//+-----------------------------------------------------------------------
//
// Microsoft Windows
//
// Copyright (c) Microsoft Corporation 1999
//
// File: events.c
//
// Contents: Schannel event log functions.
//
// Functions: SchInitializeEvents
// SchReportEvent
// SchShutdownEvents
//
// History: 03-05-99 jbanes Created
//
//------------------------------------------------------------------------
#include "sslp.h"
#include <lsapmsgs.h>
#include <netlib.h>
HANDLE g_hEventLog = NULL;
HANDLE g_hDiscardDupEventLog = NULL;
WCHAR EventSourceName[] = TEXT("Schannel");
#define MAX_EVENT_STRINGS 8
#define SCH_MESSAGE_FILENAME TEXT("%SystemRoot%\\system32\\lsasrv.dll")
LPWSTR pszClientString = NULL;
LPWSTR pszServerString = NULL;
NTSTATUS
SchGetMessageString(
LPVOID Resource,
DWORD Index,
LPWSTR * pRetString);
//+---------------------------------------------------------------------------
//
// Function: SchInitializeEvents
//
// Synopsis: Connects to event log service.
//
// Arguments: (none)
//
// History: 03-05-99 jbanes Created
//
// Notes:
//
//----------------------------------------------------------------------------
BOOL
SchInitializeEvents(void)
{
HKEY hKey;
int err;
DWORD disp;
HMODULE hResource;
//
// Create registry entries, whether event logging is currently
// enabled or not.
//
err = RegCreateKeyEx( HKEY_LOCAL_MACHINE,
TEXT("System\\CurrentControlSet\\Services\\EventLog\\System\\Schannel"),
0,
TEXT(""),
REG_OPTION_NON_VOLATILE,
KEY_WRITE,
NULL,
&hKey,
&disp);
if(err)
{
return(FALSE);
}
if (disp == REG_CREATED_NEW_KEY)
{
RegSetValueEx( hKey,
TEXT("EventMessageFile"),
0,
REG_EXPAND_SZ,
(PBYTE)SCH_MESSAGE_FILENAME,
sizeof(SCH_MESSAGE_FILENAME) );
// RegSetValueEx( hKey,
// TEXT("CategoryMessageFile"),
// 0,
// REG_EXPAND_SZ,
// (PBYTE)SCH_MESSAGE_FILENAME,
// sizeof(SCH_MESSAGE_FILENAME) );
disp = 7;
RegSetValueEx( hKey,
TEXT("TypesSupported"),
0,
REG_DWORD,
(PBYTE) &disp,
sizeof(DWORD) );
// disp = CATEGORY_MAX_CATEGORY - 1;
// RegSetValueEx( hKey,
// TEXT("CategoryCount"),
// 0,
// REG_DWORD,
// (PBYTE) &disp,
// sizeof(DWORD) );
RegFlushKey(hKey);
}
RegCloseKey(hKey);
//
// Read the event text strings from the resource file.
//
hResource = (HMODULE)LoadLibrary(TEXT("lsasrv.dll"));
if(hResource == NULL)
{
return(FALSE);
}
SchGetMessageString(hResource,
SSLEVENTTEXT_CLIENT,
&pszClientString);
SchGetMessageString(hResource,
SSLEVENTTEXT_SERVER,
&pszServerString);
FreeLibrary(hResource);
return(TRUE);
}
//+---------------------------------------------------------------------------
//
// Function: SchReportEvent
//
// Synopsis: Reports an event to the event log
//
// Arguments: [EventType] -- EventType (ERROR, WARNING, etc.)
// [EventId] -- Event ID
// [SizeOfRawData] -- Size of raw data
// [RawData] -- Raw data
// [NumberOfStrings] -- number of strings
// ... -- PWSTRs to string data
//
// History: 03-05-99 jbanes Created
//
// Notes:
//
//----------------------------------------------------------------------------
DWORD
SchReportEvent(
IN DWORD LogLevel,
IN DWORD EventType,
IN DWORD EventId,
IN DWORD Category,
IN DWORD SizeOfRawData,
IN PVOID RawData,
IN DWORD NumberOfStrings,
...
)
{
va_list arglist;
ULONG i;
PWSTR Strings[ MAX_EVENT_STRINGS ];
PSTR StringsA[ MAX_EVENT_STRINGS ];
DWORD Status;
BOOL fDiscardDuplicates = TRUE;
BOOL fSuccess;
//
// Is this event supposed to be logged?
//
if ((g_dwEventLogging & LogLevel) == 0)
{
return ERROR_SUCCESS;
}
//
// Open the event log if necessary.
//
if(g_dwEventLogging == DEFAULT_EVENT_LOGGING_SETTING)
{
// Only log identical event once per hour.
if(g_hDiscardDupEventLog == NULL)
{
g_hDiscardDupEventLog = NetpEventlogOpen(EventSourceName, 60000*60);
if(g_hDiscardDupEventLog == NULL)
{
Status = GetLastError();
DebugLog((DEB_ERROR, "Could not open duplicate discard event log, error %d\n", Status));
return Status;
}
}
}
else
{
// Log all events.
if(g_hEventLog == NULL)
{
g_hEventLog = RegisterEventSource(NULL, EventSourceName);
if(g_hEventLog == NULL)
{
Status = GetLastError();
DebugLog((DEB_ERROR, "Could not open duplicate discard event log, error %d\n", Status));
return Status;
}
}
fDiscardDuplicates = FALSE;
}
//
// Look at the strings, if they were provided
//
va_start( arglist, NumberOfStrings );
if (NumberOfStrings > MAX_EVENT_STRINGS) {
NumberOfStrings = MAX_EVENT_STRINGS;
}
for (i=0; i<NumberOfStrings; i++)
{
Strings[ i ] = va_arg( arglist, PWSTR );
}
//
// Report the event to the eventlog service
//
if(fDiscardDuplicates)
{
fSuccess = NetpEventlogWriteEx(
g_hDiscardDupEventLog,
(WORD) EventType,
(WORD) Category,
EventId,
(WORD)NumberOfStrings,
SizeOfRawData,
Strings,
RawData);
}
else
{
fSuccess = ReportEvent(
g_hEventLog,
(WORD) EventType,
(WORD) Category,
EventId,
NULL,
(WORD)NumberOfStrings,
SizeOfRawData,
Strings,
RawData);
}
if(!fSuccess)
{
Status = GetLastError();
DebugLog((DEB_ERROR, "ReportEvent( %u ) failed - %u\n", EventId, Status));
}
else
{
Status = ERROR_SUCCESS;
}
return Status;
}
void
SchShutdownEvents(void)
{
if(g_hDiscardDupEventLog != NULL)
{
NetpEventlogClose(g_hDiscardDupEventLog);
g_hDiscardDupEventLog = NULL;
}
if(g_hEventLog != NULL)
{
DeregisterEventSource(g_hEventLog);
g_hEventLog = NULL;
}
if(pszClientString)
{
LocalFree(pszClientString);
pszClientString = NULL;
}
if(pszServerString)
{
LocalFree(pszServerString);
pszServerString = NULL;
}
}
void
LogSchannelStartedEvent(void)
{
SchReportEvent( DEB_TRACE,
EVENTLOG_INFORMATION_TYPE,
SSLEVENT_SCHANNEL_STARTED,
0,
0,
NULL,
0,
NULL );
}
void
LogGlobalAcquireContextFailedEvent(
LPWSTR pwszName,
DWORD Status)
{
WCHAR wszStatus[20];
_ltow(Status, wszStatus, 16);
SchReportEvent( DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_GLOBAL_ACQUIRE_CONTEXT_FAILED,
0,
0,
NULL,
2,
pwszName,
wszStatus);
}
void
LogCreateCredEvent(
DWORD dwProtocol,
PLSA_SCHANNEL_CRED pSchannelCred)
{
SchReportEvent(DEB_TRACE,
EVENTLOG_INFORMATION_TYPE,
SSLEVENT_CREATE_CRED,
0,
sizeof(SCHANNEL_CRED),
pSchannelCred,
1,
(dwProtocol & SP_PROT_SERVERS) ? pszServerString : pszClientString);
}
void
LogCredPropertiesEvent(
DWORD dwProtocol,
PCRYPT_KEY_PROV_INFO pProvInfo,
PCCERT_CONTEXT pCertContext)
{
WCHAR wszType[20];
WCHAR wszFlags[20];
LPWSTR pwszKeySpec;
if(!(g_dwEventLogging & DEB_TRACE))
{
return;
}
_ltow(pProvInfo->dwProvType, wszType, 10);
_ltow(pProvInfo->dwFlags, wszFlags, 16);
switch(pProvInfo->dwKeySpec)
{
case AT_KEYEXCHANGE:
pwszKeySpec = L"key exchange";
break;
case AT_SIGNATURE:
pwszKeySpec = L"signature";
break;
default:
pwszKeySpec = L"unknown";
}
SchReportEvent( DEB_TRACE,
EVENTLOG_INFORMATION_TYPE,
SSLEVENT_CRED_PROPERTIES,
0,
pCertContext->cbCertEncoded,
pCertContext->pbCertEncoded,
6,
(dwProtocol & SP_PROT_SERVERS) ? pszServerString : pszClientString,
pProvInfo->pwszProvName,
wszType,
pProvInfo->pwszContainerName,
pwszKeySpec,
wszFlags);
}
void
LogNoPrivateKeyEvent(
DWORD dwProtocol)
{
SchReportEvent( DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_NO_PRIVATE_KEY,
0,
0,
NULL,
1,
(dwProtocol & SP_PROT_SERVERS) ? pszServerString : pszClientString);
}
void
LogCredAcquireContextFailedEvent(
DWORD dwProtocol,
DWORD Status)
{
WCHAR wszStatus[20];
_ltow(Status, wszStatus, 16);
SchReportEvent( DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_CRED_ACQUIRE_CONTEXT_FAILED,
0,
0,
NULL,
2,
(dwProtocol & SP_PROT_SERVERS) ? pszServerString : pszClientString,
wszStatus);
}
void
LogCreateCredFailedEvent(
DWORD dwProtocol)
{
SchReportEvent(DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_CREATE_CRED_FAILED,
0,
0,
NULL,
1,
(dwProtocol & SP_PROT_SERVERS) ? pszServerString : pszClientString);
}
void
LogNoDefaultServerCredEvent(void)
{
SchReportEvent(DEB_ERROR,
EVENTLOG_WARNING_TYPE,
SSLEVENT_NO_DEFAULT_SERVER_CRED,
0,
0,
NULL,
0,
NULL);
}
void
LogNoCiphersSupportedEvent(void)
{
SchReportEvent(DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_NO_CIPHERS_SUPPORTED,
0,
0,
NULL,
0,
NULL);
}
void
LogCipherMismatchEvent(void)
{
SchReportEvent(DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_CIPHER_MISMATCH,
0,
0,
NULL,
0,
NULL);
}
void
LogNoClientCertFoundEvent(void)
{
SchReportEvent(DEB_WARN,
EVENTLOG_WARNING_TYPE,
SSLEVENT_NO_CLIENT_CERT_FOUND,
0,
0,
NULL,
0,
NULL);
}
void
LogBogusServerCertEvent(
PCCERT_CONTEXT pCertContext,
LPWSTR pwszServerName,
DWORD Status)
{
WCHAR wszStatus[20];
if(!(g_dwEventLogging & DEB_ERROR))
{
return;
}
switch(Status)
{
case SEC_E_CERT_EXPIRED:
SchReportEvent( DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_EXPIRED_SERVER_CERT,
0,
pCertContext->cbCertEncoded,
pCertContext->pbCertEncoded,
0,
NULL);
break;
case SEC_E_UNTRUSTED_ROOT:
SchReportEvent( DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_UNTRUSTED_SERVER_CERT,
0,
pCertContext->cbCertEncoded,
pCertContext->pbCertEncoded,
0,
NULL);
break;
case CRYPT_E_REVOKED:
SchReportEvent( DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_REVOKED_SERVER_CERT,
0,
pCertContext->cbCertEncoded,
pCertContext->pbCertEncoded,
0,
NULL);
break;
case SEC_E_WRONG_PRINCIPAL:
SchReportEvent( DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_NAME_MISMATCHED_SERVER_CERT,
0,
pCertContext->cbCertEncoded,
pCertContext->pbCertEncoded,
1,
pwszServerName);
break;
default:
_ltow(Status, wszStatus, 16);
SchReportEvent( DEB_ERROR,
EVENTLOG_ERROR_TYPE,
SSLEVENT_BOGUS_SERVER_CERT,
0,
pCertContext->cbCertEncoded,
pCertContext->pbCertEncoded,
1,
wszStatus);
}
}
void
LogBogusClientCertEvent(
PCCERT_CONTEXT pCertContext,
DWORD Status)
{
WCHAR wszStatus[20];
if(!(g_dwEventLogging & DEB_WARN))
{
return;
}
_ltow(Status, wszStatus, 16);
SchReportEvent( DEB_WARN,
EVENTLOG_WARNING_TYPE,
SSLEVENT_BOGUS_CLIENT_CERT,
0,
pCertContext->cbCertEncoded,
pCertContext->pbCertEncoded,
1,
wszStatus);
}
void
LogFastMappingFailureEvent(
PCCERT_CONTEXT pCertContext,
DWORD Status)
{
WCHAR wszStatus[20];
if(!(g_dwEventLogging & DEB_WARN))
{
return;
}
_ltow(Status, wszStatus, 16);
SchReportEvent( DEB_WARN,
EVENTLOG_WARNING_TYPE,
SSLEVENT_FAST_MAPPING_FAILURE,
0,
pCertContext->cbCertEncoded,
pCertContext->pbCertEncoded,
1,
wszStatus);
}
void
LogCertMappingFailureEvent(
DWORD Status)
{
WCHAR wszStatus[20];
if(!(g_dwEventLogging & DEB_WARN))
{
return;
}
_ltow(Status, wszStatus, 16);
SchReportEvent( DEB_WARN,
EVENTLOG_WARNING_TYPE,
SSLEVENT_CERT_MAPPING_FAILURE,
0,
0,
NULL,
1,
wszStatus);
}
void
LogHandshakeInfoEvent(
DWORD dwProtocol,
PCipherInfo pCipherInfo,
PHashInfo pHashInfo,
PKeyExchangeInfo pExchangeInfo,
DWORD dwExchangeStrength)
{
WCHAR wszCipherStrength[20];
WCHAR wszExchangeStrength[20];
LPWSTR pwszProtocol;
LPWSTR pwszCipher;
LPWSTR pwszHash;
LPWSTR pwszExchange;
if(!(g_dwEventLogging & DEB_TRACE))
{
return;
}
switch(dwProtocol)
{
case SP_PROT_PCT1_SERVER:
case SP_PROT_PCT1_CLIENT:
pwszProtocol = L"PCT";
break;
case SP_PROT_SSL2_SERVER:
case SP_PROT_SSL2_CLIENT:
pwszProtocol = L"SSL 2.0";
break;
case SP_PROT_SSL3_SERVER:
case SP_PROT_SSL3_CLIENT:
pwszProtocol = L"SSL 3.0";
break;
case SP_PROT_TLS1_SERVER:
case SP_PROT_TLS1_CLIENT:
pwszProtocol = L"TLS (SSL 3.1)";
break;
default:
pwszProtocol = L"unknown";
}
switch(pCipherInfo->aiCipher)
{
case CALG_RC4:
pwszCipher = L"RC4";
break;
case CALG_3DES:
pwszCipher = L"Triple-DES";
break;
case CALG_RC2:
pwszCipher = L"RC2";
break;
case CALG_DES:
pwszCipher = L"DES";
break;
case CALG_SKIPJACK:
pwszCipher = L"Skipjack";
break;
default:
pwszCipher = L"unknown";
}
_ltow(pCipherInfo->dwStrength, wszCipherStrength, 10);
switch(pHashInfo->aiHash)
{
case CALG_MD5:
pwszHash = L"MD5";
break;
case CALG_SHA:
pwszHash = L"SHA";
break;
default:
pwszHash = L"unknown";
}
switch(pExchangeInfo->aiExch)
{
case CALG_RSA_SIGN:
case CALG_RSA_KEYX:
pwszExchange = L"RSA";
break;
case CALG_KEA_KEYX:
pwszExchange = L"KEA";
break;
case CALG_DH_EPHEM:
pwszExchange = L"Ephemeral DH";
break;
default:
pwszExchange = L"unknown";
}
_ltow(dwExchangeStrength, wszExchangeStrength, 10);
SchReportEvent( DEB_TRACE,
EVENTLOG_INFORMATION_TYPE,
SSLEVENT_HANDSHAKE_INFO,
0,
0,
NULL,
7,
(dwProtocol & SP_PROT_SERVERS) ? pszServerString : pszClientString,
pwszProtocol,
pwszCipher,
wszCipherStrength,
pwszHash,
pwszExchange,
wszExchangeStrength);
}
NTSTATUS
SchGetMessageString(
LPVOID Resource,
DWORD Index,
LPWSTR * pRetString)
{
DWORD Length;
*pRetString = NULL;
Length = FormatMessage(FORMAT_MESSAGE_FROM_HMODULE |
FORMAT_MESSAGE_ALLOCATE_BUFFER,
Resource,
Index,
0, // Use caller's language
(LPWSTR)pRetString,
0,
NULL);
if(Length == 0 || *pRetString == NULL)
{
return(STATUS_RESOURCE_DATA_NOT_FOUND);
}
//
// Note that we are retrieving a message from a message file.
// This message will have a cr/lf tacked on the end of it
// (0x0d 0x0a) that we don't want to be part of our returned
// strings. However, we do need to null terminate our string
// so we will convert the 0x0d into a null terminator.
//
// Also note that FormatMessage() returns a character count,
// not a byte count. So, we have to do some adjusting to make
// the string lengths correct.
//
ASSERT(Length >= 2); // We always expect cr/lf on our strings
//
// Adjust character count
//
Length -= 1; // For the lf - we'll convert the cr.
//
// Set null terminator
//
(*pRetString)[Length - 1] = 0;
return(STATUS_SUCCESS);
}