?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r19778: Make regkey_open_internal take a talloc ctx
[Samba.git] / source / rpc_server / srv_eventlog_nt.c
blobba366ed9832a20aa2df5386803c88c91a12c25a0
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Marcin Krzysztof Porwit 2005,
5 * Copyright (C) Brian Moran 2005,
6 * Copyright (C) Gerald (Jerry) Carter 2005.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21 */
22
23 #include "includes.h"
24
25 #undef DBGC_CLASS
26 #define DBGC_CLASS DBGC_RPC_SRV
27
28 typedef struct {
29 char *logname;
30 ELOG_TDB *etdb;
31 uint32 current_record;
32 uint32 num_records;
33 uint32 oldest_entry;
34 uint32 flags;
35 uint32 access_granted;
36 } EVENTLOG_INFO;
37
38 /********************************************************************
39 ********************************************************************/
40
41 static void free_eventlog_info( void *ptr )
42 {
43 EVENTLOG_INFO *elog = (EVENTLOG_INFO *)ptr;
44
45 if ( elog->etdb )
46 elog_close_tdb( elog->etdb, False );
47
48 TALLOC_FREE( elog );
49 }
50
51 /********************************************************************
52 ********************************************************************/
53
54 static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
55 POLICY_HND * handle )
56 {
57 EVENTLOG_INFO *info;
58
59 if ( !find_policy_by_hnd( p, handle, (void **)(void *)&info ) ) {
60 DEBUG( 2,
61 ( "find_eventlog_info_by_hnd: eventlog not found.\n" ) );
62 return NULL;
63 }
64
65 return info;
66 }
67
68 /********************************************************************
69 ********************************************************************/
70
71 static BOOL elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
72 {
73 char *tdbname = elog_tdbname( info->logname );
74 SEC_DESC *sec_desc;
75 BOOL ret;
76 NTSTATUS ntstatus;
77
78 if ( !tdbname )
79 return False;
80
81 /* get the security descriptor for the file */
82
83 sec_desc = get_nt_acl_no_snum( info, tdbname );
84 SAFE_FREE( tdbname );
85
86 if ( !sec_desc ) {
87 DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n",
88 tdbname));
89 return False;
90 }
91
92 /* root free pass */
93
94 if ( geteuid() == sec_initial_uid() ) {
95 DEBUG(5,("elog_check_access: using root's token\n"));
96 token = get_root_nt_token();
97 }
98
99 /* run the check, try for the max allowed */
100
101 ret = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
102 &info->access_granted, &ntstatus );
103
104 if ( sec_desc )
105 TALLOC_FREE( sec_desc );
106
107 if ( !ret ) {
108 DEBUG(8,("elog_check_access: se_access_check() return %s\n",
109 nt_errstr( ntstatus)));
110 return False;
111 }
112
113 /* we have to have READ permission for a successful open */
114
115 return ( info->access_granted & SA_RIGHT_FILE_READ_DATA );
116 }
117
118 /********************************************************************
119 ********************************************************************/
120
121 static BOOL elog_validate_logname( const char *name )
122 {
123 int i;
124 const char **elogs = lp_eventlog_list();
125
126 for ( i=0; elogs[i]; i++ ) {
127 if ( strequal( name, elogs[i] ) )
128 return True;
129 }
130
131 return False;
132 }
133
134 /********************************************************************
135 ********************************************************************/
136
137 static BOOL get_num_records_hook( EVENTLOG_INFO * info )
138 {
139 int next_record;
140 int oldest_record;
141
142 if ( !info->etdb ) {
143 DEBUG( 10, ( "No open tdb for %s\n", info->logname ) );
144 return False;
145 }
146
147 /* lock the tdb since we have to get 2 records */
148
149 tdb_lock_bystring_with_timeout( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD, 1 );
150 next_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
151 oldest_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_OLDEST_ENTRY);
152 tdb_unlock_bystring( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
153
154 DEBUG( 8,
155 ( "Oldest Record %d; Next Record %d\n", oldest_record,
156 next_record ) );
157
158 info->num_records = ( next_record - oldest_record );
159 info->oldest_entry = oldest_record;
160
161 return True;
162 }
163
164 /********************************************************************
165 ********************************************************************/
166
167 static BOOL get_oldest_entry_hook( EVENTLOG_INFO * info )
168 {
169 /* it's the same thing */
170 return get_num_records_hook( info );
171 }
172
173 /********************************************************************
174 ********************************************************************/
175
176 static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
177 {
178 EVENTLOG_INFO *elog;
179
180 /* first thing is to validate the eventlog name */
181
182 if ( !elog_validate_logname( logname ) )
183 return NT_STATUS_OBJECT_PATH_INVALID;
184
185 if ( !(elog = TALLOC_ZERO_P( NULL, EVENTLOG_INFO )) )
186 return NT_STATUS_NO_MEMORY;
187
188 elog->logname = talloc_strdup( elog, logname );
189
190 /* Open the tdb first (so that we can create any new tdbs if necessary).
191 We have to do this as root and then use an internal access check
192 on the file permissions since you can only have a tdb open once
193 in a single process */
194
195 become_root();
196 elog->etdb = elog_open_tdb( elog->logname, False );
197 unbecome_root();
198
199 if ( !elog->etdb ) {
200 /* according to MSDN, if the logfile cannot be found, we should
201 default to the "Application" log */
202
203 if ( !strequal( logname, ELOG_APPL ) ) {
204
205 TALLOC_FREE( elog->logname );
206
207 elog->logname = talloc_strdup( elog, ELOG_APPL );
208
209 /* do the access check */
210 if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
211 TALLOC_FREE( elog );
212 return NT_STATUS_ACCESS_DENIED;
213 }
214
215 become_root();
216 elog->etdb = elog_open_tdb( elog->logname, False );
217 unbecome_root();
218 }
219
220 if ( !elog->etdb ) {
221 TALLOC_FREE( elog );
222 return NT_STATUS_ACCESS_DENIED; /* ??? */
223 }
224 }
225
226 /* now do the access check. Close the tdb if we fail here */
227
228 if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
229 elog_close_tdb( elog->etdb, False );
230 TALLOC_FREE( elog );
231 return NT_STATUS_ACCESS_DENIED;
232 }
233
234 /* create the policy handle */
235
236 if ( !create_policy_hnd
237 ( p, hnd, free_eventlog_info, ( void * ) elog ) ) {
238 free_eventlog_info( elog );
239 return NT_STATUS_NO_MEMORY;
240 }
241
242 /* set the initial current_record pointer */
243
244 if ( !get_oldest_entry_hook( elog ) ) {
245 DEBUG(3,("elog_open: Successfully opened eventlog but can't "
246 "get any information on internal records!\n"));
247 }
248
249 elog->current_record = elog->oldest_entry;
250
251 return NT_STATUS_OK;
252 }
253
254 /********************************************************************
255 ********************************************************************/
256
257 static NTSTATUS elog_close( pipes_struct *p, POLICY_HND *hnd )
258 {
259 if ( !( close_policy_hnd( p, hnd ) ) ) {
260 return NT_STATUS_INVALID_HANDLE;
261 }
262
263 return NT_STATUS_OK;
264 }
265
266 /*******************************************************************
267 *******************************************************************/
268
269 static int elog_size( EVENTLOG_INFO *info )
270 {
271 if ( !info || !info->etdb ) {
272 DEBUG(0,("elog_size: Invalid info* structure!\n"));
273 return 0;
274 }
275
276 return elog_tdb_size( ELOG_TDB_CTX(info->etdb), NULL, NULL );
277 }
278
279 /********************************************************************
280 For the given tdb, get the next eventlog record into the passed
281 Eventlog_entry. returns NULL if it can't get the record for some reason.
282 ********************************************************************/
283
284 Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
285 int recno, Eventlog_entry * ee )
286 {
287 TDB_DATA ret, key;
288
289 int srecno;
290 int reclen;
291 int len;
292
293 pstring *wpsource, *wpcomputer, *wpsid, *wpstrs, *puserdata;
294
295 key.dsize = sizeof( int32 );
296
297 srecno = recno;
298 key.dptr = ( char * ) &srecno;
299
300 ret = tdb_fetch( tdb, key );
301
302 if ( ret.dsize == 0 ) {
303 DEBUG( 8,
304 ( "Can't find a record for the key, record %d\n",
305 recno ) );
306 return NULL;
307 }
308
309 len = tdb_unpack( ret.dptr, ret.dsize, "d", &reclen );
310
311 DEBUG( 10, ( "Unpacking record %d, size is %d\n", srecno, len ) );
312
313 if ( !len )
314 return NULL;
315
316 /* ee = PRS_ALLOC_MEM(ps, Eventlog_entry, 1); */
317
318 if ( !ee )
319 return NULL;
320
321 len = tdb_unpack( ret.dptr, ret.dsize, "ddddddwwwwddddddBBdBBBd",
322 &ee->record.length, &ee->record.reserved1,
323 &ee->record.record_number,
324 &ee->record.time_generated,
325 &ee->record.time_written, &ee->record.event_id,
326 &ee->record.event_type, &ee->record.num_strings,
327 &ee->record.event_category, &ee->record.reserved2,
328 &ee->record.closing_record_number,
329 &ee->record.string_offset,
330 &ee->record.user_sid_length,
331 &ee->record.user_sid_offset,
332 &ee->record.data_length, &ee->record.data_offset,
333 &ee->data_record.source_name_len, &wpsource,
334 &ee->data_record.computer_name_len, &wpcomputer,
335 &ee->data_record.sid_padding,
336 &ee->record.user_sid_length, &wpsid,
337 &ee->data_record.strings_len, &wpstrs,
338 &ee->data_record.user_data_len, &puserdata,
339 &ee->data_record.data_padding );
340 DEBUG( 10,
341 ( "Read record %d, len in tdb was %d\n",
342 ee->record.record_number, len ) );
343
344 /* have to do the following because the tdb_unpack allocs a buff, stuffs a pointer to the buff
345 into it's 2nd argment for 'B' */
346
347 if ( wpcomputer )
348 memcpy( ee->data_record.computer_name, wpcomputer,
349 ee->data_record.computer_name_len );
350 if ( wpsource )
351 memcpy( ee->data_record.source_name, wpsource,
352 ee->data_record.source_name_len );
353
354 if ( wpsid )
355 memcpy( ee->data_record.sid, wpsid,
356 ee->record.user_sid_length );
357 if ( wpstrs )
358 memcpy( ee->data_record.strings, wpstrs,
359 ee->data_record.strings_len );
360
361 /* note that userdata is a pstring */
362 if ( puserdata )
363 memcpy( ee->data_record.user_data, puserdata,
364 ee->data_record.user_data_len );
365
366 SAFE_FREE( wpcomputer );
367 SAFE_FREE( wpsource );
368 SAFE_FREE( wpsid );
369 SAFE_FREE( wpstrs );
370 SAFE_FREE( puserdata );
371
372 DEBUG( 10, ( "get_eventlog_record: read back %d\n", len ) );
373 DEBUG( 10,
374 ( "get_eventlog_record: computer_name %d is ",
375 ee->data_record.computer_name_len ) );
376 SAFE_FREE( ret.dptr );
377 return ee;
378 }
379
380 /********************************************************************
381 note that this can only be called AFTER the table is constructed,
382 since it uses the table to find the tdb handle
383 ********************************************************************/
384
385 static BOOL sync_eventlog_params( EVENTLOG_INFO *info )
386 {
387 pstring path;
388 uint32 uiMaxSize;
389 uint32 uiRetention;
390 REGISTRY_KEY *keyinfo;
391 REGISTRY_VALUE *val;
392 REGVAL_CTR *values;
393 WERROR wresult;
394 char *elogname = info->logname;
395
396 DEBUG( 4, ( "sync_eventlog_params with %s\n", elogname ) );
397
398 if ( !info->etdb ) {
399 DEBUG( 4, ( "No open tdb! (%s)\n", info->logname ) );
400 return False;
401 }
402 /* set resonable defaults. 512Kb on size and 1 week on time */
403
404 uiMaxSize = 0x80000;
405 uiRetention = 604800;
406
407 /* the general idea is to internally open the registry
408 key and retrieve the values. That way we can continue
409 to use the same fetch/store api that we use in
410 srv_reg_nt.c */
411
412 pstr_sprintf( path, "%s/%s", KEY_EVENTLOG, elogname );
413
414 wresult = regkey_open_internal(
415 NULL, &keyinfo, path, get_root_nt_token(), REG_KEY_READ );
416
417 if ( !W_ERROR_IS_OK( wresult ) ) {
418 DEBUG( 4,
419 ( "sync_eventlog_params: Failed to open key [%s] (%s)\n",
420 path, dos_errstr( wresult ) ) );
421 return False;
422 }
423
424 if ( !( values = TALLOC_ZERO_P( keyinfo, REGVAL_CTR ) ) ) {
425 TALLOC_FREE( keyinfo );
426 DEBUG( 0, ( "control_eventlog_hook: talloc() failed!\n" ) );
427
428 return False;
429 }
430 fetch_reg_values( keyinfo, values );
431
432 if ( ( val = regval_ctr_getvalue( values, "Retention" ) ) != NULL )
433 uiRetention = IVAL( regval_data_p( val ), 0 );
434
435 if ( ( val = regval_ctr_getvalue( values, "MaxSize" ) ) != NULL )
436 uiMaxSize = IVAL( regval_data_p( val ), 0 );
437
438 regkey_close_internal( keyinfo );
439
440 tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_MAXSIZE, uiMaxSize );
441 tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_RETENTION, uiRetention );
442
443 return True;
444 }
445
446 /********************************************************************
447 ********************************************************************/
448
449 static Eventlog_entry *read_package_entry( prs_struct * ps,
450 EVENTLOG_Q_READ_EVENTLOG * q_u,
451 EVENTLOG_R_READ_EVENTLOG * r_u,
452 Eventlog_entry * entry )
453 {
454 uint8 *offset;
455 Eventlog_entry *ee_new = NULL;
456
457 ee_new = PRS_ALLOC_MEM( ps, Eventlog_entry, 1 );
458 if ( ee_new == NULL ) {
459 return NULL;
460 }
461
462 entry->data_record.sid_padding =
463 ( ( 4 -
464 ( ( entry->data_record.source_name_len +
465 entry->data_record.computer_name_len ) % 4 ) ) % 4 );
466 entry->data_record.data_padding =
467 ( 4 -
468 ( ( entry->data_record.strings_len +
469 entry->data_record.user_data_len ) % 4 ) ) % 4;
470 entry->record.length = sizeof( Eventlog_record );
471 entry->record.length += entry->data_record.source_name_len;
472 entry->record.length += entry->data_record.computer_name_len;
473 if ( entry->record.user_sid_length == 0 ) {
474 /* Should not pad to a DWORD boundary for writing out the sid if there is
475 no SID, so just propagate the padding to pad the data */
476 entry->data_record.data_padding +=
477 entry->data_record.sid_padding;
478 entry->data_record.sid_padding = 0;
479 }
480 DEBUG( 10,
481 ( "sid_padding is [%d].\n", entry->data_record.sid_padding ) );
482 DEBUG( 10,
483 ( "data_padding is [%d].\n",
484 entry->data_record.data_padding ) );
485
486 entry->record.length += entry->data_record.sid_padding;
487 entry->record.length += entry->record.user_sid_length;
488 entry->record.length += entry->data_record.strings_len;
489 entry->record.length += entry->data_record.user_data_len;
490 entry->record.length += entry->data_record.data_padding;
491 /* need another copy of length at the end of the data */
492 entry->record.length += sizeof( entry->record.length );
493 DEBUG( 10,
494 ( "entry->record.length is [%d].\n", entry->record.length ) );
495 entry->data =
496 PRS_ALLOC_MEM( ps, uint8,
497 entry->record.length -
498 sizeof( Eventlog_record ) -
499 sizeof( entry->record.length ) );
500 if ( entry->data == NULL ) {
501 return NULL;
502 }
503 offset = entry->data;
504 memcpy( offset, &( entry->data_record.source_name ),
505 entry->data_record.source_name_len );
506 offset += entry->data_record.source_name_len;
507 memcpy( offset, &( entry->data_record.computer_name ),
508 entry->data_record.computer_name_len );
509 offset += entry->data_record.computer_name_len;
510 /* SID needs to be DWORD-aligned */
511 offset += entry->data_record.sid_padding;
512 entry->record.user_sid_offset =
513 sizeof( Eventlog_record ) + ( offset - entry->data );
514 memcpy( offset, &( entry->data_record.sid ),
515 entry->record.user_sid_length );
516 offset += entry->record.user_sid_length;
517 /* Now do the strings */
518 entry->record.string_offset =
519 sizeof( Eventlog_record ) + ( offset - entry->data );
520 memcpy( offset, &( entry->data_record.strings ),
521 entry->data_record.strings_len );
522 offset += entry->data_record.strings_len;
523 /* Now do the data */
524 entry->record.data_length = entry->data_record.user_data_len;
525 entry->record.data_offset =
526 sizeof( Eventlog_record ) + ( offset - entry->data );
527 memcpy( offset, &( entry->data_record.user_data ),
528 entry->data_record.user_data_len );
529 offset += entry->data_record.user_data_len;
530
531 memcpy( &( ee_new->record ), &entry->record,
532 sizeof( Eventlog_record ) );
533 memcpy( &( ee_new->data_record ), &entry->data_record,
534 sizeof( Eventlog_data_record ) );
535 ee_new->data = entry->data;
536
537 return ee_new;
538 }
539
540 /********************************************************************
541 ********************************************************************/
542
543 static BOOL add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
544 Eventlog_entry * ee_new )
545 {
546 Eventlog_entry *insert_point;
547
548 insert_point = r_u->entry;
549
550 if ( NULL == insert_point ) {
551 r_u->entry = ee_new;
552 ee_new->next = NULL;
553 } else {
554 while ( ( NULL != insert_point->next ) ) {
555 insert_point = insert_point->next;
556 }
557 ee_new->next = NULL;
558 insert_point->next = ee_new;
559 }
560 r_u->num_records++;
561 r_u->num_bytes_in_resp += ee_new->record.length;
562
563 return True;
564 }
565
566 /********************************************************************
567 ********************************************************************/
568
569 NTSTATUS _eventlog_open_eventlog( pipes_struct * p,
570 EVENTLOG_Q_OPEN_EVENTLOG * q_u,
571 EVENTLOG_R_OPEN_EVENTLOG * r_u )
572 {
573 fstring servername, logname;
574 EVENTLOG_INFO *info;
575 NTSTATUS result;
576
577 fstrcpy( servername, "" );
578 if ( q_u->servername.string ) {
579 rpcstr_pull( servername, q_u->servername.string->buffer,
580 sizeof( servername ),
581 q_u->servername.string->uni_str_len * 2, 0 );
582 }
583
584 fstrcpy( logname, "" );
585 if ( q_u->logname.string ) {
586 rpcstr_pull( logname, q_u->logname.string->buffer,
587 sizeof( logname ),
588 q_u->logname.string->uni_str_len * 2, 0 );
589 }
590
591 DEBUG( 10,("_eventlog_open_eventlog: Server [%s], Log [%s]\n",
592 servername, logname ));
593
594 /* according to MSDN, if the logfile cannot be found, we should
595 default to the "Application" log */
596
597 if ( !NT_STATUS_IS_OK( result = elog_open( p, logname, &r_u->handle )) )
598 return result;
599
600 if ( !(info = find_eventlog_info_by_hnd( p, &r_u->handle )) ) {
601 DEBUG(0,("_eventlog_open_eventlog: eventlog (%s) opened but unable to find handle!\n",
602 logname ));
603 elog_close( p, &r_u->handle );
604 return NT_STATUS_INVALID_HANDLE;
605 }
606
607 DEBUG(10,("_eventlog_open_eventlog: Size [%d]\n", elog_size( info )));
608
609 sync_eventlog_params( info );
610 prune_eventlog( ELOG_TDB_CTX(info->etdb) );
611
612 return NT_STATUS_OK;
613 }
614
615 /********************************************************************
616 This call still needs some work
617 ********************************************************************/
618
619 NTSTATUS _eventlog_clear_eventlog( pipes_struct * p,
620 EVENTLOG_Q_CLEAR_EVENTLOG * q_u,
621 EVENTLOG_R_CLEAR_EVENTLOG * r_u )
622 {
623 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
624 pstring backup_file_name;
625
626 if ( !info )
627 return NT_STATUS_INVALID_HANDLE;
628
629 pstrcpy( backup_file_name, "" );
630 if ( q_u->backupfile.string ) {
631 rpcstr_pull( backup_file_name, q_u->backupfile.string->buffer,
632 sizeof( backup_file_name ),
633 q_u->backupfile.string->uni_str_len * 2, 0 );
634
635 DEBUG(8,( "_eventlog_clear_eventlog: Using [%s] as the backup "
636 "file name for log [%s].",
637 backup_file_name, info->logname ) );
638 }
639
640 /* check for WRITE access to the file */
641
642 if ( !(info->access_granted&SA_RIGHT_FILE_WRITE_DATA) )
643 return NT_STATUS_ACCESS_DENIED;
644
645 /* Force a close and reopen */
646
647 elog_close_tdb( info->etdb, True );
648 become_root();
649 info->etdb = elog_open_tdb( info->logname, True );
650 unbecome_root();
651
652 if ( !info->etdb )
653 return NT_STATUS_ACCESS_DENIED;
654
655 return NT_STATUS_OK;
656 }
657
658 /********************************************************************
659 ********************************************************************/
660
661 NTSTATUS _eventlog_close_eventlog( pipes_struct * p,
662 EVENTLOG_Q_CLOSE_EVENTLOG * q_u,
663 EVENTLOG_R_CLOSE_EVENTLOG * r_u )
664 {
665 return elog_close( p, &q_u->handle );
666 }
667
668 /********************************************************************
669 ********************************************************************/
670
671 NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
672 EVENTLOG_Q_READ_EVENTLOG * q_u,
673 EVENTLOG_R_READ_EVENTLOG * r_u )
674 {
675 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
676 Eventlog_entry entry, *ee_new;
677 uint32 num_records_read = 0;
678 prs_struct *ps;
679 int bytes_left, record_number;
680 uint32 elog_read_type, elog_read_dir;
681
682 if (info == NULL) {
683 return NT_STATUS_INVALID_HANDLE;
684 }
685
686 info->flags = q_u->flags;
687 ps = &p->out_data.rdata;
688
689 bytes_left = q_u->max_read_size;
690
691 if ( !info->etdb )
692 return NT_STATUS_ACCESS_DENIED;
693
694 /* check for valid flags. Can't use the sequential and seek flags together */
695
696 elog_read_type = q_u->flags & (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ);
697 elog_read_dir = q_u->flags & (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ);
698
699 if ( elog_read_type == (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ)
700 || elog_read_dir == (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ) )
701 {
702 DEBUG(3,("_eventlog_read_eventlog: Invalid flags [0x%x] for ReadEventLog\n", q_u->flags));
703 return NT_STATUS_INVALID_PARAMETER;
704 }
705
706 /* a sequential read should ignore the offset */
707
708 if ( elog_read_type & EVENTLOG_SEQUENTIAL_READ )
709 record_number = info->current_record;
710 else
711 record_number = q_u->offset;
712
713 while ( bytes_left > 0 ) {
714
715 /* assume that when the record fetch fails, that we are done */
716
717 if ( !get_eventlog_record ( ps, ELOG_TDB_CTX(info->etdb), record_number, &entry ) )
718 break;
719
720 DEBUG( 8, ( "Retrieved record %d\n", record_number ) );
721
722 /* Now see if there is enough room to add */
723
724 if ( !(ee_new = read_package_entry( ps, q_u, r_u,&entry )) )
725 return NT_STATUS_NO_MEMORY;
726
727 if ( r_u->num_bytes_in_resp + ee_new->record.length > q_u->max_read_size ) {
728 r_u->bytes_in_next_record = ee_new->record.length;
729
730 /* response would be too big to fit in client-size buffer */
731
732 bytes_left = 0;
733 break;
734 }
735
736 add_record_to_resp( r_u, ee_new );
737 bytes_left -= ee_new->record.length;
738 ZERO_STRUCT( entry );
739 num_records_read = r_u->num_records - num_records_read;
740
741 DEBUG( 10, ( "_eventlog_read_eventlog: read [%d] records for a total "
742 "of [%d] records using [%d] bytes out of a max of [%d].\n",
743 num_records_read, r_u->num_records,
744 r_u->num_bytes_in_resp,
745 q_u->max_read_size ) );
746
747 if ( info->flags & EVENTLOG_FORWARDS_READ )
748 record_number++;
749 else
750 record_number--;
751
752 /* update the eventlog record pointer */
753
754 info->current_record = record_number;
755 }
756
757 /* crazy by WinXP uses NT_STATUS_BUFFER_TOO_SMALL to
758 say when there are no more records */
759
760 return (num_records_read ? NT_STATUS_OK : NT_STATUS_BUFFER_TOO_SMALL);
761 }
762
763 /********************************************************************
764 ********************************************************************/
765
766 NTSTATUS _eventlog_get_oldest_entry( pipes_struct * p,
767 EVENTLOG_Q_GET_OLDEST_ENTRY * q_u,
768 EVENTLOG_R_GET_OLDEST_ENTRY * r_u )
769 {
770 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
771
772 if (info == NULL) {
773 return NT_STATUS_INVALID_HANDLE;
774 }
775
776 if ( !( get_oldest_entry_hook( info ) ) )
777 return NT_STATUS_ACCESS_DENIED;
778
779 r_u->oldest_entry = info->oldest_entry;
780
781 return NT_STATUS_OK;
782 }
783
784 /********************************************************************
785 ********************************************************************/
786
787 NTSTATUS _eventlog_get_num_records( pipes_struct * p,
788 EVENTLOG_Q_GET_NUM_RECORDS * q_u,
789 EVENTLOG_R_GET_NUM_RECORDS * r_u )
790 {
791 EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
792
793 if (info == NULL) {
794 return NT_STATUS_INVALID_HANDLE;
795 }
796
797 if ( !( get_num_records_hook( info ) ) )
798 return NT_STATUS_ACCESS_DENIED;
799
800 r_u->num_records = info->num_records;
801
802 return NT_STATUS_OK;
803 }
Samba GIT mirror