2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Marcin Krzysztof Porwit 2005,
5 * Copyright (C) Brian Moran 2005,
6 * Copyright (C) Gerald (Jerry) Carter 2005.
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 #define DBGC_CLASS DBGC_RPC_SRV
30 uint32 current_record;
34 uint32 access_granted;
37 /********************************************************************
38 ********************************************************************/
40 static void free_eventlog_info( void *ptr )
42 EVENTLOG_INFO *elog = (EVENTLOG_INFO *)ptr;
45 elog_close_tdb( elog->etdb, False );
50 /********************************************************************
51 ********************************************************************/
53 static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
58 if ( !find_policy_by_hnd( p, handle, (void **)(void *)&info ) ) {
60 ( "find_eventlog_info_by_hnd: eventlog not found.\n" ) );
67 /********************************************************************
68 ********************************************************************/
70 static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
72 char *tdbname = elog_tdbname(talloc_tos(), info->logname );
80 /* get the security descriptor for the file */
82 sec_desc = get_nt_acl_no_snum( info, tdbname );
86 DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n",
93 if ( geteuid() == sec_initial_uid() ) {
94 DEBUG(5,("elog_check_access: using root's token\n"));
95 token = get_root_nt_token();
98 /* run the check, try for the max allowed */
100 ret = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
101 &info->access_granted, &ntstatus );
104 TALLOC_FREE( sec_desc );
107 DEBUG(8,("elog_check_access: se_access_check() return %s\n",
108 nt_errstr( ntstatus)));
112 /* we have to have READ permission for a successful open */
114 return ( info->access_granted & SA_RIGHT_FILE_READ_DATA );
117 /********************************************************************
118 ********************************************************************/
120 static bool elog_validate_logname( const char *name )
123 const char **elogs = lp_eventlog_list();
129 for ( i=0; elogs[i]; i++ ) {
130 if ( strequal( name, elogs[i] ) )
137 /********************************************************************
138 ********************************************************************/
140 static bool get_num_records_hook( EVENTLOG_INFO * info )
146 DEBUG( 10, ( "No open tdb for %s\n", info->logname ) );
150 /* lock the tdb since we have to get 2 records */
152 tdb_lock_bystring_with_timeout( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD, 1 );
153 next_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
154 oldest_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_OLDEST_ENTRY);
155 tdb_unlock_bystring( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
158 ( "Oldest Record %d; Next Record %d\n", oldest_record,
161 info->num_records = ( next_record - oldest_record );
162 info->oldest_entry = oldest_record;
167 /********************************************************************
168 ********************************************************************/
170 static bool get_oldest_entry_hook( EVENTLOG_INFO * info )
172 /* it's the same thing */
173 return get_num_records_hook( info );
176 /********************************************************************
177 ********************************************************************/
179 static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
183 /* first thing is to validate the eventlog name */
185 if ( !elog_validate_logname( logname ) )
186 return NT_STATUS_OBJECT_PATH_INVALID;
188 if ( !(elog = TALLOC_ZERO_P( NULL, EVENTLOG_INFO )) )
189 return NT_STATUS_NO_MEMORY;
191 elog->logname = talloc_strdup( elog, logname );
193 /* Open the tdb first (so that we can create any new tdbs if necessary).
194 We have to do this as root and then use an internal access check
195 on the file permissions since you can only have a tdb open once
196 in a single process */
199 elog->etdb = elog_open_tdb( elog->logname, False );
203 /* according to MSDN, if the logfile cannot be found, we should
204 default to the "Application" log */
206 if ( !strequal( logname, ELOG_APPL ) ) {
208 TALLOC_FREE( elog->logname );
210 elog->logname = talloc_strdup( elog, ELOG_APPL );
212 /* do the access check */
213 if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
215 return NT_STATUS_ACCESS_DENIED;
219 elog->etdb = elog_open_tdb( elog->logname, False );
225 return NT_STATUS_ACCESS_DENIED; /* ??? */
229 /* now do the access check. Close the tdb if we fail here */
231 if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
232 elog_close_tdb( elog->etdb, False );
234 return NT_STATUS_ACCESS_DENIED;
237 /* create the policy handle */
239 if ( !create_policy_hnd
240 ( p, hnd, free_eventlog_info, ( void * ) elog ) ) {
241 free_eventlog_info( elog );
242 return NT_STATUS_NO_MEMORY;
245 /* set the initial current_record pointer */
247 if ( !get_oldest_entry_hook( elog ) ) {
248 DEBUG(3,("elog_open: Successfully opened eventlog but can't "
249 "get any information on internal records!\n"));
252 elog->current_record = elog->oldest_entry;
257 /********************************************************************
258 ********************************************************************/
260 static NTSTATUS elog_close( pipes_struct *p, POLICY_HND *hnd )
262 if ( !( close_policy_hnd( p, hnd ) ) ) {
263 return NT_STATUS_INVALID_HANDLE;
269 /*******************************************************************
270 *******************************************************************/
272 static int elog_size( EVENTLOG_INFO *info )
274 if ( !info || !info->etdb ) {
275 DEBUG(0,("elog_size: Invalid info* structure!\n"));
279 return elog_tdb_size( ELOG_TDB_CTX(info->etdb), NULL, NULL );
282 /********************************************************************
283 For the given tdb, get the next eventlog record into the passed
284 Eventlog_entry. returns NULL if it can't get the record for some reason.
285 ********************************************************************/
287 static Eventlog_entry *get_eventlog_record(prs_struct *ps,
291 Eventlog_entry *ee = NULL;
298 char *wpsource = NULL;
299 char *wpcomputer = NULL;
302 char *puserdata = NULL;
304 key.dsize = sizeof(int32);
307 key.dptr = ( uint8 * ) &srecno;
309 ret = tdb_fetch( tdb, key );
311 if ( ret.dsize == 0 ) {
313 ( "Can't find a record for the key, record %d\n",
318 len = tdb_unpack( ret.dptr, ret.dsize, "d", &reclen );
320 DEBUG( 10, ( "Unpacking record %d, size is %d\n", srecno, len ) );
325 ee = TALLOC_ARRAY(ps->mem_ctx, Eventlog_entry, 1);
331 len = tdb_unpack( ret.dptr, ret.dsize, "ddddddwwwwddddddBBdBBBd",
332 &ee->record.length, &ee->record.reserved1,
333 &ee->record.record_number,
334 &ee->record.time_generated,
335 &ee->record.time_written, &ee->record.event_id,
336 &ee->record.event_type, &ee->record.num_strings,
337 &ee->record.event_category, &ee->record.reserved2,
338 &ee->record.closing_record_number,
339 &ee->record.string_offset,
340 &ee->record.user_sid_length,
341 &ee->record.user_sid_offset,
342 &ee->record.data_length, &ee->record.data_offset,
343 &ee->data_record.source_name_len, &wpsource,
344 &ee->data_record.computer_name_len, &wpcomputer,
345 &ee->data_record.sid_padding,
346 &ee->record.user_sid_length, &wpsid,
347 &ee->data_record.strings_len, &wpstrs,
348 &ee->data_record.user_data_len, &puserdata,
349 &ee->data_record.data_padding );
351 ( "Read record %d, len in tdb was %d\n",
352 ee->record.record_number, len ) );
354 /* have to do the following because the tdb_unpack allocs a buff, stuffs a pointer to the buff
355 into it's 2nd argment for 'B' */
358 ee->data_record.computer_name = (smb_ucs2_t *)TALLOC_MEMDUP(
359 ee, wpcomputer, ee->data_record.computer_name_len);
360 if (!ee->data_record.computer_name) {
366 ee->data_record.source_name = (smb_ucs2_t *)TALLOC_MEMDUP(
367 ee, wpsource, ee->data_record.source_name_len);
368 if (!ee->data_record.source_name) {
375 ee->data_record.sid = (smb_ucs2_t *)TALLOC_MEMDUP(
376 ee, wpsid, ee->record.user_sid_length);
377 if (!ee->data_record.sid) {
383 ee->data_record.strings = (smb_ucs2_t *)TALLOC_MEMDUP(
384 ee, wpstrs, ee->data_record.strings_len);
385 if (!ee->data_record.strings) {
392 ee->data_record.user_data = (char *)TALLOC_MEMDUP(
393 ee, puserdata, ee->data_record.user_data_len);
394 if (!ee->data_record.user_data) {
402 SAFE_FREE(wpcomputer);
406 SAFE_FREE(puserdata);
408 DEBUG( 10, ( "get_eventlog_record: read back %d\n", len ) );
410 ( "get_eventlog_record: computer_name %d is ",
411 ee->data_record.computer_name_len ) );
416 /********************************************************************
417 note that this can only be called AFTER the table is constructed,
418 since it uses the table to find the tdb handle
419 ********************************************************************/
421 static bool sync_eventlog_params( EVENTLOG_INFO *info )
426 struct registry_key *key;
427 struct registry_value *value;
429 char *elogname = info->logname;
430 TALLOC_CTX *ctx = talloc_tos();
433 DEBUG( 4, ( "sync_eventlog_params with %s\n", elogname ) );
436 DEBUG( 4, ( "No open tdb! (%s)\n", info->logname ) );
439 /* set resonable defaults. 512Kb on size and 1 week on time */
442 uiRetention = 604800;
444 /* the general idea is to internally open the registry
445 key and retrieve the values. That way we can continue
446 to use the same fetch/store api that we use in
449 path = talloc_asprintf(ctx, "%s/%s", KEY_EVENTLOG, elogname );
454 wresult = reg_open_path(ctx, path, REG_KEY_READ, get_root_nt_token(),
457 if ( !W_ERROR_IS_OK( wresult ) ) {
459 ( "sync_eventlog_params: Failed to open key [%s] (%s)\n",
460 path, dos_errstr( wresult ) ) );
464 wresult = reg_queryvalue(key, key, "Retention", &value);
465 if (!W_ERROR_IS_OK(wresult)) {
466 DEBUG(4, ("Failed to query value \"Retention\": %s\n",
467 dos_errstr(wresult)));
471 uiRetention = value->v.dword;
473 wresult = reg_queryvalue(key, key, "MaxSize", &value);
474 if (!W_ERROR_IS_OK(wresult)) {
475 DEBUG(4, ("Failed to query value \"MaxSize\": %s\n",
476 dos_errstr(wresult)));
480 uiMaxSize = value->v.dword;
482 tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_MAXSIZE, uiMaxSize );
483 tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_RETENTION, uiRetention );
492 /********************************************************************
493 ********************************************************************/
495 static Eventlog_entry *read_package_entry( prs_struct * ps,
496 EVENTLOG_Q_READ_EVENTLOG * q_u,
497 EVENTLOG_R_READ_EVENTLOG * r_u,
498 Eventlog_entry * entry )
501 Eventlog_entry *ee_new = NULL;
503 ee_new = PRS_ALLOC_MEM( ps, Eventlog_entry, 1 );
504 if ( ee_new == NULL ) {
508 entry->data_record.sid_padding =
510 ( ( entry->data_record.source_name_len +
511 entry->data_record.computer_name_len ) % 4 ) ) % 4 );
512 entry->data_record.data_padding =
514 ( ( entry->data_record.strings_len +
515 entry->data_record.user_data_len ) % 4 ) ) % 4;
516 entry->record.length = sizeof( Eventlog_record );
517 entry->record.length += entry->data_record.source_name_len;
518 entry->record.length += entry->data_record.computer_name_len;
519 if ( entry->record.user_sid_length == 0 ) {
520 /* Should not pad to a DWORD boundary for writing out the sid if there is
521 no SID, so just propagate the padding to pad the data */
522 entry->data_record.data_padding +=
523 entry->data_record.sid_padding;
524 entry->data_record.sid_padding = 0;
527 ( "sid_padding is [%d].\n", entry->data_record.sid_padding ) );
529 ( "data_padding is [%d].\n",
530 entry->data_record.data_padding ) );
532 entry->record.length += entry->data_record.sid_padding;
533 entry->record.length += entry->record.user_sid_length;
534 entry->record.length += entry->data_record.strings_len;
535 entry->record.length += entry->data_record.user_data_len;
536 entry->record.length += entry->data_record.data_padding;
537 /* need another copy of length at the end of the data */
538 entry->record.length += sizeof( entry->record.length );
540 ( "entry->record.length is [%d].\n", entry->record.length ) );
542 PRS_ALLOC_MEM( ps, uint8,
543 entry->record.length -
544 sizeof( Eventlog_record ) -
545 sizeof( entry->record.length ) );
546 if ( entry->data == NULL ) {
549 offset = entry->data;
550 memcpy( offset, &( entry->data_record.source_name ),
551 entry->data_record.source_name_len );
552 offset += entry->data_record.source_name_len;
553 memcpy( offset, &( entry->data_record.computer_name ),
554 entry->data_record.computer_name_len );
555 offset += entry->data_record.computer_name_len;
556 /* SID needs to be DWORD-aligned */
557 offset += entry->data_record.sid_padding;
558 entry->record.user_sid_offset =
559 sizeof( Eventlog_record ) + ( offset - entry->data );
560 memcpy( offset, &( entry->data_record.sid ),
561 entry->record.user_sid_length );
562 offset += entry->record.user_sid_length;
563 /* Now do the strings */
564 entry->record.string_offset =
565 sizeof( Eventlog_record ) + ( offset - entry->data );
566 memcpy( offset, &( entry->data_record.strings ),
567 entry->data_record.strings_len );
568 offset += entry->data_record.strings_len;
569 /* Now do the data */
570 entry->record.data_length = entry->data_record.user_data_len;
571 entry->record.data_offset =
572 sizeof( Eventlog_record ) + ( offset - entry->data );
573 memcpy( offset, &( entry->data_record.user_data ),
574 entry->data_record.user_data_len );
575 offset += entry->data_record.user_data_len;
577 memcpy( &( ee_new->record ), &entry->record,
578 sizeof( Eventlog_record ) );
579 memcpy( &( ee_new->data_record ), &entry->data_record,
580 sizeof( Eventlog_data_record ) );
581 ee_new->data = entry->data;
586 /********************************************************************
587 ********************************************************************/
589 static bool add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
590 Eventlog_entry * ee_new )
592 Eventlog_entry *insert_point;
594 insert_point = r_u->entry;
596 if ( NULL == insert_point ) {
600 while ( ( NULL != insert_point->next ) ) {
601 insert_point = insert_point->next;
604 insert_point->next = ee_new;
607 r_u->num_bytes_in_resp += ee_new->record.length;
612 /********************************************************************
613 ********************************************************************/
615 NTSTATUS _eventlog_open_eventlog( pipes_struct * p,
616 EVENTLOG_Q_OPEN_EVENTLOG * q_u,
617 EVENTLOG_R_OPEN_EVENTLOG * r_u )
619 fstring servername, logname;
623 fstrcpy( servername, "" );
624 if ( q_u->servername.string ) {
625 rpcstr_pull( servername, q_u->servername.string->buffer,
626 sizeof( servername ),
627 q_u->servername.string->uni_str_len * 2, 0 );
630 fstrcpy( logname, "" );
631 if ( q_u->logname.string ) {
632 rpcstr_pull( logname, q_u->logname.string->buffer,
634 q_u->logname.string->uni_str_len * 2, 0 );
637 DEBUG( 10,("_eventlog_open_eventlog: Server [%s], Log [%s]\n",
638 servername, logname ));
640 /* according to MSDN, if the logfile cannot be found, we should
641 default to the "Application" log */
643 if ( !NT_STATUS_IS_OK( result = elog_open( p, logname, &r_u->handle )) )
646 if ( !(info = find_eventlog_info_by_hnd( p, &r_u->handle )) ) {
647 DEBUG(0,("_eventlog_open_eventlog: eventlog (%s) opened but unable to find handle!\n",
649 elog_close( p, &r_u->handle );
650 return NT_STATUS_INVALID_HANDLE;
653 DEBUG(10,("_eventlog_open_eventlog: Size [%d]\n", elog_size( info )));
655 sync_eventlog_params( info );
656 prune_eventlog( ELOG_TDB_CTX(info->etdb) );
661 /********************************************************************
662 _eventlog_ClearEventLogW
663 This call still needs some work
664 ********************************************************************/
665 /** The windows client seems to be doing something funny with the file name
667 ClearEventLog(handle, "backup_file")
668 on the client side will result in the backup file name looking like this on the
670 \??\${CWD of client}\backup_file
671 If an absolute path gets specified, such as
672 ClearEventLog(handle, "C:\\temp\\backup_file")
673 then it is still mangled by the client into this:
674 \??\C:\temp\backup_file
675 when it is on the wire.
676 I'm not sure where the \?? is coming from, or why the ${CWD} of the client process
677 would be added in given that the backup file gets written on the server side. */
679 NTSTATUS _eventlog_ClearEventLogW(pipes_struct *p,
680 struct eventlog_ClearEventLogW *r)
682 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
683 const char *backup_file_name = NULL;
686 return NT_STATUS_INVALID_HANDLE;
688 if (r->in.backupfile && r->in.backupfile->string) {
690 backup_file_name = r->in.backupfile->string;
692 DEBUG(8,( "_eventlog_clear_eventlog: Using [%s] as the backup "
693 "file name for log [%s].",
694 backup_file_name, info->logname ) );
697 /* check for WRITE access to the file */
699 if ( !(info->access_granted&SA_RIGHT_FILE_WRITE_DATA) )
700 return NT_STATUS_ACCESS_DENIED;
702 /* Force a close and reopen */
704 elog_close_tdb( info->etdb, True );
706 info->etdb = elog_open_tdb( info->logname, True );
710 return NT_STATUS_ACCESS_DENIED;
715 /********************************************************************
716 ********************************************************************/
718 NTSTATUS _eventlog_CloseEventLog( pipes_struct * p, struct eventlog_CloseEventLog *r )
720 return elog_close( p, r->in.handle );
723 /********************************************************************
724 ********************************************************************/
726 NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
727 EVENTLOG_Q_READ_EVENTLOG * q_u,
728 EVENTLOG_R_READ_EVENTLOG * r_u )
730 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
731 Eventlog_entry *entry = NULL, *ee_new = NULL;
732 uint32 num_records_read = 0;
734 int bytes_left, record_number;
735 uint32 elog_read_type, elog_read_dir;
738 return NT_STATUS_INVALID_HANDLE;
741 info->flags = q_u->flags;
742 ps = &p->out_data.rdata;
744 bytes_left = q_u->max_read_size;
747 return NT_STATUS_ACCESS_DENIED;
749 /* check for valid flags. Can't use the sequential and seek flags together */
751 elog_read_type = q_u->flags & (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ);
752 elog_read_dir = q_u->flags & (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ);
754 if ( elog_read_type == (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ)
755 || elog_read_dir == (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ) )
757 DEBUG(3,("_eventlog_read_eventlog: Invalid flags [0x%x] for ReadEventLog\n", q_u->flags));
758 return NT_STATUS_INVALID_PARAMETER;
761 /* a sequential read should ignore the offset */
763 if ( elog_read_type & EVENTLOG_SEQUENTIAL_READ )
764 record_number = info->current_record;
766 record_number = q_u->offset;
768 while ( bytes_left > 0 ) {
770 /* assume that when the record fetch fails, that we are done */
772 entry = get_eventlog_record (ps, ELOG_TDB_CTX(info->etdb), record_number);
777 DEBUG( 8, ( "Retrieved record %d\n", record_number ) );
779 /* Now see if there is enough room to add */
781 if ( !(ee_new = read_package_entry( ps, q_u, r_u, entry )) )
782 return NT_STATUS_NO_MEMORY;
784 if ( r_u->num_bytes_in_resp + ee_new->record.length > q_u->max_read_size ) {
785 r_u->bytes_in_next_record = ee_new->record.length;
787 /* response would be too big to fit in client-size buffer */
793 add_record_to_resp( r_u, ee_new );
794 bytes_left -= ee_new->record.length;
796 num_records_read = r_u->num_records - num_records_read;
798 DEBUG( 10, ( "_eventlog_read_eventlog: read [%d] records for a total "
799 "of [%d] records using [%d] bytes out of a max of [%d].\n",
800 num_records_read, r_u->num_records,
801 r_u->num_bytes_in_resp,
802 q_u->max_read_size ) );
804 if ( info->flags & EVENTLOG_FORWARDS_READ )
809 /* update the eventlog record pointer */
811 info->current_record = record_number;
814 /* crazy by WinXP uses NT_STATUS_BUFFER_TOO_SMALL to
815 say when there are no more records */
817 return (num_records_read ? NT_STATUS_OK : NT_STATUS_BUFFER_TOO_SMALL);
820 /********************************************************************
821 _eventlog_GetOldestRecord
822 ********************************************************************/
824 NTSTATUS _eventlog_GetOldestRecord(pipes_struct *p,
825 struct eventlog_GetOldestRecord *r)
827 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
830 return NT_STATUS_INVALID_HANDLE;
833 if ( !( get_oldest_entry_hook( info ) ) )
834 return NT_STATUS_ACCESS_DENIED;
836 *r->out.oldest_entry = info->oldest_entry;
841 /********************************************************************
842 _eventlog_GetNumRecords
843 ********************************************************************/
845 NTSTATUS _eventlog_GetNumRecords(pipes_struct *p,
846 struct eventlog_GetNumRecords *r)
848 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
851 return NT_STATUS_INVALID_HANDLE;
854 if ( !( get_num_records_hook( info ) ) )
855 return NT_STATUS_ACCESS_DENIED;
857 *r->out.number = info->num_records;
862 NTSTATUS _eventlog_BackupEventLogW(pipes_struct *p, struct eventlog_BackupEventLogW *r)
864 p->rng_fault_state = True;
865 return NT_STATUS_NOT_IMPLEMENTED;
868 NTSTATUS _eventlog_DeregisterEventSource(pipes_struct *p, struct eventlog_DeregisterEventSource *r)
870 p->rng_fault_state = True;
871 return NT_STATUS_NOT_IMPLEMENTED;
874 NTSTATUS _eventlog_ChangeNotify(pipes_struct *p, struct eventlog_ChangeNotify *r)
876 p->rng_fault_state = True;
877 return NT_STATUS_NOT_IMPLEMENTED;
880 NTSTATUS _eventlog_OpenEventLogW(pipes_struct *p, struct eventlog_OpenEventLogW *r)
882 p->rng_fault_state = True;
883 return NT_STATUS_NOT_IMPLEMENTED;
886 NTSTATUS _eventlog_RegisterEventSourceW(pipes_struct *p, struct eventlog_RegisterEventSourceW *r)
888 p->rng_fault_state = True;
889 return NT_STATUS_NOT_IMPLEMENTED;
892 NTSTATUS _eventlog_OpenBackupEventLogW(pipes_struct *p, struct eventlog_OpenBackupEventLogW *r)
894 p->rng_fault_state = True;
895 return NT_STATUS_NOT_IMPLEMENTED;
898 NTSTATUS _eventlog_ReadEventLogW(pipes_struct *p, struct eventlog_ReadEventLogW *r)
900 p->rng_fault_state = True;
901 return NT_STATUS_NOT_IMPLEMENTED;
904 NTSTATUS _eventlog_ReportEventW(pipes_struct *p, struct eventlog_ReportEventW *r)
906 p->rng_fault_state = True;
907 return NT_STATUS_NOT_IMPLEMENTED;
910 NTSTATUS _eventlog_ClearEventLogA(pipes_struct *p, struct eventlog_ClearEventLogA *r)
912 p->rng_fault_state = True;
913 return NT_STATUS_NOT_IMPLEMENTED;
916 NTSTATUS _eventlog_BackupEventLogA(pipes_struct *p, struct eventlog_BackupEventLogA *r)
918 p->rng_fault_state = True;
919 return NT_STATUS_NOT_IMPLEMENTED;
922 NTSTATUS _eventlog_OpenEventLogA(pipes_struct *p, struct eventlog_OpenEventLogA *r)
924 p->rng_fault_state = True;
925 return NT_STATUS_NOT_IMPLEMENTED;
928 NTSTATUS _eventlog_RegisterEventSourceA(pipes_struct *p, struct eventlog_RegisterEventSourceA *r)
930 p->rng_fault_state = True;
931 return NT_STATUS_NOT_IMPLEMENTED;
934 NTSTATUS _eventlog_OpenBackupEventLogA(pipes_struct *p, struct eventlog_OpenBackupEventLogA *r)
936 p->rng_fault_state = True;
937 return NT_STATUS_NOT_IMPLEMENTED;
940 NTSTATUS _eventlog_ReadEventLogA(pipes_struct *p, struct eventlog_ReadEventLogA *r)
942 p->rng_fault_state = True;
943 return NT_STATUS_NOT_IMPLEMENTED;
946 NTSTATUS _eventlog_ReportEventA(pipes_struct *p, struct eventlog_ReportEventA *r)
948 p->rng_fault_state = True;
949 return NT_STATUS_NOT_IMPLEMENTED;
952 NTSTATUS _eventlog_RegisterClusterSvc(pipes_struct *p, struct eventlog_RegisterClusterSvc *r)
954 p->rng_fault_state = True;
955 return NT_STATUS_NOT_IMPLEMENTED;
958 NTSTATUS _eventlog_DeregisterClusterSvc(pipes_struct *p, struct eventlog_DeregisterClusterSvc *r)
960 p->rng_fault_state = True;
961 return NT_STATUS_NOT_IMPLEMENTED;
964 NTSTATUS _eventlog_WriteClusterEvents(pipes_struct *p, struct eventlog_WriteClusterEvents *r)
966 p->rng_fault_state = True;
967 return NT_STATUS_NOT_IMPLEMENTED;
970 NTSTATUS _eventlog_GetLogIntormation(pipes_struct *p, struct eventlog_GetLogIntormation *r)
972 p->rng_fault_state = True;
973 return NT_STATUS_NOT_IMPLEMENTED;
976 NTSTATUS _eventlog_FlushEventLog(pipes_struct *p, struct eventlog_FlushEventLog *r)
978 p->rng_fault_state = True;
979 return NT_STATUS_NOT_IMPLEMENTED;