRecord + SrcRecord->UserSidOffset),
SrcRecord->UserSidLength);
DestRecord->UserSidOffset = (ULONG)((ULONG_PTR)TempPtr - (ULONG_PTR)DestRecord);
}
else
{
TempPtr = (PVOID)((ULONG_PTR)TempPtr + PadSize);
}
//
// Copy over the Strings
//
TempPtr = (PVOID)((ULONG_PTR)TempPtr + SrcRecord->UserSidLength);
SrcStrings = (WCHAR *)((ULONG_PTR)SrcRecord + (ULONG)SrcRecord->StringOffset);
DestStrings = (WCHAR *)TempPtr;
for (i=0; i < SrcRecord->NumStrings; i++)
{
RtlInitUnicodeString (&StringU, SrcStrings);
if (DestRecord != NULL)
{
Status = RtlUnicodeStringToAnsiString(&StringA,
&StringU,
TRUE);
ulTempLength = StringA.MaximumLength;
}
else
{
ulTempLength = RtlUnicodeStringToAnsiSize(&StringU);
}
if (!NT_SUCCESS(Status))
{
//
// Bail out
//
return Status;
}
if (DestRecord != NULL)
{
RtlMoveMemory(DestStrings,
StringA.Buffer,
ulTempLength);
RtlFreeAnsiString (&StringA);
}
DestStrings = (WCHAR*)((ULONG_PTR)DestStrings + (ULONG)ulTempLength);
SrcStrings = (WCHAR*)((ULONG_PTR)SrcStrings + (ULONG)StringU.MaximumLength);
}
//
// DestStrings points to the point after the last string copied.
//
if (DestRecord != NULL)
{
DestRecord->StringOffset = (ULONG)((ULONG_PTR)TempPtr - (ULONG_PTR)DestRecord);
TempPtr = (PVOID)DestStrings;
//
// Copy over the binary Data
//
DestRecord->DataOffset = (ULONG)((ULONG_PTR)TempPtr - (ULONG_PTR)DestRecord);
RtlMoveMemory(TempPtr,
(PVOID)((ULONG_PTR)SrcRecord + SrcRecord->DataOffset),
SrcRecord->DataLength);
}
else
{
TempPtr = (PVOID)DestStrings;
}
//
// Now do the pad bytes.
//
TempPtr = (PVOID) ((ULONG_PTR) TempPtr + SrcRecord->DataLength);
PadSize = sizeof(ULONG)
- (ULONG) (((ULONG_PTR) TempPtr - (ULONG_PTR) DestRecord) % sizeof(ULONG));
RecordLength = (ULONG) ((ULONG_PTR) TempPtr
+ PadSize
+ sizeof(ULONG)
- (ULONG_PTR)DestRecord);
if (DestRecord != NULL)
{
RtlMoveMemory (TempPtr, &zero, PadSize);
pLength = (PULONG)((ULONG_PTR)TempPtr + PadSize);
*pLength = RecordLength;
DestRecord->Length = RecordLength;
ASSERT(((ULONG_PTR) DestRecord + RecordLength) ==
((ULONG_PTR) pLength + sizeof(ULONG)));
*NewBufPos = (PVOID) ((ULONG_PTR) DestRecord + RecordLength);
}
*RecordSize = RecordLength;
}
return Status;
} // CopyUnicodeToAnsiRecord
BOOL
ValidFilePos (
PVOID Position,
PVOID BeginningRecord,
PVOID EndingRecord,
PVOID PhysicalEOF,
PVOID BaseAddress,
BOOL fCheckBeginEndRange
)
/*++
Routine Description:
This routine determines whether we are pointing to a valid beginning
of an event record in the event log. It does this by validating
the signature then comparing the length at the beginning of the record to
the length at the end, both of which have to be at least the size of the
fixed length portion of an eventlog record.
Arguments:
Position - Pointer to be verified.
BeginningRecord - Pointer to the beginning record in the file.
EndingRecord - Pointer to the byte after the ending record in the file.
PhysicalEOF - Pointer the physical end of the log.
BaseAddress - Pointer to the physical beginning of the log.
Return Value:
TRUE if this position is valid.
Note:
There is a possibility of error if a record just happens to have the
ULONG at the current position the same as the value that number of
bytes further on in the record. However, this is a very slim chance
as it must have a valid log signature as well.
--*/
{
PULONG pEndRecordLength;
BOOL fValid = TRUE;
PEVENTLOGRECORD pEventRecord;
try
{
pEventRecord = (PEVENTLOGRECORD)Position;
//
// Verify that the pointer is within the range of BEGINNING->END
//
if ( fCheckBeginEndRange )
{
fValid = IsPositionWithinRange(Position,
BeginningRecord,
EndingRecord,
PhysicalEOF,
BaseAddress);
}
//
// If the offset looks OK, then examine the lengths at the beginning
// and end of the current record. If they don't match, then the position
// is invalid.
//
if (fValid)
{
//
// Make sure the length is a multiple number of DWORDS
//
if (pEventRecord->Length & 3)
{
fValid = FALSE;
}
else
{
pEndRecordLength = (PULONG) ((PBYTE) Position + pEventRecord->Length) - 1;
//
// If the file is wrapped, adjust the pointer to reflect the
// portion of the record that is wrapped starting after the
// header
//
if ((PVOID) pEndRecordLength >= PhysicalEOF)
{
pEndRecordLength = (PULONG) ((PBYTE) BaseAddress +
((PBYTE) pEndRecordLength - (PBYTE) PhysicalEOF) +
FILEHEADERBUFSIZE);
}
// Do a sanity check on this pointer before dereferencing. DAVJ
if ((PVOID) pEndRecordLength > PhysicalEOF)
{
return FALSE;
}
if (pEventRecord->Length == *pEndRecordLength
&&
pEventRecord->Length == ELFEOFRECORDSIZE)
{
ULONG Size;
Size = min(ELFEOFUNIQUEPART,
(ULONG) ((PBYTE) PhysicalEOF - (PBYTE) pEventRecord));
if (RtlCompareMemory(pEventRecord,
&EOFRecord,
Size) == Size)
{
Size = ELFEOFUNIQUEPART - Size;
//
// If Size is non-zero, then the unique portion of
// the EOF record is wrapped across the end of file.
// Continue comparison at file beginning for the
// remainder of the record.
//
if ( Size )
{
PBYTE pRemainder = (PBYTE) &EOFRecord + ELFEOFUNIQUEPART - Size;
fValid = (RtlCompareMemory((PBYTE) BaseAddress + FILEHEADERBUFSIZE,
pRemainder,
Size) == Size);
}
}
else
{
fValid = FALSE;
}
}
else if ((pEventRecord->Length < sizeof(EVENTLOGRECORD))
||
(pEventRecord->Reserved != ELF_LOG_FILE_SIGNATURE)
||
(pEventRecord->Length != *pEndRecordLength))
{
fValid = FALSE;
}
}
}
}
except (EXCEPTION_EXECUTE_HANDLER)
{
ELF_LOG2(ERROR,
"ValidFilePos: Exception %#x caught validating file position %p\n",
GetExceptionCode(),
BeginningRecord);
fValid = FALSE;
}
return fValid;
}
BOOL
IsPositionWithinRange(
PVOID Position,
PVOID BeginningRecord,
PVOID EndingRecord,
PVOID PhysEOF,
PVOID BaseAddress
)
{
//
// Verify that the pointer is within the range of [Beginning, End]
//
//This check was introduced to make sure that the position does not
//cross the file boundaries. Refer to Bug #370063. If required, one
//can change this check to make sure that the position lies between
//PhyStart i.e. BaseAddress + FILEHEADERBUFSIZE
if((Position < BaseAddress) || (Position > PhysEOF))
return FALSE;
else if (EndingRecord > BeginningRecord)
{
return ((Position >= BeginningRecord) && (Position <= EndingRecord));
}
else if (EndingRecord < BeginningRecord)
{
return ((Position >= BeginningRecord) || (Position <= EndingRecord));
}
//
// If BeginningRecord and EndingRecord are equal, it means that the only
// record in the log file is the EOF record. In that case, return FALSE
// as Position isn't pointing to a valid (i.e., non-EOF) record.
//
return FALSE;
}
PVOID
FindStartOfNextRecord (
PVOID Position,
PVOID BeginningRecord,
PVOID EndingRecord,
PVOID PhysicalStart,
PVOID PhysicalEOF,
PVOID BaseAddress
)
/*++
Routine Description:
This routine starts at Position, and finds the beginning of the next
valid record, wrapping around the physical end of the file if necessary.
Arguments:
Position - Pointer at which to start the search.
BeginningRecord - Pointer to the beginning record in the file.
EndingRecord - Pointer to the byte after the ending record in the file.
PhysicalStart - Pointer to the start of log information (after header)
PhysicalEOF - Pointer to the physical end of the log.
BaseAddress - Pointer to the physical beginning of the log.
Return Value:
A pointer to the start of the next valid record, NULL if there is no
valid record.
Note:
There is a possibility of error if a record just happens to have the
ULONG at the current position the same as the value that number of
bytes further on in the record. However, this is a very slim chance
as it must have a valid log signature as well.
--*/
{
PULONG ptr;
PULONG EndOfBlock;
PULONG EndOfFile;
PVOID pRecord;
ULONG Size;
BOOL StillLooking = TRUE;
//
// Search for a ULONG which matches a record signature
//
ptr = (PULONG) Position;
EndOfBlock = EndOfFile = (PULONG) PhysicalEOF - 1;
while (StillLooking)
{
//
// Check to see if it is the EOF record
//
if (*ptr == ELFEOFRECORDSIZE)
{
//
// Only scan up to the end of the file. Just compare up the
// constant information
//
//
// BUGBUG: If (End - pEvent) is less than ELFEOFUNIQUEPART,
// we never validate what should be the remainder of
// the EOF record at the start of the logfile
//
Size = min(ELFEOFUNIQUEPART,
(ULONG) ((PBYTE) PhysicalEOF - (PBYTE) ptr));
pRecord = CONTAINING_RECORD(ptr,
ELF_EOF_RECORD,
RecordSizeBeginning);
if (RtlCompareMemory(pRecord,
&EOFRecord,
Size) == Size)
{
ELF_LOG1(FILES,
"FindStartOfNextRecord: Found EOF record at %p\n",
pRecord);
//
// This is the EOF record, back up to the last record
//
(PBYTE) pRecord -= *((PULONG) pRecord - 1);
if (pRecord < PhysicalStart)
{
pRecord = (PBYTE) PhysicalEOF -
((PBYTE)PhysicalStart - (PBYTE)pRecord);
}
}
if (ValidFilePos(pRecord,
BeginningRecord,
EndingRecord,
PhysicalEOF,
BaseAddress,
TRUE))
{
ELF_LOG1(FILES,
"FindStartOfNextRecord: Valid record at %p preceding EOF record\n",
pRecord);
return pRecord;
}
}
//
// Check to see if it is an event record
//
if (*ptr == ELF_LOG_FILE_SIGNATURE)
{
//
// This is a signature, see if the containing record is valid
//
pRecord = CONTAINING_RECORD(ptr,
EVENTLOGRECORD,
Reserved);
if (ValidFilePos(pRecord,
BeginningRecord,
EndingRecord,
PhysicalEOF,
BaseAddress,
TRUE))
{
ELF_LOG1(FILES,
"FindStartOfNextRecord: Valid record found at %p\n",
pRecord);
return pRecord;
}
}
//
// Bump to the next byte and see if we're done.
//
ptr++;
if (ptr >= EndOfBlock)
{
//
// Need the second test on this condition in case Position
// happens to equal PhysicalEOF - 1 (EndOfBlock initial value);
// without this, this loop would terminate prematurely.
//
if ((EndOfBlock == (PULONG) Position)
&&
((PULONG) Position != EndOfFile))
{
//
// This was the top half, so we're done
//
StillLooking = FALSE;
ELF_LOG0(FILES,
"FindStartOfNextRecord: Unsuccessfully searched "
"top half of file\n");
}
else
{
//
// This was the bottom half, let's look in the top half
//
EndOfBlock = (PULONG) Position;
ptr = (PULONG) PhysicalStart;
ELF_LOG0(FILES,
"FindStartOfNextRecord: Unsuccessfully searched "
"bottom half of file -- searching top half\n");
}
}
}
//
// Didn't find a valid record
//
return NULL;
}
PVOID
NextRecordPosition (
ULONG ReadFlags,
PVOID CurrPosition,
ULONG CurrRecordLength,
PVOID BeginRecord,
PVOID EndRecord,
PVOID PhysicalEOF,
PVOID PhysStart
)
/*++
Routine Description:
This routine seeks to the beginning of the next record to be read
depending on the flags in the request packet.
Arguments:
ReadFlags - Read forwards or backwards
CurrPosition - Pointer to the current position.
CurrRecordLength - Length of the record at the last position read.
BeginRecord - Logical first record
EndRecord - Logical last record (EOF record)
PhysEOF - End of file
PhysStart - Start of file pointer (following file header).
Return Value:
New position or NULL if invalid record.
Note:
--*/
{
PVOID NewPosition;
ULONG Length;
PDWORD FillDword;
if (ReadFlags & EVENTLOG_FORWARDS_READ)
{
//
// If we're pointing at the EOF record, just set the position to
// the first record
//
if (CurrRecordLength == ELFEOFRECORDSIZE)
{
ELF_LOG1(FILES,
"NextRecordPosition: Pointing to EOF record -- returning "
"address of first record (%p)\n",
BeginRecord);
return BeginRecord;
}
NewPosition = (PVOID) ((ULONG_PTR) CurrPosition + CurrRecordLength);
//
// Take care of wrapping.
//
if (NewPosition >= PhysicalEOF)
{
NewPosition = (PBYTE)PhysStart
+ ((PBYTE) NewPosition - (PBYTE) PhysicalEOF);
}
//
// If this is a ELF_SKIP_DWORD, skip to the top of the file
//
if (*(PDWORD) NewPosition == ELF_SKIP_DWORD)
{
NewPosition = PhysStart;
}
}
else
{
//
// Reading backwards.
//
ASSERT (ReadFlags & EVENTLOG_BACKWARDS_READ);
if (CurrPosition == BeginRecord)
{
//
// This is the "end of file" if we're reading backwards.
//
ELF_LOG1(FILES,
"NextRecordPosition: Reading backwards and pointing to first "
"record -- returning address of last record (%p)\n",
EndRecord);
return EndRecord;
}
else if (CurrPosition == PhysStart)
{
//
// Flip to the bottom of the file, but skip and ELF_SKIP_DWORDs
//
FillDword = (PDWORD) PhysicalEOF; // last dword
FillDword--;
while (*FillDword == ELF_SKIP_DWORD)
{
FillDword--;
}
CurrPosition = (PVOID) (FillDword + 1);
}
Length = *((PULONG) CurrPosition - 1);
if (Length < ELFEOFRECORDSIZE)
{
//
// Bogus length, must be invalid record
//
ELF_LOG1(FILES,
"NextRecordPosition: Invalid record length (%d) encountered\n",
Length);
return NULL;
}
NewPosition = (PBYTE) CurrPosition - Length;
//
// Take care of wrapping
//
if (NewPosition < PhysStart)
{
NewPosition = (PBYTE) PhysicalEOF
- ((PBYTE) PhysStart - (PBYTE) NewPosition);
}
}
return NewPosition;
}
NTSTATUS
SeekToStartingRecord (
PELF_REQUEST_RECORD Request,
PVOID *ReadPosition,
PVOID BeginRecord,
PVOID EndRecord,
PVOID PhysEOF,
PVOID PhysStart
)
/*++
Routine Description:
This routine seeks to the correct position as indicated in the
request packet.
Arguments:
Pointer to the request packet.
Pointer to a pointer where the final position after the seek is returned.
Return Value:
NTSTATUS and new position in file.
Note:
This routine ensures that it is possible to seek to the position
specified in the request packet. If not, then an error is returned
which indicates that the file probably changed between the two
READ operations, or else the record offset specified is beyond the
end of the file.
--*/
{
PVOID Position;
ULONG RecordLen;
ULONG NumRecordsToSeek;
ULONG BytesPerRecord;
ULONG NumberOfRecords;
ULONG NumberOfBytes;
ULONG ReadFlags;
//
// If the beginning and the end are the same, then there are no
// entries in this file.
//
if (BeginRecord == EndRecord)
{
ELF_LOG1(FILES,
"SeekToStartingRecord: %ws log is empty\n",
Request->Module->ModuleName);
return STATUS_END_OF_FILE;
}
//
// Find the last position (or the "beginning" if this is the first READ
// call for this handle).
//
if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_SEQUENTIAL_READ)
{
if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_FORWARDS_READ)
{
//
// If this is the first READ operation, LastSeekPosition will
// be zero. In that case, we set the position to the first
// record (in terms of time) in the file.
//
if (Request->Pkt.ReadPkt->LastSeekPos == 0)
{
ELF_LOG1(FILES,
"SeekToStartingRecord: First read (forwards) of %ws log\n",
Request->Module->ModuleName);
Position = BeginRecord;
}
else
{
Position = (PBYTE) Request->LogFile->BaseAddress
+ Request->Pkt.ReadPkt->LastSeekPos;
//
// If we're changing the direction we're reading, skip
// forward one record. This is because we're pointing at
// the "next" record based on the last read direction
//
if (!(Request->Pkt.ReadPkt->Flags & ELF_LAST_READ_FORWARD))
{
Position = NextRecordPosition(Request->Pkt.ReadPkt->ReadFlags,
Position,
((PEVENTLOGRECORD) Position)->Length,
BeginRecord,
EndRecord,
PhysEOF,
PhysStart);
}
else
{
//
// This *really* cheesy check exists to handle the case
// where Position could be on an ELF_SKIP_DWORD pad
// dword at end of the file.
//
// NB: Must be prepared to handle an exception since
// a somewhat unknown pointer is dereferenced.
//
NTSTATUS Status = STATUS_SUCCESS;
try
{
if (IsPositionWithinRange(Position,
BeginRecord,
EndRecord,
PhysEOF,
Request->LogFile->BaseAddress))
{
//
// If this is an ELF_SKIP_DWORD, skip to the
// top of the file.
//
if (*(PDWORD) Position == ELF_SKIP_DWORD)
{
ELF_LOG1(FILES,
"SeekToStartingRecord: Next forward read position "
"in %ws log is on an ELF_SKIP_DWORD\n",
Request->Module->ModuleName);
Position = PhysStart;
}
}
else
{
//
// More likely the caller's handle was invalid
// if the position was not within range.
//
ELF_LOG1(ERROR,
"SeekToStartingRecord: Next forward read position "
"in %ws log is out of range -- log is corrupt\n",
Request->Module->ModuleName);
Status = STATUS_INVALID_HANDLE;
}
}
except (EXCEPTION_EXECUTE_HANDLER)
{
ELF_LOG2(ERROR,
"SeekToStartingRecord: Caught exception %#x looking for "
"next forward read position in %ws log\n",
GetExceptionCode(),
Request->Module->ModuleName);
Status = STATUS_EVENTLOG_FILE_CORRUPT;
}
if (!NT_SUCCESS(Status))
{
*ReadPosition = NULL;
return Status;
}
}
}
}
else
{
//
// READ backwards
//
// If this is the first READ operation, LastSeekPosition will
// be zero. In that case, we set the position to the last
// record (in terms of time) in the file.
//
if (Request->Pkt.ReadPkt->LastSeekPos == 0)
{
ELF_LOG1(FILES,
"SeekToStartingRecord: First read (backwards) of %ws log\n",
Request->Module->ModuleName);
Position = EndRecord;
//
// Subtract the length of the last record from the current
// position to get to the beginning of the record.
//
// If that moves beyond the physical beginning of the file,
// then we need to wrap around to the physical end of the file.
//
Position = (PBYTE) Position - *((PULONG) Position - 1);
if (Position < PhysStart)
{
Position = (PBYTE) PhysEOF - ((PBYTE) PhysStart - (PBYTE) Position);
}
}
else
{
Position = (PBYTE) Request->LogFile->BaseAddress
+ Request->Pkt.ReadPkt->LastSeekPos;
//
// If we're changing the direction we're reading, skip
// forward one record. This is because we're pointing at
// the "next" record based on the last read direction
//
if (Request->Pkt.ReadPkt->Flags & ELF_LAST_READ_FORWARD)
{
Position = NextRecordPosition(Request->Pkt.ReadPkt->ReadFlags,
Position,
0, // not used if reading backwards
BeginRecord,
EndRecord,
PhysEOF,
PhysStart);
}
}
}
}
else if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_SEEK_READ)
{
//
// Make sure the record number passed in is valid
//
if (Request->Pkt.ReadPkt->RecordNumber < Request->LogFile->OldestRecordNumber
||
Request->Pkt.ReadPkt->RecordNumber >= Request->LogFile->CurrentRecordNumber)
{
ELF_LOG1(ERROR,
"SeekToStartingRecord: Invalid record number %d\n",
Request->Pkt.ReadPkt->RecordNumber);
return STATUS_INVALID_PARAMETER;
}
//
// We're seeking to an absolute record number, so use the following
// algorithm:
//
// 1. Calculate the average number of bytes per record
//
// 2. Based on this number seek to where the record should start
//
// 3. Find the start of the next record in the file
//
// 4. Walk (forwards or backwards) from there to the right record
//
//
// 1. Calculate the average number of bytes per record
//
NumberOfRecords = Request->LogFile->CurrentRecordNumber
- Request->LogFile->OldestRecordNumber;
NumberOfBytes = Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP ?
Request->LogFile->ActualMaxFileSize :
Request->LogFile->EndRecord;
NumberOfBytes -= FILEHEADERBUFSIZE;
BytesPerRecord = NumberOfBytes / NumberOfRecords;
//
// 2. Calcuate the first guess as to what the offset of the desired
// record should be
//
Position = (PBYTE) Request->LogFile->BaseAddress
+ Request->LogFile->BeginRecord
+ BytesPerRecord
* (Request->Pkt.ReadPkt->RecordNumber
- Request->LogFile->OldestRecordNumber);
//
// Align the position to a ULONG bountry.
//
Position = (PVOID) (((ULONG_PTR) Position + sizeof(ULONG) - 1) & ~(sizeof(ULONG) - 1));
//
// Take care of file wrap
//
if (Position >= PhysEOF)
{
Position = (PBYTE)PhysStart +
((PBYTE) Position - (PBYTE) PhysEOF);
if (Position >= PhysEOF)
{
//
// It's possible, in an obscure error case, that Position
// may still be beyond the EOF. Adjust, if so.
//
Position = BeginRecord;
}
}
//
// Bug fix:
//
// 57017 - Event Log Causes Services.Exe to Access Violate therefore
// Hanging the Server
//
// The calculation above can easily put Position out of range of
// the begin/end file markers. This is not good. Adjust Position,
// if necessary.
//
if (BeginRecord < EndRecord && Position >= EndRecord)
{
Position = BeginRecord;
}
else if (BeginRecord > EndRecord && Position >= EndRecord && Position < BeginRecord)
{
Position = BeginRecord;
}
else
{
// Do nothing.
}
//
// 3. Get to the start of the next record after Position
//
Position = FindStartOfNextRecord(Position,
BeginRecord,
EndRecord,
PhysStart,
PhysEOF,
Request->LogFile->BaseAddress);
//
// 4. Walk (forwards or backwards) from Position to the right record
//
if (Position)
{
if (Request->Pkt.ReadPkt->RecordNumber >
((PEVENTLOGRECORD) Position)->RecordNumber)
{
NumRecordsToSeek = Request->Pkt.ReadPkt->RecordNumber
- ((PEVENTLOGRECORD) Position)->RecordNumber;
ReadFlags = EVENTLOG_FORWARDS_READ;
ELF_LOG2(FILES,
"SeekToStartingRecord: Walking forward %d records from record %d\n",
NumRecordsToSeek,
((PEVENTLOGRECORD) Position)->RecordNumber);
}
else
{
NumRecordsToSeek = ((PEVENTLOGRECORD) Position)->RecordNumber
- Request->Pkt.ReadPkt->RecordNumber;
ReadFlags = EVENTLOG_BACKWARDS_READ;
ELF_LOG2(FILES,
"SeekToStartingRecord: Walking backward %d records from record %d\n",
NumRecordsToSeek,
((PEVENTLOGRECORD) Position)->RecordNumber);
}
}
while (Position != NULL && NumRecordsToSeek--)
{
RecordLen = ((PEVENTLOGRECORD) Position)->Length;
Position = NextRecordPosition(ReadFlags,
Position,
RecordLen,
BeginRecord,
EndRecord,
PhysEOF,
PhysStart);
}
}
else
{
//
// Flags didn't specify a sequential or seek read
//
return STATUS_INVALID_PARAMETER;
}
*ReadPosition = Position; // This is the new seek position
if (!Position)
{
//
// The record was invalid
//
ELF_LOG1(ERROR,
"SeekToStartingRecord: Position is NULL -- %ws log is corrupt\n",
Request->Module->ModuleName);
return STATUS_EVENTLOG_FILE_CORRUPT;
}
return STATUS_SUCCESS;
}
VOID
CopyRecordToBuffer(
IN PBYTE pReadPosition,
IN OUT PBYTE *ppBufferPosition,
IN ULONG ulRecordSize,
IN PBYTE pPhysicalEOF,
IN PBYTE pPhysStart
)
/*++
Routine Description:
This routine copies the EVENTLOGRECORD at pReadPosition into
*ppBufferPosition
Return Value:
None.
--*/
{
ULONG ulBytesToMove; // Number of bytes to copy
ASSERT(ppBufferPosition != NULL);
//
// If the number of bytes to the end of the file is less than the
// size of the record, then part of the record has wrapped to the
// beginning of the file - transfer the bytes piece-meal.
//
// Otherwise, transfer the whole record.
//
ulBytesToMove = min(ulRecordSize,
(ULONG) (pPhysicalEOF - pReadPosition));
if (ulBytesToMove < ulRecordSize)
{
//
// We need to copy the bytes up to the end of the file,
// and then wrap around and copy the remaining bytes of
// this record.
//
RtlMoveMemory(*ppBufferPosition, pReadPosition, ulBytesToMove);
//
// Advance user buffer pointer, move read position to the
// beginning of the file (past the file header), and
// update bytes remaining to be moved for this record.
//
*ppBufferPosition += ulBytesToMove;
pReadPosition = pPhysStart;
ulBytesToMove = ulRecordSize - ulBytesToMove; // Remaining bytes
}
//
// Move the remaining bytes of the record OR the full record.
//
RtlMoveMemory(*ppBufferPosition, pReadPosition, ulBytesToMove);
//
// Update to new read positions
//
*ppBufferPosition += ulBytesToMove;
}
NTSTATUS
ReadFromLog(
PELF_REQUEST_RECORD Request
)
/*++
Routine Description:
This routine reads from the event log specified in the request packet.
This routine uses memory mapped I/O to access the log file. This makes
it much easier to move around the file.
Arguments:
Pointer to the request packet.
Return Value:
NTSTATUS.
Note:
--*/
{
NTSTATUS Status;
PVOID ReadPosition; // Current read position in file
PVOID BufferPosition; // Current position in user's buffer
ULONG TotalBytesRead; // Total Bytes transferred
ULONG TotalRecordsRead; // Total records transferred
ULONG BytesInBuffer; // Bytes remaining in buffer
ULONG RecordSize; // Size of event record
PVOID PhysicalEOF; // Physical end of file
PVOID PhysStart; // Physical start of file (after file hdr)
PVOID BeginRecord; // Points to first record
PVOID EndRecord; // Points to byte after last record
PVOID TempBuf = NULL, TempBufferPosition;
ULONG RecordBytesTransferred;
PEVENTLOGRECORD pEvent;
//
// Initialize variables.
//
BytesInBuffer = Request->Pkt.ReadPkt->BufferSize;
BufferPosition = Request->Pkt.ReadPkt->Buffer;
TotalBytesRead = 0;
TotalRecordsRead = 0;
PhysicalEOF = (LPBYTE) Request->LogFile->BaseAddress
+ Request->LogFile->ViewSize;
PhysStart = (LPBYTE) Request->LogFile->BaseAddress
+ FILEHEADERBUFSIZE;
BeginRecord = (LPBYTE) Request->LogFile->BaseAddress
+ Request->LogFile->BeginRecord; // Start at first record
EndRecord = (LPBYTE) Request->LogFile->BaseAddress
+ Request->LogFile->EndRecord; // Byte after end of last record
//
// "Seek" to the starting record depending on either the last seek
// position, or the starting record offset passed in.
//
Status = SeekToStartingRecord(Request,
&ReadPosition,
BeginRecord,
EndRecord,
PhysicalEOF,
PhysStart);
if (NT_SUCCESS(Status))
{
//
// Make sure the record is valid
//
if (!ValidFilePos(ReadPosition,
BeginRecord,
EndRecord,
PhysicalEOF,
Request->LogFile->BaseAddress,
TRUE))
{
ELF_LOG1(ERROR,
"ReadFromLog: Next record (%p) is not valid -- log is corrupt\n",
ReadPosition);
Request->Pkt.ReadPkt->BytesRead = 0;
Request->Pkt.ReadPkt->RecordsRead = 0;
return STATUS_INVALID_HANDLE;
}
// make sure that if we asked for a specific record, that we got it
if ((Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_SEEK_READ) &&
(Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_BACKWARDS_READ))
{
pEvent = (PEVENTLOGRECORD)ReadPosition;
if(pEvent->Length == ELFEOFRECORDSIZE ||
pEvent->RecordNumber != Request->Pkt.ReadPkt->RecordNumber)
{
Request->Pkt.ReadPkt->BytesRead = 0;
Request->Pkt.ReadPkt->RecordsRead = 0;
return STATUS_EVENTLOG_FILE_CORRUPT;
}
}
RecordSize = RecordBytesTransferred = *(PULONG) ReadPosition;
if ((Request->Pkt.ReadPkt->Flags & ELF_IREAD_ANSI)
&&
(RecordSize != ELFEOFRECORDSIZE))
{
//
//
// If we were called by an ANSI API, then we need to read the
// next record into a temporary buffer, process the data in
// that record and copy it over to the real buffer as ANSI
// strings (rather than UNICODE).
//
// We need to do this here since we won't be able to
// appropriately size a record that wraps for an ANSI
// call otherwise (we'll AV trying to read it past
// the end of the log).
//
TempBuf = ElfpAllocateBuffer(RecordSize);
if (TempBuf == NULL)
{
ELF_LOG0(ERROR,
"ReadFromLog: Unable to allocate memory for "
"Ansi record (1st call)\n");
return STATUS_NO_MEMORY;
}
TempBufferPosition = BufferPosition; // Save this away
BufferPosition = TempBuf; // Read into TempBuf
CopyRecordToBuffer((PBYTE) ReadPosition,
(PBYTE *) &BufferPosition,
RecordSize,
(PBYTE) PhysicalEOF,
(PBYTE) PhysStart);
//
// Call CopyUnicodeToAnsiRecord with a NULL destination
// location in order to get the size of the Ansi record
//
Status = CopyUnicodeToAnsiRecord(NULL,
TempBuf,
NULL,
&RecordBytesTransferred);
if (!NT_SUCCESS(Status))
{
ELF_LOG1(ERROR,
"ReadFromLog: CopyUnicodeToAnsiRecord failed %#x (1st call)\n",
Status);
ElfpFreeBuffer(TempBuf);
return Status;
}
}
//
// While there are records to be read, and more space in the buffer,
// keep on reading records into the buffer.
//
while((RecordBytesTransferred <= BytesInBuffer)
&&
(RecordSize != ELFEOFRECORDSIZE))
{
//
// If we were called by an ANSI API, then we need to take the
// record read into TempBuf and transfer it over to the user's
// buffer while converting any UNICODE strings to ANSI.
//
if (Request->Pkt.ReadPkt->Flags & ELF_IREAD_ANSI)
{
Status = CopyUnicodeToAnsiRecord(TempBufferPosition,
TempBuf,
&BufferPosition,
&RecordBytesTransferred);
//
// RecordBytesTransferred contains the bytes actually
// copied into the user's buffer.
//
// BufferPosition points to the point in the user's buffer
// just after this record.
//
ElfpFreeBuffer(TempBuf);
TempBuf = NULL;
if (!NT_SUCCESS(Status))
{
ELF_LOG1(ERROR,
"ReadFromLog: CopyUnicodeToAnsiRecord failed %x "
"(2nd call)\n",
Status);
//
// Stop reading
//
break;
}
}
else
{
//
// Unicode call -- simply copy the record into the buffer
//
CopyRecordToBuffer((PBYTE) ReadPosition,
(PBYTE *) &BufferPosition,
RecordSize,
(PBYTE) PhysicalEOF,
(PBYTE) PhysStart);
}
//
// Update the byte and record counts
//
TotalRecordsRead++;
TotalBytesRead += RecordBytesTransferred;
BytesInBuffer -= RecordBytesTransferred;
ReadPosition = NextRecordPosition(Request->Pkt.ReadPkt->ReadFlags,
ReadPosition,
RecordSize,
BeginRecord,
EndRecord,
PhysicalEOF,
PhysStart);
//
// Make sure the record is valid
//
if (ReadPosition == NULL
||
!ValidFilePos(ReadPosition,
BeginRecord,
EndRecord,
PhysicalEOF,
Request->LogFile->BaseAddress,
TRUE))
{
ELF_LOG0(ERROR,
"ReadFromLog: Next record is invalid -- log is corrupt\n");
return STATUS_EVENTLOG_FILE_CORRUPT;
}
RecordSize = RecordBytesTransferred = *(PULONG) ReadPosition;
if ((Request->Pkt.ReadPkt->Flags & ELF_IREAD_ANSI)
&&
(RecordSize != ELFEOFRECORDSIZE))
{
TempBuf = ElfpAllocateBuffer(RecordSize);
if (TempBuf == NULL)
{
ELF_LOG0(ERROR,
"ReadFromLog: Unable to allocate memory for "
"Ansi record (2nd call)\n");
return STATUS_NO_MEMORY;
}
TempBufferPosition = BufferPosition; // Save this away
BufferPosition = TempBuf; // Read into TempBuf
CopyRecordToBuffer((PBYTE) ReadPosition,
(PBYTE *) &BufferPosition,
RecordSize,
(PBYTE) PhysicalEOF,
(PBYTE) PhysStart);
//
// Call CopyUnicodeToAnsiRecord with a NULL destination
// location in order to get the size of the Ansi record
//
Status = CopyUnicodeToAnsiRecord(NULL,
TempBuf,
NULL,
&RecordBytesTransferred);
if (!NT_SUCCESS(Status))
{
ELF_LOG1(ERROR,
"ReadFromLog: CopyUnicodeToAnsiRecord failed %#x "
"(1st call)\n",
Status);
ElfpFreeBuffer(TempBuf);
return Status;
}
}
} // while
ElfpFreeBuffer(TempBuf);
TempBuf = NULL;
//
// If we got to the end and did not read in any records, return
// an error indicating that the user's buffer is too small if
// we're not at the EOF record, or end of file if we are.
//
if (TotalRecordsRead == 0)
{
if (RecordSize == ELFEOFRECORDSIZE)
{
ELF_LOG0(FILES,
"ReadFromLog: No records read -- pointing at EOF record\n");
Status = STATUS_END_OF_FILE;
}
else
{
//
// We didn't read any records, and we're not at EOF, so
// the buffer was too small
//
ELF_LOG1(ERROR,
"ReadFromLog: No records read -- buffer was too small "
"(%d bytes needed)\n",
RecordBytesTransferred);
Status = STATUS_BUFFER_TOO_SMALL;
Request->Pkt.ReadPkt->MinimumBytesNeeded = RecordBytesTransferred;
}
}
//
// Update the current file position.
//
Request->Pkt.ReadPkt->LastSeekPos =
(ULONG) ((ULONG_PTR) ReadPosition
- (ULONG_PTR) Request->LogFile->BaseAddress);
Request->Pkt.ReadPkt->LastSeekRecord += TotalRecordsRead;
ELF_LOG1(FILES,
"ReadFromLog: %d records successfully read\n",
TotalRecordsRead);
}
else
{
ELF_LOG1(ERROR,
"ReadFromLog: SeekToStartingRecord failed %#x\n",
Status);
}
//
// Set the bytes read in the request packet for return to client.
//
Request->Pkt.ReadPkt->BytesRead = TotalBytesRead;
Request->Pkt.ReadPkt->RecordsRead = TotalRecordsRead;
return Status;
}
VOID
PerformReadRequest(
PELF_REQUEST_RECORD Request
)
/*++
Routine Description:
This routine performs the READ request.
It first grabs the log file structure resource and then proceeds
to read from the file. If the resource is not available, it will
block until it is.
This routine impersonates the client in order to ensure that the correct
access control is uesd. If the client does not have permission to read
the file, the operation will fail.
Arguments:
Pointer to the request packet.
Return Value:
NONE
Note:
--*/
{
//
// Get shared access to the log file. This will allow multiple
// readers to get to the file together.
//
RtlAcquireResourceShared(&Request->Module->LogFile->Resource,
TRUE); // Wait until available
//
// Try to read from the log. Note that a corrupt log is the
// most likely cause of an exception (garbage pointers, etc).
// The eventlog corruption error is a bit all-inclusive, but
// necessary, since log state is pretty much indeterminable
// in this situation.
//
try
{
Request->Status = ReadFromLog(Request);
}
except (EXCEPTION_EXECUTE_HANDLER)
{
ELF_LOG2(ERROR,
"PerformReadRequest: Caught exception %#x reading %ws log\n",
GetExceptionCode(),
Request->Module->ModuleName);
Request->Status = STATUS_EVENTLOG_FILE_CORRUPT;
}
//
// Release the resource
//
RtlReleaseResource(&Request->Module->LogFile->Resource);
}
//
// BUGBUG: These are only used in WriteToLog and they're not modified.
// Probably cleaner to make them #define'd constants.
//
WCHAR wszAltDosDevices[] = L"\\DosDevices\\";
WCHAR wszDosDevices[] = L"\\??\\";
#define DOSDEVICES_LEN ((sizeof(wszDosDevices) / sizeof(WCHAR)) - 1)
#define ALTDOSDEVICES_LEN ((sizeof(wszAltDosDevices) / sizeof(WCHAR)) - 1)
VOID
WriteToLog(
PLOGFILE pLogFile,
PVOID Buffer,
ULONG BufSize,
PULONG Destination,
ULONG PhysEOF,
ULONG PhysStart
)
/*++
Routine Description:
This routine writes the record into the log file, allowing for wrapping
around the end of the file.
It assumes that the caller has serialized access to the file, and has
ensured that there is enough space in the file for the record.
Arguments:
Buffer - Pointer to the buffer containing the event record.
BufSize - Size of the record to be written.
Destination - Pointer to the destination - which is in the log file.
PhysEOF - Physical end of file.
PhysStart - Physical beginning of file (past the file header).
Return Value:
NONE.
Note:
--*/
{
ULONG BytesToCopy;
SIZE_T FlushSize;
ULONG NewDestination;
NTSTATUS Status;
PVOID BaseAddress;
LPWSTR pwszLogFileName;
LARGE_INTEGER ByteOffset;
IO_STATUS_BLOCK IoStatusBlock;
BytesToCopy = min(PhysEOF - *Destination, BufSize);
ByteOffset = RtlConvertUlongToLargeInteger(*Destination);
//
// BUGBUG: If this call fails, we shouldn't set *Destination to
// NewDestination below. The same is true if the second
// NtWriteFile call fails.
//
Status = NtWriteFile(pLogFile->FileHandle, // Filehandle
NULL, // Event
NULL, // APC routine
NULL, // APC context
&IoStatusBlock, // IO_STATUS_BLOCK
Buffer, // Buffer
BytesToCopy, // Length
&ByteOffset, // Byteoffset
NULL); // Key
if (!NT_SUCCESS(Status))
{
ELF_LOG1(ERROR,
"WriteToLog: NtWriteFile (1st call) failed %#x\n",
Status);
}
NewDestination = *Destination + BytesToCopy;
if (BytesToCopy != BufSize)
{
//
// Wrap around to the beginning of the file and copy the
// rest of the data.
//
Buffer = (PBYTE) Buffer + BytesToCopy;
BytesToCopy = BufSize - BytesToCopy;
ByteOffset = RtlConvertUlongToLargeInteger(PhysStart);
Status = NtWriteFile(pLogFile->FileHandle, // Filehandle
NULL, // Event
NULL, // APC routine
NULL, // APC context
&IoStatusBlock, // IO_STATUS_BLOCK
Buffer, // Buffer
BytesToCopy, // Length
&ByteOffset, // Byteoffset
NULL); // Key
if (!NT_SUCCESS(Status))
{
ELF_LOG1(ERROR,
"WriteToLog: NtWriteFile (2nd call) failed %#x\n",
Status);
}
NewDestination = PhysStart + BytesToCopy;
//
// Set "wrap" bit in log file structure
//
pLogFile->Flags |= ELF_LOGFILE_HEADER_WRAP;
//
// Now flush this to disk to commit it
//
BaseAddress = pLogFile->BaseAddress;
FlushSize = FILEHEADERBUFSIZE;
Status = NtFlushVirtualMemory(NtCurrentProcess(),
&BaseAddress,
&FlushSize,
&IoStatusBlock);
if (!NT_SUCCESS(Status))
{
ELF_LOG1(ERROR,
"WriteToLog: NtFlushVirtualMemory failed %#x\n",
Status);
}
}
*Destination = NewDestination; // Return new destination
//
// Providing all succeeded above, if not set, set the archive file
// attribute on this log.
//
if (NT_SUCCESS(Status)
&&
!(pLogFile->Flags & ELF_LOGFILE_ARCHIVE_SET))
{
//
// Advance past prefix string, '\??\' or '\DosDevices\'
//
if ((pLogFile->LogFileName->Length / 2) >= DOSDEVICES_LEN
&&
!_wcsnicmp(wszDosDevices, pLogFile->LogFileName->Buffer, DOSDEVICES_LEN))
{
pwszLogFileName = pLogFile->LogFileName->Buffer + DOSDEVICES_LEN;
}
else if ((pLogFile->LogFileName->Length / 2) >= ALTDOSDEVICES_LEN
&&
!_wcsnicmp(wszAltDosDevices, pLogFile->LogFileName->Buffer, ALTDOSDEVICES_LEN))
{
pwszLogFileName = pLogFile->LogFileName->Buffer + ALTDOSDEVICES_LEN;
}
else
{
pwszLogFileName = pLogFile->LogFileName->Buffer;
}
if (SetFileAttributes(pwszLogFileName, FILE_ATTRIBUTE_ARCHIVE))
{
pLogFile->Flags |= ELF_LOGFILE_ARCHIVE_SET;
}
else
{
ELF_LOG2(ERROR,
"WriteToLog: SetFileAttributes on file %ws failed %d\n",
pwszLogFileName,
GetLastError());
}
}
}
NTSTATUS
AutoBackupLogFile(PELF_REQUEST_RECORD Request, ULONG OverwrittenEOF)
/*++
Routine Description:
This routine makes a best attempt to backup the log file.
It will log an event in the SECURITY log file indicating
success or failure.
Arguments:
Pointer to the request packet.
Return Value:
NTSTATUS
Note:
--*/
{
UNICODE_STRING BackupFileNameU;
WCHAR BackupFileName[64]; // holds the "unique" part of the name (wsprintf)
PLOGFILE pLogFile; // For optimized access to structure
WCHAR BackupFileNamePrefix[] = L"Archive-";
WCHAR* EventMessage[3];
WCHAR Number[20]; // long enough to hold a DWORD represented as a string
SYSTEMTIME SystemTime;
ELF_REQUEST_RECORD ClearRequest;
CLEAR_PKT ClearPkt;
USHORT ClearStatus;
NTSTATUS Status;
ULONG WritePos; // Position to write record
pLogFile = Request->LogFile; // Set local variable
if (OverwrittenEOF)
{
//
// The EOF record was at the end of the physical file,
// and we overwrote it with ELF_SKIP_DWORDs, so we need
// to put it back since we're not going to be able to
// write a record. We also need to turn the wrap bit
// back off
//
pLogFile->Flags &= ~(ELF_LOGFILE_HEADER_WRAP);
pLogFile->EndRecord = OverwrittenEOF;
WritePos = OverwrittenEOF;
//
// Write out the EOF record
//
WriteToLog(pLogFile,
&EOFRecord,
ELFEOFRECORDSIZE,
&WritePos,
pLogFile->ActualMaxFileSize,
FILEHEADERBUFSIZE);
}
Status = FlushLogFile(pLogFile);
if (!NT_SUCCESS(Status))
return Status;
//
// Make BackupFileNameU unique.
// Allocate enough space for the current LogModuleName, a NULL character,
// and BackupFileName bytes.
// If AutoBackupPath is non-NULL, add space for that too.
//
// Rename file in place.
//
BackupFileNameU.Length = 0;
BackupFileNameU.MaximumLength = ((wcslen(pLogFile->LogModuleName->Buffer) +
wcslen(BackupFileNamePrefix) + 1 ) * sizeof(WCHAR)) +
sizeof(BackupFileName);
BackupFileNameU.Buffer = ElfpAllocateBuffer(BackupFileNameU.MaximumLength);
if (BackupFileNameU.Buffer == NULL)
{
ELF_LOG0(ERROR,
"AutoBackupLogFile: failed due to lack of memory\n");
return STATUS_NO_MEMORY;
}
StringCbCopy(BackupFileNameU.Buffer, BackupFileNameU.MaximumLength,
BackupFileNamePrefix);
StringCbCat(BackupFileNameU.Buffer, BackupFileNameU.MaximumLength,
pLogFile->LogModuleName->Buffer);
GetSystemTime(&SystemTime);
StringCchPrintfW(BackupFileName, 64, L"-%u-%02u-%02u-%02u-%02u-%02u-%03u.evt",
SystemTime.wYear,
SystemTime.wMonth,
SystemTime.wDay,
SystemTime.wHour,
SystemTime.wMinute,
SystemTime.wSecond,
SystemTime.wMilliseconds);
StringCbCat(BackupFileNameU.Buffer, BackupFileNameU.MaximumLength,BackupFileName);
BackupFileNameU.Length = wcslen(BackupFileNameU.Buffer) * sizeof(WCHAR);
//
// Fill in the request packet
//
ClearRequest.Pkt.ClearPkt = &ClearPkt;
ClearRequest.Flags = 0;
ClearRequest.Module = Request->Module;
ClearRequest.LogFile = Request->LogFile;
ClearRequest.Command = ELF_COMMAND_CLEAR;
ClearRequest.Status = STATUS_SUCCESS;
ClearRequest.Pkt.ClearPkt->BackupFileName = &BackupFileNameU;
PerformClearRequest(&ClearRequest);
//
// Generate an audit in the Security log.
//
StringCchPrintfW(Number, 20, L"0x%x", ClearRequest.Status);
EventMessage[0] = pLogFile->LogModuleName->Buffer;
EventMessage[1] = BackupFileNameU.Buffer;
EventMessage[2] = Number;
if (NT_SUCCESS(ClearRequest.Status))
{
ELF_LOG0(TRACE,
"AutoBackupLogFile: auto backup and clear worked\n");
ClearStatus = EVENTLOG_AUDIT_SUCCESS;
}
else
{
ELF_LOG1(ERROR,
"AutoBackupLogFile: failed calling clear/backup, error 0x%x\n",
ClearRequest.Status);
ClearStatus = EVENTLOG_AUDIT_FAILURE;
}
ElfpCreateElfEvent(
0x20c, // todo, get the #def
ClearStatus,
1, // EventCategory (SE_CATEGID_SYSTEM)
3, // NumberOfStrings
EventMessage, // Strings
NULL, // Data
0, // Datalength
0, // Do not Overwrite if necc.
TRUE); // For the Security Log file
ElfpFreeBuffer(BackupFileNameU.Buffer);
return ClearRequest.Status;
}
VOID
PerformWriteRequest(
PELF_REQUEST_RECORD Request
)
/*++
Routine Description:
This routine writes the event log entry to the log file specified in
the request packet.
There is no need to impersonate the client since we want all clients
to have access to writing to the log file.
This routine does not use memory mapped I/O to access the log file. This
is so the changes can be immediately committed to disk if that was how
the log file was opened.
Arguments:
Pointer to the request packet.
Return Value:
NONE
Note:
--*/
{
NTSTATUS Status;
ULONG WritePos; // Position to write record
LARGE_INTEGER Time;
ULONG SpaceNeeded; // Record size + "buffer" size
ULONG CurrentTime = 0;
PEVENTLOGRECORD EventRecord;
ULONG RecordSize;
ULONG DeletedRecordOffset;
ULONG SpaceAvail;
ULONG EarliestTime;
PLOGFILE pLogFile; // For optimized access to structure
PELF_LOGFILE_HEADER pFileHeader;
PVOID BaseAddress;
IO_STATUS_BLOCK IoStatusBlock;
PEVENTLOGRECORD pEventLogRecord;
PDWORD FillDword;
ULONG OverwrittenEOF = 0;
BOOL bSecurity = FALSE;
BOOL fRetryWriteRequest = FALSE;
pLogFile = Request->LogFile; // Set local variable
// Set some basic BOOLs
if(!_wcsicmp(pLogFile->LogModuleName->Buffer, ELF_SECURITY_MODULE_NAME))
bSecurity = TRUE;
else
bSecurity = FALSE;
//This condition occurs under stress conditions
//and causes an AV further in this function
if(pLogFile->BaseAddress == NULL)
{
Request->Status = STATUS_INVALID_HANDLE;
return;
}
//
// Get exclusive access to the log file. This will ensure no one
// else is accessing the file.
//
RtlAcquireResourceExclusive(&pLogFile->Resource,
TRUE); // Wait until available
try
{
RetryWriteRequest:
//
// Put in the record number
//
pEventLogRecord = (PEVENTLOGRECORD) Request->Pkt.WritePkt->Buffer;
pEventLogRecord->RecordNumber = pLogFile->CurrentRecordNumber;
//
// Now, go to the end of the file and look for empty space.
//
// If there is enough space to write out the record, just
// write it out and update the pointers.
//
// If there isn't enough space, then we need to check if we can
// wrap around the file without overwriting any records that are
// within the time retention period.
// If we cannot find any room, then we have to return an error
// that the file is full (and alert the administrator).
//
RecordSize = Request->Pkt.WritePkt->Datasize;
SpaceNeeded = RecordSize + ELFEOFRECORDSIZE;
if (pLogFile->EndRecord > pLogFile->BeginRecord)
{
//
// The current write position is after the position of the first
// record, then we can write up to the end of the file without
// worrying about overwriting existing records.
//
SpaceAvail = pLogFile->ActualMaxFileSize
- (pLogFile->EndRecord - pLogFile->BeginRecord + FILEHEADERBUFSIZE);
}
else if (pLogFile->EndRecord == pLogFile->BeginRecord
&&
!(pLogFile->Flags & ELF_LOGFILE_HEADER_WRAP))
{
//
// If the write position is equal to the position of the first
// record, and we have't wrapped yet, then the file is "empty"
// and so we have room to the physical end of the file.
//
SpaceAvail = pLogFile->ActualMaxFileSize - FILEHEADERBUFSIZE;
}
else
{
//
// If our write position is before the position of the first record, then
// the file has wrapped and we need to deal with overwriting existing
// records in the file.
//
SpaceAvail = pLogFile->BeginRecord - pLogFile->EndRecord;
}
//
// We now have the number of bytes available to write the record
// WITHOUT overwriting any existing records stored in SpaceAvail.
// If that amount is not sufficient, then we need to create more space
// by "deleting" existing records that are older than the retention
// time that was configured for this file.
//
// We check the retention time against the time when the log was
// written since that is consistent at the server. We cannot use the
// client's time since that may vary if the clients are in different
// time zones.
//
NtQuerySystemTime(&Time);
RtlTimeToSecondsSince1970(&Time, &CurrentTime);
EarliestTime = CurrentTime - pLogFile->Retention;
Status = STATUS_SUCCESS; // Initialize for return to caller
//
// Check to see if the file hasn't reached its maximum allowable
// size yet, and also hasn't wrapped. If not, grow it by as much as
// needed, in 64K chunks.
//
if (pLogFile->ActualMaxFileSize < pLogFile->ConfigMaxFileSize
&&
SpaceNeeded > SpaceAvail)
{
//
// Extend it. This call cannot fail. If it can't extend it, it
// just caps it at the current size by changing
// pLogFile->ConfigMaxFileSize
//
ElfExtendFile(pLogFile,
SpaceNeeded,
&SpaceAvail);
}
//
// We don't want to split the fixed portion of a record across the
// physical end of the file, it makes it difficult when referencing
// these fields later (you have to check before you touch each one
// to make sure it's not after the physical EOF). So, if there's
// not enough room at the end of the file for the fixed portion,
// we fill it with a known byte pattern (ELF_SKIP_DWORD) that will
// be skipped if it's found at the start of a record (as long as
// it's less than the minimum record size, then we know it's not
// the start of a valid record).
//
if (pLogFile->ActualMaxFileSize - pLogFile->EndRecord < sizeof(EVENTLOGRECORD))
{
//
// Save the EndRecord pointer. In case we don't have the space
// to write another record, we'll need to rewrite the EOF where
// it was
//
OverwrittenEOF = pLogFile->EndRecord;
FillDword = (PDWORD) ((PBYTE) pLogFile->BaseAddress + pLogFile->EndRecord);
while (FillDword < (PDWORD) ((LPBYTE) pLogFile->BaseAddress +
pLogFile->ActualMaxFileSize))
{
*FillDword = ELF_SKIP_DWORD;
FillDword++;
}
pLogFile->EndRecord = FILEHEADERBUFSIZE;
SpaceAvail = pLogFile->BeginRecord - FILEHEADERBUFSIZE;
pLogFile->Flags |= ELF_LOGFILE_HEADER_WRAP;
}
EventRecord = (PEVENTLOGRECORD) ((PBYTE) pLogFile->BaseAddress
+ pLogFile->BeginRecord);
while (SpaceNeeded > SpaceAvail)
{
//
// If this logfile can be overwrite-as-needed, or if it has
// an overwrite time limit and the time hasn't expired, then
// allow the new event to overwrite an older event.
//
if (pLogFile->Retention == OVERWRITE_AS_NEEDED
||
(pLogFile->Retention != NEVER_OVERWRITE
&&
(EventRecord->TimeWritten < EarliestTime
||
Request->Flags & ELF_FORCE_OVERWRITE)))
{
//
// OK to overwrite
//
ULONG NextRecord;
ULONG SearchStartPos;
BOOL fBeginningRecordWrap = FALSE;
BOOL fInvalidRecordLength = FALSE;
DeletedRecordOffset = pLogFile->BeginRecord;
pLogFile->BeginRecord += EventRecord->Length;
//
// Ensure BeginRecord offset is DWORD-aligned.
//
pLogFile->BeginRecord = (pLogFile->BeginRecord + sizeof(ULONG) - 1)
& ~(sizeof(ULONG) - 1);
//
// Check specifically for a record length value of zero.
// Zero is considered invalid.
//
if (EventRecord->Length == 0)
{
ELF_LOG2(ERROR,
"PerformWriteRequest: Zero-length record at "
"offset %d in %ws log\n",
DeletedRecordOffset,
pLogFile->LogModuleName->Buffer);
fInvalidRecordLength = TRUE;
}
if (pLogFile->BeginRecord >= pLogFile->ActualMaxFileSize)
{
ULONG BeginRecord;
//
// We're about to wrap around the end of the file. Adjust
// BeginRecord accordingly.
//
fBeginningRecordWrap = TRUE;
BeginRecord = FILEHEADERBUFSIZE
+ (pLogFile->BeginRecord
- pLogFile->ActualMaxFileSize);
//
// If the record length was bogus (very large), it's possible
// the wrap-adjusted computed position is still beyond the
// end of file. In thise case, mark it as bogus.
//
if (BeginRecord >= pLogFile->ActualMaxFileSize)
{
ELF_LOG3(ERROR,
"PerformWriteRequest: Too-large record length (%#x) "
"at offset %d in %ws log\n",
EventRecord->Length,
DeletedRecordOffset,
pLogFile->LogModuleName->Buffer);
fInvalidRecordLength = TRUE;
}
else
{
pLogFile->BeginRecord = BeginRecord;
}
}
if (fInvalidRecordLength)
{
//
// If the record length is considered bogus, adjust
// BeginRecord to be just beyond the length and signature of
// the previous record to scan for the next valid record.
//
pLogFile->BeginRecord = DeletedRecordOffset
+ (sizeof(ULONG) * 2);
}
//
// Ensure the record referenced is indeed a valid record and that
// we're not reading into a partially overwritten record. With a
// circular log, it's possible to partially overwrite existing
// entries with the EOF record and/or ELF_SKIP_DWORD values.
//
// Skip the record size to the record signature since the loop
// below will search for the next valid signature. Note that
// the increment of SpaceAvail is undone when we find a valid
// record below.
//
NextRecord = pLogFile->BeginRecord + sizeof(ULONG);
if (NextRecord < pLogFile->ActualMaxFileSize)
{
SpaceAvail += min(sizeof(ULONG),
pLogFile->ActualMaxFileSize - NextRecord);
}
//
// Seek to find a record signature.
//
SearchStartPos = pLogFile->BeginRecord;
for ( ;; )
{
PVOID Position;
for ( ;
NextRecord != SearchStartPos;
SpaceAvail += sizeof(ULONG), NextRecord += sizeof(ULONG))
{
if (NextRecord >= pLogFile->ActualMaxFileSize)
{
NextRecord = pLogFile->BeginRecord = FILEHEADERBUFSIZE;
}
if (*(PULONG) ((PBYTE) pLogFile->BaseAddress + NextRecord)
== ELF_LOG_FILE_SIGNATURE)
{
//
// Found the next valid record signature
//
break;
}
}
Position = (PULONG) ((PBYTE) pLogFile->BaseAddress + NextRecord);
if (*(PULONG) Position == ELF_LOG_FILE_SIGNATURE)
{
//
// This record is valid so far, perform a final, more
// rigorous check for record validity.
//
if (ValidFilePos(CONTAINING_RECORD(Position,
EVENTLOGRECORD,
Reserved),
NULL,
NULL,
(PBYTE) pLogFile->BaseAddress
+ pLogFile->ViewSize,
pLogFile->BaseAddress,
FALSE))
{
//
// The record is valid. Adjust SpaceAvail to not
// include a sub-portion of this record in the
// available space computation.
//
SpaceAvail -= sizeof(ULONG);
pLogFile->BeginRecord = NextRecord - sizeof(ULONG);
break;
}
else
{
//
// Continue the search for the next valid record.
//
// NB : Not calling FixContextHandlesForRecord
// since we have not established a valid
// beginning record position yet. Not that
// it would do any good - this condition would
// be evaluated in cases of corrupt logs.
//
ELF_LOG2(FILES,
"PerformWriteRequest: Valid record signature with "
"invalid record found at offset %d of %ws log\n",
NextRecord,
pLogFile->LogModuleName->Buffer);
SpaceAvail += sizeof(ULONG);
NextRecord += sizeof(ULONG);
continue;
}
}
else
{
//
// Not a single valid record can be found. This is not
// good. Consider the log corrupted and bail the write.
//
ELF_LOG1(ERROR,
"PerformWriteRequest: No valid records found in %ws log\n",
pLogFile->LogModuleName->Buffer);
Status = STATUS_EVENTLOG_FILE_CORRUPT;
ASSERT(Status != STATUS_EVENTLOG_FILE_CORRUPT);
break;
}
}
if (Status == STATUS_EVENTLOG_FILE_CORRUPT)
{
break;
}
if (fBeginningRecordWrap)
{
//
// Check to see if the file has reached its maximum allowable
// size yet. If not, grow it by as much as needed in 64K
// chunks.
//
if (pLogFile->ActualMaxFileSize < pLogFile->ConfigMaxFileSize)
{
//
// Extend it. This call cannot fail. If it can't
// extend it, it just caps it at the current size by
// changing pLogFile->ConfigMaxFileSize.
//
ElfExtendFile(pLogFile,
SpaceNeeded,
&SpaceAvail);
//
// Since extending the file will cause it to be moved, we
// need to re-establish the address for the EventRecord.
//
EventRecord = (PEVENTLOGRECORD) ((PBYTE) pLogFile->BaseAddress
+ DeletedRecordOffset);
}
}
//
// Make sure no handle points to the record that we're getting
// ready to overwrite, it one does, correct it to point to the
// new first record.
//
FixContextHandlesForRecord(DeletedRecordOffset,
pLogFile->BeginRecord);
if (!fInvalidRecordLength)
{
//
// Update SpaceAvail to include the deleted record's size.
// That is, if we have a high degree of confidence that
// it is valid.
//
SpaceAvail += EventRecord->Length;
}
//
// Bump to the next record, file wrap was handled above
//
//
// If these are ELF_SKIP_DWORDs, just move past them
//
FillDword = (PDWORD) ((PBYTE) pLogFile->BaseAddress
+ pLogFile->BeginRecord);
if (*FillDword == ELF_SKIP_DWORD)
{
SpaceAvail += pLogFile->ActualMaxFileSize - pLogFile->BeginRecord;
pLogFile->BeginRecord = FILEHEADERBUFSIZE;
}
EventRecord = (PEVENTLOGRECORD) ((PBYTE) pLogFile->BaseAddress
+ pLogFile->BeginRecord);
}
else
{
//
// CODEWORK: Split this out into a separate function
//
//
// All records within retention period
//
ELF_LOG1(ERROR,
"PerformWriteRequest: %ws log is full\n",
pLogFile->LogModuleName->Buffer);
//
// Do new behavior.
//
// Auto backup, clear the log, and log and event that says the file
// was backed up and try to log the current event one more time.
//
// If this cannot be done, we made our best attempt, so we will probably
// crash on audit fail, and not log the event (revert to old behavior).
//
if ((pLogFile->AutoBackupLogFiles != 0) && (fRetryWriteRequest == FALSE)) {
AutoBackupLogFile(Request, OverwrittenEOF);
fRetryWriteRequest = TRUE;
goto RetryWriteRequest;
}
//
// Hang an event on the queuedevent list for later writing
// if we haven't just written a log full event for this log.
// Don't put up the popup during setup as there's nothing
// the user can do about it until setup finishes.
//
if (pLogFile->logpLogPopup == LOGPOPUP_CLEARED
&&
!ElfGlobalData->fSetupInProgress && !bSecurity)
{
INT StringLen, id = -1;
LPTSTR lpModuleNameLoc = NULL;
HMODULE StringsResource;
//
// We should never be popping up or logging an event
// for the security log
//
ASSERT(_wcsicmp(pLogFile->LogModuleName->Buffer,
ELF_SECURITY_MODULE_NAME) != 0);
//
// Get the localized module name from message table
//
StringsResource = GetModuleHandle(L"EVENTLOG.DLL");
ASSERT(StringsResource != NULL);
if (_wcsicmp(pLogFile->LogModuleName->Buffer,
ELF_SYSTEM_MODULE_NAME) == 0)
{
id = ELF_MODULE_NAME_LOCALIZE_SYSTEM;
}
else if (_wcsicmp(pLogFile->LogModuleName->Buffer,
ELF_APPLICATION_MODULE_NAME) == 0)
{
id = ELF_MODULE_NAME_LOCALIZE_APPLICATION;
}
if (id != -1)
{
StringLen = FormatMessage(FORMAT_MESSAGE_FROM_HMODULE |
FORMAT_MESSAGE_ALLOCATE_BUFFER,
StringsResource,
id,
0,
(LPTSTR) &lpModuleNameLoc,
0,
NULL);
if ((StringLen > 1) && (lpModuleNameLoc != NULL))
{
//
// Get rid of cr/lf control code at the end
//
*(lpModuleNameLoc + StringLen - 2) = 0;
}
}
//
// Create the "log full" event -- use the name stored in the
// log's default module if it's not a well-known log type
//
ElfpCreateElfEvent(EVENT_LOG_FULL,
EVENTLOG_ERROR_TYPE,
0, // EventCategory
1, // NumberOfStrings
(lpModuleNameLoc != NULL) ?
&lpModuleNameLoc :
&Request->LogFile->LogModuleName->Buffer,
NULL, // Data
0, // Datalength
ELF_FORCE_OVERWRITE,
FALSE); // Overwrite if necc.
ElfpCreateQueuedMessage(
ALERT_ELF_LogOverflow,
1,
(lpModuleNameLoc != NULL) ?
&lpModuleNameLoc :
&Request->Module->LogFile->LogModuleName->Buffer);
LocalFree(lpModuleNameLoc);
//
// Don't post the popup again until either the machine is
// rebooted or the log is cleared
//
pLogFile->logpLogPopup = LOGPOPUP_ALREADY_SHOWN;
}
else if(bSecurity)
{
if(pLogFile->bFullAlertDone == FALSE)
ElfpCreateQueuedAlert(
ALERT_ELF_LogOverflow,
1,
&Request->Module->LogFile->LogModuleName->Buffer);
pLogFile->bFullAlertDone = TRUE;
}
pLogFile->Flags |= ELF_LOGFILE_LOGFULL_WRITTEN;
if (OverwrittenEOF)
{
//
// The EOF record was at the end of the physical file,
// and we overwrote it with ELF_SKIP_DWORDs, so we need
// to put it back since we're not going to be able to
// write a record. We also need to turn the wrap bit
// back off
//
pLogFile->Flags &= ~(ELF_LOGFILE_HEADER_WRAP);
pLogFile->EndRecord = OverwrittenEOF;
WritePos = OverwrittenEOF;
//
// Write out the EOF record
//
WriteToLog(pLogFile,
&EOFRecord,
ELFEOFRECORDSIZE,
&WritePos,
pLogFile->ActualMaxFileSize,
FILEHEADERBUFSIZE);
}
Status = STATUS_LOG_FILE_FULL;
break; // Get out of while loop
}
}
if (NT_SUCCESS(Status))
{
//
// We have enough room to write the record and the EOF record.
//
//
// Update OldestRecordNumber to reflect the records that were
// overwritten amd increment the CurrentRecordNumber
//
// Make sure that the log isn't empty, if it is, the oldest
// record is 1
//
if (pLogFile->BeginRecord == pLogFile->EndRecord)
{
pLogFile->OldestRecordNumber = 1;
}
else
{
pLogFile->OldestRecordNumber = EventRecord->RecordNumber;
}
pLogFile->CurrentRecordNumber++;
//
// If the dirty bit is not set, then this is the first time that
// we have written to the file since we started. In that case,
// set the dirty bit in the file header as well so that we will
// know that the contents have changed.
//
if (!(pLogFile->Flags & ELF_LOGFILE_HEADER_DIRTY))
{
SIZE_T HeaderSize;
pLogFile->Flags |= ELF_LOGFILE_HEADER_DIRTY;
pFileHeader = (PELF_LOGFILE_HEADER) pLogFile->BaseAddress;
pFileHeader->Flags |= ELF_LOGFILE_HEADER_DIRTY;
//
// Now flush this to disk to commit it
//
BaseAddress = pLogFile->BaseAddress;
HeaderSize = FILEHEADERBUFSIZE;
Status = NtFlushVirtualMemory(NtCurrentProcess(),
&BaseAddress,
&HeaderSize,
&IoStatusBlock);
if (!NT_SUCCESS(Status))
{
ELF_LOG1(ERROR,
"PerformWriteRequest: NtFlushVirtualMemory to add dirty "
"flag to header failed %#x\n",
Status);
}
}
//
// Write the event to the log
//
WriteToLog(pLogFile,
Request->Pkt.WritePkt->Buffer,
RecordSize,
&(pLogFile->EndRecord),
pLogFile->ActualMaxFileSize,
FILEHEADERBUFSIZE);
//
// Use a separate variable for the position since we don't want
// it updated.
//
WritePos = pLogFile->EndRecord;
if (WritePos > pLogFile->ActualMaxFileSize)
{
WritePos -= pLogFile->ActualMaxFileSize - FILEHEADERBUFSIZE;
}
//
// Update the EOF record fields
//
EOFRecord.BeginRecord = pLogFile->BeginRecord;
EOFRecord.EndRecord = WritePos;
EOFRecord.CurrentRecordNumber = pLogFile->CurrentRecordNumber;
EOFRecord.OldestRecordNumber = pLogFile->OldestRecordNumber;
//
// Write out the EOF record
//
WriteToLog(pLogFile,
&EOFRecord,
ELFEOFRECORDSIZE,
&WritePos,
pLogFile->ActualMaxFileSize,
FILEHEADERBUFSIZE);
//
// If we had just written a logfull record, turn the bit off.
// Since we just wrote a record, technically it's not full anymore
//
if (!(Request->Flags & ELF_FORCE_OVERWRITE))
{
pLogFile->Flags &= ~(ELF_LOGFILE_LOGFULL_WRITTEN);
}
//
// See if there are any ElfChangeNotify callers to notify, and if
// there are, pulse their event
//
NotifyChange(pLogFile);
}
//
// Set status field in the request packet.
//
Request->Status = Status;
}
except (EXCEPTION_EXECUTE_HANDLER)
{
ELF_LOG2(ERROR,
"PerformWriteRequest: Caught exception %#x writing to %ws log\n",
GetExceptionCode(),
pLogFile->LogModuleName->Buffer);
Request->Status = STATUS_EVENTLOG_FILE_CORRUPT;
}
//
// Release the resource
//
RtlReleaseResource ( &pLogFile->Resource );
}
VOID
PerformClearRequest(
PELF_REQUEST_RECORD Request
)
/*++
Routine Description:
This routine will optionally back up the log file specified, and will
delete it.
Arguments:
Pointer to the request packet.
Return Value:
NONE
Note:
On the exit path, when we do some "cleanup" work, we discard the
status and instead return the status of the operation that is being
performed.
This is necessary since we wish to return any error condition that is
directly related to the clear operation. For other errors, we will
fail at a later stage.
--*/
{
NTSTATUS Status, IStatus;
PUNICODE_STRING FileName;
IO_STATUS_BLOCK IoStatusBlock;
PFILE_RENAME_INFORMATION NewName = NULL;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE ClearHandle = NULL;
FILE_DISPOSITION_INFORMATION DeleteInfo = {TRUE};
ULONG FileRefCount;
BOOLEAN FileRenamed = FALSE;
//
// Get exclusive access to the log file. This will ensure no one
// else is accessing the file.
//
RtlAcquireResourceExclusive (&Request->Module->LogFile->Resource,
TRUE); // Wait until available
//
// We have exclusive access to the file.
//
// We force the file to be closed, and store away the ref count
// so that we can set it back when we reopen the file.
// This is a little *sleazy* but we have exclusive access to the
// logfile structure so we can play these games.
//
FileRefCount = Request->LogFile->RefCount; // Store this away
ElfpCloseLogFile(Request->LogFile, ELF_LOG_CLOSE_FORCE);
Request->LogFile->FileHandle = NULL; // For use later
//
// Open the file with delete access in order to rename it.
//
InitializeObjectAttributes(&ObjectAttributes,
Request->LogFile->LogFileName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
Status = NtOpenFile(&ClearHandle,
GENERIC_READ | DELETE | SYNCHRONIZE,
&ObjectAttributes,
&IoStatusBlock,
FILE_SHARE_DELETE,
FILE_SYNCHRONOUS_IO_NONALERT);
if (NT_SUCCESS(Status))
{
//
// If the backup file name has been specified and is not NULL,
// then we move the current file to the new file. If that fails,
// then fail the whole operation.
//
if ((Request->Pkt.ClearPkt->BackupFileName != NULL)
&&
(Request->Pkt.ClearPkt->BackupFileName->Length != 0))
{
FileName = Request->Pkt.ClearPkt->BackupFileName;
//
// Set up the rename information structure with the new name
//
NewName = ElfpAllocateBuffer(FileName->Length
+ sizeof(WCHAR) + sizeof(*NewName));
if (NewName)
{
RtlCopyMemory(NewName->FileName,
FileName->Buffer,
FileName->Length);
//
// Guarantee that it's NULL terminated
//
NewName->FileName[FileName->Length / sizeof(WCHAR)] = L'\0';
NewName->ReplaceIfExists = FALSE;
NewName->RootDirectory = NULL;
NewName->FileNameLength = FileName->Length;
Status = NtSetInformationFile(ClearHandle,
&IoStatusBlock,
NewName,
FileName->Length + sizeof(*NewName),
FileRenameInformation);
if (Status == STATUS_NOT_SAME_DEVICE)
{
//
// They want the backup file to be on a different
// device. We need to copy this one, and then delete
// it.
//
ELF_LOG2(FILES,
"PerformClearRequest: Attempting to copy log file %ws "
"to different device (%ws)\n",
Request->LogFile->LogFileName->Buffer,
NewName->FileName);
Status = ElfpCopyFile(ClearHandle, FileName);
if (NT_SUCCESS(Status))
{
ELF_LOG1(FILES,
"PerformClearRequest: Copy succeeded -- deleting %ws\n",
Request->LogFile->LogFileName->Buffer);
Status = NtSetInformationFile(ClearHandle,
&IoStatusBlock,
&DeleteInfo,
sizeof(DeleteInfo),
FileDispositionInformation);
if (!NT_SUCCESS (Status))
{
ELF_LOG2(ERROR,
"PerformClearRequest: Delete of %ws after "
"successful copy failed %#x\n",
Request->LogFile->LogFileName->Buffer,
Status);
}
}
}
else if (NT_SUCCESS (Status))
{
FileRenamed = TRUE;
}
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"PerformClearRequest: Rename of %ws failed %#x\n",
Request->LogFile->LogFileName->Buffer,
Status);
}
}
else
{
ELF_LOG0(ERROR,
"PerformClearRequest: Unable to allocate memory for "
"FILE_RENAME_INFORMATION structure\n");
Status = STATUS_NO_MEMORY;
}
}
else
{
//
// No backup name was specified. Just delete the log file
// (i.e. "clear it"). We can just delete it since we know
// that the first time anything is written to a log file,
// if that file does not exist, it is created and a header
// is written to it. By deleting it here, we make it cleaner
// to manage log files, and avoid having zero-length files all
// over the disk.
//
ELF_LOG1(FILES,
"PerformClearRequest: No backup name specified -- deleting %ws\n",
Request->LogFile->LogFileName->Buffer);
Status = NtSetInformationFile(ClearHandle,
&IoStatusBlock,
&DeleteInfo,
sizeof(DeleteInfo),
FileDispositionInformation);
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"PerformClearRequest: Delete of %ws failed %#x\n",
Request->LogFile->LogFileName->Buffer,
Status);
}
}
IStatus = NtClose(ClearHandle); // Discard status
ASSERT(NT_SUCCESS(IStatus));
}
else
{
//
// The open-for-delete failed.
//
ELF_LOG2(ERROR,
"PerformClearRequest: NtOpenFile of %ws for delete failed %#x\n",
Request->LogFile->LogFileName->Buffer,
Status);
}
//
// If the user reduced the size of the log file, pick up the new
// size as it couldn't be used until the log was cleared
//
if (NT_SUCCESS (Status))
{
if (Request->LogFile->NextClearMaxFileSize)
{
Request->LogFile->ConfigMaxFileSize = Request->LogFile->NextClearMaxFileSize;
}
//
// We need to recreate the file or if the file was just closed,
// then we reopen it.
//
IStatus = ElfOpenLogFile(Request->LogFile, ElfNormalLog);
if (!NT_SUCCESS(IStatus))
{
ELF_LOG2(ERROR,
"PerformClearRequest: Open of %ws after successful delete "
"failed %#x\n",
Request->LogFile->LogFileName->Buffer,
IStatus);
Status = IStatus;
//
// The open failed -- try to restore the old log file. If
// NewName is NULL, it means there was no backup file specified.
//
if (NewName != NULL)
{
//
// Opening the new log file failed, reopen the old log and
// return this error from the Api
//
PFILE_RENAME_INFORMATION OldName;
UNICODE_STRING UnicodeString;
//
// There shouldn't be any way to fail unless we successfully
// renamed the file, and there's no recovery if that happens.
//
//
// BUGBUG: We can hit this if the user asked for the backup
// file to be put on a different device, in which
// case the delete succeeded but FileRenamed is
// still set to FALSE if ElfOpenLogFile fails.
//
ASSERT(FileRenamed == TRUE);
//
// Rename the file back to the original name. Reuse ClearHandle.
//
RtlInitUnicodeString(&UnicodeString, NewName->FileName);
InitializeObjectAttributes(&ObjectAttributes,
&UnicodeString,
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
IStatus = NtOpenFile(&ClearHandle,
GENERIC_READ | DELETE | SYNCHRONIZE,
&ObjectAttributes,
&IoStatusBlock,
FILE_SHARE_DELETE,
FILE_SYNCHRONOUS_IO_NONALERT);
if (NT_SUCCESS(IStatus))
{
//
// Set up the rename information structure with the old name
//
OldName = ElfpAllocateBuffer(Request->LogFile->LogFileName->Length
+ sizeof(WCHAR) + sizeof(*OldName));
if (OldName)
{
PUNICODE_STRING pFileName = Request->LogFile->LogFileName;
RtlCopyMemory(OldName->FileName,
pFileName->Buffer,
pFileName->Length);
//
// Guarantee that it's NULL terminated
//
OldName->FileName[pFileName->Length / sizeof(WCHAR)] = L'\0';
OldName->ReplaceIfExists = FALSE;
OldName->RootDirectory = NULL;
OldName->FileNameLength = pFileName->Length;
//
// Change the name of the backed-up (i.e., cleared) log
// file to its original name.
//
IStatus = NtSetInformationFile(ClearHandle,
&IoStatusBlock,
OldName,
pFileName->Length
+ sizeof(*OldName)
+ sizeof(WCHAR),
FileRenameInformation);
ASSERT(NT_SUCCESS(IStatus));
//
// Reopen the original file. This has to work.
//
IStatus = ElfOpenLogFile(Request->LogFile, ElfNormalLog);
ASSERT(NT_SUCCESS(IStatus));
ElfpFreeBuffer(OldName);
}
NtClose(ClearHandle);
}
else
{
ELF_LOG2(ERROR,
"PerformClearRequest: Open of backed-up log file %ws "
"failed %#x\n",
NewName->FileName,
IStatus);
}
}
}
}
else
{
//
// The delete failed for some reason -- reopen the original log file
//
ELF_LOG1(FILES,
"PerformClearRequest: Delete of %ws failed -- reopening original file\n",
Request->LogFile->LogFileName->Buffer);
IStatus = ElfOpenLogFile(Request->LogFile, ElfNormalLog);
ASSERT(NT_SUCCESS(IStatus));
}
Request->LogFile->RefCount = FileRefCount; // Restore old value.
if (Request->LogFile->logpLogPopup == LOGPOPUP_ALREADY_SHOWN)
{
//
// This log has a viewable popup (i.e., it's not LOGPOPUP_NEVER_SHOW),
// so we should show it again if the log fills up.
//
Request->LogFile->logpLogPopup = LOGPOPUP_CLEARED;
}
Request->LogFile->bFullAlertDone = FALSE;
//
// Mark any open context handles that point to this file as "invalid for
// read." This will fail any further READ operations and force the caller
// to close and reopen the handle.
//
InvalidateContextHandlesForLogFile(Request->LogFile);
//
// Set status field in the request packet.
//
Request->Status = Status;
//
// Release the resource
//
RtlReleaseResource(&Request->Module->LogFile->Resource);
ElfpFreeBuffer(NewName);
}
VOID
PerformBackupRequest(
PELF_REQUEST_RECORD Request
)
/*++
Routine Description:
This routine will back up the log file specified.
This routine impersonates the client in order to ensure that the correct
access control is used.
This routine is entered with the ElfGlobalResource held in a shared
state and the logfile lock is acquired shared to prevent writing, but
allow people to still read.
This copies the file in two chunks, from the first record to the end
of the file, and then from the top of the file (excluding the header)
to the end of the EOF record.
Arguments:
Pointer to the request packet.
Return Value:
NONE, status is placed in the packet for later use by the API wrapper
--*/
{
NTSTATUS Status, IStatus;
IO_STATUS_BLOCK IoStatusBlock;
OBJECT_ATTRIBUTES ObjectAttributes;
LARGE_INTEGER MaximumSizeOfSection;
LARGE_INTEGER Offset;
ULONG LastRecordNumber;
ULONG OldestRecordNumber;
HANDLE BackupHandle = INVALID_HANDLE_VALUE;
PBYTE StartOfCopy;
PBYTE EndOfCopy;
ULONG BytesToCopy;
ULONG EndRecord = FILEHEADERBUFSIZE;
BOOL ImpersonatingClient = FALSE;
ELF_LOGFILE_HEADER FileHeaderBuf = { FILEHEADERBUFSIZE, // Size
ELF_LOG_FILE_SIGNATURE,
ELF_VERSION_MAJOR,
ELF_VERSION_MINOR,
FILEHEADERBUFSIZE, // Start offset
FILEHEADERBUFSIZE, // End offset
1, // Next record #
1, // Oldest record #
0, // Maxsize
0, // Flags
0, // Retention
FILEHEADERBUFSIZE // Size
};
//
// Get shared access to the log file. This will ensure no one
// else clears the file.
//
RtlAcquireResourceShared(&Request->Module->LogFile->Resource,
TRUE); // Wait until available
//
// Save away the next record number. We'll stop copying when we get to
// the record before this one. Also save the first record number so we
// can update the header and EOF record.
//
LastRecordNumber = Request->LogFile->CurrentRecordNumber;
OldestRecordNumber = Request->LogFile->OldestRecordNumber;
//
// Impersonate the client
//
Status = I_RpcMapWin32Status(RpcImpersonateClient(NULL));
if (NT_SUCCESS(Status))
{
//
// Keep this info so I can only revert in 1 place
//
ImpersonatingClient = TRUE;
//
// Set up the object attributes structure for the backup file
//
InitializeObjectAttributes(&ObjectAttributes,
Request->Pkt.BackupPkt->BackupFileName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
//
// Open the backup file. Fail if a file by this name already exists.
//
MaximumSizeOfSection =
RtlConvertUlongToLargeInteger(Request->LogFile->ActualMaxFileSize);
Status = NtCreateFile(&BackupHandle,
GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE,
&ObjectAttributes,
&IoStatusBlock,
&MaximumSizeOfSection,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_CREATE,
FILE_WRITE_THROUGH | FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"PerformBackupRequest: Open of backup file %ws failed %#x\n",
Request->Pkt.BackupPkt->BackupFileName->Buffer,
Status);
goto errorexit;
}
//
// Write out the header, we'll update it later
//
FileHeaderBuf.CurrentRecordNumber = LastRecordNumber;
FileHeaderBuf.OldestRecordNumber = OldestRecordNumber;
FileHeaderBuf.Flags = 0;
FileHeaderBuf.Retention = Request->LogFile->Retention;
Status = NtWriteFile(BackupHandle, // Filehandle
NULL, // Event
NULL, // APC routine
NULL, // APC context
&IoStatusBlock, // IO_STATUS_BLOCK
&FileHeaderBuf, // Buffer
FILEHEADERBUFSIZE, // Length
NULL, // Byteoffset
NULL); // Key
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"PerformBackupRequest: Write of header to backup file %ws "
"failed %#x\n",
Request->Pkt.BackupPkt->BackupFileName->Buffer,
Status);
goto errorexit;
}
//
// Scan from the end of the file skipping over ELF_SKIP_DWORDs
// to figure out how far to copy. If we haven't wrapped, we just
// copy to the EndRecord offset.
//
if (Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP)
{
EndOfCopy = (PBYTE) Request->LogFile->BaseAddress
+ Request->LogFile->ActualMaxFileSize - sizeof(DWORD);
while (*((PDWORD) EndOfCopy) == ELF_SKIP_DWORD)
{
EndOfCopy -= sizeof(DWORD);
}
EndOfCopy += sizeof(DWORD);
}
else
{
EndOfCopy = (PBYTE) Request->LogFile->BaseAddress
+ Request->LogFile->EndRecord;
}
//
// Now set the start position to be the first record and
// calculate the number of bytes to copy
//
StartOfCopy = (PBYTE) Request->LogFile->BaseAddress
+ Request->LogFile->BeginRecord;
BytesToCopy = (ULONG) (EndOfCopy - StartOfCopy);
EndRecord += BytesToCopy;
Status = NtWriteFile(BackupHandle, // Filehandle
NULL, // Event
NULL, // APC routine
NULL, // APC context
&IoStatusBlock, // IO_STATUS_BLOCK
StartOfCopy, // Buffer
BytesToCopy, // Length
NULL, // Byteoffset
NULL); // Key
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"PerformBackupRequest: Block write to backup file %ws (1st "
"call) failed %#x\n",
Request->Pkt.BackupPkt->BackupFileName->Buffer,
Status);
goto errorexit;
}
//
// If the file's not wrapped, we're done except for the EOF
// record. If the file is wrapped we have to copy the 2nd
// piece
//
if (Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP)
{
StartOfCopy = (PBYTE) Request->LogFile->BaseAddress
+ FILEHEADERBUFSIZE;
EndOfCopy = (PBYTE) Request->LogFile->BaseAddress
+ Request->LogFile->EndRecord;
BytesToCopy = (ULONG) (EndOfCopy - StartOfCopy);
EndRecord += BytesToCopy;
Status = NtWriteFile(BackupHandle, // Filehandle
NULL, // Event
NULL, // APC routine
NULL, // APC context
&IoStatusBlock, // IO_STATUS_BLOCK
StartOfCopy, // Buffer
BytesToCopy, // Length
NULL, // Byteoffset
NULL); // Key
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"PerformBackupRequest: Block write to backup file %ws "
"(2nd call) failed %#x\n",
Request->Pkt.BackupPkt->BackupFileName->Buffer,
Status);
goto errorexit;
}
}
//
// Write out the EOF record after updating the fields needed for
// recovery.
//
EOFRecord.BeginRecord = FILEHEADERBUFSIZE;
EOFRecord.EndRecord = EndRecord;
EOFRecord.CurrentRecordNumber = LastRecordNumber;
EOFRecord.OldestRecordNumber = OldestRecordNumber;
Status = NtWriteFile(BackupHandle, // Filehandle
NULL, // Event
NULL, // APC routine
NULL, // APC context
&IoStatusBlock, // IO_STATUS_BLOCK
&EOFRecord, // Buffer
ELFEOFRECORDSIZE, // Length
NULL, // Byteoffset
NULL); // Key
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"PerformBackupRequest: Write of EOF record to backup file "
"%ws failed %#x\n",
Request->Pkt.BackupPkt->BackupFileName->Buffer,
Status);
goto errorexit;
}
//
// Update the header with valid information
//
FileHeaderBuf.EndOffset = EndRecord;
FileHeaderBuf.MaxSize = EndRecord + ELFEOFRECORDSIZE;
Offset = RtlConvertUlongToLargeInteger(0);
Status = NtWriteFile(BackupHandle, // Filehandle
NULL, // Event
NULL, // APC routine
NULL, // APC context
&IoStatusBlock, // IO_STATUS_BLOCK
&FileHeaderBuf, // Buffer
FILEHEADERBUFSIZE, // Length
&Offset, // Byteoffset
NULL); // Key
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"PerformBackupRequest: Rewrite of header to backup file "
"%ws failed %#x\n",
Request->Pkt.BackupPkt->BackupFileName->Buffer,
Status);
goto errorexit;
}
//
// Clear the LogFile flag archive bit, assuming the caller will
// clear (or has cleared) this log's archive file attribute.
// Note: No big deal if the caller didn't clear the archive
// attribute.
//
// The next write to this log tests the LogFile flag archive bit.
// If the bit is clear, the archive file attribute is set on the
// log file.
//
Request->LogFile->Flags &= ~ELF_LOGFILE_ARCHIVE_SET;
}
else
{
ELF_LOG1(ERROR,
"PerformBackupRequest: RpcImpersonateClient failed %#x\n",
Status);
}
errorexit:
if (ImpersonatingClient)
{
IStatus = I_RpcMapWin32Status(RpcRevertToSelf());
if (!NT_SUCCESS(IStatus))
{
ELF_LOG1(ERROR,
"PerformBackupRequest: RpcRevertToSelf failed %#x\n",
IStatus);
}
}
//
// Close the output file
//
if (BackupHandle != INVALID_HANDLE_VALUE)
{
NtClose(BackupHandle);
}
//
// Set status field in the request packet.
//
Request->Status = Status;
//
// Release the resource
//
RtlReleaseResource(&Request->Module->LogFile->Resource);
}
VOID
ElfPerformRequest(
PELF_REQUEST_RECORD Request
)
/*++
Routine Description:
This routine takes the request packet and performs the operation
on the event log.
Before it does that, it takes the Global serialization resource
for a READ to prevent other threads from doing WRITE operations on
the resources of the service.
After it has performed the requested operation, it writes any records
generated by the eventlog service that have been put on the queued event
list.
Arguments:
Pointer to the request packet.
Return Value:
NONE
--*/
{
BOOL Acquired = FALSE;
//
// Acquire the global resource for shared access. If the resource is
// not immediately available (i.e., don't wait) then some other thread
// has it out for exclusive access.
//
// If we time out, one of two threads owns the global resource:
//
// 1) Thread monitoring the registry
// We can wait for this thread to finish so that the
// operation can continue.
//
// 2) Control thread
// In this case, it may turn out that the service is
// stopping. We examine the current service state to
// see if it is still running. If so, we loop around
// and try to get the resource again.
//
while ((GetElState() == RUNNING) && (!Acquired))
{
Acquired = RtlAcquireResourceShared(&GlobalElfResource,
FALSE); // Don't wait
if (!Acquired)
{
ELF_LOG1(TRACE,
"ElfPerformRequest: Sleep %d milliseconds waiting "
"for global resource\n",
ELF_GLOBAL_RESOURCE_WAIT);
Sleep(ELF_GLOBAL_RESOURCE_WAIT);
}
}
//
// If the resource was not available and the status of the service
// changed to one of the "non-working" states, then we just return
// unsuccesful. Rpc should not allow this to happen.
//
if (!Acquired)
{
ELF_LOG0(TRACE,
"ElfPerformRequest: Global resource not acquired\n");
Request->Status = STATUS_UNSUCCESSFUL;
}
else
{
switch (Request->Command)
{
case ELF_COMMAND_READ:
//
// The read/write code paths are high risk for exceptions.
// Ensure exceptions do not go beyond this point. Otherwise,
// services.exe will be taken out. Note that the try-except
// blocks are in PerformReadRequest and PerformWriteRequest
// since the risky calls are between calls to acquire and
// release a resource -- if the block were out here, a thrown
// exception would prevent the releasing of the resource
// (Bug #175768)
//
PerformReadRequest(Request);
break;
case ELF_COMMAND_WRITE:
PerformWriteRequest (Request);
break;
case ELF_COMMAND_CLEAR:
PerformClearRequest(Request);
break;
case ELF_COMMAND_BACKUP:
PerformBackupRequest(Request);
break;
case ELF_COMMAND_WRITE_QUEUED:
break;
}
//
// Now run the queued event list dequeueing elements and
// writing them
//
if (!IsListEmpty(&QueuedEventListHead))
{
//
// There are things queued up to write, do it
//
WriteQueuedEvents();
}
//
// Release the global resource.
//
ReleaseGlobalResource();
}
}
/****
@func NTSTATUS | FindSizeofEventsSinceStart| This routine walks
through all the logfile structures and returns the size of
events that were reported since the start of the eventlog service
and that need to be proapagated through the cluster-wide replicated
logs. For all logfiles that are returned in the list, the shared
lock for their log file is held and must be released by the caller.
@parm OUT PULONG | pulSize | Pointer to a LONG that contains the size on return.
@parm OUT PULONG | pulNumLogFiles | Pointer to a LONG that number of log files
configured for eventlogging.
@parm OUT PPROPLOGFILEINFO | *ppPropLogFileInfo | A pointer to a PROPLOGFILEINFO with
all the information about events that need to be propagated is returned via this.
@rdesc Returns a result code. ERROR_SUCCESS on success.
@comm This is called by ElfrRegisterClusterSvc
@xref <f ElfrRegisterClusterSvc>
****/
NTSTATUS
FindSizeofEventsSinceStart(
OUT PULONG pulTotalEventSize,
OUT PULONG pulNumLogFiles,
OUT PPROPLOGFILEINFO *ppPropLogFileInfo
)
{
PLOGFILE pLogFile;
PVOID pStartPropPosition;
PVOID pEndPropPosition;
ULONG ulSize;
ULONG ulNumLogFiles;
PPROPLOGFILEINFO pPropLogFileInfo = NULL;
UINT i;
PVOID PhysicalEOF; // Physical end of file
PVOID PhysStart; // Physical start of file (after file hdr)
PVOID BeginRecord; // Points to first record
PVOID EndRecord; // Points to byte after last record
ELF_REQUEST_RECORD Request; // points to the elf request
NTSTATUS Status = STATUS_SUCCESS;
READ_PKT ReadPkt;
//
// Lock the linked list
//
RtlEnterCriticalSection(&LogFileCritSec);
//
// Initialize the number of files
//
ulNumLogFiles = 0; // Count of files
//
// Initialize the number of files/total event size
//
*pulNumLogFiles = 0; // Count of files with events to be propagated
*pulTotalEventSize = 0;
//
// Count the number of files
// Initialize to the first logfile in the list
//
pLogFile = CONTAINING_RECORD(LogFilesHead.Flink,
LOGFILE,
FileList);
//
// While there are more
//
while(pLogFile->FileList.Flink != LogFilesHead.Flink)
{
ulNumLogFiles++;
//
// Advance to the next log file
//
pLogFile = CONTAINING_RECORD(pLogFile->FileList.Flink,
LOGFILE,
FileList);
}
ELF_LOG1(CLUSTER,
"FindSizeOfEventsSinceStart: %d log files\n",
ulNumLogFiles);
if (!ulNumLogFiles)
{
goto FnExit;
}
//
// Allocate a structure for log file info
//
pPropLogFileInfo =
(PPROPLOGFILEINFO) ElfpAllocateBuffer(ulNumLogFiles * sizeof(PROPLOGFILEINFO));
if (!pPropLogFileInfo)
{
ELF_LOG0(ERROR,
"FindSizeOfEventsSinceStart: Unable to allocate memory "
"for pPropLogFileInfo\n");
Status = STATUS_NO_MEMORY;
goto FnExit;
}
//
// Gather information about the files
// Initialize to the first logfile in the list
//
pLogFile = CONTAINING_RECORD(LogFilesHead.Flink,
LOGFILE,
FileList);
i = 0;
//
// While there are more
//
//
// BUGBUG: Based on the generation of ulNumLogFiles above, these
// two checks are actually identical
//
while ((pLogFile->FileList.Flink != LogFilesHead.Flink)
&&
(i < ulNumLogFiles))
{
ELF_LOG1(CLUSTER,
"FindSizeOfEventsSinceStart: Processing file %ws\n",
pLogFile->LogFileName->Buffer);
//
// Get shared access to the log file. This will allow multiple
// readers to get to the file together.
//
RtlAcquireResourceShared(&pLogFile->Resource,
TRUE); // Wait until available
//
// Check if any records need to be propagated
//
if (pLogFile->CurrentRecordNumber == pLogFile->SessionStartRecordNumber)
{
ELF_LOG1(CLUSTER,
"FindSizeOfEventsSinceStart: No records to propagate from %ws log\n",
pLogFile->LogModuleName->Buffer);
goto process_nextlogfile;
}
//
// Records need to be propagated, so find the positions in the
// file where they are logged
//
PhysicalEOF = (LPBYTE) pLogFile->BaseAddress
+ pLogFile->ViewSize;
PhysStart = (LPBYTE)pLogFile->BaseAddress
+ FILEHEADERBUFSIZE;
BeginRecord = (LPBYTE) pLogFile->BaseAddress
+ pLogFile->BeginRecord; // Start at first record
EndRecord = (LPBYTE)pLogFile->BaseAddress
+ pLogFile->EndRecord; // Byte after end of last record
//
// Set up the request structure
//
Request.Pkt.ReadPkt = &ReadPkt;
Request.LogFile = pLogFile;
//
// Set up the read packet structure for the first event logged in this session
//
Request.Pkt.ReadPkt->LastSeekPos = 0;
Request.Pkt.ReadPkt->ReadFlags = EVENTLOG_SEEK_READ | EVENTLOG_FORWARDS_READ;
Request.Pkt.ReadPkt->RecordNumber = pLogFile->SessionStartRecordNumber;
//
// Chittur Subbaraman (chitturs) - 3/22/99
//
// Enclose the SeekToStartingRecord within a try-except block to
// account for the eventlog getting corrupted under certain
// circumstances (such as the system crashing). You don't want to
// read such corrupt records.
//
try
{
//
// Find the size of events in this log file
//
Status = SeekToStartingRecord(&Request,
&pStartPropPosition,
BeginRecord,
EndRecord,
PhysicalEOF,
PhysStart);
}
except(EXCEPTION_EXECUTE_HANDLER)
{
ELF_LOG2(ERROR,
"FindSizeOfEventsSinceStart: Caught exception %#x while "
"seeking first record in %ws log\n",
GetExceptionCode(),
pLogFile->LogModuleName->Buffer);
Status = STATUS_EVENTLOG_FILE_CORRUPT;
}
//
// Skip this log file if error
//
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"FindSizeOfEventsSinceStart: SeekToStartingRecord (1st call) for %ws "
"log failed %#x\n",
pLogFile->LogModuleName->Buffer,
Status);
//
// Resetting status so that we skip only this file.
//
Status = STATUS_SUCCESS;
goto process_nextlogfile;
}
//
// SS: if this is not a valid position - the file could have wrapped since
// Should be try and find the last valid record after the session start record
// number then ? Since this is unlikely to happen-its not worth the trouble
// however valid position for session start record never succeeds even though
// it is valid, so we skip it
//
//
// Set up the read packet structure to seek till the start of the
// last record
//
//
// CODEWORK: We already have the position of the last record (via EndRecord)
// so just using ((PBYTE) EndRecord - *((PULONG) EndRecord - 1))
// should give the offset of the last record.
//
Request.Pkt.ReadPkt->LastSeekPos = 0;
Request.Pkt.ReadPkt->ReadFlags = EVENTLOG_SEEK_READ | EVENTLOG_FORWARDS_READ;
Request.Pkt.ReadPkt->RecordNumber = pLogFile->CurrentRecordNumber - 1;
//
// Chittur Subbaraman (chitturs) - 3/22/99
//
// Enclose the SeekToStartingRecord within a try-except block to
// account for the eventlog getting corrupted under certain
// circumstances (such as the system crashing). You don't want to
// read such corrupt records.
//
try
{
Status = SeekToStartingRecord(&Request,
&pEndPropPosition,
BeginRecord,
EndRecord,
PhysicalEOF,
PhysStart);
}
except(EXCEPTION_EXECUTE_HANDLER)
{
ELF_LOG2(ERROR,
"FindSizeOfEventsSinceStart: Caught exception %#x while "
"seeking last record in %ws log\n",
GetExceptionCode(),
pLogFile->LogModuleName->Buffer);
Status = STATUS_EVENTLOG_FILE_CORRUPT;
}
//
// Skip this log file if error
//
if (!NT_SUCCESS(Status))
{
ELF_LOG2(ERROR,
"FindSizeOfEventsSinceStart: SeekToStartingRecord (2nd call) for %ws "
"log failed %#x\n",
pLogFile->LogModuleName->Buffer,
Status);
//
// Resetting status so that we skip only this file.
//
Status = STATUS_SUCCESS;
goto process_nextlogfile;
}
//
// SS: if this is not a valid position - the file could have wrapped since
//
if (!ValidFilePos(pEndPropPosition,
BeginRecord,
EndRecord,
PhysicalEOF,
pLogFile->BaseAddress,
TRUE))
{
ELF_LOG1(ERROR,
"FindSizeOfEventsSinceStart: ValidFilePos for pEndPropPosition "
"in %ws log failed\n",
pLogFile->LogModuleName->Buffer);
goto process_nextlogfile;
}
//
// The end prop position
//
pEndPropPosition = (PBYTE) pEndPropPosition
+ ((PEVENTLOGRECORD)pEndPropPosition)->Length;
ELF_LOG3(CLUSTER,
"FindSizeOfEventsSinceStart: Log %ws, pStartPosition %p, pEndPosition %p\n",
pLogFile->LogModuleName->Buffer,
pStartPropPosition,
pEndPropPosition);
//
// If no records to propagate - skip the file
//
if (pStartPropPosition == pEndPropPosition)
{
ELF_LOG1(CLUSTER,
"FindSizeOfEventsSinceStart: Start and end positions in %ws log "
"are equal -- no events to propagate\n",
pLogFile->LogModuleName->Buffer);
goto process_nextlogfile;
}
if (pEndPropPosition > pStartPropPosition)
{
ulSize = (ULONG) ((PBYTE) pEndPropPosition - (PBYTE) pStartPropPosition);
}
else
{
//
// BUGBUG: This ignores any ELF_SKIP_DWORDs at the end of the file
//
ulSize = (ULONG) ((PBYTE) PhysicalEOF - (PBYTE) pStartPropPosition)
+
(ULONG) ((PBYTE)pEndPropPosition - (PBYTE)PhysStart);
}
ELF_LOG2(CLUSTER,
"FindSizeOfEventsSinceStart: Need to propagate %d bytes from %ws log\n",
ulSize,
pLogFile->LogModuleName->Buffer);
pPropLogFileInfo[i].pLogFile = pLogFile;
pPropLogFileInfo[i].pStartPosition = pStartPropPosition;
pPropLogFileInfo[i].pEndPosition = pEndPropPosition;
pPropLogFileInfo[i].ulTotalEventSize = ulSize;
pPropLogFileInfo[i].ulNumRecords = pLogFile->CurrentRecordNumber
- pLogFile->SessionStartRecordNumber;
i++;
(*pulNumLogFiles)++;
*pulTotalEventSize += ulSize;
//
// Advance to the next log file
//
pLogFile = CONTAINING_RECORD(pLogFile->FileList.Flink,
LOGFILE,
FileList);
//
// NB: We were successful with this log file and we therefore hold on to
// the lock -- the caller will/must release it.
//
continue;
process_nextlogfile:
//
// We were not successful with the log file -- release the lock
//
RtlReleaseResource(&pLogFile->Resource);
//
// Advance to the next log file
//
pLogFile = CONTAINING_RECORD(pLogFile->FileList.Flink,
LOGFILE,
FileList);
}
//
// Free the memory if unsuccessful
//
if (!(*pulNumLogFiles))
{
ElfpFreeBuffer(pPropLogFileInfo);
pPropLogFileInfo = NULL;
}
FnExit:
*ppPropLogFileInfo = pPropLogFileInfo;
ELF_LOG3(CLUSTER,
"FindSizeOfEventsSinceStart: ulTotalEventSize = %d, ulNumLogFiles = %d, "
"pPropLogFileInfo = %p\n",
*pulTotalEventSize,
*pulNumLogFiles,
*ppPropLogFileInfo);
//
// Unlock the linked list
//
RtlLeaveCriticalSection(&LogFileCritSec);
return Status;
}
/****
@func NTSTATUS | GetEventsToProp| Given a propagate log file
info structure, this events prepares a block of eventlog
records to propagate. The shared lock to the logfile must
be held thru when the PROPLOGINFO structure is prepared
to when this routine is called.
@parm OUT PEVENTLOGRECORD | pEventLogRecords | Pointer to a EVENTLOGRECORD
structure where the events to be propagated are returned.
@parm IN PPROPLOGFILEINFO | pPropLogFileInfo | Pointer to a PROPLOGFILEINFO
structure that contains the information to retrieve events from the
corresponding eventlog file.
@rdesc Returns a result code. ERROR_SUCCESS on success.
@xref
****/
NTSTATUS
GetEventsToProp(
IN PEVENTLOGRECORD pEventLogRecords,
IN PPROPLOGFILEINFO pPropLogFileInfo
)
{
PVOID BufferPosition;
PVOID XferPosition;
PVOID PhysicalEOF;
PVOID PhysicalStart;
ULONG ulBytesToMove;
NTSTATUS Status = STATUS_SUCCESS;
ELF_LOG1(CLUSTER,
"GetEventsToProp: Getting events for %ws log\n",
pPropLogFileInfo->pLogFile->LogModuleName->Buffer);
BufferPosition = pEventLogRecords;
ulBytesToMove = pPropLogFileInfo->ulTotalEventSize;
//
// If the start and end positions are the same there are no bytes to copy
//
if (pPropLogFileInfo->pStartPosition == pPropLogFileInfo->pEndPosition)
{
ASSERT(FALSE);
//
// Shouldn't come here as FindSizeofEventsSinceStart checks
// for this explicitly
//
return STATUS_SUCCESS;
}
//
// Chittur Subbaraman (chitturs) - 3/15/99
//
// Enclose the memcpy within a try-except block to account for
// the eventlog getting corrupted under certain circumstances (such
// as the system crashing). You don't want to read such corrupt
// records.
//
try
{
XferPosition = pPropLogFileInfo->pStartPosition;
ulBytesToMove = pPropLogFileInfo->ulTotalEventSize;
if (pPropLogFileInfo->pStartPosition > pPropLogFileInfo->pEndPosition)
{
//
// The log is wrapped -- copy the bytes from the start position
// to the end of the file
//
PhysicalEOF = (PBYTE) pPropLogFileInfo->pLogFile->BaseAddress
+ pPropLogFileInfo->pLogFile->ViewSize;
PhysicalStart = (PBYTE) pPropLogFileInfo->pLogFile->BaseAddress
+ FILEHEADERBUFSIZE;
//
// BUGBUG: This copies any ELF_SKIP_DWORDs that are at the
// end of the file
//
ulBytesToMove = (ULONG) ((PBYTE) PhysicalEOF
- (PBYTE) pPropLogFileInfo->pStartPosition);
RtlCopyMemory(BufferPosition, XferPosition, ulBytesToMove);
//
// Set it up for the second half
//
BufferPosition = (PBYTE) BufferPosition + ulBytesToMove;
ulBytesToMove = pPropLogFileInfo->ulTotalEventSize - ulBytesToMove;
XferPosition = PhysicalStart;
}
RtlCopyMemory(BufferPosition, XferPosition, ulBytesToMove);
}
except (EXCEPTION_EXECUTE_HANDLER)
{
ELF_LOG2(ERROR,
"GetEventsToProp: Caught exception %#x copying records from %ws log\n",
GetExceptionCode(),
pPropLogFileInfo->pLogFile->LogModuleName->Buffer);
Status = STATUS_EVENTLOG_FILE_CORRUPT;
}
return Status;
}
//SS:end of changes made to enable cluster wide event logging
Reference in a new issue Copy permalink