From: Daniel Lehman dlehman25@gmail.com
Wine-bug: https://bugs.winehq.org/show_bug.cgi?id=55129 --- dlls/advapi32/eventlog.c | 81 +++++++++++++++++++++ dlls/advapi32/tests/eventlog.c | 126 +++++++++++++++++++++++++++++++++ include/Makefile.in | 1 + include/netevent.h | 24 +++++++ 4 files changed, 232 insertions(+) create mode 100644 include/netevent.h
diff --git a/dlls/advapi32/eventlog.c b/dlls/advapi32/eventlog.c index f455b2cb947..e7f78ba929d 100644 --- a/dlls/advapi32/eventlog.c +++ b/dlls/advapi32/eventlog.c @@ -29,6 +29,7 @@ #include "wmistr.h" #include "evntrace.h" #include "evntprov.h" +#include "netevent.h"
#include "wine/debug.h"
@@ -484,6 +485,54 @@ HANDLE WINAPI OpenEventLogW( LPCWSTR uncname, LPCWSTR source ) return (HANDLE)0xcafe4242; }
+#define DATALEN 24 +#define STRINGSLEN (sizeof("EventLog") + MAX_COMPUTERNAME_LENGTH + 1) +#define ALIGN(x) (((x) + 7) & ~7) +static const EVENTLOGRECORD *fake_eventlog_start(BOOL unicode) +{ + static BYTE bufA[ALIGN(sizeof(EVENTLOGRECORD) + STRINGSLEN) + DATALEN] = {0}; + static BYTE bufW[ALIGN(sizeof(EVENTLOGRECORD) + STRINGSLEN * sizeof(WCHAR)) + DATALEN] = {0}; + EVENTLOGRECORD *recA = (EVENTLOGRECORD *)bufA; + EVENTLOGRECORD *recW = (EVENTLOGRECORD *)bufW; + SYSTEM_TIMEOFDAY_INFORMATION ti; + DWORD size; + + if (!recA->Length) + { + NtQuerySystemInformation(SystemTimeOfDayInformation, &ti, sizeof(ti), NULL); + RtlTimeToSecondsSince1970(&ti.BootTime, &recA->TimeGenerated); + recW->TimeGenerated = recA->TimeGenerated; + + recW->Reserved = recA->Reserved = 0x654c664c; /* LfLe */ + recW->RecordNumber = recA->RecordNumber = 1; + recW->TimeWritten = recA->TimeWritten = recA->TimeGenerated; + recW->EventID = recA->EventID = EVENT_EventlogStarted; + recW->EventType = recA->EventType = EVENTLOG_INFORMATION_TYPE; + recW->DataLength = recA->DataLength = DATALEN; + + strcpy((char *)(recA + 1), "EventLog"); + wcscpy((WCHAR *)(recW + 1), L"EventLog"); + + size = MAX_COMPUTERNAME_LENGTH + 1; + recA->Length = sizeof(EVENTLOGRECORD) + sizeof("EventLog"); + GetComputerNameA((char *)&bufA[recA->Length], &size); + recA->Length += size + 1; + recA->DataOffset = ALIGN(recA->Length); + recA->StringOffset = recA->DataOffset; + recA->UserSidOffset = recA->DataOffset; + + size = (MAX_COMPUTERNAME_LENGTH + 1) * sizeof(WCHAR); + recW->Length = sizeof(EVENTLOGRECORD) + sizeof(L"EventLog"); + GetComputerNameW((WCHAR *)&bufW[recW->Length], &size); + recW->Length += (size + 1) * sizeof(WCHAR); + recW->DataOffset = ALIGN(recW->Length); + recW->StringOffset = recW->DataOffset; + recW->UserSidOffset = recW->DataOffset; + } + + return unicode ? recW : recA; +} + /****************************************************************************** * ReadEventLogA [ADVAPI32.@] * @@ -524,6 +573,22 @@ BOOL WINAPI ReadEventLogA( HANDLE log, DWORD flags, DWORD offset, void *buffer, return FALSE; }
+ if (offset == 0) + { + const EVENTLOGRECORD *rec = fake_eventlog_start(FALSE); + + if (toread < rec->Length) + { + *needed = rec->Length; + SetLastError(ERROR_INSUFFICIENT_BUFFER); + return FALSE; + } + + *numread = rec->Length; + memcpy(buffer, rec, rec->Length); + return TRUE; + } + SetLastError(ERROR_HANDLE_EOF); return FALSE; } @@ -554,6 +619,22 @@ BOOL WINAPI ReadEventLogW( HANDLE log, DWORD flags, DWORD offset, void *buffer, return FALSE; }
+ if (offset == 0) + { + const EVENTLOGRECORD *rec = fake_eventlog_start(TRUE); + + if (toread < rec->Length) + { + *needed = rec->Length; + SetLastError(ERROR_INSUFFICIENT_BUFFER); + return FALSE; + } + + *numread = rec->Length; + memcpy(buffer, rec, rec->Length); + return TRUE; + } + SetLastError(ERROR_HANDLE_EOF); return FALSE; } diff --git a/dlls/advapi32/tests/eventlog.c b/dlls/advapi32/tests/eventlog.c index fafe2e641fa..02c79d3174b 100644 --- a/dlls/advapi32/tests/eventlog.c +++ b/dlls/advapi32/tests/eventlog.c @@ -30,6 +30,7 @@ #include "wmistr.h" #include "evntprov.h" #include "evntrace.h" +#include "netevent.h"
#include "wine/test.h"
@@ -1302,6 +1303,129 @@ done: DeleteFileA(filepath); }
+static void test_eventlog_start(void) +{ + HANDLE handle; + BOOL ret, found; + EVENTLOGRECORD *record; + DWORD size, read, needed; + char *sourcename, *computername, *localcomputer; + WCHAR *sourcenameW, *computernameW, *localcomputerW; + + size = MAX_COMPUTERNAME_LENGTH + 1; + localcomputer = HeapAlloc(GetProcessHeap(), 0, size); + GetComputerNameA(localcomputer, &size); + + found = FALSE; + handle = OpenEventLogA(0, "System"); + while (!found) + { + record = HeapAlloc(GetProcessHeap(), 0, sizeof(EVENTLOGRECORD)); + if (!(ret = ReadEventLogA(handle, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ, + 0, record, sizeof(EVENTLOGRECORD), &read, &needed)) && + GetLastError() == ERROR_INSUFFICIENT_BUFFER) + { + record = HeapReAlloc(GetProcessHeap(), 0, record, needed); + ret = ReadEventLogA(handle, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ, + 0, record, needed, &read, &needed); + } + if (ret && record->EventID == EVENT_EventlogStarted) + { + ok(record->Length == read, "Expected %ld, got %ld\n", read, record->Length); + ok(record->Reserved == 0x654c664c, "Expected 0x654c664c, got %ld\n", record->Reserved); + ok(record->RecordNumber > 0, "Expected 1 or higher, got %ld\n", record->RecordNumber); + ok(record->TimeGenerated == record->TimeWritten, "Expected time values to be the same\n"); + ok(record->EventType == EVENTLOG_INFORMATION_TYPE, + "Expected %d, got %d\n", EVENTLOG_INFORMATION_TYPE, record->EventType); + ok(record->NumStrings == 0, "Expected 0, got %d\n", record->NumStrings); + ok(record->EventCategory == 0, "Expected 0, got %d\n", record->EventCategory); + ok(record->ReservedFlags == 0, "Expected 0, got %d\n", record->ReservedFlags); + ok(record->ClosingRecordNumber == 0, "Expected 0, got %ld\n", record->ClosingRecordNumber); + ok(record->StringOffset == record->UserSidOffset, "Expected offsets to be the same\n"); + ok(record->UserSidLength == 0, "Expected 0, got %ld\n", record->UserSidLength); + ok(record->DataLength == 24, "Expected 24, got %ld\n", record->DataLength); + ok(record->DataOffset == record->UserSidOffset, "Expected offsets to be the same\n"); + + sourcename = (char *)(record + 1); + ok(!lstrcmpA(sourcename, "EventLog"), + "Expected 'EventLog', got '%s'\n", sourcename); + + computername = sourcename + sizeof("EventLog"); + ok(!lstrcmpiA(computername, localcomputer), "Expected '%s', got '%s'\n", + localcomputer, computername); + + size = sizeof(EVENTLOGRECORD) + sizeof("EventLog") + lstrlenA(computername) + 1; + size = (size + 7) & ~7; + ok(record->DataOffset == size || + broken(record->DataOffset == size - 1), /* win8 */ + "Expected %ld, got %ld\n", size, record->DataOffset); + + found = TRUE; + } + HeapFree(GetProcessHeap(), 0, record); + + } + CloseEventLog(handle); + HeapFree(GetProcessHeap(), 0, localcomputer); + + + size = (MAX_COMPUTERNAME_LENGTH + 1) * sizeof(WCHAR); + localcomputerW = HeapAlloc(GetProcessHeap(), 0, size); + GetComputerNameW(localcomputerW, &size); + + found = FALSE; + handle = OpenEventLogW(0, L"System"); + while (!found) + { + record = HeapAlloc(GetProcessHeap(), 0, sizeof(EVENTLOGRECORD)); + if (!(ret = ReadEventLogW(handle, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ, + 0, record, sizeof(EVENTLOGRECORD), &read, &needed)) && + GetLastError() == ERROR_INSUFFICIENT_BUFFER) + { + record = HeapReAlloc(GetProcessHeap(), 0, record, needed); + ret = ReadEventLogW(handle, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_BACKWARDS_READ, + 0, record, needed, &read, &needed); + } + if (ret && record->EventID == EVENT_EventlogStarted) + { + ok(record->Length == read, "Expected %ld, got %ld\n", read, record->Length); + ok(record->Reserved == 0x654c664c, "Expected 0x654c664c, got %ld\n", record->Reserved); + ok(record->RecordNumber > 0, "Expected 1 or higher, got %ld\n", record->RecordNumber); + ok(record->TimeGenerated == record->TimeWritten, "Expected time values to be the same\n"); + ok(record->EventType == EVENTLOG_INFORMATION_TYPE, + "Expected %d, got %d\n", EVENTLOG_INFORMATION_TYPE, record->EventType); + ok(record->NumStrings == 0, "Expected 0, got %d\n", record->NumStrings); + ok(record->EventCategory == 0, "Expected 0, got %d\n", record->EventCategory); + ok(record->ReservedFlags == 0, "Expected 0, got %d\n", record->ReservedFlags); + ok(record->ClosingRecordNumber == 0, "Expected 0, got %ld\n", record->ClosingRecordNumber); + ok(record->StringOffset == record->UserSidOffset, "Expected offsets to be the same\n"); + ok(record->UserSidLength == 0, "Expected 0, got %ld\n", record->UserSidLength); + ok(record->DataLength == 24, "Expected 24, got %ld\n", record->DataLength); + ok(record->DataOffset == record->UserSidOffset, "Expected offsets to be the same\n"); + + sourcenameW = (WCHAR *)(record + 1); + ok(!lstrcmpW(sourcenameW, L"EventLog"), + "Expected 'EventLog', got '%ls'\n", sourcenameW); + + computernameW = sourcenameW + sizeof("EventLog"); + ok(!lstrcmpiW(computernameW, localcomputerW), "Expected '%ls', got '%ls'\n", + localcomputerW, computernameW); + + size = sizeof(EVENTLOGRECORD) + sizeof(L"EventLog") + + (lstrlenW(computernameW) + 1) * sizeof(WCHAR); + size = (size + 7) & ~7; + ok(record->DataOffset == size || + broken(record->DataOffset == size - sizeof(WCHAR)), /* win8 */ + "Expected %ld, got %ld\n", size, record->DataOffset); + + found = TRUE; + } + HeapFree(GetProcessHeap(), 0, record); + } + CloseEventLog(handle); + HeapFree(GetProcessHeap(), 0, localcomputerW); +} + START_TEST(eventlog) { SetLastError(0xdeadbeef); @@ -1335,4 +1459,6 @@ START_TEST(eventlog)
/* Trace tests */ test_start_trace(); + + test_eventlog_start(); } diff --git a/include/Makefile.in b/include/Makefile.in index e9f0aa8d5fb..6d98d96a1f4 100644 --- a/include/Makefile.in +++ b/include/Makefile.in @@ -556,6 +556,7 @@ SOURCES = \ ndrtypes.h \ netcfgx.idl \ netcon.idl \ + netevent.h \ netfw.idl \ netioapi.h \ netiodef.h \ diff --git a/include/netevent.h b/include/netevent.h new file mode 100644 index 00000000000..d338a9321bb --- /dev/null +++ b/include/netevent.h @@ -0,0 +1,24 @@ +/* + * Copyright 2023 Daniel Lehman + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + */ + +#ifndef _NETEVENT_ +#define _NETEVENT_ + +#define EVENT_EventlogStarted 0x80001775 + +#endif