2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Marcin Krzysztof Porwit 2005,
5 * Copyright (C) Brian Moran 2005,
6 * Copyright (C) Gerald (Jerry) Carter 2005.
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 #define DBGC_CLASS DBGC_RPC_SRV
30 uint32 current_record;
34 uint32 access_granted;
37 /********************************************************************
38 ********************************************************************/
40 static void free_eventlog_info( void *ptr )
42 EVENTLOG_INFO *elog = (EVENTLOG_INFO *)ptr;
45 elog_close_tdb( elog->etdb, False );
50 /********************************************************************
51 ********************************************************************/
53 static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
58 if ( !find_policy_by_hnd( p, handle, (void **)(void *)&info ) ) {
60 ( "find_eventlog_info_by_hnd: eventlog not found.\n" ) );
67 /********************************************************************
68 ********************************************************************/
70 static BOOL elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
72 char *tdbname = elog_tdbname( info->logname );
80 /* get the security descriptor for the file */
82 sec_desc = get_nt_acl_no_snum( info, tdbname );
86 DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n",
93 if ( geteuid() == sec_initial_uid() ) {
94 DEBUG(5,("elog_check_access: using root's token\n"));
95 token = get_root_nt_token();
98 /* run the check, try for the max allowed */
100 ret = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
101 &info->access_granted, &ntstatus );
104 TALLOC_FREE( sec_desc );
107 DEBUG(8,("elog_check_access: se_access_check() return %s\n",
108 nt_errstr( ntstatus)));
112 /* we have to have READ permission for a successful open */
114 return ( info->access_granted & SA_RIGHT_FILE_READ_DATA );
117 /********************************************************************
118 ********************************************************************/
120 static BOOL elog_validate_logname( const char *name )
123 const char **elogs = lp_eventlog_list();
129 for ( i=0; elogs[i]; i++ ) {
130 if ( strequal( name, elogs[i] ) )
137 /********************************************************************
138 ********************************************************************/
140 static BOOL get_num_records_hook( EVENTLOG_INFO * info )
146 DEBUG( 10, ( "No open tdb for %s\n", info->logname ) );
150 /* lock the tdb since we have to get 2 records */
152 tdb_lock_bystring_with_timeout( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD, 1 );
153 next_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
154 oldest_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_OLDEST_ENTRY);
155 tdb_unlock_bystring( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
158 ( "Oldest Record %d; Next Record %d\n", oldest_record,
161 info->num_records = ( next_record - oldest_record );
162 info->oldest_entry = oldest_record;
167 /********************************************************************
168 ********************************************************************/
170 static BOOL get_oldest_entry_hook( EVENTLOG_INFO * info )
172 /* it's the same thing */
173 return get_num_records_hook( info );
176 /********************************************************************
177 ********************************************************************/
179 static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
183 /* first thing is to validate the eventlog name */
185 if ( !elog_validate_logname( logname ) )
186 return NT_STATUS_OBJECT_PATH_INVALID;
188 if ( !(elog = TALLOC_ZERO_P( NULL, EVENTLOG_INFO )) )
189 return NT_STATUS_NO_MEMORY;
191 elog->logname = talloc_strdup( elog, logname );
193 /* Open the tdb first (so that we can create any new tdbs if necessary).
194 We have to do this as root and then use an internal access check
195 on the file permissions since you can only have a tdb open once
196 in a single process */
199 elog->etdb = elog_open_tdb( elog->logname, False );
203 /* according to MSDN, if the logfile cannot be found, we should
204 default to the "Application" log */
206 if ( !strequal( logname, ELOG_APPL ) ) {
208 TALLOC_FREE( elog->logname );
210 elog->logname = talloc_strdup( elog, ELOG_APPL );
212 /* do the access check */
213 if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
215 return NT_STATUS_ACCESS_DENIED;
219 elog->etdb = elog_open_tdb( elog->logname, False );
225 return NT_STATUS_ACCESS_DENIED; /* ??? */
229 /* now do the access check. Close the tdb if we fail here */
231 if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
232 elog_close_tdb( elog->etdb, False );
234 return NT_STATUS_ACCESS_DENIED;
237 /* create the policy handle */
239 if ( !create_policy_hnd
240 ( p, hnd, free_eventlog_info, ( void * ) elog ) ) {
241 free_eventlog_info( elog );
242 return NT_STATUS_NO_MEMORY;
245 /* set the initial current_record pointer */
247 if ( !get_oldest_entry_hook( elog ) ) {
248 DEBUG(3,("elog_open: Successfully opened eventlog but can't "
249 "get any information on internal records!\n"));
252 elog->current_record = elog->oldest_entry;
257 /********************************************************************
258 ********************************************************************/
260 static NTSTATUS elog_close( pipes_struct *p, POLICY_HND *hnd )
262 if ( !( close_policy_hnd( p, hnd ) ) ) {
263 return NT_STATUS_INVALID_HANDLE;
269 /*******************************************************************
270 *******************************************************************/
272 static int elog_size( EVENTLOG_INFO *info )
274 if ( !info || !info->etdb ) {
275 DEBUG(0,("elog_size: Invalid info* structure!\n"));
279 return elog_tdb_size( ELOG_TDB_CTX(info->etdb), NULL, NULL );
282 /********************************************************************
283 For the given tdb, get the next eventlog record into the passed
284 Eventlog_entry. returns NULL if it can't get the record for some reason.
285 ********************************************************************/
287 static Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
288 int recno, Eventlog_entry * ee )
296 pstring *wpsource, *wpcomputer, *wpsid, *wpstrs, *puserdata;
298 key.dsize = sizeof( int32 );
301 key.dptr = ( uint8 * ) &srecno;
303 ret = tdb_fetch( tdb, key );
305 if ( ret.dsize == 0 ) {
307 ( "Can't find a record for the key, record %d\n",
312 len = tdb_unpack( ret.dptr, ret.dsize, "d", &reclen );
314 DEBUG( 10, ( "Unpacking record %d, size is %d\n", srecno, len ) );
319 /* ee = PRS_ALLOC_MEM(ps, Eventlog_entry, 1); */
324 len = tdb_unpack( ret.dptr, ret.dsize, "ddddddwwwwddddddBBdBBBd",
325 &ee->record.length, &ee->record.reserved1,
326 &ee->record.record_number,
327 &ee->record.time_generated,
328 &ee->record.time_written, &ee->record.event_id,
329 &ee->record.event_type, &ee->record.num_strings,
330 &ee->record.event_category, &ee->record.reserved2,
331 &ee->record.closing_record_number,
332 &ee->record.string_offset,
333 &ee->record.user_sid_length,
334 &ee->record.user_sid_offset,
335 &ee->record.data_length, &ee->record.data_offset,
336 &ee->data_record.source_name_len, &wpsource,
337 &ee->data_record.computer_name_len, &wpcomputer,
338 &ee->data_record.sid_padding,
339 &ee->record.user_sid_length, &wpsid,
340 &ee->data_record.strings_len, &wpstrs,
341 &ee->data_record.user_data_len, &puserdata,
342 &ee->data_record.data_padding );
344 ( "Read record %d, len in tdb was %d\n",
345 ee->record.record_number, len ) );
347 /* have to do the following because the tdb_unpack allocs a buff, stuffs a pointer to the buff
348 into it's 2nd argment for 'B' */
351 memcpy( ee->data_record.computer_name, wpcomputer,
352 ee->data_record.computer_name_len );
354 memcpy( ee->data_record.source_name, wpsource,
355 ee->data_record.source_name_len );
358 memcpy( ee->data_record.sid, wpsid,
359 ee->record.user_sid_length );
361 memcpy( ee->data_record.strings, wpstrs,
362 ee->data_record.strings_len );
364 /* note that userdata is a pstring */
366 memcpy( ee->data_record.user_data, puserdata,
367 ee->data_record.user_data_len );
369 SAFE_FREE( wpcomputer );
370 SAFE_FREE( wpsource );
373 SAFE_FREE( puserdata );
375 DEBUG( 10, ( "get_eventlog_record: read back %d\n", len ) );
377 ( "get_eventlog_record: computer_name %d is ",
378 ee->data_record.computer_name_len ) );
379 SAFE_FREE( ret.dptr );
383 /********************************************************************
384 note that this can only be called AFTER the table is constructed,
385 since it uses the table to find the tdb handle
386 ********************************************************************/
388 static BOOL sync_eventlog_params( EVENTLOG_INFO *info )
393 REGISTRY_KEY *keyinfo;
397 char *elogname = info->logname;
399 DEBUG( 4, ( "sync_eventlog_params with %s\n", elogname ) );
402 DEBUG( 4, ( "No open tdb! (%s)\n", info->logname ) );
405 /* set resonable defaults. 512Kb on size and 1 week on time */
408 uiRetention = 604800;
410 /* the general idea is to internally open the registry
411 key and retrieve the values. That way we can continue
412 to use the same fetch/store api that we use in
415 pstr_sprintf( path, "%s/%s", KEY_EVENTLOG, elogname );
417 wresult = regkey_open_internal( NULL, &keyinfo, path,
418 get_root_nt_token( ), REG_KEY_READ );
420 if ( !W_ERROR_IS_OK( wresult ) ) {
422 ( "sync_eventlog_params: Failed to open key [%s] (%s)\n",
423 path, dos_errstr( wresult ) ) );
427 if ( !( values = TALLOC_ZERO_P( keyinfo, REGVAL_CTR ) ) ) {
428 TALLOC_FREE( keyinfo );
429 DEBUG( 0, ( "control_eventlog_hook: talloc() failed!\n" ) );
433 fetch_reg_values( keyinfo, values );
435 if ( ( val = regval_ctr_getvalue( values, "Retention" ) ) != NULL )
436 uiRetention = IVAL( regval_data_p( val ), 0 );
438 if ( ( val = regval_ctr_getvalue( values, "MaxSize" ) ) != NULL )
439 uiMaxSize = IVAL( regval_data_p( val ), 0 );
441 TALLOC_FREE( keyinfo );
443 tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_MAXSIZE, uiMaxSize );
444 tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_RETENTION, uiRetention );
449 /********************************************************************
450 ********************************************************************/
452 static Eventlog_entry *read_package_entry( prs_struct * ps,
453 EVENTLOG_Q_READ_EVENTLOG * q_u,
454 EVENTLOG_R_READ_EVENTLOG * r_u,
455 Eventlog_entry * entry )
458 Eventlog_entry *ee_new = NULL;
460 ee_new = PRS_ALLOC_MEM( ps, Eventlog_entry, 1 );
461 if ( ee_new == NULL ) {
465 entry->data_record.sid_padding =
467 ( ( entry->data_record.source_name_len +
468 entry->data_record.computer_name_len ) % 4 ) ) % 4 );
469 entry->data_record.data_padding =
471 ( ( entry->data_record.strings_len +
472 entry->data_record.user_data_len ) % 4 ) ) % 4;
473 entry->record.length = sizeof( Eventlog_record );
474 entry->record.length += entry->data_record.source_name_len;
475 entry->record.length += entry->data_record.computer_name_len;
476 if ( entry->record.user_sid_length == 0 ) {
477 /* Should not pad to a DWORD boundary for writing out the sid if there is
478 no SID, so just propagate the padding to pad the data */
479 entry->data_record.data_padding +=
480 entry->data_record.sid_padding;
481 entry->data_record.sid_padding = 0;
484 ( "sid_padding is [%d].\n", entry->data_record.sid_padding ) );
486 ( "data_padding is [%d].\n",
487 entry->data_record.data_padding ) );
489 entry->record.length += entry->data_record.sid_padding;
490 entry->record.length += entry->record.user_sid_length;
491 entry->record.length += entry->data_record.strings_len;
492 entry->record.length += entry->data_record.user_data_len;
493 entry->record.length += entry->data_record.data_padding;
494 /* need another copy of length at the end of the data */
495 entry->record.length += sizeof( entry->record.length );
497 ( "entry->record.length is [%d].\n", entry->record.length ) );
499 PRS_ALLOC_MEM( ps, uint8,
500 entry->record.length -
501 sizeof( Eventlog_record ) -
502 sizeof( entry->record.length ) );
503 if ( entry->data == NULL ) {
506 offset = entry->data;
507 memcpy( offset, &( entry->data_record.source_name ),
508 entry->data_record.source_name_len );
509 offset += entry->data_record.source_name_len;
510 memcpy( offset, &( entry->data_record.computer_name ),
511 entry->data_record.computer_name_len );
512 offset += entry->data_record.computer_name_len;
513 /* SID needs to be DWORD-aligned */
514 offset += entry->data_record.sid_padding;
515 entry->record.user_sid_offset =
516 sizeof( Eventlog_record ) + ( offset - entry->data );
517 memcpy( offset, &( entry->data_record.sid ),
518 entry->record.user_sid_length );
519 offset += entry->record.user_sid_length;
520 /* Now do the strings */
521 entry->record.string_offset =
522 sizeof( Eventlog_record ) + ( offset - entry->data );
523 memcpy( offset, &( entry->data_record.strings ),
524 entry->data_record.strings_len );
525 offset += entry->data_record.strings_len;
526 /* Now do the data */
527 entry->record.data_length = entry->data_record.user_data_len;
528 entry->record.data_offset =
529 sizeof( Eventlog_record ) + ( offset - entry->data );
530 memcpy( offset, &( entry->data_record.user_data ),
531 entry->data_record.user_data_len );
532 offset += entry->data_record.user_data_len;
534 memcpy( &( ee_new->record ), &entry->record,
535 sizeof( Eventlog_record ) );
536 memcpy( &( ee_new->data_record ), &entry->data_record,
537 sizeof( Eventlog_data_record ) );
538 ee_new->data = entry->data;
543 /********************************************************************
544 ********************************************************************/
546 static BOOL add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
547 Eventlog_entry * ee_new )
549 Eventlog_entry *insert_point;
551 insert_point = r_u->entry;
553 if ( NULL == insert_point ) {
557 while ( ( NULL != insert_point->next ) ) {
558 insert_point = insert_point->next;
561 insert_point->next = ee_new;
564 r_u->num_bytes_in_resp += ee_new->record.length;
569 /********************************************************************
570 ********************************************************************/
572 NTSTATUS _eventlog_open_eventlog( pipes_struct * p,
573 EVENTLOG_Q_OPEN_EVENTLOG * q_u,
574 EVENTLOG_R_OPEN_EVENTLOG * r_u )
576 fstring servername, logname;
580 fstrcpy( servername, "" );
581 if ( q_u->servername.string ) {
582 rpcstr_pull( servername, q_u->servername.string->buffer,
583 sizeof( servername ),
584 q_u->servername.string->uni_str_len * 2, 0 );
587 fstrcpy( logname, "" );
588 if ( q_u->logname.string ) {
589 rpcstr_pull( logname, q_u->logname.string->buffer,
591 q_u->logname.string->uni_str_len * 2, 0 );
594 DEBUG( 10,("_eventlog_open_eventlog: Server [%s], Log [%s]\n",
595 servername, logname ));
597 /* according to MSDN, if the logfile cannot be found, we should
598 default to the "Application" log */
600 if ( !NT_STATUS_IS_OK( result = elog_open( p, logname, &r_u->handle )) )
603 if ( !(info = find_eventlog_info_by_hnd( p, &r_u->handle )) ) {
604 DEBUG(0,("_eventlog_open_eventlog: eventlog (%s) opened but unable to find handle!\n",
606 elog_close( p, &r_u->handle );
607 return NT_STATUS_INVALID_HANDLE;
610 DEBUG(10,("_eventlog_open_eventlog: Size [%d]\n", elog_size( info )));
612 sync_eventlog_params( info );
613 prune_eventlog( ELOG_TDB_CTX(info->etdb) );
618 /********************************************************************
619 This call still needs some work
620 ********************************************************************/
622 NTSTATUS _eventlog_clear_eventlog( pipes_struct * p,
623 EVENTLOG_Q_CLEAR_EVENTLOG * q_u,
624 EVENTLOG_R_CLEAR_EVENTLOG * r_u )
626 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
627 pstring backup_file_name;
630 return NT_STATUS_INVALID_HANDLE;
632 pstrcpy( backup_file_name, "" );
633 if ( q_u->backupfile.string ) {
634 rpcstr_pull( backup_file_name, q_u->backupfile.string->buffer,
635 sizeof( backup_file_name ),
636 q_u->backupfile.string->uni_str_len * 2, 0 );
638 DEBUG(8,( "_eventlog_clear_eventlog: Using [%s] as the backup "
639 "file name for log [%s].",
640 backup_file_name, info->logname ) );
643 /* check for WRITE access to the file */
645 if ( !(info->access_granted&SA_RIGHT_FILE_WRITE_DATA) )
646 return NT_STATUS_ACCESS_DENIED;
648 /* Force a close and reopen */
650 elog_close_tdb( info->etdb, True );
652 info->etdb = elog_open_tdb( info->logname, True );
656 return NT_STATUS_ACCESS_DENIED;
661 /********************************************************************
662 ********************************************************************/
664 NTSTATUS _eventlog_CloseEventLog( pipes_struct * p, struct eventlog_CloseEventLog *r )
666 return elog_close( p, r->in.handle );
669 /********************************************************************
670 ********************************************************************/
672 NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
673 EVENTLOG_Q_READ_EVENTLOG * q_u,
674 EVENTLOG_R_READ_EVENTLOG * r_u )
676 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
677 Eventlog_entry entry, *ee_new;
678 uint32 num_records_read = 0;
680 int bytes_left, record_number;
681 uint32 elog_read_type, elog_read_dir;
684 return NT_STATUS_INVALID_HANDLE;
687 info->flags = q_u->flags;
688 ps = &p->out_data.rdata;
690 bytes_left = q_u->max_read_size;
693 return NT_STATUS_ACCESS_DENIED;
695 /* check for valid flags. Can't use the sequential and seek flags together */
697 elog_read_type = q_u->flags & (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ);
698 elog_read_dir = q_u->flags & (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ);
700 if ( elog_read_type == (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ)
701 || elog_read_dir == (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ) )
703 DEBUG(3,("_eventlog_read_eventlog: Invalid flags [0x%x] for ReadEventLog\n", q_u->flags));
704 return NT_STATUS_INVALID_PARAMETER;
707 /* a sequential read should ignore the offset */
709 if ( elog_read_type & EVENTLOG_SEQUENTIAL_READ )
710 record_number = info->current_record;
712 record_number = q_u->offset;
714 while ( bytes_left > 0 ) {
716 /* assume that when the record fetch fails, that we are done */
718 if ( !get_eventlog_record ( ps, ELOG_TDB_CTX(info->etdb), record_number, &entry ) )
721 DEBUG( 8, ( "Retrieved record %d\n", record_number ) );
723 /* Now see if there is enough room to add */
725 if ( !(ee_new = read_package_entry( ps, q_u, r_u,&entry )) )
726 return NT_STATUS_NO_MEMORY;
728 if ( r_u->num_bytes_in_resp + ee_new->record.length > q_u->max_read_size ) {
729 r_u->bytes_in_next_record = ee_new->record.length;
731 /* response would be too big to fit in client-size buffer */
737 add_record_to_resp( r_u, ee_new );
738 bytes_left -= ee_new->record.length;
739 ZERO_STRUCT( entry );
740 num_records_read = r_u->num_records - num_records_read;
742 DEBUG( 10, ( "_eventlog_read_eventlog: read [%d] records for a total "
743 "of [%d] records using [%d] bytes out of a max of [%d].\n",
744 num_records_read, r_u->num_records,
745 r_u->num_bytes_in_resp,
746 q_u->max_read_size ) );
748 if ( info->flags & EVENTLOG_FORWARDS_READ )
753 /* update the eventlog record pointer */
755 info->current_record = record_number;
758 /* crazy by WinXP uses NT_STATUS_BUFFER_TOO_SMALL to
759 say when there are no more records */
761 return (num_records_read ? NT_STATUS_OK : NT_STATUS_BUFFER_TOO_SMALL);
764 /********************************************************************
765 ********************************************************************/
767 NTSTATUS _eventlog_get_oldest_entry( pipes_struct * p,
768 EVENTLOG_Q_GET_OLDEST_ENTRY * q_u,
769 EVENTLOG_R_GET_OLDEST_ENTRY * r_u )
771 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
774 return NT_STATUS_INVALID_HANDLE;
777 if ( !( get_oldest_entry_hook( info ) ) )
778 return NT_STATUS_ACCESS_DENIED;
780 r_u->oldest_entry = info->oldest_entry;
785 /********************************************************************
786 ********************************************************************/
788 NTSTATUS _eventlog_get_num_records( pipes_struct * p,
789 EVENTLOG_Q_GET_NUM_RECORDS * q_u,
790 EVENTLOG_R_GET_NUM_RECORDS * r_u )
792 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
795 return NT_STATUS_INVALID_HANDLE;
798 if ( !( get_num_records_hook( info ) ) )
799 return NT_STATUS_ACCESS_DENIED;
801 r_u->num_records = info->num_records;
806 NTSTATUS _eventlog_ClearEventLogW(pipes_struct *p, struct eventlog_ClearEventLogW *r)
808 p->rng_fault_state = True;
809 return NT_STATUS_NOT_IMPLEMENTED;
812 NTSTATUS _eventlog_BackupEventLogW(pipes_struct *p, struct eventlog_BackupEventLogW *r)
814 p->rng_fault_state = True;
815 return NT_STATUS_NOT_IMPLEMENTED;
818 NTSTATUS _eventlog_DeregisterEventSource(pipes_struct *p, struct eventlog_DeregisterEventSource *r)
820 p->rng_fault_state = True;
821 return NT_STATUS_NOT_IMPLEMENTED;
824 NTSTATUS _eventlog_GetNumRecords(pipes_struct *p, struct eventlog_GetNumRecords *r)
826 p->rng_fault_state = True;
827 return NT_STATUS_NOT_IMPLEMENTED;
830 NTSTATUS _eventlog_GetOldestRecord(pipes_struct *p, struct eventlog_GetOldestRecord *r)
832 p->rng_fault_state = True;
833 return NT_STATUS_NOT_IMPLEMENTED;
836 NTSTATUS _eventlog_ChangeNotify(pipes_struct *p, struct eventlog_ChangeNotify *r)
838 p->rng_fault_state = True;
839 return NT_STATUS_NOT_IMPLEMENTED;
842 NTSTATUS _eventlog_OpenEventLogW(pipes_struct *p, struct eventlog_OpenEventLogW *r)
844 p->rng_fault_state = True;
845 return NT_STATUS_NOT_IMPLEMENTED;
848 NTSTATUS _eventlog_RegisterEventSourceW(pipes_struct *p, struct eventlog_RegisterEventSourceW *r)
850 p->rng_fault_state = True;
851 return NT_STATUS_NOT_IMPLEMENTED;
854 NTSTATUS _eventlog_OpenBackupEventLogW(pipes_struct *p, struct eventlog_OpenBackupEventLogW *r)
856 p->rng_fault_state = True;
857 return NT_STATUS_NOT_IMPLEMENTED;
860 NTSTATUS _eventlog_ReadEventLogW(pipes_struct *p, struct eventlog_ReadEventLogW *r)
862 p->rng_fault_state = True;
863 return NT_STATUS_NOT_IMPLEMENTED;
866 NTSTATUS _eventlog_ReportEventW(pipes_struct *p, struct eventlog_ReportEventW *r)
868 p->rng_fault_state = True;
869 return NT_STATUS_NOT_IMPLEMENTED;
872 NTSTATUS _eventlog_ClearEventLogA(pipes_struct *p, struct eventlog_ClearEventLogA *r)
874 p->rng_fault_state = True;
875 return NT_STATUS_NOT_IMPLEMENTED;
878 NTSTATUS _eventlog_BackupEventLogA(pipes_struct *p, struct eventlog_BackupEventLogA *r)
880 p->rng_fault_state = True;
881 return NT_STATUS_NOT_IMPLEMENTED;
884 NTSTATUS _eventlog_OpenEventLogA(pipes_struct *p, struct eventlog_OpenEventLogA *r)
886 p->rng_fault_state = True;
887 return NT_STATUS_NOT_IMPLEMENTED;
890 NTSTATUS _eventlog_RegisterEventSourceA(pipes_struct *p, struct eventlog_RegisterEventSourceA *r)
892 p->rng_fault_state = True;
893 return NT_STATUS_NOT_IMPLEMENTED;
896 NTSTATUS _eventlog_OpenBackupEventLogA(pipes_struct *p, struct eventlog_OpenBackupEventLogA *r)
898 p->rng_fault_state = True;
899 return NT_STATUS_NOT_IMPLEMENTED;
902 NTSTATUS _eventlog_ReadEventLogA(pipes_struct *p, struct eventlog_ReadEventLogA *r)
904 p->rng_fault_state = True;
905 return NT_STATUS_NOT_IMPLEMENTED;
908 NTSTATUS _eventlog_ReportEventA(pipes_struct *p, struct eventlog_ReportEventA *r)
910 p->rng_fault_state = True;
911 return NT_STATUS_NOT_IMPLEMENTED;
914 NTSTATUS _eventlog_RegisterClusterSvc(pipes_struct *p, struct eventlog_RegisterClusterSvc *r)
916 p->rng_fault_state = True;
917 return NT_STATUS_NOT_IMPLEMENTED;
920 NTSTATUS _eventlog_DeregisterClusterSvc(pipes_struct *p, struct eventlog_DeregisterClusterSvc *r)
922 p->rng_fault_state = True;
923 return NT_STATUS_NOT_IMPLEMENTED;
926 NTSTATUS _eventlog_WriteClusterEvents(pipes_struct *p, struct eventlog_WriteClusterEvents *r)
928 p->rng_fault_state = True;
929 return NT_STATUS_NOT_IMPLEMENTED;
932 NTSTATUS _eventlog_GetLogIntormation(pipes_struct *p, struct eventlog_GetLogIntormation *r)
934 p->rng_fault_state = True;
935 return NT_STATUS_NOT_IMPLEMENTED;
938 NTSTATUS _eventlog_FlushEventLog(pipes_struct *p, struct eventlog_FlushEventLog *r)
940 p->rng_fault_state = True;
941 return NT_STATUS_NOT_IMPLEMENTED;