mirror of https://github.com/tongzx/nt5src
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
4572 lines
151 KiB
4572 lines
151 KiB
/*++
|
|
|
|
Copyright (c) 1990-1994 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
operate.c
|
|
|
|
Abstract:
|
|
|
|
This file contains all the routines to perform operations on the
|
|
log files. They are called by the thread that performs requests.
|
|
|
|
Author:
|
|
|
|
Rajen Shah (rajens) 16-Jul-1991
|
|
|
|
Revision History:
|
|
|
|
04-Apr-1995 MarkBl
|
|
Resets the file archive attribute on log write. The backup caller
|
|
clears it.
|
|
29-Aug-1994 Danl
|
|
We no longer grow log files in place. Therefore, the ExtendSize
|
|
function will allocate a block that is as large as the old size plus
|
|
the size of the new block that must be added. If this allocation
|
|
succeeds, then it will free up the old block. If a failure occurs,
|
|
we continue to use the old block as if we have already grown as much
|
|
as we can.
|
|
22-Jul-1994 Danl
|
|
ValidFilePos: Changed test for pEndRecordLen > PhysicalEOF
|
|
so that it uses >=. In the case where pEndRecordLen == PhysicalEOF,
|
|
we want to wrap to find the last DWORD at the beginning of the File
|
|
(after the header).
|
|
|
|
08-Jul-1994 Danl
|
|
PerformWriteRequest: Fixed overwrite logic so that in the case where
|
|
a log is set up for always-overwrite, that we never go down the branch
|
|
that indicates the log was full. Previously, it would go down that
|
|
branch if the current time was less than the log time (ie. someone
|
|
set the clock back).
|
|
|
|
18-Apr-2001 a-jyotig
|
|
IsPositionWithinRange function changed to take 2 additional parameters
|
|
EOF and Base Address (BOF) and check if the position is between EOF
|
|
and BOF
|
|
--*/
|
|
|
|
/****
|
|
@doc EXTERNAL INTERFACES EVTLOG
|
|
****/
|
|
|
|
//
|
|
// INCLUDES
|
|
//
|
|
#include <eventp.h>
|
|
#include <alertmsg.h> // ALERT_ELF manifests
|
|
#include "elfmsg.h"
|
|
#include <strsafe.h>
|
|
#define OVERWRITE_AS_NEEDED 0x00000000
|
|
#define NEVER_OVERWRITE 0xffffffff
|
|
|
|
|
|
//
|
|
// Prototypes
|
|
//
|
|
|
|
VOID PerformClearRequest(PELF_REQUEST_RECORD Request);
|
|
|
|
BOOL
|
|
IsPositionWithinRange(
|
|
PVOID Position,
|
|
PVOID BeginningRecord,
|
|
PVOID EndingRecord,
|
|
PVOID PhysEOF,
|
|
PVOID BaseAddress
|
|
);
|
|
|
|
|
|
VOID
|
|
ElfExtendFile (
|
|
PLOGFILE pLogFile,
|
|
ULONG SpaceNeeded,
|
|
PULONG SpaceAvail
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine takes an open log file and extends the file and underlying
|
|
section and view if possible. If it can't be grown, it caps the file
|
|
at this size by setting the ConfigMaxFileSize to the Actual. It also
|
|
updates the SpaceAvail parm which is used in PerformWriteRequest (the
|
|
caller).
|
|
|
|
Arguments:
|
|
|
|
pLogFile - pointer to a LOGFILE structure for the open logfile
|
|
ExtendAmount - How much bigger to make the file/section/view
|
|
SpaceAvail - Update this with how much space was added to the section
|
|
|
|
Return Value:
|
|
|
|
None - If we can't extend the file, we just cap it at this size for the
|
|
duration of this boot. We'll try again the next time the eventlog
|
|
is closed and reopened.
|
|
|
|
Note:
|
|
|
|
ExtendAmount should always be granular to 64K.
|
|
|
|
--*/
|
|
{
|
|
LARGE_INTEGER NewSize;
|
|
NTSTATUS Status;
|
|
PVOID BaseAddress;
|
|
SIZE_T Size;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
|
|
//
|
|
// Calculate how much to grow the file then extend the section by
|
|
// that amount. Do this in 64K chunks.
|
|
//
|
|
SpaceNeeded = ((SpaceNeeded - *SpaceAvail) & 0xFFFF0000) + 0x10000;
|
|
|
|
if (SpaceNeeded > (pLogFile->ConfigMaxFileSize - pLogFile->ActualMaxFileSize))
|
|
{
|
|
//
|
|
// We can't grow it by the full amount we need. Grow
|
|
// it to the max size and let file wrap take over.
|
|
// If there isn't any room to grow, then return;
|
|
//
|
|
SpaceNeeded = pLogFile->ConfigMaxFileSize - pLogFile->ActualMaxFileSize;
|
|
|
|
if (SpaceNeeded == 0)
|
|
{
|
|
return;
|
|
}
|
|
}
|
|
|
|
NewSize = RtlConvertUlongToLargeInteger(pLogFile->ActualMaxFileSize + SpaceNeeded);
|
|
|
|
//
|
|
// Update the file size information, extend the section, and map the
|
|
// new section
|
|
//
|
|
Status = NtSetInformationFile(pLogFile->FileHandle,
|
|
&IoStatusBlock,
|
|
&NewSize,
|
|
sizeof(NewSize),
|
|
FileEndOfFileInformation);
|
|
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"ElfExtendFile: NtSetInformationFile for %ws log failed %#x\n",
|
|
pLogFile->LogModuleName->Buffer,
|
|
Status);
|
|
|
|
goto ErrorExit;
|
|
}
|
|
|
|
Status = NtExtendSection(pLogFile->SectionHandle, &NewSize);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"ElfExtendFile: NtExtendSection for %ws log failed %#x\n",
|
|
pLogFile->LogModuleName->Buffer,
|
|
Status);
|
|
|
|
goto ErrorExit;
|
|
}
|
|
|
|
//
|
|
// Now that the section is extended, we need to map the new section.
|
|
//
|
|
|
|
//
|
|
// Map a view of the entire section (with the extension).
|
|
// Allow the allocator to tell us where it is located, and
|
|
// what the size is.
|
|
//
|
|
BaseAddress = NULL;
|
|
Size = 0;
|
|
Status = NtMapViewOfSection(pLogFile->SectionHandle,
|
|
NtCurrentProcess(),
|
|
&BaseAddress,
|
|
0,
|
|
0,
|
|
NULL,
|
|
&Size,
|
|
ViewUnmap,
|
|
0,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
//
|
|
// If this fails, just exit, and we will continue with the
|
|
// view that we have.
|
|
//
|
|
ELF_LOG2(ERROR,
|
|
"ElfExtendFile: NtMapViewOfSection for %ws log failed %#x\n",
|
|
pLogFile->LogModuleName->Buffer,
|
|
Status);
|
|
|
|
goto ErrorExit;
|
|
}
|
|
|
|
//
|
|
// Unmap the old section.
|
|
//
|
|
Status = NtUnmapViewOfSection(NtCurrentProcess(),
|
|
pLogFile->BaseAddress);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"ElfExtendFile: NtUnmapeViewOfSection for %ws log failed %#x\n",
|
|
pLogFile->LogModuleName->Buffer,
|
|
Status);
|
|
}
|
|
|
|
pLogFile->BaseAddress = BaseAddress;
|
|
|
|
//
|
|
// We managed to extend the file, update the actual size
|
|
// and space available and press on.
|
|
//
|
|
if (pLogFile->Flags & ELF_LOGFILE_HEADER_WRAP)
|
|
{
|
|
//
|
|
// Since we're wrapped, we want to move the "unwrapped" portion (i.e.,
|
|
// everything from the first record to the end of the old file) down to
|
|
// be at the bottom of the new file
|
|
//
|
|
// The call below moves memory as follows:
|
|
//
|
|
// 1. Destination -- PhysicalEOF - the size of the region
|
|
// 2. Source -- Address of the start of the first record
|
|
// 3. Size -- Num. bytes in the old file -
|
|
// offset of the first record
|
|
//
|
|
//
|
|
// Note that at this point, we have the following relevant variables
|
|
//
|
|
// BaseAddress -- The base address of the mapped section
|
|
// Size -- The size of the enlarged section
|
|
// pLogFile->ViewSize -- The size of the old section
|
|
// pLogfile->BeginRecord -- The offset of the first log record
|
|
//
|
|
|
|
//
|
|
// Calculate the number of bytes to move
|
|
//
|
|
DWORD dwWrapSize = (DWORD)(pLogFile->ViewSize - pLogFile->BeginRecord);
|
|
|
|
ELF_LOG1(FILES,
|
|
"ElfExtendFile: %ws is wrapped\n",
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
RtlMoveMemory((LPBYTE)BaseAddress + Size - dwWrapSize,
|
|
(LPBYTE)BaseAddress + pLogFile->BeginRecord,
|
|
dwWrapSize);
|
|
|
|
//
|
|
// We've moved the BeginRecord -- update the offset
|
|
//
|
|
pLogFile->BeginRecord = (ULONG)(Size - dwWrapSize);
|
|
}
|
|
|
|
pLogFile->ViewSize = (ULONG)Size;
|
|
pLogFile->ActualMaxFileSize += SpaceNeeded;
|
|
*SpaceAvail += SpaceNeeded;
|
|
|
|
//
|
|
// Now flush this to disk to commit it
|
|
//
|
|
BaseAddress = pLogFile->BaseAddress;
|
|
Size = FILEHEADERBUFSIZE;
|
|
|
|
Status = NtFlushVirtualMemory(NtCurrentProcess(),
|
|
&BaseAddress,
|
|
&Size,
|
|
&IoStatusBlock);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"ElfExtendFile: NtFlushVirtualMemory for %ws log failed %#x\n",
|
|
pLogFile->LogModuleName->Buffer,
|
|
Status);
|
|
}
|
|
|
|
return;
|
|
|
|
ErrorExit:
|
|
|
|
//
|
|
// Couldn't extend the section for some reason. Just wrap the file now.
|
|
// Cap the file at this size, so we don't try and extend the section on
|
|
// every write. The next time the eventlog service is started up it
|
|
// will revert to the configured max again.
|
|
//
|
|
|
|
//
|
|
// BUGBUG: Generate an Alert here
|
|
//
|
|
ELF_LOG1(ERROR,
|
|
"ElfExtendFile: Couldn't extend %ws log\n",
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
pLogFile->ConfigMaxFileSize = pLogFile->ActualMaxFileSize;
|
|
|
|
return;
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS
|
|
CopyUnicodeToAnsiRecord (
|
|
OUT PVOID Dest OPTIONAL,
|
|
IN PVOID Src,
|
|
OUT PVOID *NewBufPos OPTIONAL,
|
|
OUT PULONG RecordSize
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine reads from the event log specified in the request packet.
|
|
|
|
This routine uses memory mapped I/O to access the log file. This makes
|
|
it much easier to move around the file.
|
|
|
|
Arguments:
|
|
|
|
Dest - Points to destination buffer. If NULL, calculate and return
|
|
the record length without copying the record.
|
|
|
|
Src - Points to the UNICODE record.
|
|
|
|
NewBufPos - Gets offset in Dest buffer after record just transferred.
|
|
If Dest is NULL, this is ignored.
|
|
|
|
RecordSize - Gets size of this (ANSI) record.
|
|
|
|
Return Value:
|
|
|
|
STATUS_SUCCESS if no errors occur. Specific NTSTATUS error otherwise.
|
|
|
|
Note:
|
|
|
|
--*/
|
|
{
|
|
ANSI_STRING StringA;
|
|
UNICODE_STRING StringU;
|
|
PEVENTLOGRECORD SrcRecord, DestRecord;
|
|
PWSTR pStringU;
|
|
PVOID TempPtr;
|
|
ULONG PadSize, i;
|
|
ULONG zero = 0;
|
|
WCHAR *SrcStrings, *DestStrings;
|
|
ULONG RecordLength, *pLength;
|
|
ULONG ulTempLength;
|
|
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
|
|
DestRecord = (PEVENTLOGRECORD)Dest;
|
|
SrcRecord = (PEVENTLOGRECORD)Src;
|
|
|
|
if (DestRecord != NULL)
|
|
{
|
|
DestRecord->TimeGenerated = SrcRecord->TimeGenerated;
|
|
DestRecord->Reserved = SrcRecord->Reserved;
|
|
DestRecord->RecordNumber = SrcRecord->RecordNumber;
|
|
DestRecord->TimeWritten = SrcRecord->TimeWritten;
|
|
DestRecord->EventID = SrcRecord->EventID;
|
|
DestRecord->EventType = SrcRecord->EventType;
|
|
DestRecord->EventCategory = SrcRecord->EventCategory;
|
|
DestRecord->NumStrings = SrcRecord->NumStrings;
|
|
DestRecord->UserSidLength = SrcRecord->UserSidLength;
|
|
DestRecord->DataLength = SrcRecord->DataLength;
|
|
}
|
|
|
|
//
|
|
// Convert and copy over modulename
|
|
//
|
|
pStringU = (PWSTR)((ULONG_PTR)SrcRecord + sizeof(EVENTLOGRECORD));
|
|
|
|
RtlInitUnicodeString(&StringU, pStringU);
|
|
|
|
if (DestRecord != NULL)
|
|
{
|
|
Status = RtlUnicodeStringToAnsiString(&StringA,
|
|
&StringU,
|
|
TRUE);
|
|
|
|
ulTempLength = StringA.MaximumLength;
|
|
}
|
|
else
|
|
{
|
|
ulTempLength = RtlUnicodeStringToAnsiSize(&StringU);
|
|
}
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
TempPtr = (PVOID)((ULONG_PTR)DestRecord + sizeof(EVENTLOGRECORD));
|
|
|
|
if (DestRecord != NULL)
|
|
{
|
|
RtlMoveMemory ( TempPtr, StringA.Buffer, ulTempLength );
|
|
RtlFreeAnsiString(&StringA);
|
|
}
|
|
|
|
TempPtr = (PVOID)((ULONG_PTR) TempPtr + ulTempLength);
|
|
|
|
//
|
|
// Convert and copy over computername
|
|
//
|
|
// TempPtr points to location in the destination for the computername
|
|
//
|
|
|
|
pStringU = (PWSTR)((ULONG_PTR)pStringU + StringU.MaximumLength);
|
|
|
|
RtlInitUnicodeString ( &StringU, pStringU );
|
|
|
|
if (DestRecord != NULL)
|
|
{
|
|
Status = RtlUnicodeStringToAnsiString (
|
|
&StringA,
|
|
&StringU,
|
|
TRUE
|
|
);
|
|
|
|
ulTempLength = StringA.MaximumLength;
|
|
}
|
|
else
|
|
{
|
|
ulTempLength = RtlUnicodeStringToAnsiSize(&StringU);
|
|
}
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
if (DestRecord != NULL)
|
|
{
|
|
RtlMoveMemory ( TempPtr, StringA.Buffer, ulTempLength );
|
|
RtlFreeAnsiString(&StringA);
|
|
}
|
|
|
|
TempPtr = (PVOID)((ULONG_PTR) TempPtr + ulTempLength);
|
|
}
|
|
}
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
// TempPtr points to location after computername - i.e. UserSid.
|
|
// Before we write out the UserSid, we ensure that we pad the
|
|
// bytes so that the UserSid starts on a DWORD boundary.
|
|
//
|
|
PadSize = sizeof(ULONG)
|
|
- (ULONG)(((ULONG_PTR)TempPtr-(ULONG_PTR)DestRecord) % sizeof(ULONG));
|
|
|
|
if (DestRecord != NULL)
|
|
{
|
|
RtlMoveMemory (TempPtr, &zero, PadSize);
|
|
|
|
TempPtr = (PVOID)((ULONG_PTR)TempPtr + PadSize);
|
|
|
|
//
|
|
// Copy over the UserSid.
|
|
//
|
|
|
|
RtlMoveMemory(TempPtr,
|
|
(PVOID)((ULONG_PTR)SrcRecord + SrcRecord->UserSidOffset),
|
|
SrcRecord->UserSidLength);
|
|
|
|
DestRecord->UserSidOffset = (ULONG)((ULONG_PTR)TempPtr - (ULONG_PTR)DestRecord);
|
|
}
|
|
else
|
|
{
|
|
TempPtr = (PVOID)((ULONG_PTR)TempPtr + PadSize);
|
|
}
|
|
|
|
//
|
|
// Copy over the Strings
|
|
//
|
|
TempPtr = (PVOID)((ULONG_PTR)TempPtr + SrcRecord->UserSidLength);
|
|
SrcStrings = (WCHAR *)((ULONG_PTR)SrcRecord + (ULONG)SrcRecord->StringOffset);
|
|
DestStrings = (WCHAR *)TempPtr;
|
|
|
|
for (i=0; i < SrcRecord->NumStrings; i++)
|
|
{
|
|
RtlInitUnicodeString (&StringU, SrcStrings);
|
|
|
|
if (DestRecord != NULL)
|
|
{
|
|
Status = RtlUnicodeStringToAnsiString(&StringA,
|
|
&StringU,
|
|
TRUE);
|
|
|
|
ulTempLength = StringA.MaximumLength;
|
|
}
|
|
else
|
|
{
|
|
ulTempLength = RtlUnicodeStringToAnsiSize(&StringU);
|
|
}
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
//
|
|
// Bail out
|
|
//
|
|
return Status;
|
|
}
|
|
|
|
if (DestRecord != NULL)
|
|
{
|
|
RtlMoveMemory(DestStrings,
|
|
StringA.Buffer,
|
|
ulTempLength);
|
|
|
|
RtlFreeAnsiString (&StringA);
|
|
}
|
|
|
|
DestStrings = (WCHAR*)((ULONG_PTR)DestStrings + (ULONG)ulTempLength);
|
|
SrcStrings = (WCHAR*)((ULONG_PTR)SrcStrings + (ULONG)StringU.MaximumLength);
|
|
}
|
|
|
|
//
|
|
// DestStrings points to the point after the last string copied.
|
|
//
|
|
if (DestRecord != NULL)
|
|
{
|
|
DestRecord->StringOffset = (ULONG)((ULONG_PTR)TempPtr - (ULONG_PTR)DestRecord);
|
|
|
|
TempPtr = (PVOID)DestStrings;
|
|
|
|
//
|
|
// Copy over the binary Data
|
|
//
|
|
DestRecord->DataOffset = (ULONG)((ULONG_PTR)TempPtr - (ULONG_PTR)DestRecord);
|
|
|
|
RtlMoveMemory(TempPtr,
|
|
(PVOID)((ULONG_PTR)SrcRecord + SrcRecord->DataOffset),
|
|
SrcRecord->DataLength);
|
|
}
|
|
else
|
|
{
|
|
TempPtr = (PVOID)DestStrings;
|
|
}
|
|
|
|
//
|
|
// Now do the pad bytes.
|
|
//
|
|
TempPtr = (PVOID) ((ULONG_PTR) TempPtr + SrcRecord->DataLength);
|
|
PadSize = sizeof(ULONG)
|
|
- (ULONG) (((ULONG_PTR) TempPtr - (ULONG_PTR) DestRecord) % sizeof(ULONG));
|
|
|
|
RecordLength = (ULONG) ((ULONG_PTR) TempPtr
|
|
+ PadSize
|
|
+ sizeof(ULONG)
|
|
- (ULONG_PTR)DestRecord);
|
|
|
|
if (DestRecord != NULL)
|
|
{
|
|
RtlMoveMemory (TempPtr, &zero, PadSize);
|
|
pLength = (PULONG)((ULONG_PTR)TempPtr + PadSize);
|
|
*pLength = RecordLength;
|
|
DestRecord->Length = RecordLength;
|
|
|
|
ASSERT(((ULONG_PTR) DestRecord + RecordLength) ==
|
|
((ULONG_PTR) pLength + sizeof(ULONG)));
|
|
|
|
*NewBufPos = (PVOID) ((ULONG_PTR) DestRecord + RecordLength);
|
|
}
|
|
|
|
*RecordSize = RecordLength;
|
|
}
|
|
|
|
return Status;
|
|
|
|
} // CopyUnicodeToAnsiRecord
|
|
|
|
|
|
BOOL
|
|
ValidFilePos (
|
|
PVOID Position,
|
|
PVOID BeginningRecord,
|
|
PVOID EndingRecord,
|
|
PVOID PhysicalEOF,
|
|
PVOID BaseAddress,
|
|
BOOL fCheckBeginEndRange
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine determines whether we are pointing to a valid beginning
|
|
of an event record in the event log. It does this by validating
|
|
the signature then comparing the length at the beginning of the record to
|
|
the length at the end, both of which have to be at least the size of the
|
|
fixed length portion of an eventlog record.
|
|
|
|
Arguments:
|
|
|
|
Position - Pointer to be verified.
|
|
BeginningRecord - Pointer to the beginning record in the file.
|
|
EndingRecord - Pointer to the byte after the ending record in the file.
|
|
PhysicalEOF - Pointer the physical end of the log.
|
|
BaseAddress - Pointer to the physical beginning of the log.
|
|
|
|
Return Value:
|
|
|
|
TRUE if this position is valid.
|
|
|
|
Note:
|
|
|
|
There is a possibility of error if a record just happens to have the
|
|
ULONG at the current position the same as the value that number of
|
|
bytes further on in the record. However, this is a very slim chance
|
|
as it must have a valid log signature as well.
|
|
|
|
--*/
|
|
{
|
|
PULONG pEndRecordLength;
|
|
BOOL fValid = TRUE;
|
|
|
|
PEVENTLOGRECORD pEventRecord;
|
|
|
|
|
|
try
|
|
{
|
|
pEventRecord = (PEVENTLOGRECORD)Position;
|
|
|
|
//
|
|
// Verify that the pointer is within the range of BEGINNING->END
|
|
//
|
|
if ( fCheckBeginEndRange )
|
|
{
|
|
fValid = IsPositionWithinRange(Position,
|
|
BeginningRecord,
|
|
EndingRecord,
|
|
PhysicalEOF,
|
|
BaseAddress);
|
|
}
|
|
|
|
//
|
|
// If the offset looks OK, then examine the lengths at the beginning
|
|
// and end of the current record. If they don't match, then the position
|
|
// is invalid.
|
|
//
|
|
if (fValid)
|
|
{
|
|
//
|
|
// Make sure the length is a multiple number of DWORDS
|
|
//
|
|
if (pEventRecord->Length & 3)
|
|
{
|
|
fValid = FALSE;
|
|
}
|
|
else
|
|
{
|
|
pEndRecordLength = (PULONG) ((PBYTE) Position + pEventRecord->Length) - 1;
|
|
|
|
//
|
|
// If the file is wrapped, adjust the pointer to reflect the
|
|
// portion of the record that is wrapped starting after the
|
|
// header
|
|
//
|
|
if ((PVOID) pEndRecordLength >= PhysicalEOF)
|
|
{
|
|
pEndRecordLength = (PULONG) ((PBYTE) BaseAddress +
|
|
((PBYTE) pEndRecordLength - (PBYTE) PhysicalEOF) +
|
|
FILEHEADERBUFSIZE);
|
|
}
|
|
|
|
// Do a sanity check on this pointer before dereferencing. DAVJ
|
|
|
|
if ((PVOID) pEndRecordLength > PhysicalEOF)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
if (pEventRecord->Length == *pEndRecordLength
|
|
&&
|
|
pEventRecord->Length == ELFEOFRECORDSIZE)
|
|
{
|
|
ULONG Size;
|
|
|
|
Size = min(ELFEOFUNIQUEPART,
|
|
(ULONG) ((PBYTE) PhysicalEOF - (PBYTE) pEventRecord));
|
|
|
|
if (RtlCompareMemory(pEventRecord,
|
|
&EOFRecord,
|
|
Size) == Size)
|
|
{
|
|
Size = ELFEOFUNIQUEPART - Size;
|
|
|
|
//
|
|
// If Size is non-zero, then the unique portion of
|
|
// the EOF record is wrapped across the end of file.
|
|
// Continue comparison at file beginning for the
|
|
// remainder of the record.
|
|
//
|
|
if ( Size )
|
|
{
|
|
PBYTE pRemainder = (PBYTE) &EOFRecord + ELFEOFUNIQUEPART - Size;
|
|
|
|
fValid = (RtlCompareMemory((PBYTE) BaseAddress + FILEHEADERBUFSIZE,
|
|
pRemainder,
|
|
Size) == Size);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
fValid = FALSE;
|
|
}
|
|
}
|
|
else if ((pEventRecord->Length < sizeof(EVENTLOGRECORD))
|
|
||
|
|
(pEventRecord->Reserved != ELF_LOG_FILE_SIGNATURE)
|
|
||
|
|
(pEventRecord->Length != *pEndRecordLength))
|
|
{
|
|
fValid = FALSE;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
except (EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"ValidFilePos: Exception %#x caught validating file position %p\n",
|
|
GetExceptionCode(),
|
|
BeginningRecord);
|
|
|
|
fValid = FALSE;
|
|
}
|
|
|
|
return fValid;
|
|
}
|
|
|
|
|
|
BOOL
|
|
IsPositionWithinRange(
|
|
PVOID Position,
|
|
PVOID BeginningRecord,
|
|
PVOID EndingRecord,
|
|
PVOID PhysEOF,
|
|
PVOID BaseAddress
|
|
)
|
|
{
|
|
//
|
|
// Verify that the pointer is within the range of [Beginning, End]
|
|
//
|
|
|
|
//This check was introduced to make sure that the position does not
|
|
//cross the file boundaries. Refer to Bug #370063. If required, one
|
|
//can change this check to make sure that the position lies between
|
|
//PhyStart i.e. BaseAddress + FILEHEADERBUFSIZE
|
|
|
|
if((Position < BaseAddress) || (Position > PhysEOF))
|
|
return FALSE;
|
|
|
|
else if (EndingRecord > BeginningRecord)
|
|
{
|
|
return ((Position >= BeginningRecord) && (Position <= EndingRecord));
|
|
}
|
|
else if (EndingRecord < BeginningRecord)
|
|
{
|
|
return ((Position >= BeginningRecord) || (Position <= EndingRecord));
|
|
}
|
|
|
|
//
|
|
// If BeginningRecord and EndingRecord are equal, it means that the only
|
|
// record in the log file is the EOF record. In that case, return FALSE
|
|
// as Position isn't pointing to a valid (i.e., non-EOF) record.
|
|
//
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
PVOID
|
|
FindStartOfNextRecord (
|
|
PVOID Position,
|
|
PVOID BeginningRecord,
|
|
PVOID EndingRecord,
|
|
PVOID PhysicalStart,
|
|
PVOID PhysicalEOF,
|
|
PVOID BaseAddress
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine starts at Position, and finds the beginning of the next
|
|
valid record, wrapping around the physical end of the file if necessary.
|
|
|
|
Arguments:
|
|
|
|
Position - Pointer at which to start the search.
|
|
BeginningRecord - Pointer to the beginning record in the file.
|
|
EndingRecord - Pointer to the byte after the ending record in the file.
|
|
PhysicalStart - Pointer to the start of log information (after header)
|
|
PhysicalEOF - Pointer to the physical end of the log.
|
|
BaseAddress - Pointer to the physical beginning of the log.
|
|
|
|
Return Value:
|
|
|
|
A pointer to the start of the next valid record, NULL if there is no
|
|
valid record.
|
|
|
|
Note:
|
|
|
|
There is a possibility of error if a record just happens to have the
|
|
ULONG at the current position the same as the value that number of
|
|
bytes further on in the record. However, this is a very slim chance
|
|
as it must have a valid log signature as well.
|
|
|
|
--*/
|
|
{
|
|
PULONG ptr;
|
|
PULONG EndOfBlock;
|
|
PULONG EndOfFile;
|
|
PVOID pRecord;
|
|
ULONG Size;
|
|
BOOL StillLooking = TRUE;
|
|
|
|
//
|
|
// Search for a ULONG which matches a record signature
|
|
//
|
|
ptr = (PULONG) Position;
|
|
EndOfBlock = EndOfFile = (PULONG) PhysicalEOF - 1;
|
|
|
|
while (StillLooking)
|
|
{
|
|
//
|
|
// Check to see if it is the EOF record
|
|
//
|
|
if (*ptr == ELFEOFRECORDSIZE)
|
|
{
|
|
//
|
|
// Only scan up to the end of the file. Just compare up the
|
|
// constant information
|
|
//
|
|
|
|
//
|
|
// BUGBUG: If (End - pEvent) is less than ELFEOFUNIQUEPART,
|
|
// we never validate what should be the remainder of
|
|
// the EOF record at the start of the logfile
|
|
//
|
|
Size = min(ELFEOFUNIQUEPART,
|
|
(ULONG) ((PBYTE) PhysicalEOF - (PBYTE) ptr));
|
|
|
|
pRecord = CONTAINING_RECORD(ptr,
|
|
ELF_EOF_RECORD,
|
|
RecordSizeBeginning);
|
|
|
|
if (RtlCompareMemory(pRecord,
|
|
&EOFRecord,
|
|
Size) == Size)
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"FindStartOfNextRecord: Found EOF record at %p\n",
|
|
pRecord);
|
|
|
|
//
|
|
// This is the EOF record, back up to the last record
|
|
//
|
|
(PBYTE) pRecord -= *((PULONG) pRecord - 1);
|
|
|
|
if (pRecord < PhysicalStart)
|
|
{
|
|
pRecord = (PBYTE) PhysicalEOF -
|
|
((PBYTE)PhysicalStart - (PBYTE)pRecord);
|
|
}
|
|
}
|
|
|
|
if (ValidFilePos(pRecord,
|
|
BeginningRecord,
|
|
EndingRecord,
|
|
PhysicalEOF,
|
|
BaseAddress,
|
|
TRUE))
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"FindStartOfNextRecord: Valid record at %p preceding EOF record\n",
|
|
pRecord);
|
|
|
|
return pRecord;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Check to see if it is an event record
|
|
//
|
|
if (*ptr == ELF_LOG_FILE_SIGNATURE)
|
|
{
|
|
//
|
|
// This is a signature, see if the containing record is valid
|
|
//
|
|
pRecord = CONTAINING_RECORD(ptr,
|
|
EVENTLOGRECORD,
|
|
Reserved);
|
|
|
|
if (ValidFilePos(pRecord,
|
|
BeginningRecord,
|
|
EndingRecord,
|
|
PhysicalEOF,
|
|
BaseAddress,
|
|
TRUE))
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"FindStartOfNextRecord: Valid record found at %p\n",
|
|
pRecord);
|
|
|
|
return pRecord;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Bump to the next byte and see if we're done.
|
|
//
|
|
ptr++;
|
|
|
|
if (ptr >= EndOfBlock)
|
|
{
|
|
//
|
|
// Need the second test on this condition in case Position
|
|
// happens to equal PhysicalEOF - 1 (EndOfBlock initial value);
|
|
// without this, this loop would terminate prematurely.
|
|
//
|
|
if ((EndOfBlock == (PULONG) Position)
|
|
&&
|
|
((PULONG) Position != EndOfFile))
|
|
{
|
|
//
|
|
// This was the top half, so we're done
|
|
//
|
|
StillLooking = FALSE;
|
|
|
|
ELF_LOG0(FILES,
|
|
"FindStartOfNextRecord: Unsuccessfully searched "
|
|
"top half of file\n");
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// This was the bottom half, let's look in the top half
|
|
//
|
|
EndOfBlock = (PULONG) Position;
|
|
ptr = (PULONG) PhysicalStart;
|
|
|
|
ELF_LOG0(FILES,
|
|
"FindStartOfNextRecord: Unsuccessfully searched "
|
|
"bottom half of file -- searching top half\n");
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// Didn't find a valid record
|
|
//
|
|
return NULL;
|
|
}
|
|
|
|
|
|
PVOID
|
|
NextRecordPosition (
|
|
ULONG ReadFlags,
|
|
PVOID CurrPosition,
|
|
ULONG CurrRecordLength,
|
|
PVOID BeginRecord,
|
|
PVOID EndRecord,
|
|
PVOID PhysicalEOF,
|
|
PVOID PhysStart
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine seeks to the beginning of the next record to be read
|
|
depending on the flags in the request packet.
|
|
|
|
Arguments:
|
|
|
|
ReadFlags - Read forwards or backwards
|
|
CurrPosition - Pointer to the current position.
|
|
CurrRecordLength - Length of the record at the last position read.
|
|
BeginRecord - Logical first record
|
|
EndRecord - Logical last record (EOF record)
|
|
PhysEOF - End of file
|
|
PhysStart - Start of file pointer (following file header).
|
|
|
|
Return Value:
|
|
|
|
New position or NULL if invalid record.
|
|
|
|
Note:
|
|
|
|
|
|
--*/
|
|
{
|
|
|
|
PVOID NewPosition;
|
|
ULONG Length;
|
|
PDWORD FillDword;
|
|
|
|
if (ReadFlags & EVENTLOG_FORWARDS_READ)
|
|
{
|
|
//
|
|
// If we're pointing at the EOF record, just set the position to
|
|
// the first record
|
|
//
|
|
if (CurrRecordLength == ELFEOFRECORDSIZE)
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"NextRecordPosition: Pointing to EOF record -- returning "
|
|
"address of first record (%p)\n",
|
|
BeginRecord);
|
|
|
|
return BeginRecord;
|
|
}
|
|
|
|
NewPosition = (PVOID) ((ULONG_PTR) CurrPosition + CurrRecordLength);
|
|
|
|
//
|
|
// Take care of wrapping.
|
|
//
|
|
if (NewPosition >= PhysicalEOF)
|
|
{
|
|
NewPosition = (PBYTE)PhysStart
|
|
+ ((PBYTE) NewPosition - (PBYTE) PhysicalEOF);
|
|
}
|
|
|
|
//
|
|
// If this is a ELF_SKIP_DWORD, skip to the top of the file
|
|
//
|
|
if (*(PDWORD) NewPosition == ELF_SKIP_DWORD)
|
|
{
|
|
NewPosition = PhysStart;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Reading backwards.
|
|
//
|
|
ASSERT (ReadFlags & EVENTLOG_BACKWARDS_READ);
|
|
|
|
if (CurrPosition == BeginRecord)
|
|
{
|
|
//
|
|
// This is the "end of file" if we're reading backwards.
|
|
//
|
|
ELF_LOG1(FILES,
|
|
"NextRecordPosition: Reading backwards and pointing to first "
|
|
"record -- returning address of last record (%p)\n",
|
|
EndRecord);
|
|
|
|
return EndRecord;
|
|
}
|
|
else if (CurrPosition == PhysStart)
|
|
{
|
|
//
|
|
// Flip to the bottom of the file, but skip and ELF_SKIP_DWORDs
|
|
//
|
|
FillDword = (PDWORD) PhysicalEOF; // last dword
|
|
FillDword--;
|
|
|
|
while (*FillDword == ELF_SKIP_DWORD)
|
|
{
|
|
FillDword--;
|
|
}
|
|
|
|
CurrPosition = (PVOID) (FillDword + 1);
|
|
}
|
|
|
|
Length = *((PULONG) CurrPosition - 1);
|
|
|
|
if (Length < ELFEOFRECORDSIZE)
|
|
{
|
|
//
|
|
// Bogus length, must be invalid record
|
|
//
|
|
ELF_LOG1(FILES,
|
|
"NextRecordPosition: Invalid record length (%d) encountered\n",
|
|
Length);
|
|
|
|
return NULL;
|
|
}
|
|
|
|
NewPosition = (PBYTE) CurrPosition - Length;
|
|
|
|
//
|
|
// Take care of wrapping
|
|
//
|
|
|
|
if (NewPosition < PhysStart)
|
|
{
|
|
NewPosition = (PBYTE) PhysicalEOF
|
|
- ((PBYTE) PhysStart - (PBYTE) NewPosition);
|
|
}
|
|
}
|
|
|
|
return NewPosition;
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS
|
|
SeekToStartingRecord (
|
|
PELF_REQUEST_RECORD Request,
|
|
PVOID *ReadPosition,
|
|
PVOID BeginRecord,
|
|
PVOID EndRecord,
|
|
PVOID PhysEOF,
|
|
PVOID PhysStart
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine seeks to the correct position as indicated in the
|
|
request packet.
|
|
|
|
Arguments:
|
|
|
|
Pointer to the request packet.
|
|
Pointer to a pointer where the final position after the seek is returned.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS and new position in file.
|
|
|
|
Note:
|
|
|
|
This routine ensures that it is possible to seek to the position
|
|
specified in the request packet. If not, then an error is returned
|
|
which indicates that the file probably changed between the two
|
|
READ operations, or else the record offset specified is beyond the
|
|
end of the file.
|
|
|
|
--*/
|
|
{
|
|
PVOID Position;
|
|
ULONG RecordLen;
|
|
ULONG NumRecordsToSeek;
|
|
ULONG BytesPerRecord;
|
|
ULONG NumberOfRecords;
|
|
ULONG NumberOfBytes;
|
|
ULONG ReadFlags;
|
|
|
|
//
|
|
// If the beginning and the end are the same, then there are no
|
|
// entries in this file.
|
|
//
|
|
if (BeginRecord == EndRecord)
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"SeekToStartingRecord: %ws log is empty\n",
|
|
Request->Module->ModuleName);
|
|
|
|
return STATUS_END_OF_FILE;
|
|
}
|
|
|
|
//
|
|
// Find the last position (or the "beginning" if this is the first READ
|
|
// call for this handle).
|
|
//
|
|
if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_SEQUENTIAL_READ)
|
|
{
|
|
if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_FORWARDS_READ)
|
|
{
|
|
//
|
|
// If this is the first READ operation, LastSeekPosition will
|
|
// be zero. In that case, we set the position to the first
|
|
// record (in terms of time) in the file.
|
|
//
|
|
if (Request->Pkt.ReadPkt->LastSeekPos == 0)
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"SeekToStartingRecord: First read (forwards) of %ws log\n",
|
|
Request->Module->ModuleName);
|
|
|
|
Position = BeginRecord;
|
|
}
|
|
else
|
|
{
|
|
Position = (PBYTE) Request->LogFile->BaseAddress
|
|
+ Request->Pkt.ReadPkt->LastSeekPos;
|
|
|
|
//
|
|
// If we're changing the direction we're reading, skip
|
|
// forward one record. This is because we're pointing at
|
|
// the "next" record based on the last read direction
|
|
//
|
|
if (!(Request->Pkt.ReadPkt->Flags & ELF_LAST_READ_FORWARD))
|
|
{
|
|
Position = NextRecordPosition(Request->Pkt.ReadPkt->ReadFlags,
|
|
Position,
|
|
((PEVENTLOGRECORD) Position)->Length,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysEOF,
|
|
PhysStart);
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// This *really* cheesy check exists to handle the case
|
|
// where Position could be on an ELF_SKIP_DWORD pad
|
|
// dword at end of the file.
|
|
//
|
|
// NB: Must be prepared to handle an exception since
|
|
// a somewhat unknown pointer is dereferenced.
|
|
//
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
|
|
try
|
|
{
|
|
if (IsPositionWithinRange(Position,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysEOF,
|
|
Request->LogFile->BaseAddress))
|
|
{
|
|
//
|
|
// If this is an ELF_SKIP_DWORD, skip to the
|
|
// top of the file.
|
|
//
|
|
if (*(PDWORD) Position == ELF_SKIP_DWORD)
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"SeekToStartingRecord: Next forward read position "
|
|
"in %ws log is on an ELF_SKIP_DWORD\n",
|
|
Request->Module->ModuleName);
|
|
|
|
Position = PhysStart;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// More likely the caller's handle was invalid
|
|
// if the position was not within range.
|
|
//
|
|
ELF_LOG1(ERROR,
|
|
"SeekToStartingRecord: Next forward read position "
|
|
"in %ws log is out of range -- log is corrupt\n",
|
|
Request->Module->ModuleName);
|
|
|
|
Status = STATUS_INVALID_HANDLE;
|
|
}
|
|
}
|
|
except (EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"SeekToStartingRecord: Caught exception %#x looking for "
|
|
"next forward read position in %ws log\n",
|
|
GetExceptionCode(),
|
|
Request->Module->ModuleName);
|
|
|
|
Status = STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
*ReadPosition = NULL;
|
|
return Status;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// READ backwards
|
|
//
|
|
|
|
// If this is the first READ operation, LastSeekPosition will
|
|
// be zero. In that case, we set the position to the last
|
|
// record (in terms of time) in the file.
|
|
//
|
|
if (Request->Pkt.ReadPkt->LastSeekPos == 0)
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"SeekToStartingRecord: First read (backwards) of %ws log\n",
|
|
Request->Module->ModuleName);
|
|
|
|
Position = EndRecord;
|
|
|
|
//
|
|
// Subtract the length of the last record from the current
|
|
// position to get to the beginning of the record.
|
|
//
|
|
// If that moves beyond the physical beginning of the file,
|
|
// then we need to wrap around to the physical end of the file.
|
|
//
|
|
Position = (PBYTE) Position - *((PULONG) Position - 1);
|
|
|
|
if (Position < PhysStart)
|
|
{
|
|
Position = (PBYTE) PhysEOF - ((PBYTE) PhysStart - (PBYTE) Position);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
Position = (PBYTE) Request->LogFile->BaseAddress
|
|
+ Request->Pkt.ReadPkt->LastSeekPos;
|
|
|
|
//
|
|
// If we're changing the direction we're reading, skip
|
|
// forward one record. This is because we're pointing at
|
|
// the "next" record based on the last read direction
|
|
//
|
|
if (Request->Pkt.ReadPkt->Flags & ELF_LAST_READ_FORWARD)
|
|
{
|
|
Position = NextRecordPosition(Request->Pkt.ReadPkt->ReadFlags,
|
|
Position,
|
|
0, // not used if reading backwards
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysEOF,
|
|
PhysStart);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
else if (Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_SEEK_READ)
|
|
{
|
|
//
|
|
// Make sure the record number passed in is valid
|
|
//
|
|
if (Request->Pkt.ReadPkt->RecordNumber < Request->LogFile->OldestRecordNumber
|
|
||
|
|
Request->Pkt.ReadPkt->RecordNumber >= Request->LogFile->CurrentRecordNumber)
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"SeekToStartingRecord: Invalid record number %d\n",
|
|
Request->Pkt.ReadPkt->RecordNumber);
|
|
|
|
return STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
//
|
|
// We're seeking to an absolute record number, so use the following
|
|
// algorithm:
|
|
//
|
|
// 1. Calculate the average number of bytes per record
|
|
//
|
|
// 2. Based on this number seek to where the record should start
|
|
//
|
|
// 3. Find the start of the next record in the file
|
|
//
|
|
// 4. Walk (forwards or backwards) from there to the right record
|
|
//
|
|
|
|
//
|
|
// 1. Calculate the average number of bytes per record
|
|
//
|
|
NumberOfRecords = Request->LogFile->CurrentRecordNumber
|
|
- Request->LogFile->OldestRecordNumber;
|
|
|
|
NumberOfBytes = Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP ?
|
|
Request->LogFile->ActualMaxFileSize :
|
|
Request->LogFile->EndRecord;
|
|
|
|
NumberOfBytes -= FILEHEADERBUFSIZE;
|
|
BytesPerRecord = NumberOfBytes / NumberOfRecords;
|
|
|
|
//
|
|
// 2. Calcuate the first guess as to what the offset of the desired
|
|
// record should be
|
|
//
|
|
Position = (PBYTE) Request->LogFile->BaseAddress
|
|
+ Request->LogFile->BeginRecord
|
|
+ BytesPerRecord
|
|
* (Request->Pkt.ReadPkt->RecordNumber
|
|
- Request->LogFile->OldestRecordNumber);
|
|
|
|
//
|
|
// Align the position to a ULONG bountry.
|
|
//
|
|
Position = (PVOID) (((ULONG_PTR) Position + sizeof(ULONG) - 1) & ~(sizeof(ULONG) - 1));
|
|
|
|
//
|
|
// Take care of file wrap
|
|
//
|
|
if (Position >= PhysEOF)
|
|
{
|
|
Position = (PBYTE)PhysStart +
|
|
((PBYTE) Position - (PBYTE) PhysEOF);
|
|
|
|
if (Position >= PhysEOF)
|
|
{
|
|
//
|
|
// It's possible, in an obscure error case, that Position
|
|
// may still be beyond the EOF. Adjust, if so.
|
|
//
|
|
Position = BeginRecord;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Bug fix:
|
|
//
|
|
// 57017 - Event Log Causes Services.Exe to Access Violate therefore
|
|
// Hanging the Server
|
|
//
|
|
// The calculation above can easily put Position out of range of
|
|
// the begin/end file markers. This is not good. Adjust Position,
|
|
// if necessary.
|
|
//
|
|
if (BeginRecord < EndRecord && Position >= EndRecord)
|
|
{
|
|
Position = BeginRecord;
|
|
}
|
|
else if (BeginRecord > EndRecord && Position >= EndRecord && Position < BeginRecord)
|
|
{
|
|
Position = BeginRecord;
|
|
}
|
|
else
|
|
{
|
|
// Do nothing.
|
|
}
|
|
|
|
//
|
|
// 3. Get to the start of the next record after Position
|
|
//
|
|
Position = FindStartOfNextRecord(Position,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysStart,
|
|
PhysEOF,
|
|
Request->LogFile->BaseAddress);
|
|
|
|
//
|
|
// 4. Walk (forwards or backwards) from Position to the right record
|
|
//
|
|
if (Position)
|
|
{
|
|
if (Request->Pkt.ReadPkt->RecordNumber >
|
|
((PEVENTLOGRECORD) Position)->RecordNumber)
|
|
{
|
|
NumRecordsToSeek = Request->Pkt.ReadPkt->RecordNumber
|
|
- ((PEVENTLOGRECORD) Position)->RecordNumber;
|
|
|
|
ReadFlags = EVENTLOG_FORWARDS_READ;
|
|
|
|
ELF_LOG2(FILES,
|
|
"SeekToStartingRecord: Walking forward %d records from record %d\n",
|
|
NumRecordsToSeek,
|
|
((PEVENTLOGRECORD) Position)->RecordNumber);
|
|
}
|
|
else
|
|
{
|
|
NumRecordsToSeek = ((PEVENTLOGRECORD) Position)->RecordNumber
|
|
- Request->Pkt.ReadPkt->RecordNumber;
|
|
|
|
ReadFlags = EVENTLOG_BACKWARDS_READ;
|
|
|
|
ELF_LOG2(FILES,
|
|
"SeekToStartingRecord: Walking backward %d records from record %d\n",
|
|
NumRecordsToSeek,
|
|
((PEVENTLOGRECORD) Position)->RecordNumber);
|
|
}
|
|
}
|
|
|
|
while (Position != NULL && NumRecordsToSeek--)
|
|
{
|
|
RecordLen = ((PEVENTLOGRECORD) Position)->Length;
|
|
|
|
Position = NextRecordPosition(ReadFlags,
|
|
Position,
|
|
RecordLen,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysEOF,
|
|
PhysStart);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Flags didn't specify a sequential or seek read
|
|
//
|
|
return STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
*ReadPosition = Position; // This is the new seek position
|
|
|
|
if (!Position)
|
|
{
|
|
//
|
|
// The record was invalid
|
|
//
|
|
ELF_LOG1(ERROR,
|
|
"SeekToStartingRecord: Position is NULL -- %ws log is corrupt\n",
|
|
Request->Module->ModuleName);
|
|
|
|
return STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
|
|
VOID
|
|
CopyRecordToBuffer(
|
|
IN PBYTE pReadPosition,
|
|
IN OUT PBYTE *ppBufferPosition,
|
|
IN ULONG ulRecordSize,
|
|
IN PBYTE pPhysicalEOF,
|
|
IN PBYTE pPhysStart
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine copies the EVENTLOGRECORD at pReadPosition into
|
|
*ppBufferPosition
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
{
|
|
ULONG ulBytesToMove; // Number of bytes to copy
|
|
|
|
ASSERT(ppBufferPosition != NULL);
|
|
|
|
//
|
|
// If the number of bytes to the end of the file is less than the
|
|
// size of the record, then part of the record has wrapped to the
|
|
// beginning of the file - transfer the bytes piece-meal.
|
|
//
|
|
// Otherwise, transfer the whole record.
|
|
//
|
|
ulBytesToMove = min(ulRecordSize,
|
|
(ULONG) (pPhysicalEOF - pReadPosition));
|
|
|
|
if (ulBytesToMove < ulRecordSize)
|
|
{
|
|
//
|
|
// We need to copy the bytes up to the end of the file,
|
|
// and then wrap around and copy the remaining bytes of
|
|
// this record.
|
|
//
|
|
RtlMoveMemory(*ppBufferPosition, pReadPosition, ulBytesToMove);
|
|
|
|
//
|
|
// Advance user buffer pointer, move read position to the
|
|
// beginning of the file (past the file header), and
|
|
// update bytes remaining to be moved for this record.
|
|
//
|
|
*ppBufferPosition += ulBytesToMove;
|
|
|
|
pReadPosition = pPhysStart;
|
|
|
|
ulBytesToMove = ulRecordSize - ulBytesToMove; // Remaining bytes
|
|
}
|
|
|
|
//
|
|
// Move the remaining bytes of the record OR the full record.
|
|
//
|
|
RtlMoveMemory(*ppBufferPosition, pReadPosition, ulBytesToMove);
|
|
|
|
//
|
|
// Update to new read positions
|
|
//
|
|
*ppBufferPosition += ulBytesToMove;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
ReadFromLog(
|
|
PELF_REQUEST_RECORD Request
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine reads from the event log specified in the request packet.
|
|
|
|
This routine uses memory mapped I/O to access the log file. This makes
|
|
it much easier to move around the file.
|
|
|
|
Arguments:
|
|
|
|
Pointer to the request packet.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS.
|
|
|
|
Note:
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
PVOID ReadPosition; // Current read position in file
|
|
PVOID BufferPosition; // Current position in user's buffer
|
|
ULONG TotalBytesRead; // Total Bytes transferred
|
|
ULONG TotalRecordsRead; // Total records transferred
|
|
ULONG BytesInBuffer; // Bytes remaining in buffer
|
|
ULONG RecordSize; // Size of event record
|
|
PVOID PhysicalEOF; // Physical end of file
|
|
PVOID PhysStart; // Physical start of file (after file hdr)
|
|
PVOID BeginRecord; // Points to first record
|
|
PVOID EndRecord; // Points to byte after last record
|
|
PVOID TempBuf = NULL, TempBufferPosition;
|
|
ULONG RecordBytesTransferred;
|
|
PEVENTLOGRECORD pEvent;
|
|
|
|
//
|
|
// Initialize variables.
|
|
//
|
|
BytesInBuffer = Request->Pkt.ReadPkt->BufferSize;
|
|
BufferPosition = Request->Pkt.ReadPkt->Buffer;
|
|
TotalBytesRead = 0;
|
|
TotalRecordsRead = 0;
|
|
|
|
PhysicalEOF = (LPBYTE) Request->LogFile->BaseAddress
|
|
+ Request->LogFile->ViewSize;
|
|
|
|
PhysStart = (LPBYTE) Request->LogFile->BaseAddress
|
|
+ FILEHEADERBUFSIZE;
|
|
|
|
BeginRecord = (LPBYTE) Request->LogFile->BaseAddress
|
|
+ Request->LogFile->BeginRecord; // Start at first record
|
|
|
|
EndRecord = (LPBYTE) Request->LogFile->BaseAddress
|
|
+ Request->LogFile->EndRecord; // Byte after end of last record
|
|
|
|
//
|
|
// "Seek" to the starting record depending on either the last seek
|
|
// position, or the starting record offset passed in.
|
|
//
|
|
Status = SeekToStartingRecord(Request,
|
|
&ReadPosition,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysicalEOF,
|
|
PhysStart);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
//
|
|
// Make sure the record is valid
|
|
//
|
|
|
|
if (!ValidFilePos(ReadPosition,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysicalEOF,
|
|
Request->LogFile->BaseAddress,
|
|
TRUE))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"ReadFromLog: Next record (%p) is not valid -- log is corrupt\n",
|
|
ReadPosition);
|
|
|
|
Request->Pkt.ReadPkt->BytesRead = 0;
|
|
Request->Pkt.ReadPkt->RecordsRead = 0;
|
|
|
|
return STATUS_INVALID_HANDLE;
|
|
}
|
|
|
|
// make sure that if we asked for a specific record, that we got it
|
|
|
|
if ((Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_SEEK_READ) &&
|
|
(Request->Pkt.ReadPkt->ReadFlags & EVENTLOG_BACKWARDS_READ))
|
|
{
|
|
pEvent = (PEVENTLOGRECORD)ReadPosition;
|
|
if(pEvent->Length == ELFEOFRECORDSIZE ||
|
|
pEvent->RecordNumber != Request->Pkt.ReadPkt->RecordNumber)
|
|
{
|
|
Request->Pkt.ReadPkt->BytesRead = 0;
|
|
Request->Pkt.ReadPkt->RecordsRead = 0;
|
|
return STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
}
|
|
|
|
|
|
RecordSize = RecordBytesTransferred = *(PULONG) ReadPosition;
|
|
|
|
if ((Request->Pkt.ReadPkt->Flags & ELF_IREAD_ANSI)
|
|
&&
|
|
(RecordSize != ELFEOFRECORDSIZE))
|
|
{
|
|
//
|
|
//
|
|
// If we were called by an ANSI API, then we need to read the
|
|
// next record into a temporary buffer, process the data in
|
|
// that record and copy it over to the real buffer as ANSI
|
|
// strings (rather than UNICODE).
|
|
//
|
|
// We need to do this here since we won't be able to
|
|
// appropriately size a record that wraps for an ANSI
|
|
// call otherwise (we'll AV trying to read it past
|
|
// the end of the log).
|
|
//
|
|
TempBuf = ElfpAllocateBuffer(RecordSize);
|
|
|
|
if (TempBuf == NULL)
|
|
{
|
|
ELF_LOG0(ERROR,
|
|
"ReadFromLog: Unable to allocate memory for "
|
|
"Ansi record (1st call)\n");
|
|
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
|
|
TempBufferPosition = BufferPosition; // Save this away
|
|
BufferPosition = TempBuf; // Read into TempBuf
|
|
|
|
CopyRecordToBuffer((PBYTE) ReadPosition,
|
|
(PBYTE *) &BufferPosition,
|
|
RecordSize,
|
|
(PBYTE) PhysicalEOF,
|
|
(PBYTE) PhysStart);
|
|
|
|
//
|
|
// Call CopyUnicodeToAnsiRecord with a NULL destination
|
|
// location in order to get the size of the Ansi record
|
|
//
|
|
Status = CopyUnicodeToAnsiRecord(NULL,
|
|
TempBuf,
|
|
NULL,
|
|
&RecordBytesTransferred);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"ReadFromLog: CopyUnicodeToAnsiRecord failed %#x (1st call)\n",
|
|
Status);
|
|
|
|
ElfpFreeBuffer(TempBuf);
|
|
return Status;
|
|
}
|
|
}
|
|
|
|
//
|
|
// While there are records to be read, and more space in the buffer,
|
|
// keep on reading records into the buffer.
|
|
//
|
|
while((RecordBytesTransferred <= BytesInBuffer)
|
|
&&
|
|
(RecordSize != ELFEOFRECORDSIZE))
|
|
{
|
|
//
|
|
// If we were called by an ANSI API, then we need to take the
|
|
// record read into TempBuf and transfer it over to the user's
|
|
// buffer while converting any UNICODE strings to ANSI.
|
|
//
|
|
if (Request->Pkt.ReadPkt->Flags & ELF_IREAD_ANSI)
|
|
{
|
|
Status = CopyUnicodeToAnsiRecord(TempBufferPosition,
|
|
TempBuf,
|
|
&BufferPosition,
|
|
&RecordBytesTransferred);
|
|
|
|
//
|
|
// RecordBytesTransferred contains the bytes actually
|
|
// copied into the user's buffer.
|
|
//
|
|
// BufferPosition points to the point in the user's buffer
|
|
// just after this record.
|
|
//
|
|
ElfpFreeBuffer(TempBuf);
|
|
TempBuf = NULL;
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"ReadFromLog: CopyUnicodeToAnsiRecord failed %x "
|
|
"(2nd call)\n",
|
|
Status);
|
|
|
|
//
|
|
// Stop reading
|
|
//
|
|
break;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Unicode call -- simply copy the record into the buffer
|
|
//
|
|
CopyRecordToBuffer((PBYTE) ReadPosition,
|
|
(PBYTE *) &BufferPosition,
|
|
RecordSize,
|
|
(PBYTE) PhysicalEOF,
|
|
(PBYTE) PhysStart);
|
|
}
|
|
|
|
//
|
|
// Update the byte and record counts
|
|
//
|
|
TotalRecordsRead++;
|
|
TotalBytesRead += RecordBytesTransferred;
|
|
BytesInBuffer -= RecordBytesTransferred;
|
|
|
|
ReadPosition = NextRecordPosition(Request->Pkt.ReadPkt->ReadFlags,
|
|
ReadPosition,
|
|
RecordSize,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysicalEOF,
|
|
PhysStart);
|
|
|
|
//
|
|
// Make sure the record is valid
|
|
//
|
|
if (ReadPosition == NULL
|
|
||
|
|
!ValidFilePos(ReadPosition,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysicalEOF,
|
|
Request->LogFile->BaseAddress,
|
|
TRUE))
|
|
{
|
|
ELF_LOG0(ERROR,
|
|
"ReadFromLog: Next record is invalid -- log is corrupt\n");
|
|
|
|
return STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
|
|
RecordSize = RecordBytesTransferred = *(PULONG) ReadPosition;
|
|
|
|
if ((Request->Pkt.ReadPkt->Flags & ELF_IREAD_ANSI)
|
|
&&
|
|
(RecordSize != ELFEOFRECORDSIZE))
|
|
{
|
|
TempBuf = ElfpAllocateBuffer(RecordSize);
|
|
|
|
if (TempBuf == NULL)
|
|
{
|
|
ELF_LOG0(ERROR,
|
|
"ReadFromLog: Unable to allocate memory for "
|
|
"Ansi record (2nd call)\n");
|
|
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
|
|
TempBufferPosition = BufferPosition; // Save this away
|
|
BufferPosition = TempBuf; // Read into TempBuf
|
|
|
|
CopyRecordToBuffer((PBYTE) ReadPosition,
|
|
(PBYTE *) &BufferPosition,
|
|
RecordSize,
|
|
(PBYTE) PhysicalEOF,
|
|
(PBYTE) PhysStart);
|
|
|
|
//
|
|
// Call CopyUnicodeToAnsiRecord with a NULL destination
|
|
// location in order to get the size of the Ansi record
|
|
//
|
|
Status = CopyUnicodeToAnsiRecord(NULL,
|
|
TempBuf,
|
|
NULL,
|
|
&RecordBytesTransferred);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"ReadFromLog: CopyUnicodeToAnsiRecord failed %#x "
|
|
"(1st call)\n",
|
|
Status);
|
|
|
|
ElfpFreeBuffer(TempBuf);
|
|
return Status;
|
|
}
|
|
}
|
|
} // while
|
|
|
|
ElfpFreeBuffer(TempBuf);
|
|
TempBuf = NULL;
|
|
|
|
//
|
|
// If we got to the end and did not read in any records, return
|
|
// an error indicating that the user's buffer is too small if
|
|
// we're not at the EOF record, or end of file if we are.
|
|
//
|
|
if (TotalRecordsRead == 0)
|
|
{
|
|
if (RecordSize == ELFEOFRECORDSIZE)
|
|
{
|
|
ELF_LOG0(FILES,
|
|
"ReadFromLog: No records read -- pointing at EOF record\n");
|
|
|
|
Status = STATUS_END_OF_FILE;
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// We didn't read any records, and we're not at EOF, so
|
|
// the buffer was too small
|
|
//
|
|
ELF_LOG1(ERROR,
|
|
"ReadFromLog: No records read -- buffer was too small "
|
|
"(%d bytes needed)\n",
|
|
RecordBytesTransferred);
|
|
|
|
Status = STATUS_BUFFER_TOO_SMALL;
|
|
Request->Pkt.ReadPkt->MinimumBytesNeeded = RecordBytesTransferred;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Update the current file position.
|
|
//
|
|
Request->Pkt.ReadPkt->LastSeekPos =
|
|
(ULONG) ((ULONG_PTR) ReadPosition
|
|
- (ULONG_PTR) Request->LogFile->BaseAddress);
|
|
|
|
Request->Pkt.ReadPkt->LastSeekRecord += TotalRecordsRead;
|
|
|
|
ELF_LOG1(FILES,
|
|
"ReadFromLog: %d records successfully read\n",
|
|
TotalRecordsRead);
|
|
}
|
|
else
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"ReadFromLog: SeekToStartingRecord failed %#x\n",
|
|
Status);
|
|
}
|
|
|
|
//
|
|
// Set the bytes read in the request packet for return to client.
|
|
//
|
|
Request->Pkt.ReadPkt->BytesRead = TotalBytesRead;
|
|
Request->Pkt.ReadPkt->RecordsRead = TotalRecordsRead;
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
|
|
|
|
VOID
|
|
PerformReadRequest(
|
|
PELF_REQUEST_RECORD Request
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine performs the READ request.
|
|
It first grabs the log file structure resource and then proceeds
|
|
to read from the file. If the resource is not available, it will
|
|
block until it is.
|
|
|
|
This routine impersonates the client in order to ensure that the correct
|
|
access control is uesd. If the client does not have permission to read
|
|
the file, the operation will fail.
|
|
|
|
Arguments:
|
|
|
|
Pointer to the request packet.
|
|
|
|
Return Value:
|
|
|
|
NONE
|
|
|
|
Note:
|
|
|
|
|
|
--*/
|
|
{
|
|
|
|
//
|
|
// Get shared access to the log file. This will allow multiple
|
|
// readers to get to the file together.
|
|
//
|
|
RtlAcquireResourceShared(&Request->Module->LogFile->Resource,
|
|
TRUE); // Wait until available
|
|
|
|
//
|
|
// Try to read from the log. Note that a corrupt log is the
|
|
// most likely cause of an exception (garbage pointers, etc).
|
|
// The eventlog corruption error is a bit all-inclusive, but
|
|
// necessary, since log state is pretty much indeterminable
|
|
// in this situation.
|
|
//
|
|
try
|
|
{
|
|
Request->Status = ReadFromLog(Request);
|
|
}
|
|
except (EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformReadRequest: Caught exception %#x reading %ws log\n",
|
|
GetExceptionCode(),
|
|
Request->Module->ModuleName);
|
|
|
|
Request->Status = STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
|
|
//
|
|
// Release the resource
|
|
//
|
|
RtlReleaseResource(&Request->Module->LogFile->Resource);
|
|
}
|
|
|
|
//
|
|
// BUGBUG: These are only used in WriteToLog and they're not modified.
|
|
// Probably cleaner to make them #define'd constants.
|
|
//
|
|
WCHAR wszAltDosDevices[] = L"\\DosDevices\\";
|
|
WCHAR wszDosDevices[] = L"\\??\\";
|
|
#define DOSDEVICES_LEN ((sizeof(wszDosDevices) / sizeof(WCHAR)) - 1)
|
|
#define ALTDOSDEVICES_LEN ((sizeof(wszAltDosDevices) / sizeof(WCHAR)) - 1)
|
|
|
|
|
|
VOID
|
|
WriteToLog(
|
|
PLOGFILE pLogFile,
|
|
PVOID Buffer,
|
|
ULONG BufSize,
|
|
PULONG Destination,
|
|
ULONG PhysEOF,
|
|
ULONG PhysStart
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine writes the record into the log file, allowing for wrapping
|
|
around the end of the file.
|
|
|
|
It assumes that the caller has serialized access to the file, and has
|
|
ensured that there is enough space in the file for the record.
|
|
|
|
Arguments:
|
|
|
|
Buffer - Pointer to the buffer containing the event record.
|
|
BufSize - Size of the record to be written.
|
|
Destination - Pointer to the destination - which is in the log file.
|
|
PhysEOF - Physical end of file.
|
|
PhysStart - Physical beginning of file (past the file header).
|
|
|
|
Return Value:
|
|
|
|
NONE.
|
|
|
|
Note:
|
|
|
|
|
|
--*/
|
|
{
|
|
ULONG BytesToCopy;
|
|
SIZE_T FlushSize;
|
|
ULONG NewDestination;
|
|
NTSTATUS Status;
|
|
PVOID BaseAddress;
|
|
LPWSTR pwszLogFileName;
|
|
|
|
LARGE_INTEGER ByteOffset;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
|
|
BytesToCopy = min(PhysEOF - *Destination, BufSize);
|
|
|
|
ByteOffset = RtlConvertUlongToLargeInteger(*Destination);
|
|
|
|
//
|
|
// BUGBUG: If this call fails, we shouldn't set *Destination to
|
|
// NewDestination below. The same is true if the second
|
|
// NtWriteFile call fails.
|
|
//
|
|
Status = NtWriteFile(pLogFile->FileHandle, // Filehandle
|
|
NULL, // Event
|
|
NULL, // APC routine
|
|
NULL, // APC context
|
|
&IoStatusBlock, // IO_STATUS_BLOCK
|
|
Buffer, // Buffer
|
|
BytesToCopy, // Length
|
|
&ByteOffset, // Byteoffset
|
|
NULL); // Key
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"WriteToLog: NtWriteFile (1st call) failed %#x\n",
|
|
Status);
|
|
}
|
|
|
|
NewDestination = *Destination + BytesToCopy;
|
|
|
|
if (BytesToCopy != BufSize)
|
|
{
|
|
//
|
|
// Wrap around to the beginning of the file and copy the
|
|
// rest of the data.
|
|
//
|
|
Buffer = (PBYTE) Buffer + BytesToCopy;
|
|
|
|
BytesToCopy = BufSize - BytesToCopy;
|
|
|
|
ByteOffset = RtlConvertUlongToLargeInteger(PhysStart);
|
|
|
|
Status = NtWriteFile(pLogFile->FileHandle, // Filehandle
|
|
NULL, // Event
|
|
NULL, // APC routine
|
|
NULL, // APC context
|
|
&IoStatusBlock, // IO_STATUS_BLOCK
|
|
Buffer, // Buffer
|
|
BytesToCopy, // Length
|
|
&ByteOffset, // Byteoffset
|
|
NULL); // Key
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"WriteToLog: NtWriteFile (2nd call) failed %#x\n",
|
|
Status);
|
|
}
|
|
|
|
NewDestination = PhysStart + BytesToCopy;
|
|
|
|
//
|
|
// Set "wrap" bit in log file structure
|
|
//
|
|
pLogFile->Flags |= ELF_LOGFILE_HEADER_WRAP;
|
|
|
|
//
|
|
// Now flush this to disk to commit it
|
|
//
|
|
BaseAddress = pLogFile->BaseAddress;
|
|
FlushSize = FILEHEADERBUFSIZE;
|
|
|
|
Status = NtFlushVirtualMemory(NtCurrentProcess(),
|
|
&BaseAddress,
|
|
&FlushSize,
|
|
&IoStatusBlock);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"WriteToLog: NtFlushVirtualMemory failed %#x\n",
|
|
Status);
|
|
}
|
|
}
|
|
|
|
*Destination = NewDestination; // Return new destination
|
|
|
|
//
|
|
// Providing all succeeded above, if not set, set the archive file
|
|
// attribute on this log.
|
|
//
|
|
|
|
if (NT_SUCCESS(Status)
|
|
&&
|
|
!(pLogFile->Flags & ELF_LOGFILE_ARCHIVE_SET))
|
|
{
|
|
//
|
|
// Advance past prefix string, '\??\' or '\DosDevices\'
|
|
//
|
|
if ((pLogFile->LogFileName->Length / 2) >= DOSDEVICES_LEN
|
|
&&
|
|
!_wcsnicmp(wszDosDevices, pLogFile->LogFileName->Buffer, DOSDEVICES_LEN))
|
|
{
|
|
pwszLogFileName = pLogFile->LogFileName->Buffer + DOSDEVICES_LEN;
|
|
}
|
|
else if ((pLogFile->LogFileName->Length / 2) >= ALTDOSDEVICES_LEN
|
|
&&
|
|
!_wcsnicmp(wszAltDosDevices, pLogFile->LogFileName->Buffer, ALTDOSDEVICES_LEN))
|
|
{
|
|
pwszLogFileName = pLogFile->LogFileName->Buffer + ALTDOSDEVICES_LEN;
|
|
}
|
|
else
|
|
{
|
|
pwszLogFileName = pLogFile->LogFileName->Buffer;
|
|
}
|
|
|
|
if (SetFileAttributes(pwszLogFileName, FILE_ATTRIBUTE_ARCHIVE))
|
|
{
|
|
pLogFile->Flags |= ELF_LOGFILE_ARCHIVE_SET;
|
|
}
|
|
else
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"WriteToLog: SetFileAttributes on file %ws failed %d\n",
|
|
pwszLogFileName,
|
|
GetLastError());
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
AutoBackupLogFile(PELF_REQUEST_RECORD Request, ULONG OverwrittenEOF)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine makes a best attempt to backup the log file.
|
|
It will log an event in the SECURITY log file indicating
|
|
success or failure.
|
|
|
|
Arguments:
|
|
|
|
Pointer to the request packet.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS
|
|
|
|
Note:
|
|
|
|
--*/
|
|
{
|
|
UNICODE_STRING BackupFileNameU;
|
|
WCHAR BackupFileName[64]; // holds the "unique" part of the name (wsprintf)
|
|
PLOGFILE pLogFile; // For optimized access to structure
|
|
WCHAR BackupFileNamePrefix[] = L"Archive-";
|
|
WCHAR* EventMessage[3];
|
|
WCHAR Number[20]; // long enough to hold a DWORD represented as a string
|
|
SYSTEMTIME SystemTime;
|
|
ELF_REQUEST_RECORD ClearRequest;
|
|
CLEAR_PKT ClearPkt;
|
|
USHORT ClearStatus;
|
|
NTSTATUS Status;
|
|
ULONG WritePos; // Position to write record
|
|
|
|
pLogFile = Request->LogFile; // Set local variable
|
|
|
|
if (OverwrittenEOF)
|
|
{
|
|
//
|
|
// The EOF record was at the end of the physical file,
|
|
// and we overwrote it with ELF_SKIP_DWORDs, so we need
|
|
// to put it back since we're not going to be able to
|
|
// write a record. We also need to turn the wrap bit
|
|
// back off
|
|
//
|
|
pLogFile->Flags &= ~(ELF_LOGFILE_HEADER_WRAP);
|
|
pLogFile->EndRecord = OverwrittenEOF;
|
|
WritePos = OverwrittenEOF;
|
|
|
|
//
|
|
// Write out the EOF record
|
|
//
|
|
WriteToLog(pLogFile,
|
|
&EOFRecord,
|
|
ELFEOFRECORDSIZE,
|
|
&WritePos,
|
|
pLogFile->ActualMaxFileSize,
|
|
FILEHEADERBUFSIZE);
|
|
|
|
}
|
|
Status = FlushLogFile(pLogFile);
|
|
if (!NT_SUCCESS(Status))
|
|
return Status;
|
|
|
|
//
|
|
// Make BackupFileNameU unique.
|
|
// Allocate enough space for the current LogModuleName, a NULL character,
|
|
// and BackupFileName bytes.
|
|
// If AutoBackupPath is non-NULL, add space for that too.
|
|
//
|
|
// Rename file in place.
|
|
//
|
|
BackupFileNameU.Length = 0;
|
|
BackupFileNameU.MaximumLength = ((wcslen(pLogFile->LogModuleName->Buffer) +
|
|
wcslen(BackupFileNamePrefix) + 1 ) * sizeof(WCHAR)) +
|
|
sizeof(BackupFileName);
|
|
BackupFileNameU.Buffer = ElfpAllocateBuffer(BackupFileNameU.MaximumLength);
|
|
if (BackupFileNameU.Buffer == NULL)
|
|
{
|
|
ELF_LOG0(ERROR,
|
|
"AutoBackupLogFile: failed due to lack of memory\n");
|
|
return STATUS_NO_MEMORY;
|
|
}
|
|
|
|
StringCbCopy(BackupFileNameU.Buffer, BackupFileNameU.MaximumLength,
|
|
BackupFileNamePrefix);
|
|
StringCbCat(BackupFileNameU.Buffer, BackupFileNameU.MaximumLength,
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
GetSystemTime(&SystemTime);
|
|
|
|
StringCchPrintfW(BackupFileName, 64, L"-%u-%02u-%02u-%02u-%02u-%02u-%03u.evt",
|
|
SystemTime.wYear,
|
|
SystemTime.wMonth,
|
|
SystemTime.wDay,
|
|
SystemTime.wHour,
|
|
SystemTime.wMinute,
|
|
SystemTime.wSecond,
|
|
SystemTime.wMilliseconds);
|
|
|
|
StringCbCat(BackupFileNameU.Buffer, BackupFileNameU.MaximumLength,BackupFileName);
|
|
BackupFileNameU.Length = wcslen(BackupFileNameU.Buffer) * sizeof(WCHAR);
|
|
|
|
//
|
|
// Fill in the request packet
|
|
//
|
|
|
|
ClearRequest.Pkt.ClearPkt = &ClearPkt;
|
|
ClearRequest.Flags = 0;
|
|
ClearRequest.Module = Request->Module;
|
|
ClearRequest.LogFile = Request->LogFile;
|
|
ClearRequest.Command = ELF_COMMAND_CLEAR;
|
|
ClearRequest.Status = STATUS_SUCCESS;
|
|
ClearRequest.Pkt.ClearPkt->BackupFileName = &BackupFileNameU;
|
|
|
|
PerformClearRequest(&ClearRequest);
|
|
|
|
//
|
|
// Generate an audit in the Security log.
|
|
//
|
|
|
|
StringCchPrintfW(Number, 20, L"0x%x", ClearRequest.Status);
|
|
|
|
EventMessage[0] = pLogFile->LogModuleName->Buffer;
|
|
EventMessage[1] = BackupFileNameU.Buffer;
|
|
EventMessage[2] = Number;
|
|
|
|
if (NT_SUCCESS(ClearRequest.Status))
|
|
{
|
|
ELF_LOG0(TRACE,
|
|
"AutoBackupLogFile: auto backup and clear worked\n");
|
|
|
|
ClearStatus = EVENTLOG_AUDIT_SUCCESS;
|
|
}
|
|
else
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"AutoBackupLogFile: failed calling clear/backup, error 0x%x\n",
|
|
ClearRequest.Status);
|
|
ClearStatus = EVENTLOG_AUDIT_FAILURE;
|
|
}
|
|
|
|
ElfpCreateElfEvent(
|
|
0x20c, // todo, get the #def
|
|
ClearStatus,
|
|
1, // EventCategory (SE_CATEGID_SYSTEM)
|
|
3, // NumberOfStrings
|
|
EventMessage, // Strings
|
|
NULL, // Data
|
|
0, // Datalength
|
|
0, // Do not Overwrite if necc.
|
|
TRUE); // For the Security Log file
|
|
|
|
ElfpFreeBuffer(BackupFileNameU.Buffer);
|
|
|
|
return ClearRequest.Status;
|
|
}
|
|
|
|
|
|
VOID
|
|
PerformWriteRequest(
|
|
PELF_REQUEST_RECORD Request
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine writes the event log entry to the log file specified in
|
|
the request packet.
|
|
There is no need to impersonate the client since we want all clients
|
|
to have access to writing to the log file.
|
|
|
|
This routine does not use memory mapped I/O to access the log file. This
|
|
is so the changes can be immediately committed to disk if that was how
|
|
the log file was opened.
|
|
|
|
Arguments:
|
|
|
|
Pointer to the request packet.
|
|
|
|
Return Value:
|
|
|
|
NONE
|
|
|
|
Note:
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
ULONG WritePos; // Position to write record
|
|
LARGE_INTEGER Time;
|
|
ULONG SpaceNeeded; // Record size + "buffer" size
|
|
ULONG CurrentTime = 0;
|
|
PEVENTLOGRECORD EventRecord;
|
|
ULONG RecordSize;
|
|
ULONG DeletedRecordOffset;
|
|
ULONG SpaceAvail;
|
|
ULONG EarliestTime;
|
|
PLOGFILE pLogFile; // For optimized access to structure
|
|
PELF_LOGFILE_HEADER pFileHeader;
|
|
PVOID BaseAddress;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
PEVENTLOGRECORD pEventLogRecord;
|
|
PDWORD FillDword;
|
|
ULONG OverwrittenEOF = 0;
|
|
BOOL bSecurity = FALSE;
|
|
BOOL fRetryWriteRequest = FALSE;
|
|
|
|
pLogFile = Request->LogFile; // Set local variable
|
|
|
|
// Set some basic BOOLs
|
|
|
|
if(!_wcsicmp(pLogFile->LogModuleName->Buffer, ELF_SECURITY_MODULE_NAME))
|
|
bSecurity = TRUE;
|
|
else
|
|
bSecurity = FALSE;
|
|
|
|
//This condition occurs under stress conditions
|
|
//and causes an AV further in this function
|
|
if(pLogFile->BaseAddress == NULL)
|
|
{
|
|
Request->Status = STATUS_INVALID_HANDLE;
|
|
return;
|
|
}
|
|
//
|
|
// Get exclusive access to the log file. This will ensure no one
|
|
// else is accessing the file.
|
|
//
|
|
RtlAcquireResourceExclusive(&pLogFile->Resource,
|
|
TRUE); // Wait until available
|
|
|
|
try
|
|
{
|
|
|
|
RetryWriteRequest:
|
|
|
|
//
|
|
// Put in the record number
|
|
//
|
|
pEventLogRecord = (PEVENTLOGRECORD) Request->Pkt.WritePkt->Buffer;
|
|
pEventLogRecord->RecordNumber = pLogFile->CurrentRecordNumber;
|
|
|
|
//
|
|
// Now, go to the end of the file and look for empty space.
|
|
//
|
|
// If there is enough space to write out the record, just
|
|
// write it out and update the pointers.
|
|
//
|
|
// If there isn't enough space, then we need to check if we can
|
|
// wrap around the file without overwriting any records that are
|
|
// within the time retention period.
|
|
// If we cannot find any room, then we have to return an error
|
|
// that the file is full (and alert the administrator).
|
|
//
|
|
RecordSize = Request->Pkt.WritePkt->Datasize;
|
|
SpaceNeeded = RecordSize + ELFEOFRECORDSIZE;
|
|
|
|
if (pLogFile->EndRecord > pLogFile->BeginRecord)
|
|
{
|
|
//
|
|
// The current write position is after the position of the first
|
|
// record, then we can write up to the end of the file without
|
|
// worrying about overwriting existing records.
|
|
//
|
|
SpaceAvail = pLogFile->ActualMaxFileSize
|
|
- (pLogFile->EndRecord - pLogFile->BeginRecord + FILEHEADERBUFSIZE);
|
|
}
|
|
else if (pLogFile->EndRecord == pLogFile->BeginRecord
|
|
&&
|
|
!(pLogFile->Flags & ELF_LOGFILE_HEADER_WRAP))
|
|
{
|
|
//
|
|
// If the write position is equal to the position of the first
|
|
// record, and we have't wrapped yet, then the file is "empty"
|
|
// and so we have room to the physical end of the file.
|
|
//
|
|
SpaceAvail = pLogFile->ActualMaxFileSize - FILEHEADERBUFSIZE;
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// If our write position is before the position of the first record, then
|
|
// the file has wrapped and we need to deal with overwriting existing
|
|
// records in the file.
|
|
//
|
|
SpaceAvail = pLogFile->BeginRecord - pLogFile->EndRecord;
|
|
}
|
|
|
|
//
|
|
// We now have the number of bytes available to write the record
|
|
// WITHOUT overwriting any existing records stored in SpaceAvail.
|
|
// If that amount is not sufficient, then we need to create more space
|
|
// by "deleting" existing records that are older than the retention
|
|
// time that was configured for this file.
|
|
//
|
|
// We check the retention time against the time when the log was
|
|
// written since that is consistent at the server. We cannot use the
|
|
// client's time since that may vary if the clients are in different
|
|
// time zones.
|
|
//
|
|
NtQuerySystemTime(&Time);
|
|
RtlTimeToSecondsSince1970(&Time, &CurrentTime);
|
|
|
|
EarliestTime = CurrentTime - pLogFile->Retention;
|
|
|
|
Status = STATUS_SUCCESS; // Initialize for return to caller
|
|
|
|
//
|
|
// Check to see if the file hasn't reached its maximum allowable
|
|
// size yet, and also hasn't wrapped. If not, grow it by as much as
|
|
// needed, in 64K chunks.
|
|
//
|
|
if (pLogFile->ActualMaxFileSize < pLogFile->ConfigMaxFileSize
|
|
&&
|
|
SpaceNeeded > SpaceAvail)
|
|
{
|
|
//
|
|
// Extend it. This call cannot fail. If it can't extend it, it
|
|
// just caps it at the current size by changing
|
|
// pLogFile->ConfigMaxFileSize
|
|
//
|
|
ElfExtendFile(pLogFile,
|
|
SpaceNeeded,
|
|
&SpaceAvail);
|
|
}
|
|
|
|
//
|
|
// We don't want to split the fixed portion of a record across the
|
|
// physical end of the file, it makes it difficult when referencing
|
|
// these fields later (you have to check before you touch each one
|
|
// to make sure it's not after the physical EOF). So, if there's
|
|
// not enough room at the end of the file for the fixed portion,
|
|
// we fill it with a known byte pattern (ELF_SKIP_DWORD) that will
|
|
// be skipped if it's found at the start of a record (as long as
|
|
// it's less than the minimum record size, then we know it's not
|
|
// the start of a valid record).
|
|
//
|
|
if (pLogFile->ActualMaxFileSize - pLogFile->EndRecord < sizeof(EVENTLOGRECORD))
|
|
{
|
|
//
|
|
// Save the EndRecord pointer. In case we don't have the space
|
|
// to write another record, we'll need to rewrite the EOF where
|
|
// it was
|
|
//
|
|
OverwrittenEOF = pLogFile->EndRecord;
|
|
|
|
FillDword = (PDWORD) ((PBYTE) pLogFile->BaseAddress + pLogFile->EndRecord);
|
|
|
|
while (FillDword < (PDWORD) ((LPBYTE) pLogFile->BaseAddress +
|
|
pLogFile->ActualMaxFileSize))
|
|
{
|
|
*FillDword = ELF_SKIP_DWORD;
|
|
FillDword++;
|
|
}
|
|
|
|
pLogFile->EndRecord = FILEHEADERBUFSIZE;
|
|
SpaceAvail = pLogFile->BeginRecord - FILEHEADERBUFSIZE;
|
|
pLogFile->Flags |= ELF_LOGFILE_HEADER_WRAP;
|
|
}
|
|
|
|
EventRecord = (PEVENTLOGRECORD) ((PBYTE) pLogFile->BaseAddress
|
|
+ pLogFile->BeginRecord);
|
|
|
|
while (SpaceNeeded > SpaceAvail)
|
|
{
|
|
//
|
|
// If this logfile can be overwrite-as-needed, or if it has
|
|
// an overwrite time limit and the time hasn't expired, then
|
|
// allow the new event to overwrite an older event.
|
|
//
|
|
if (pLogFile->Retention == OVERWRITE_AS_NEEDED
|
|
||
|
|
(pLogFile->Retention != NEVER_OVERWRITE
|
|
&&
|
|
(EventRecord->TimeWritten < EarliestTime
|
|
||
|
|
Request->Flags & ELF_FORCE_OVERWRITE)))
|
|
{
|
|
//
|
|
// OK to overwrite
|
|
//
|
|
ULONG NextRecord;
|
|
ULONG SearchStartPos;
|
|
BOOL fBeginningRecordWrap = FALSE;
|
|
BOOL fInvalidRecordLength = FALSE;
|
|
|
|
DeletedRecordOffset = pLogFile->BeginRecord;
|
|
|
|
pLogFile->BeginRecord += EventRecord->Length;
|
|
|
|
//
|
|
// Ensure BeginRecord offset is DWORD-aligned.
|
|
//
|
|
pLogFile->BeginRecord = (pLogFile->BeginRecord + sizeof(ULONG) - 1)
|
|
& ~(sizeof(ULONG) - 1);
|
|
|
|
//
|
|
// Check specifically for a record length value of zero.
|
|
// Zero is considered invalid.
|
|
//
|
|
if (EventRecord->Length == 0)
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformWriteRequest: Zero-length record at "
|
|
"offset %d in %ws log\n",
|
|
DeletedRecordOffset,
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
fInvalidRecordLength = TRUE;
|
|
}
|
|
|
|
if (pLogFile->BeginRecord >= pLogFile->ActualMaxFileSize)
|
|
{
|
|
ULONG BeginRecord;
|
|
|
|
//
|
|
// We're about to wrap around the end of the file. Adjust
|
|
// BeginRecord accordingly.
|
|
//
|
|
fBeginningRecordWrap = TRUE;
|
|
BeginRecord = FILEHEADERBUFSIZE
|
|
+ (pLogFile->BeginRecord
|
|
- pLogFile->ActualMaxFileSize);
|
|
|
|
//
|
|
// If the record length was bogus (very large), it's possible
|
|
// the wrap-adjusted computed position is still beyond the
|
|
// end of file. In thise case, mark it as bogus.
|
|
//
|
|
if (BeginRecord >= pLogFile->ActualMaxFileSize)
|
|
{
|
|
ELF_LOG3(ERROR,
|
|
"PerformWriteRequest: Too-large record length (%#x) "
|
|
"at offset %d in %ws log\n",
|
|
EventRecord->Length,
|
|
DeletedRecordOffset,
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
fInvalidRecordLength = TRUE;
|
|
}
|
|
else
|
|
{
|
|
pLogFile->BeginRecord = BeginRecord;
|
|
}
|
|
}
|
|
|
|
if (fInvalidRecordLength)
|
|
{
|
|
//
|
|
// If the record length is considered bogus, adjust
|
|
// BeginRecord to be just beyond the length and signature of
|
|
// the previous record to scan for the next valid record.
|
|
//
|
|
pLogFile->BeginRecord = DeletedRecordOffset
|
|
+ (sizeof(ULONG) * 2);
|
|
}
|
|
|
|
//
|
|
// Ensure the record referenced is indeed a valid record and that
|
|
// we're not reading into a partially overwritten record. With a
|
|
// circular log, it's possible to partially overwrite existing
|
|
// entries with the EOF record and/or ELF_SKIP_DWORD values.
|
|
//
|
|
// Skip the record size to the record signature since the loop
|
|
// below will search for the next valid signature. Note that
|
|
// the increment of SpaceAvail is undone when we find a valid
|
|
// record below.
|
|
//
|
|
NextRecord = pLogFile->BeginRecord + sizeof(ULONG);
|
|
|
|
if (NextRecord < pLogFile->ActualMaxFileSize)
|
|
{
|
|
SpaceAvail += min(sizeof(ULONG),
|
|
pLogFile->ActualMaxFileSize - NextRecord);
|
|
}
|
|
|
|
//
|
|
// Seek to find a record signature.
|
|
//
|
|
SearchStartPos = pLogFile->BeginRecord;
|
|
|
|
for ( ;; )
|
|
{
|
|
PVOID Position;
|
|
|
|
for ( ;
|
|
NextRecord != SearchStartPos;
|
|
SpaceAvail += sizeof(ULONG), NextRecord += sizeof(ULONG))
|
|
{
|
|
if (NextRecord >= pLogFile->ActualMaxFileSize)
|
|
{
|
|
NextRecord = pLogFile->BeginRecord = FILEHEADERBUFSIZE;
|
|
}
|
|
|
|
if (*(PULONG) ((PBYTE) pLogFile->BaseAddress + NextRecord)
|
|
== ELF_LOG_FILE_SIGNATURE)
|
|
{
|
|
//
|
|
// Found the next valid record signature
|
|
//
|
|
break;
|
|
}
|
|
}
|
|
|
|
Position = (PULONG) ((PBYTE) pLogFile->BaseAddress + NextRecord);
|
|
|
|
if (*(PULONG) Position == ELF_LOG_FILE_SIGNATURE)
|
|
{
|
|
//
|
|
// This record is valid so far, perform a final, more
|
|
// rigorous check for record validity.
|
|
//
|
|
if (ValidFilePos(CONTAINING_RECORD(Position,
|
|
EVENTLOGRECORD,
|
|
Reserved),
|
|
NULL,
|
|
NULL,
|
|
(PBYTE) pLogFile->BaseAddress
|
|
+ pLogFile->ViewSize,
|
|
pLogFile->BaseAddress,
|
|
FALSE))
|
|
{
|
|
//
|
|
// The record is valid. Adjust SpaceAvail to not
|
|
// include a sub-portion of this record in the
|
|
// available space computation.
|
|
//
|
|
SpaceAvail -= sizeof(ULONG);
|
|
pLogFile->BeginRecord = NextRecord - sizeof(ULONG);
|
|
break;
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Continue the search for the next valid record.
|
|
//
|
|
// NB : Not calling FixContextHandlesForRecord
|
|
// since we have not established a valid
|
|
// beginning record position yet. Not that
|
|
// it would do any good - this condition would
|
|
// be evaluated in cases of corrupt logs.
|
|
//
|
|
ELF_LOG2(FILES,
|
|
"PerformWriteRequest: Valid record signature with "
|
|
"invalid record found at offset %d of %ws log\n",
|
|
NextRecord,
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
SpaceAvail += sizeof(ULONG);
|
|
NextRecord += sizeof(ULONG);
|
|
continue;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Not a single valid record can be found. This is not
|
|
// good. Consider the log corrupted and bail the write.
|
|
//
|
|
ELF_LOG1(ERROR,
|
|
"PerformWriteRequest: No valid records found in %ws log\n",
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
Status = STATUS_EVENTLOG_FILE_CORRUPT;
|
|
ASSERT(Status != STATUS_EVENTLOG_FILE_CORRUPT);
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (Status == STATUS_EVENTLOG_FILE_CORRUPT)
|
|
{
|
|
break;
|
|
}
|
|
|
|
if (fBeginningRecordWrap)
|
|
{
|
|
//
|
|
// Check to see if the file has reached its maximum allowable
|
|
// size yet. If not, grow it by as much as needed in 64K
|
|
// chunks.
|
|
//
|
|
if (pLogFile->ActualMaxFileSize < pLogFile->ConfigMaxFileSize)
|
|
{
|
|
//
|
|
// Extend it. This call cannot fail. If it can't
|
|
// extend it, it just caps it at the current size by
|
|
// changing pLogFile->ConfigMaxFileSize.
|
|
//
|
|
ElfExtendFile(pLogFile,
|
|
SpaceNeeded,
|
|
&SpaceAvail);
|
|
|
|
//
|
|
// Since extending the file will cause it to be moved, we
|
|
// need to re-establish the address for the EventRecord.
|
|
//
|
|
EventRecord = (PEVENTLOGRECORD) ((PBYTE) pLogFile->BaseAddress
|
|
+ DeletedRecordOffset);
|
|
}
|
|
}
|
|
|
|
//
|
|
// Make sure no handle points to the record that we're getting
|
|
// ready to overwrite, it one does, correct it to point to the
|
|
// new first record.
|
|
//
|
|
FixContextHandlesForRecord(DeletedRecordOffset,
|
|
pLogFile->BeginRecord);
|
|
|
|
if (!fInvalidRecordLength)
|
|
{
|
|
//
|
|
// Update SpaceAvail to include the deleted record's size.
|
|
// That is, if we have a high degree of confidence that
|
|
// it is valid.
|
|
//
|
|
SpaceAvail += EventRecord->Length;
|
|
}
|
|
|
|
//
|
|
// Bump to the next record, file wrap was handled above
|
|
//
|
|
|
|
//
|
|
// If these are ELF_SKIP_DWORDs, just move past them
|
|
//
|
|
FillDword = (PDWORD) ((PBYTE) pLogFile->BaseAddress
|
|
+ pLogFile->BeginRecord);
|
|
|
|
if (*FillDword == ELF_SKIP_DWORD)
|
|
{
|
|
SpaceAvail += pLogFile->ActualMaxFileSize - pLogFile->BeginRecord;
|
|
pLogFile->BeginRecord = FILEHEADERBUFSIZE;
|
|
}
|
|
|
|
EventRecord = (PEVENTLOGRECORD) ((PBYTE) pLogFile->BaseAddress
|
|
+ pLogFile->BeginRecord);
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// CODEWORK: Split this out into a separate function
|
|
//
|
|
|
|
//
|
|
// All records within retention period
|
|
//
|
|
ELF_LOG1(ERROR,
|
|
"PerformWriteRequest: %ws log is full\n",
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
//
|
|
// Do new behavior.
|
|
//
|
|
// Auto backup, clear the log, and log and event that says the file
|
|
// was backed up and try to log the current event one more time.
|
|
//
|
|
// If this cannot be done, we made our best attempt, so we will probably
|
|
// crash on audit fail, and not log the event (revert to old behavior).
|
|
//
|
|
|
|
if ((pLogFile->AutoBackupLogFiles != 0) && (fRetryWriteRequest == FALSE)) {
|
|
|
|
AutoBackupLogFile(Request, OverwrittenEOF);
|
|
|
|
fRetryWriteRequest = TRUE;
|
|
|
|
goto RetryWriteRequest;
|
|
}
|
|
|
|
//
|
|
// Hang an event on the queuedevent list for later writing
|
|
// if we haven't just written a log full event for this log.
|
|
// Don't put up the popup during setup as there's nothing
|
|
// the user can do about it until setup finishes.
|
|
//
|
|
if (pLogFile->logpLogPopup == LOGPOPUP_CLEARED
|
|
&&
|
|
!ElfGlobalData->fSetupInProgress && !bSecurity)
|
|
{
|
|
INT StringLen, id = -1;
|
|
LPTSTR lpModuleNameLoc = NULL;
|
|
HMODULE StringsResource;
|
|
|
|
//
|
|
// We should never be popping up or logging an event
|
|
// for the security log
|
|
//
|
|
ASSERT(_wcsicmp(pLogFile->LogModuleName->Buffer,
|
|
ELF_SECURITY_MODULE_NAME) != 0);
|
|
|
|
//
|
|
// Get the localized module name from message table
|
|
//
|
|
StringsResource = GetModuleHandle(L"EVENTLOG.DLL");
|
|
|
|
ASSERT(StringsResource != NULL);
|
|
|
|
if (_wcsicmp(pLogFile->LogModuleName->Buffer,
|
|
ELF_SYSTEM_MODULE_NAME) == 0)
|
|
{
|
|
id = ELF_MODULE_NAME_LOCALIZE_SYSTEM;
|
|
}
|
|
else if (_wcsicmp(pLogFile->LogModuleName->Buffer,
|
|
ELF_APPLICATION_MODULE_NAME) == 0)
|
|
{
|
|
id = ELF_MODULE_NAME_LOCALIZE_APPLICATION;
|
|
}
|
|
|
|
if (id != -1)
|
|
{
|
|
StringLen = FormatMessage(FORMAT_MESSAGE_FROM_HMODULE |
|
|
FORMAT_MESSAGE_ALLOCATE_BUFFER,
|
|
StringsResource,
|
|
id,
|
|
0,
|
|
(LPTSTR) &lpModuleNameLoc,
|
|
0,
|
|
NULL);
|
|
|
|
if ((StringLen > 1) && (lpModuleNameLoc != NULL))
|
|
{
|
|
//
|
|
// Get rid of cr/lf control code at the end
|
|
//
|
|
*(lpModuleNameLoc + StringLen - 2) = 0;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Create the "log full" event -- use the name stored in the
|
|
// log's default module if it's not a well-known log type
|
|
//
|
|
ElfpCreateElfEvent(EVENT_LOG_FULL,
|
|
EVENTLOG_ERROR_TYPE,
|
|
0, // EventCategory
|
|
1, // NumberOfStrings
|
|
(lpModuleNameLoc != NULL) ?
|
|
&lpModuleNameLoc :
|
|
&Request->LogFile->LogModuleName->Buffer,
|
|
NULL, // Data
|
|
0, // Datalength
|
|
ELF_FORCE_OVERWRITE,
|
|
FALSE); // Overwrite if necc.
|
|
|
|
ElfpCreateQueuedMessage(
|
|
ALERT_ELF_LogOverflow,
|
|
1,
|
|
(lpModuleNameLoc != NULL) ?
|
|
&lpModuleNameLoc :
|
|
&Request->Module->LogFile->LogModuleName->Buffer);
|
|
|
|
LocalFree(lpModuleNameLoc);
|
|
|
|
//
|
|
// Don't post the popup again until either the machine is
|
|
// rebooted or the log is cleared
|
|
//
|
|
pLogFile->logpLogPopup = LOGPOPUP_ALREADY_SHOWN;
|
|
}
|
|
else if(bSecurity)
|
|
{
|
|
if(pLogFile->bFullAlertDone == FALSE)
|
|
ElfpCreateQueuedAlert(
|
|
ALERT_ELF_LogOverflow,
|
|
1,
|
|
&Request->Module->LogFile->LogModuleName->Buffer);
|
|
pLogFile->bFullAlertDone = TRUE;
|
|
}
|
|
|
|
pLogFile->Flags |= ELF_LOGFILE_LOGFULL_WRITTEN;
|
|
|
|
if (OverwrittenEOF)
|
|
{
|
|
//
|
|
// The EOF record was at the end of the physical file,
|
|
// and we overwrote it with ELF_SKIP_DWORDs, so we need
|
|
// to put it back since we're not going to be able to
|
|
// write a record. We also need to turn the wrap bit
|
|
// back off
|
|
//
|
|
pLogFile->Flags &= ~(ELF_LOGFILE_HEADER_WRAP);
|
|
pLogFile->EndRecord = OverwrittenEOF;
|
|
WritePos = OverwrittenEOF;
|
|
|
|
//
|
|
// Write out the EOF record
|
|
//
|
|
WriteToLog(pLogFile,
|
|
&EOFRecord,
|
|
ELFEOFRECORDSIZE,
|
|
&WritePos,
|
|
pLogFile->ActualMaxFileSize,
|
|
FILEHEADERBUFSIZE);
|
|
}
|
|
|
|
Status = STATUS_LOG_FILE_FULL;
|
|
break; // Get out of while loop
|
|
}
|
|
}
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
//
|
|
// We have enough room to write the record and the EOF record.
|
|
//
|
|
|
|
//
|
|
// Update OldestRecordNumber to reflect the records that were
|
|
// overwritten amd increment the CurrentRecordNumber
|
|
//
|
|
// Make sure that the log isn't empty, if it is, the oldest
|
|
// record is 1
|
|
//
|
|
if (pLogFile->BeginRecord == pLogFile->EndRecord)
|
|
{
|
|
pLogFile->OldestRecordNumber = 1;
|
|
}
|
|
else
|
|
{
|
|
pLogFile->OldestRecordNumber = EventRecord->RecordNumber;
|
|
}
|
|
|
|
pLogFile->CurrentRecordNumber++;
|
|
|
|
//
|
|
// If the dirty bit is not set, then this is the first time that
|
|
// we have written to the file since we started. In that case,
|
|
// set the dirty bit in the file header as well so that we will
|
|
// know that the contents have changed.
|
|
//
|
|
if (!(pLogFile->Flags & ELF_LOGFILE_HEADER_DIRTY))
|
|
{
|
|
SIZE_T HeaderSize;
|
|
|
|
pLogFile->Flags |= ELF_LOGFILE_HEADER_DIRTY;
|
|
|
|
pFileHeader = (PELF_LOGFILE_HEADER) pLogFile->BaseAddress;
|
|
pFileHeader->Flags |= ELF_LOGFILE_HEADER_DIRTY;
|
|
|
|
//
|
|
// Now flush this to disk to commit it
|
|
//
|
|
BaseAddress = pLogFile->BaseAddress;
|
|
HeaderSize = FILEHEADERBUFSIZE;
|
|
|
|
Status = NtFlushVirtualMemory(NtCurrentProcess(),
|
|
&BaseAddress,
|
|
&HeaderSize,
|
|
&IoStatusBlock);
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"PerformWriteRequest: NtFlushVirtualMemory to add dirty "
|
|
"flag to header failed %#x\n",
|
|
Status);
|
|
}
|
|
}
|
|
|
|
//
|
|
// Write the event to the log
|
|
//
|
|
WriteToLog(pLogFile,
|
|
Request->Pkt.WritePkt->Buffer,
|
|
RecordSize,
|
|
&(pLogFile->EndRecord),
|
|
pLogFile->ActualMaxFileSize,
|
|
FILEHEADERBUFSIZE);
|
|
|
|
//
|
|
// Use a separate variable for the position since we don't want
|
|
// it updated.
|
|
//
|
|
WritePos = pLogFile->EndRecord;
|
|
|
|
if (WritePos > pLogFile->ActualMaxFileSize)
|
|
{
|
|
WritePos -= pLogFile->ActualMaxFileSize - FILEHEADERBUFSIZE;
|
|
}
|
|
|
|
//
|
|
// Update the EOF record fields
|
|
//
|
|
EOFRecord.BeginRecord = pLogFile->BeginRecord;
|
|
EOFRecord.EndRecord = WritePos;
|
|
EOFRecord.CurrentRecordNumber = pLogFile->CurrentRecordNumber;
|
|
EOFRecord.OldestRecordNumber = pLogFile->OldestRecordNumber;
|
|
|
|
//
|
|
// Write out the EOF record
|
|
//
|
|
WriteToLog(pLogFile,
|
|
&EOFRecord,
|
|
ELFEOFRECORDSIZE,
|
|
&WritePos,
|
|
pLogFile->ActualMaxFileSize,
|
|
FILEHEADERBUFSIZE);
|
|
|
|
//
|
|
// If we had just written a logfull record, turn the bit off.
|
|
// Since we just wrote a record, technically it's not full anymore
|
|
//
|
|
if (!(Request->Flags & ELF_FORCE_OVERWRITE))
|
|
{
|
|
pLogFile->Flags &= ~(ELF_LOGFILE_LOGFULL_WRITTEN);
|
|
}
|
|
|
|
//
|
|
// See if there are any ElfChangeNotify callers to notify, and if
|
|
// there are, pulse their event
|
|
//
|
|
NotifyChange(pLogFile);
|
|
}
|
|
|
|
//
|
|
// Set status field in the request packet.
|
|
//
|
|
Request->Status = Status;
|
|
}
|
|
except (EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformWriteRequest: Caught exception %#x writing to %ws log\n",
|
|
GetExceptionCode(),
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
Request->Status = STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
|
|
//
|
|
// Release the resource
|
|
//
|
|
RtlReleaseResource ( &pLogFile->Resource );
|
|
}
|
|
|
|
|
|
VOID
|
|
PerformClearRequest(
|
|
PELF_REQUEST_RECORD Request
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will optionally back up the log file specified, and will
|
|
delete it.
|
|
|
|
Arguments:
|
|
|
|
Pointer to the request packet.
|
|
|
|
Return Value:
|
|
|
|
NONE
|
|
|
|
Note:
|
|
|
|
On the exit path, when we do some "cleanup" work, we discard the
|
|
status and instead return the status of the operation that is being
|
|
performed.
|
|
This is necessary since we wish to return any error condition that is
|
|
directly related to the clear operation. For other errors, we will
|
|
fail at a later stage.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status, IStatus;
|
|
PUNICODE_STRING FileName;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
PFILE_RENAME_INFORMATION NewName = NULL;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
HANDLE ClearHandle = NULL;
|
|
FILE_DISPOSITION_INFORMATION DeleteInfo = {TRUE};
|
|
ULONG FileRefCount;
|
|
BOOLEAN FileRenamed = FALSE;
|
|
|
|
//
|
|
// Get exclusive access to the log file. This will ensure no one
|
|
// else is accessing the file.
|
|
//
|
|
RtlAcquireResourceExclusive (&Request->Module->LogFile->Resource,
|
|
TRUE); // Wait until available
|
|
|
|
//
|
|
// We have exclusive access to the file.
|
|
//
|
|
// We force the file to be closed, and store away the ref count
|
|
// so that we can set it back when we reopen the file.
|
|
// This is a little *sleazy* but we have exclusive access to the
|
|
// logfile structure so we can play these games.
|
|
//
|
|
FileRefCount = Request->LogFile->RefCount; // Store this away
|
|
|
|
ElfpCloseLogFile(Request->LogFile, ELF_LOG_CLOSE_FORCE);
|
|
Request->LogFile->FileHandle = NULL; // For use later
|
|
|
|
//
|
|
// Open the file with delete access in order to rename it.
|
|
//
|
|
InitializeObjectAttributes(&ObjectAttributes,
|
|
Request->LogFile->LogFileName,
|
|
OBJ_CASE_INSENSITIVE,
|
|
NULL,
|
|
NULL);
|
|
|
|
Status = NtOpenFile(&ClearHandle,
|
|
GENERIC_READ | DELETE | SYNCHRONIZE,
|
|
&ObjectAttributes,
|
|
&IoStatusBlock,
|
|
FILE_SHARE_DELETE,
|
|
FILE_SYNCHRONOUS_IO_NONALERT);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
//
|
|
// If the backup file name has been specified and is not NULL,
|
|
// then we move the current file to the new file. If that fails,
|
|
// then fail the whole operation.
|
|
//
|
|
if ((Request->Pkt.ClearPkt->BackupFileName != NULL)
|
|
&&
|
|
(Request->Pkt.ClearPkt->BackupFileName->Length != 0))
|
|
{
|
|
FileName = Request->Pkt.ClearPkt->BackupFileName;
|
|
|
|
//
|
|
// Set up the rename information structure with the new name
|
|
//
|
|
NewName = ElfpAllocateBuffer(FileName->Length
|
|
+ sizeof(WCHAR) + sizeof(*NewName));
|
|
|
|
if (NewName)
|
|
{
|
|
RtlCopyMemory(NewName->FileName,
|
|
FileName->Buffer,
|
|
FileName->Length);
|
|
|
|
//
|
|
// Guarantee that it's NULL terminated
|
|
//
|
|
NewName->FileName[FileName->Length / sizeof(WCHAR)] = L'\0';
|
|
|
|
NewName->ReplaceIfExists = FALSE;
|
|
NewName->RootDirectory = NULL;
|
|
NewName->FileNameLength = FileName->Length;
|
|
|
|
Status = NtSetInformationFile(ClearHandle,
|
|
&IoStatusBlock,
|
|
NewName,
|
|
FileName->Length + sizeof(*NewName),
|
|
FileRenameInformation);
|
|
|
|
if (Status == STATUS_NOT_SAME_DEVICE)
|
|
{
|
|
//
|
|
// They want the backup file to be on a different
|
|
// device. We need to copy this one, and then delete
|
|
// it.
|
|
//
|
|
ELF_LOG2(FILES,
|
|
"PerformClearRequest: Attempting to copy log file %ws "
|
|
"to different device (%ws)\n",
|
|
Request->LogFile->LogFileName->Buffer,
|
|
NewName->FileName);
|
|
|
|
Status = ElfpCopyFile(ClearHandle, FileName);
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG1(FILES,
|
|
"PerformClearRequest: Copy succeeded -- deleting %ws\n",
|
|
Request->LogFile->LogFileName->Buffer);
|
|
|
|
Status = NtSetInformationFile(ClearHandle,
|
|
&IoStatusBlock,
|
|
&DeleteInfo,
|
|
sizeof(DeleteInfo),
|
|
FileDispositionInformation);
|
|
|
|
if (!NT_SUCCESS (Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformClearRequest: Delete of %ws after "
|
|
"successful copy failed %#x\n",
|
|
Request->LogFile->LogFileName->Buffer,
|
|
Status);
|
|
}
|
|
}
|
|
}
|
|
else if (NT_SUCCESS (Status))
|
|
{
|
|
FileRenamed = TRUE;
|
|
}
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformClearRequest: Rename of %ws failed %#x\n",
|
|
Request->LogFile->LogFileName->Buffer,
|
|
Status);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
ELF_LOG0(ERROR,
|
|
"PerformClearRequest: Unable to allocate memory for "
|
|
"FILE_RENAME_INFORMATION structure\n");
|
|
|
|
Status = STATUS_NO_MEMORY;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// No backup name was specified. Just delete the log file
|
|
// (i.e. "clear it"). We can just delete it since we know
|
|
// that the first time anything is written to a log file,
|
|
// if that file does not exist, it is created and a header
|
|
// is written to it. By deleting it here, we make it cleaner
|
|
// to manage log files, and avoid having zero-length files all
|
|
// over the disk.
|
|
//
|
|
ELF_LOG1(FILES,
|
|
"PerformClearRequest: No backup name specified -- deleting %ws\n",
|
|
Request->LogFile->LogFileName->Buffer);
|
|
|
|
Status = NtSetInformationFile(ClearHandle,
|
|
&IoStatusBlock,
|
|
&DeleteInfo,
|
|
sizeof(DeleteInfo),
|
|
FileDispositionInformation);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformClearRequest: Delete of %ws failed %#x\n",
|
|
Request->LogFile->LogFileName->Buffer,
|
|
Status);
|
|
}
|
|
}
|
|
|
|
IStatus = NtClose(ClearHandle); // Discard status
|
|
ASSERT(NT_SUCCESS(IStatus));
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// The open-for-delete failed.
|
|
//
|
|
ELF_LOG2(ERROR,
|
|
"PerformClearRequest: NtOpenFile of %ws for delete failed %#x\n",
|
|
Request->LogFile->LogFileName->Buffer,
|
|
Status);
|
|
}
|
|
|
|
//
|
|
// If the user reduced the size of the log file, pick up the new
|
|
// size as it couldn't be used until the log was cleared
|
|
//
|
|
if (NT_SUCCESS (Status))
|
|
{
|
|
if (Request->LogFile->NextClearMaxFileSize)
|
|
{
|
|
Request->LogFile->ConfigMaxFileSize = Request->LogFile->NextClearMaxFileSize;
|
|
}
|
|
|
|
//
|
|
// We need to recreate the file or if the file was just closed,
|
|
// then we reopen it.
|
|
//
|
|
IStatus = ElfOpenLogFile(Request->LogFile, ElfNormalLog);
|
|
|
|
if (!NT_SUCCESS(IStatus))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformClearRequest: Open of %ws after successful delete "
|
|
"failed %#x\n",
|
|
Request->LogFile->LogFileName->Buffer,
|
|
IStatus);
|
|
|
|
Status = IStatus;
|
|
|
|
//
|
|
// The open failed -- try to restore the old log file. If
|
|
// NewName is NULL, it means there was no backup file specified.
|
|
//
|
|
if (NewName != NULL)
|
|
{
|
|
//
|
|
// Opening the new log file failed, reopen the old log and
|
|
// return this error from the Api
|
|
//
|
|
PFILE_RENAME_INFORMATION OldName;
|
|
UNICODE_STRING UnicodeString;
|
|
|
|
//
|
|
// There shouldn't be any way to fail unless we successfully
|
|
// renamed the file, and there's no recovery if that happens.
|
|
//
|
|
|
|
//
|
|
// BUGBUG: We can hit this if the user asked for the backup
|
|
// file to be put on a different device, in which
|
|
// case the delete succeeded but FileRenamed is
|
|
// still set to FALSE if ElfOpenLogFile fails.
|
|
//
|
|
ASSERT(FileRenamed == TRUE);
|
|
|
|
//
|
|
// Rename the file back to the original name. Reuse ClearHandle.
|
|
//
|
|
RtlInitUnicodeString(&UnicodeString, NewName->FileName);
|
|
|
|
InitializeObjectAttributes(&ObjectAttributes,
|
|
&UnicodeString,
|
|
OBJ_CASE_INSENSITIVE,
|
|
NULL,
|
|
NULL);
|
|
|
|
IStatus = NtOpenFile(&ClearHandle,
|
|
GENERIC_READ | DELETE | SYNCHRONIZE,
|
|
&ObjectAttributes,
|
|
&IoStatusBlock,
|
|
FILE_SHARE_DELETE,
|
|
FILE_SYNCHRONOUS_IO_NONALERT);
|
|
|
|
if (NT_SUCCESS(IStatus))
|
|
{
|
|
//
|
|
// Set up the rename information structure with the old name
|
|
//
|
|
OldName = ElfpAllocateBuffer(Request->LogFile->LogFileName->Length
|
|
+ sizeof(WCHAR) + sizeof(*OldName));
|
|
|
|
if (OldName)
|
|
{
|
|
PUNICODE_STRING pFileName = Request->LogFile->LogFileName;
|
|
|
|
RtlCopyMemory(OldName->FileName,
|
|
pFileName->Buffer,
|
|
pFileName->Length);
|
|
|
|
//
|
|
// Guarantee that it's NULL terminated
|
|
//
|
|
OldName->FileName[pFileName->Length / sizeof(WCHAR)] = L'\0';
|
|
|
|
OldName->ReplaceIfExists = FALSE;
|
|
OldName->RootDirectory = NULL;
|
|
OldName->FileNameLength = pFileName->Length;
|
|
|
|
//
|
|
// Change the name of the backed-up (i.e., cleared) log
|
|
// file to its original name.
|
|
//
|
|
IStatus = NtSetInformationFile(ClearHandle,
|
|
&IoStatusBlock,
|
|
OldName,
|
|
pFileName->Length
|
|
+ sizeof(*OldName)
|
|
+ sizeof(WCHAR),
|
|
FileRenameInformation);
|
|
|
|
ASSERT(NT_SUCCESS(IStatus));
|
|
|
|
//
|
|
// Reopen the original file. This has to work.
|
|
//
|
|
IStatus = ElfOpenLogFile(Request->LogFile, ElfNormalLog);
|
|
ASSERT(NT_SUCCESS(IStatus));
|
|
|
|
ElfpFreeBuffer(OldName);
|
|
}
|
|
|
|
NtClose(ClearHandle);
|
|
}
|
|
else
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformClearRequest: Open of backed-up log file %ws "
|
|
"failed %#x\n",
|
|
NewName->FileName,
|
|
IStatus);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// The delete failed for some reason -- reopen the original log file
|
|
//
|
|
ELF_LOG1(FILES,
|
|
"PerformClearRequest: Delete of %ws failed -- reopening original file\n",
|
|
Request->LogFile->LogFileName->Buffer);
|
|
|
|
IStatus = ElfOpenLogFile(Request->LogFile, ElfNormalLog);
|
|
ASSERT(NT_SUCCESS(IStatus));
|
|
}
|
|
|
|
Request->LogFile->RefCount = FileRefCount; // Restore old value.
|
|
|
|
if (Request->LogFile->logpLogPopup == LOGPOPUP_ALREADY_SHOWN)
|
|
{
|
|
//
|
|
// This log has a viewable popup (i.e., it's not LOGPOPUP_NEVER_SHOW),
|
|
// so we should show it again if the log fills up.
|
|
//
|
|
Request->LogFile->logpLogPopup = LOGPOPUP_CLEARED;
|
|
}
|
|
|
|
Request->LogFile->bFullAlertDone = FALSE;
|
|
//
|
|
// Mark any open context handles that point to this file as "invalid for
|
|
// read." This will fail any further READ operations and force the caller
|
|
// to close and reopen the handle.
|
|
//
|
|
InvalidateContextHandlesForLogFile(Request->LogFile);
|
|
|
|
//
|
|
// Set status field in the request packet.
|
|
//
|
|
Request->Status = Status;
|
|
|
|
//
|
|
// Release the resource
|
|
//
|
|
RtlReleaseResource(&Request->Module->LogFile->Resource);
|
|
|
|
ElfpFreeBuffer(NewName);
|
|
}
|
|
|
|
|
|
VOID
|
|
PerformBackupRequest(
|
|
PELF_REQUEST_RECORD Request
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine will back up the log file specified.
|
|
|
|
This routine impersonates the client in order to ensure that the correct
|
|
access control is used.
|
|
|
|
This routine is entered with the ElfGlobalResource held in a shared
|
|
state and the logfile lock is acquired shared to prevent writing, but
|
|
allow people to still read.
|
|
|
|
This copies the file in two chunks, from the first record to the end
|
|
of the file, and then from the top of the file (excluding the header)
|
|
to the end of the EOF record.
|
|
|
|
Arguments:
|
|
|
|
Pointer to the request packet.
|
|
|
|
Return Value:
|
|
|
|
NONE, status is placed in the packet for later use by the API wrapper
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status, IStatus;
|
|
IO_STATUS_BLOCK IoStatusBlock;
|
|
OBJECT_ATTRIBUTES ObjectAttributes;
|
|
LARGE_INTEGER MaximumSizeOfSection;
|
|
LARGE_INTEGER Offset;
|
|
ULONG LastRecordNumber;
|
|
ULONG OldestRecordNumber;
|
|
HANDLE BackupHandle = INVALID_HANDLE_VALUE;
|
|
PBYTE StartOfCopy;
|
|
PBYTE EndOfCopy;
|
|
ULONG BytesToCopy;
|
|
ULONG EndRecord = FILEHEADERBUFSIZE;
|
|
BOOL ImpersonatingClient = FALSE;
|
|
ELF_LOGFILE_HEADER FileHeaderBuf = { FILEHEADERBUFSIZE, // Size
|
|
ELF_LOG_FILE_SIGNATURE,
|
|
ELF_VERSION_MAJOR,
|
|
ELF_VERSION_MINOR,
|
|
FILEHEADERBUFSIZE, // Start offset
|
|
FILEHEADERBUFSIZE, // End offset
|
|
1, // Next record #
|
|
1, // Oldest record #
|
|
0, // Maxsize
|
|
0, // Flags
|
|
0, // Retention
|
|
FILEHEADERBUFSIZE // Size
|
|
};
|
|
|
|
|
|
//
|
|
// Get shared access to the log file. This will ensure no one
|
|
// else clears the file.
|
|
//
|
|
RtlAcquireResourceShared(&Request->Module->LogFile->Resource,
|
|
TRUE); // Wait until available
|
|
|
|
//
|
|
// Save away the next record number. We'll stop copying when we get to
|
|
// the record before this one. Also save the first record number so we
|
|
// can update the header and EOF record.
|
|
//
|
|
LastRecordNumber = Request->LogFile->CurrentRecordNumber;
|
|
OldestRecordNumber = Request->LogFile->OldestRecordNumber;
|
|
|
|
//
|
|
// Impersonate the client
|
|
//
|
|
Status = I_RpcMapWin32Status(RpcImpersonateClient(NULL));
|
|
|
|
if (NT_SUCCESS(Status))
|
|
{
|
|
//
|
|
// Keep this info so I can only revert in 1 place
|
|
//
|
|
ImpersonatingClient = TRUE;
|
|
|
|
//
|
|
// Set up the object attributes structure for the backup file
|
|
//
|
|
InitializeObjectAttributes(&ObjectAttributes,
|
|
Request->Pkt.BackupPkt->BackupFileName,
|
|
OBJ_CASE_INSENSITIVE,
|
|
NULL,
|
|
NULL);
|
|
|
|
//
|
|
// Open the backup file. Fail if a file by this name already exists.
|
|
//
|
|
MaximumSizeOfSection =
|
|
RtlConvertUlongToLargeInteger(Request->LogFile->ActualMaxFileSize);
|
|
|
|
Status = NtCreateFile(&BackupHandle,
|
|
GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE,
|
|
&ObjectAttributes,
|
|
&IoStatusBlock,
|
|
&MaximumSizeOfSection,
|
|
FILE_ATTRIBUTE_NORMAL,
|
|
FILE_SHARE_READ,
|
|
FILE_CREATE,
|
|
FILE_WRITE_THROUGH | FILE_SYNCHRONOUS_IO_NONALERT,
|
|
NULL,
|
|
0);
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformBackupRequest: Open of backup file %ws failed %#x\n",
|
|
Request->Pkt.BackupPkt->BackupFileName->Buffer,
|
|
Status);
|
|
|
|
goto errorexit;
|
|
}
|
|
|
|
//
|
|
// Write out the header, we'll update it later
|
|
//
|
|
FileHeaderBuf.CurrentRecordNumber = LastRecordNumber;
|
|
FileHeaderBuf.OldestRecordNumber = OldestRecordNumber;
|
|
FileHeaderBuf.Flags = 0;
|
|
FileHeaderBuf.Retention = Request->LogFile->Retention;
|
|
|
|
Status = NtWriteFile(BackupHandle, // Filehandle
|
|
NULL, // Event
|
|
NULL, // APC routine
|
|
NULL, // APC context
|
|
&IoStatusBlock, // IO_STATUS_BLOCK
|
|
&FileHeaderBuf, // Buffer
|
|
FILEHEADERBUFSIZE, // Length
|
|
NULL, // Byteoffset
|
|
NULL); // Key
|
|
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformBackupRequest: Write of header to backup file %ws "
|
|
"failed %#x\n",
|
|
Request->Pkt.BackupPkt->BackupFileName->Buffer,
|
|
Status);
|
|
|
|
goto errorexit;
|
|
}
|
|
|
|
//
|
|
// Scan from the end of the file skipping over ELF_SKIP_DWORDs
|
|
// to figure out how far to copy. If we haven't wrapped, we just
|
|
// copy to the EndRecord offset.
|
|
//
|
|
if (Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP)
|
|
{
|
|
EndOfCopy = (PBYTE) Request->LogFile->BaseAddress
|
|
+ Request->LogFile->ActualMaxFileSize - sizeof(DWORD);
|
|
|
|
while (*((PDWORD) EndOfCopy) == ELF_SKIP_DWORD)
|
|
{
|
|
EndOfCopy -= sizeof(DWORD);
|
|
}
|
|
|
|
EndOfCopy += sizeof(DWORD);
|
|
}
|
|
else
|
|
{
|
|
EndOfCopy = (PBYTE) Request->LogFile->BaseAddress
|
|
+ Request->LogFile->EndRecord;
|
|
}
|
|
|
|
//
|
|
// Now set the start position to be the first record and
|
|
// calculate the number of bytes to copy
|
|
//
|
|
StartOfCopy = (PBYTE) Request->LogFile->BaseAddress
|
|
+ Request->LogFile->BeginRecord;
|
|
|
|
BytesToCopy = (ULONG) (EndOfCopy - StartOfCopy);
|
|
EndRecord += BytesToCopy;
|
|
|
|
Status = NtWriteFile(BackupHandle, // Filehandle
|
|
NULL, // Event
|
|
NULL, // APC routine
|
|
NULL, // APC context
|
|
&IoStatusBlock, // IO_STATUS_BLOCK
|
|
StartOfCopy, // Buffer
|
|
BytesToCopy, // Length
|
|
NULL, // Byteoffset
|
|
NULL); // Key
|
|
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformBackupRequest: Block write to backup file %ws (1st "
|
|
"call) failed %#x\n",
|
|
Request->Pkt.BackupPkt->BackupFileName->Buffer,
|
|
Status);
|
|
|
|
goto errorexit;
|
|
}
|
|
|
|
//
|
|
// If the file's not wrapped, we're done except for the EOF
|
|
// record. If the file is wrapped we have to copy the 2nd
|
|
// piece
|
|
//
|
|
if (Request->LogFile->Flags & ELF_LOGFILE_HEADER_WRAP)
|
|
{
|
|
StartOfCopy = (PBYTE) Request->LogFile->BaseAddress
|
|
+ FILEHEADERBUFSIZE;
|
|
|
|
EndOfCopy = (PBYTE) Request->LogFile->BaseAddress
|
|
+ Request->LogFile->EndRecord;
|
|
|
|
BytesToCopy = (ULONG) (EndOfCopy - StartOfCopy);
|
|
EndRecord += BytesToCopy;
|
|
|
|
Status = NtWriteFile(BackupHandle, // Filehandle
|
|
NULL, // Event
|
|
NULL, // APC routine
|
|
NULL, // APC context
|
|
&IoStatusBlock, // IO_STATUS_BLOCK
|
|
StartOfCopy, // Buffer
|
|
BytesToCopy, // Length
|
|
NULL, // Byteoffset
|
|
NULL); // Key
|
|
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformBackupRequest: Block write to backup file %ws "
|
|
"(2nd call) failed %#x\n",
|
|
Request->Pkt.BackupPkt->BackupFileName->Buffer,
|
|
Status);
|
|
|
|
goto errorexit;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Write out the EOF record after updating the fields needed for
|
|
// recovery.
|
|
//
|
|
EOFRecord.BeginRecord = FILEHEADERBUFSIZE;
|
|
EOFRecord.EndRecord = EndRecord;
|
|
EOFRecord.CurrentRecordNumber = LastRecordNumber;
|
|
EOFRecord.OldestRecordNumber = OldestRecordNumber;
|
|
|
|
Status = NtWriteFile(BackupHandle, // Filehandle
|
|
NULL, // Event
|
|
NULL, // APC routine
|
|
NULL, // APC context
|
|
&IoStatusBlock, // IO_STATUS_BLOCK
|
|
&EOFRecord, // Buffer
|
|
ELFEOFRECORDSIZE, // Length
|
|
NULL, // Byteoffset
|
|
NULL); // Key
|
|
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformBackupRequest: Write of EOF record to backup file "
|
|
"%ws failed %#x\n",
|
|
Request->Pkt.BackupPkt->BackupFileName->Buffer,
|
|
Status);
|
|
|
|
goto errorexit;
|
|
}
|
|
|
|
//
|
|
// Update the header with valid information
|
|
//
|
|
FileHeaderBuf.EndOffset = EndRecord;
|
|
FileHeaderBuf.MaxSize = EndRecord + ELFEOFRECORDSIZE;
|
|
|
|
Offset = RtlConvertUlongToLargeInteger(0);
|
|
|
|
Status = NtWriteFile(BackupHandle, // Filehandle
|
|
NULL, // Event
|
|
NULL, // APC routine
|
|
NULL, // APC context
|
|
&IoStatusBlock, // IO_STATUS_BLOCK
|
|
&FileHeaderBuf, // Buffer
|
|
FILEHEADERBUFSIZE, // Length
|
|
&Offset, // Byteoffset
|
|
NULL); // Key
|
|
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"PerformBackupRequest: Rewrite of header to backup file "
|
|
"%ws failed %#x\n",
|
|
Request->Pkt.BackupPkt->BackupFileName->Buffer,
|
|
Status);
|
|
|
|
goto errorexit;
|
|
}
|
|
|
|
//
|
|
// Clear the LogFile flag archive bit, assuming the caller will
|
|
// clear (or has cleared) this log's archive file attribute.
|
|
// Note: No big deal if the caller didn't clear the archive
|
|
// attribute.
|
|
//
|
|
// The next write to this log tests the LogFile flag archive bit.
|
|
// If the bit is clear, the archive file attribute is set on the
|
|
// log file.
|
|
//
|
|
Request->LogFile->Flags &= ~ELF_LOGFILE_ARCHIVE_SET;
|
|
}
|
|
else
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"PerformBackupRequest: RpcImpersonateClient failed %#x\n",
|
|
Status);
|
|
}
|
|
|
|
errorexit:
|
|
|
|
if (ImpersonatingClient)
|
|
{
|
|
IStatus = I_RpcMapWin32Status(RpcRevertToSelf());
|
|
|
|
if (!NT_SUCCESS(IStatus))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"PerformBackupRequest: RpcRevertToSelf failed %#x\n",
|
|
IStatus);
|
|
}
|
|
}
|
|
|
|
//
|
|
// Close the output file
|
|
//
|
|
if (BackupHandle != INVALID_HANDLE_VALUE)
|
|
{
|
|
NtClose(BackupHandle);
|
|
}
|
|
|
|
//
|
|
// Set status field in the request packet.
|
|
//
|
|
Request->Status = Status;
|
|
|
|
//
|
|
// Release the resource
|
|
//
|
|
RtlReleaseResource(&Request->Module->LogFile->Resource);
|
|
}
|
|
|
|
|
|
VOID
|
|
ElfPerformRequest(
|
|
PELF_REQUEST_RECORD Request
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine takes the request packet and performs the operation
|
|
on the event log.
|
|
|
|
Before it does that, it takes the Global serialization resource
|
|
for a READ to prevent other threads from doing WRITE operations on
|
|
the resources of the service.
|
|
|
|
After it has performed the requested operation, it writes any records
|
|
generated by the eventlog service that have been put on the queued event
|
|
list.
|
|
|
|
Arguments:
|
|
|
|
Pointer to the request packet.
|
|
|
|
Return Value:
|
|
|
|
NONE
|
|
|
|
--*/
|
|
{
|
|
BOOL Acquired = FALSE;
|
|
|
|
//
|
|
// Acquire the global resource for shared access. If the resource is
|
|
// not immediately available (i.e., don't wait) then some other thread
|
|
// has it out for exclusive access.
|
|
//
|
|
// If we time out, one of two threads owns the global resource:
|
|
//
|
|
// 1) Thread monitoring the registry
|
|
// We can wait for this thread to finish so that the
|
|
// operation can continue.
|
|
//
|
|
// 2) Control thread
|
|
// In this case, it may turn out that the service is
|
|
// stopping. We examine the current service state to
|
|
// see if it is still running. If so, we loop around
|
|
// and try to get the resource again.
|
|
//
|
|
|
|
while ((GetElState() == RUNNING) && (!Acquired))
|
|
{
|
|
Acquired = RtlAcquireResourceShared(&GlobalElfResource,
|
|
FALSE); // Don't wait
|
|
|
|
if (!Acquired)
|
|
{
|
|
ELF_LOG1(TRACE,
|
|
"ElfPerformRequest: Sleep %d milliseconds waiting "
|
|
"for global resource\n",
|
|
ELF_GLOBAL_RESOURCE_WAIT);
|
|
|
|
Sleep(ELF_GLOBAL_RESOURCE_WAIT);
|
|
}
|
|
}
|
|
|
|
//
|
|
// If the resource was not available and the status of the service
|
|
// changed to one of the "non-working" states, then we just return
|
|
// unsuccesful. Rpc should not allow this to happen.
|
|
//
|
|
if (!Acquired)
|
|
{
|
|
ELF_LOG0(TRACE,
|
|
"ElfPerformRequest: Global resource not acquired\n");
|
|
|
|
Request->Status = STATUS_UNSUCCESSFUL;
|
|
}
|
|
else
|
|
{
|
|
switch (Request->Command)
|
|
{
|
|
case ELF_COMMAND_READ:
|
|
|
|
//
|
|
// The read/write code paths are high risk for exceptions.
|
|
// Ensure exceptions do not go beyond this point. Otherwise,
|
|
// services.exe will be taken out. Note that the try-except
|
|
// blocks are in PerformReadRequest and PerformWriteRequest
|
|
// since the risky calls are between calls to acquire and
|
|
// release a resource -- if the block were out here, a thrown
|
|
// exception would prevent the releasing of the resource
|
|
// (Bug #175768)
|
|
//
|
|
|
|
PerformReadRequest(Request);
|
|
break;
|
|
|
|
case ELF_COMMAND_WRITE:
|
|
|
|
PerformWriteRequest (Request);
|
|
break;
|
|
|
|
case ELF_COMMAND_CLEAR:
|
|
PerformClearRequest(Request);
|
|
break;
|
|
|
|
case ELF_COMMAND_BACKUP:
|
|
PerformBackupRequest(Request);
|
|
break;
|
|
|
|
case ELF_COMMAND_WRITE_QUEUED:
|
|
break;
|
|
}
|
|
|
|
//
|
|
// Now run the queued event list dequeueing elements and
|
|
// writing them
|
|
//
|
|
if (!IsListEmpty(&QueuedEventListHead))
|
|
{
|
|
//
|
|
// There are things queued up to write, do it
|
|
//
|
|
WriteQueuedEvents();
|
|
}
|
|
|
|
//
|
|
// Release the global resource.
|
|
//
|
|
ReleaseGlobalResource();
|
|
}
|
|
}
|
|
|
|
|
|
/****
|
|
@func NTSTATUS | FindSizeofEventsSinceStart| This routine walks
|
|
through all the logfile structures and returns the size of
|
|
events that were reported since the start of the eventlog service
|
|
and that need to be proapagated through the cluster-wide replicated
|
|
logs. For all logfiles that are returned in the list, the shared
|
|
lock for their log file is held and must be released by the caller.
|
|
|
|
@parm OUT PULONG | pulSize | Pointer to a LONG that contains the size on return.
|
|
@parm OUT PULONG | pulNumLogFiles | Pointer to a LONG that number of log files
|
|
configured for eventlogging.
|
|
@parm OUT PPROPLOGFILEINFO | *ppPropLogFileInfo | A pointer to a PROPLOGFILEINFO with
|
|
all the information about events that need to be propagated is returned via this.
|
|
|
|
@rdesc Returns a result code. ERROR_SUCCESS on success.
|
|
|
|
@comm This is called by ElfrRegisterClusterSvc
|
|
@xref <f ElfrRegisterClusterSvc>
|
|
****/
|
|
NTSTATUS
|
|
FindSizeofEventsSinceStart(
|
|
OUT PULONG pulTotalEventSize,
|
|
OUT PULONG pulNumLogFiles,
|
|
OUT PPROPLOGFILEINFO *ppPropLogFileInfo
|
|
)
|
|
{
|
|
PLOGFILE pLogFile;
|
|
PVOID pStartPropPosition;
|
|
PVOID pEndPropPosition;
|
|
ULONG ulSize;
|
|
ULONG ulNumLogFiles;
|
|
PPROPLOGFILEINFO pPropLogFileInfo = NULL;
|
|
UINT i;
|
|
PVOID PhysicalEOF; // Physical end of file
|
|
PVOID PhysStart; // Physical start of file (after file hdr)
|
|
PVOID BeginRecord; // Points to first record
|
|
PVOID EndRecord; // Points to byte after last record
|
|
ELF_REQUEST_RECORD Request; // points to the elf request
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
READ_PKT ReadPkt;
|
|
|
|
//
|
|
// Lock the linked list
|
|
//
|
|
RtlEnterCriticalSection(&LogFileCritSec);
|
|
|
|
//
|
|
// Initialize the number of files
|
|
//
|
|
ulNumLogFiles = 0; // Count of files
|
|
|
|
//
|
|
// Initialize the number of files/total event size
|
|
//
|
|
*pulNumLogFiles = 0; // Count of files with events to be propagated
|
|
*pulTotalEventSize = 0;
|
|
|
|
//
|
|
// Count the number of files
|
|
// Initialize to the first logfile in the list
|
|
//
|
|
pLogFile = CONTAINING_RECORD(LogFilesHead.Flink,
|
|
LOGFILE,
|
|
FileList);
|
|
|
|
//
|
|
// While there are more
|
|
//
|
|
while(pLogFile->FileList.Flink != LogFilesHead.Flink)
|
|
{
|
|
ulNumLogFiles++;
|
|
|
|
//
|
|
// Advance to the next log file
|
|
//
|
|
pLogFile = CONTAINING_RECORD(pLogFile->FileList.Flink,
|
|
LOGFILE,
|
|
FileList);
|
|
}
|
|
|
|
ELF_LOG1(CLUSTER,
|
|
"FindSizeOfEventsSinceStart: %d log files\n",
|
|
ulNumLogFiles);
|
|
|
|
if (!ulNumLogFiles)
|
|
{
|
|
goto FnExit;
|
|
}
|
|
|
|
//
|
|
// Allocate a structure for log file info
|
|
//
|
|
pPropLogFileInfo =
|
|
(PPROPLOGFILEINFO) ElfpAllocateBuffer(ulNumLogFiles * sizeof(PROPLOGFILEINFO));
|
|
|
|
if (!pPropLogFileInfo)
|
|
{
|
|
ELF_LOG0(ERROR,
|
|
"FindSizeOfEventsSinceStart: Unable to allocate memory "
|
|
"for pPropLogFileInfo\n");
|
|
|
|
Status = STATUS_NO_MEMORY;
|
|
goto FnExit;
|
|
}
|
|
|
|
//
|
|
// Gather information about the files
|
|
// Initialize to the first logfile in the list
|
|
//
|
|
pLogFile = CONTAINING_RECORD(LogFilesHead.Flink,
|
|
LOGFILE,
|
|
FileList);
|
|
|
|
i = 0;
|
|
|
|
//
|
|
// While there are more
|
|
//
|
|
|
|
//
|
|
// BUGBUG: Based on the generation of ulNumLogFiles above, these
|
|
// two checks are actually identical
|
|
//
|
|
while ((pLogFile->FileList.Flink != LogFilesHead.Flink)
|
|
&&
|
|
(i < ulNumLogFiles))
|
|
{
|
|
ELF_LOG1(CLUSTER,
|
|
"FindSizeOfEventsSinceStart: Processing file %ws\n",
|
|
pLogFile->LogFileName->Buffer);
|
|
|
|
//
|
|
// Get shared access to the log file. This will allow multiple
|
|
// readers to get to the file together.
|
|
//
|
|
RtlAcquireResourceShared(&pLogFile->Resource,
|
|
TRUE); // Wait until available
|
|
|
|
//
|
|
// Check if any records need to be propagated
|
|
//
|
|
if (pLogFile->CurrentRecordNumber == pLogFile->SessionStartRecordNumber)
|
|
{
|
|
ELF_LOG1(CLUSTER,
|
|
"FindSizeOfEventsSinceStart: No records to propagate from %ws log\n",
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
goto process_nextlogfile;
|
|
}
|
|
|
|
//
|
|
// Records need to be propagated, so find the positions in the
|
|
// file where they are logged
|
|
//
|
|
PhysicalEOF = (LPBYTE) pLogFile->BaseAddress
|
|
+ pLogFile->ViewSize;
|
|
|
|
PhysStart = (LPBYTE)pLogFile->BaseAddress
|
|
+ FILEHEADERBUFSIZE;
|
|
|
|
BeginRecord = (LPBYTE) pLogFile->BaseAddress
|
|
+ pLogFile->BeginRecord; // Start at first record
|
|
|
|
EndRecord = (LPBYTE)pLogFile->BaseAddress
|
|
+ pLogFile->EndRecord; // Byte after end of last record
|
|
|
|
|
|
//
|
|
// Set up the request structure
|
|
//
|
|
Request.Pkt.ReadPkt = &ReadPkt;
|
|
Request.LogFile = pLogFile;
|
|
|
|
//
|
|
// Set up the read packet structure for the first event logged in this session
|
|
//
|
|
Request.Pkt.ReadPkt->LastSeekPos = 0;
|
|
Request.Pkt.ReadPkt->ReadFlags = EVENTLOG_SEEK_READ | EVENTLOG_FORWARDS_READ;
|
|
Request.Pkt.ReadPkt->RecordNumber = pLogFile->SessionStartRecordNumber;
|
|
|
|
//
|
|
// Chittur Subbaraman (chitturs) - 3/22/99
|
|
//
|
|
// Enclose the SeekToStartingRecord within a try-except block to
|
|
// account for the eventlog getting corrupted under certain
|
|
// circumstances (such as the system crashing). You don't want to
|
|
// read such corrupt records.
|
|
//
|
|
try
|
|
{
|
|
//
|
|
// Find the size of events in this log file
|
|
//
|
|
Status = SeekToStartingRecord(&Request,
|
|
&pStartPropPosition,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysicalEOF,
|
|
PhysStart);
|
|
}
|
|
except(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"FindSizeOfEventsSinceStart: Caught exception %#x while "
|
|
"seeking first record in %ws log\n",
|
|
GetExceptionCode(),
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
Status = STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
|
|
//
|
|
// Skip this log file if error
|
|
//
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"FindSizeOfEventsSinceStart: SeekToStartingRecord (1st call) for %ws "
|
|
"log failed %#x\n",
|
|
pLogFile->LogModuleName->Buffer,
|
|
Status);
|
|
|
|
//
|
|
// Resetting status so that we skip only this file.
|
|
//
|
|
Status = STATUS_SUCCESS;
|
|
goto process_nextlogfile;
|
|
}
|
|
|
|
//
|
|
// SS: if this is not a valid position - the file could have wrapped since
|
|
// Should be try and find the last valid record after the session start record
|
|
// number then ? Since this is unlikely to happen-its not worth the trouble
|
|
// however valid position for session start record never succeeds even though
|
|
// it is valid, so we skip it
|
|
//
|
|
|
|
//
|
|
// Set up the read packet structure to seek till the start of the
|
|
// last record
|
|
//
|
|
|
|
//
|
|
// CODEWORK: We already have the position of the last record (via EndRecord)
|
|
// so just using ((PBYTE) EndRecord - *((PULONG) EndRecord - 1))
|
|
// should give the offset of the last record.
|
|
//
|
|
Request.Pkt.ReadPkt->LastSeekPos = 0;
|
|
Request.Pkt.ReadPkt->ReadFlags = EVENTLOG_SEEK_READ | EVENTLOG_FORWARDS_READ;
|
|
Request.Pkt.ReadPkt->RecordNumber = pLogFile->CurrentRecordNumber - 1;
|
|
|
|
//
|
|
// Chittur Subbaraman (chitturs) - 3/22/99
|
|
//
|
|
// Enclose the SeekToStartingRecord within a try-except block to
|
|
// account for the eventlog getting corrupted under certain
|
|
// circumstances (such as the system crashing). You don't want to
|
|
// read such corrupt records.
|
|
//
|
|
try
|
|
{
|
|
Status = SeekToStartingRecord(&Request,
|
|
&pEndPropPosition,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysicalEOF,
|
|
PhysStart);
|
|
}
|
|
except(EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"FindSizeOfEventsSinceStart: Caught exception %#x while "
|
|
"seeking last record in %ws log\n",
|
|
GetExceptionCode(),
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
Status = STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
|
|
//
|
|
// Skip this log file if error
|
|
//
|
|
if (!NT_SUCCESS(Status))
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"FindSizeOfEventsSinceStart: SeekToStartingRecord (2nd call) for %ws "
|
|
"log failed %#x\n",
|
|
pLogFile->LogModuleName->Buffer,
|
|
Status);
|
|
|
|
//
|
|
// Resetting status so that we skip only this file.
|
|
//
|
|
Status = STATUS_SUCCESS;
|
|
goto process_nextlogfile;
|
|
}
|
|
|
|
//
|
|
// SS: if this is not a valid position - the file could have wrapped since
|
|
//
|
|
if (!ValidFilePos(pEndPropPosition,
|
|
BeginRecord,
|
|
EndRecord,
|
|
PhysicalEOF,
|
|
pLogFile->BaseAddress,
|
|
TRUE))
|
|
{
|
|
ELF_LOG1(ERROR,
|
|
"FindSizeOfEventsSinceStart: ValidFilePos for pEndPropPosition "
|
|
"in %ws log failed\n",
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
goto process_nextlogfile;
|
|
}
|
|
|
|
//
|
|
// The end prop position
|
|
//
|
|
pEndPropPosition = (PBYTE) pEndPropPosition
|
|
+ ((PEVENTLOGRECORD)pEndPropPosition)->Length;
|
|
|
|
ELF_LOG3(CLUSTER,
|
|
"FindSizeOfEventsSinceStart: Log %ws, pStartPosition %p, pEndPosition %p\n",
|
|
pLogFile->LogModuleName->Buffer,
|
|
pStartPropPosition,
|
|
pEndPropPosition);
|
|
|
|
//
|
|
// If no records to propagate - skip the file
|
|
//
|
|
if (pStartPropPosition == pEndPropPosition)
|
|
{
|
|
ELF_LOG1(CLUSTER,
|
|
"FindSizeOfEventsSinceStart: Start and end positions in %ws log "
|
|
"are equal -- no events to propagate\n",
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
goto process_nextlogfile;
|
|
}
|
|
|
|
if (pEndPropPosition > pStartPropPosition)
|
|
{
|
|
ulSize = (ULONG) ((PBYTE) pEndPropPosition - (PBYTE) pStartPropPosition);
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// BUGBUG: This ignores any ELF_SKIP_DWORDs at the end of the file
|
|
//
|
|
ulSize = (ULONG) ((PBYTE) PhysicalEOF - (PBYTE) pStartPropPosition)
|
|
+
|
|
(ULONG) ((PBYTE)pEndPropPosition - (PBYTE)PhysStart);
|
|
}
|
|
|
|
ELF_LOG2(CLUSTER,
|
|
"FindSizeOfEventsSinceStart: Need to propagate %d bytes from %ws log\n",
|
|
ulSize,
|
|
pLogFile->LogModuleName->Buffer);
|
|
|
|
pPropLogFileInfo[i].pLogFile = pLogFile;
|
|
pPropLogFileInfo[i].pStartPosition = pStartPropPosition;
|
|
pPropLogFileInfo[i].pEndPosition = pEndPropPosition;
|
|
pPropLogFileInfo[i].ulTotalEventSize = ulSize;
|
|
pPropLogFileInfo[i].ulNumRecords = pLogFile->CurrentRecordNumber
|
|
- pLogFile->SessionStartRecordNumber;
|
|
i++;
|
|
(*pulNumLogFiles)++;
|
|
*pulTotalEventSize += ulSize;
|
|
|
|
//
|
|
// Advance to the next log file
|
|
//
|
|
pLogFile = CONTAINING_RECORD(pLogFile->FileList.Flink,
|
|
LOGFILE,
|
|
FileList);
|
|
|
|
//
|
|
// NB: We were successful with this log file and we therefore hold on to
|
|
// the lock -- the caller will/must release it.
|
|
//
|
|
continue;
|
|
|
|
process_nextlogfile:
|
|
|
|
//
|
|
// We were not successful with the log file -- release the lock
|
|
//
|
|
RtlReleaseResource(&pLogFile->Resource);
|
|
|
|
//
|
|
// Advance to the next log file
|
|
//
|
|
pLogFile = CONTAINING_RECORD(pLogFile->FileList.Flink,
|
|
LOGFILE,
|
|
FileList);
|
|
}
|
|
|
|
//
|
|
// Free the memory if unsuccessful
|
|
//
|
|
if (!(*pulNumLogFiles))
|
|
{
|
|
ElfpFreeBuffer(pPropLogFileInfo);
|
|
pPropLogFileInfo = NULL;
|
|
}
|
|
|
|
FnExit:
|
|
|
|
*ppPropLogFileInfo = pPropLogFileInfo;
|
|
|
|
ELF_LOG3(CLUSTER,
|
|
"FindSizeOfEventsSinceStart: ulTotalEventSize = %d, ulNumLogFiles = %d, "
|
|
"pPropLogFileInfo = %p\n",
|
|
*pulTotalEventSize,
|
|
*pulNumLogFiles,
|
|
*ppPropLogFileInfo);
|
|
|
|
//
|
|
// Unlock the linked list
|
|
//
|
|
RtlLeaveCriticalSection(&LogFileCritSec);
|
|
return Status;
|
|
}
|
|
|
|
/****
|
|
@func NTSTATUS | GetEventsToProp| Given a propagate log file
|
|
info structure, this events prepares a block of eventlog
|
|
records to propagate. The shared lock to the logfile must
|
|
be held thru when the PROPLOGINFO structure is prepared
|
|
to when this routine is called.
|
|
|
|
@parm OUT PEVENTLOGRECORD | pEventLogRecords | Pointer to a EVENTLOGRECORD
|
|
structure where the events to be propagated are returned.
|
|
@parm IN PPROPLOGFILEINFO | pPropLogFileInfo | Pointer to a PROPLOGFILEINFO
|
|
structure that contains the information to retrieve events from the
|
|
corresponding eventlog file.
|
|
|
|
@rdesc Returns a result code. ERROR_SUCCESS on success.
|
|
|
|
@xref
|
|
****/
|
|
NTSTATUS
|
|
GetEventsToProp(
|
|
IN PEVENTLOGRECORD pEventLogRecords,
|
|
IN PPROPLOGFILEINFO pPropLogFileInfo
|
|
)
|
|
{
|
|
PVOID BufferPosition;
|
|
PVOID XferPosition;
|
|
PVOID PhysicalEOF;
|
|
PVOID PhysicalStart;
|
|
ULONG ulBytesToMove;
|
|
NTSTATUS Status = STATUS_SUCCESS;
|
|
|
|
ELF_LOG1(CLUSTER,
|
|
"GetEventsToProp: Getting events for %ws log\n",
|
|
pPropLogFileInfo->pLogFile->LogModuleName->Buffer);
|
|
|
|
BufferPosition = pEventLogRecords;
|
|
ulBytesToMove = pPropLogFileInfo->ulTotalEventSize;
|
|
|
|
//
|
|
// If the start and end positions are the same there are no bytes to copy
|
|
//
|
|
if (pPropLogFileInfo->pStartPosition == pPropLogFileInfo->pEndPosition)
|
|
{
|
|
ASSERT(FALSE);
|
|
|
|
//
|
|
// Shouldn't come here as FindSizeofEventsSinceStart checks
|
|
// for this explicitly
|
|
//
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
//
|
|
// Chittur Subbaraman (chitturs) - 3/15/99
|
|
//
|
|
// Enclose the memcpy within a try-except block to account for
|
|
// the eventlog getting corrupted under certain circumstances (such
|
|
// as the system crashing). You don't want to read such corrupt
|
|
// records.
|
|
//
|
|
try
|
|
{
|
|
XferPosition = pPropLogFileInfo->pStartPosition;
|
|
ulBytesToMove = pPropLogFileInfo->ulTotalEventSize;
|
|
|
|
if (pPropLogFileInfo->pStartPosition > pPropLogFileInfo->pEndPosition)
|
|
{
|
|
//
|
|
// The log is wrapped -- copy the bytes from the start position
|
|
// to the end of the file
|
|
//
|
|
PhysicalEOF = (PBYTE) pPropLogFileInfo->pLogFile->BaseAddress
|
|
+ pPropLogFileInfo->pLogFile->ViewSize;
|
|
|
|
PhysicalStart = (PBYTE) pPropLogFileInfo->pLogFile->BaseAddress
|
|
+ FILEHEADERBUFSIZE;
|
|
|
|
//
|
|
// BUGBUG: This copies any ELF_SKIP_DWORDs that are at the
|
|
// end of the file
|
|
//
|
|
ulBytesToMove = (ULONG) ((PBYTE) PhysicalEOF
|
|
- (PBYTE) pPropLogFileInfo->pStartPosition);
|
|
|
|
RtlCopyMemory(BufferPosition, XferPosition, ulBytesToMove);
|
|
|
|
//
|
|
// Set it up for the second half
|
|
//
|
|
BufferPosition = (PBYTE) BufferPosition + ulBytesToMove;
|
|
ulBytesToMove = pPropLogFileInfo->ulTotalEventSize - ulBytesToMove;
|
|
XferPosition = PhysicalStart;
|
|
}
|
|
|
|
RtlCopyMemory(BufferPosition, XferPosition, ulBytesToMove);
|
|
}
|
|
except (EXCEPTION_EXECUTE_HANDLER)
|
|
{
|
|
ELF_LOG2(ERROR,
|
|
"GetEventsToProp: Caught exception %#x copying records from %ws log\n",
|
|
GetExceptionCode(),
|
|
pPropLogFileInfo->pLogFile->LogModuleName->Buffer);
|
|
|
|
Status = STATUS_EVENTLOG_FILE_CORRUPT;
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
//SS:end of changes made to enable cluster wide event logging
|