source3/rpc_server/srv_eventlog_nt.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Marcin Krzysztof Porwit    2005,
   5  *  Copyright (C) Brian Moran                2005,
   6  *  Copyright (C) Gerald (Jerry) Carter      2005.
   7  *  Copyright (C) Guenther Deschner          2009.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "../librpc/gen_ndr/srv_eventlog.h"
  25 #include "lib/eventlog/eventlog.h"
  26 #include "registry.h"
  27
  28 #undef  DBGC_CLASS
  29 #define DBGC_CLASS DBGC_RPC_SRV
  30
  31 typedef struct {
  32         char *logname;
  33         ELOG_TDB *etdb;
  34         uint32 current_record;
  35         uint32 num_records;
  36         uint32 oldest_entry;
  37         uint32 flags;
  38         uint32 access_granted;
  39 } EVENTLOG_INFO;
  40
  41 /********************************************************************
  42  ********************************************************************/
  43
  44 static int eventlog_info_destructor(EVENTLOG_INFO *elog)
  45 {
  46         if (elog->etdb) {
  47                 elog_close_tdb(elog->etdb, false);
  48         }
  49         return 0;
  50 }
  51
  52 /********************************************************************
  53  ********************************************************************/
  54
  55 static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
  56                                                 struct policy_handle * handle )
  57 {
  58         EVENTLOG_INFO *info;
  59
  60         if ( !find_policy_by_hnd( p, handle, (void **)(void *)&info ) ) {
  61                 DEBUG( 2,
  62                        ( "find_eventlog_info_by_hnd: eventlog not found.\n" ) );
  63                 return NULL;
  64         }
  65
  66         return info;
  67 }
  68
  69 /********************************************************************
  70 ********************************************************************/
  71
  72 static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
  73 {
  74         char *tdbname = elog_tdbname(talloc_tos(), info->logname );
  75         struct security_descriptor *sec_desc;
  76         NTSTATUS status;
  77
  78         if ( !tdbname )
  79                 return False;
  80
  81         /* get the security descriptor for the file */
  82
  83         sec_desc = get_nt_acl_no_snum( info, tdbname );
  84         TALLOC_FREE( tdbname );
  85
  86         if ( !sec_desc ) {
  87                 DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n",
  88                         tdbname));
  89                 return False;
  90         }
  91
  92         /* root free pass */
  93
  94         if ( geteuid() == sec_initial_uid() ) {
  95                 DEBUG(5,("elog_check_access: using root's token\n"));
  96                 token = get_root_nt_token();
  97         }
  98
  99         /* run the check, try for the max allowed */
 100
 101         status = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
 102                 &info->access_granted);
 103
 104         if ( sec_desc )
 105                 TALLOC_FREE( sec_desc );
 106
 107         if (!NT_STATUS_IS_OK(status)) {
 108                 DEBUG(8,("elog_check_access: se_access_check() return %s\n",
 109                         nt_errstr(status)));
 110                 return False;
 111         }
 112
 113         /* we have to have READ permission for a successful open */
 114
 115         return ( info->access_granted & SA_RIGHT_FILE_READ_DATA );
 116 }
 117
 118 /********************************************************************
 119  ********************************************************************/
 120
 121 static bool elog_validate_logname( const char *name )
 122 {
 123         int i;
 124         const char **elogs = lp_eventlog_list();
 125
 126         if (!elogs) {
 127                 return False;
 128         }
 129
 130         for ( i=0; elogs[i]; i++ ) {
 131                 if ( strequal( name, elogs[i] ) )
 132                         return True;
 133         }
 134
 135         return False;
 136 }
 137
 138 /********************************************************************
 139 ********************************************************************/
 140
 141 static bool get_num_records_hook( EVENTLOG_INFO * info )
 142 {
 143         int next_record;
 144         int oldest_record;
 145
 146         if ( !info->etdb ) {
 147                 DEBUG( 10, ( "No open tdb for %s\n", info->logname ) );
 148                 return False;
 149         }
 150
 151         /* lock the tdb since we have to get 2 records */
 152
 153         tdb_lock_bystring_with_timeout( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD, 1 );
 154         next_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
 155         oldest_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_OLDEST_ENTRY);
 156         tdb_unlock_bystring( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
 157
 158         DEBUG( 8,
 159                ( "Oldest Record %d; Next Record %d\n", oldest_record,
 160                  next_record ) );
 161
 162         info->num_records = ( next_record - oldest_record );
 163         info->oldest_entry = oldest_record;
 164
 165         return True;
 166 }
 167
 168 /********************************************************************
 169  ********************************************************************/
 170
 171 static bool get_oldest_entry_hook( EVENTLOG_INFO * info )
 172 {
 173         /* it's the same thing */
 174         return get_num_records_hook( info );
 175 }
 176
 177 /********************************************************************
 178  ********************************************************************/
 179
 180 static NTSTATUS elog_open( pipes_struct * p, const char *logname, struct policy_handle *hnd )
 181 {
 182         EVENTLOG_INFO *elog;
 183
 184         /* first thing is to validate the eventlog name */
 185
 186         if ( !elog_validate_logname( logname ) )
 187                 return NT_STATUS_OBJECT_PATH_INVALID;
 188
 189         if ( !(elog = TALLOC_ZERO_P( NULL, EVENTLOG_INFO )) )
 190                 return NT_STATUS_NO_MEMORY;
 191         talloc_set_destructor(elog, eventlog_info_destructor);
 192
 193         elog->logname = talloc_strdup( elog, logname );
 194
 195         /* Open the tdb first (so that we can create any new tdbs if necessary).
 196            We have to do this as root and then use an internal access check
 197            on the file permissions since you can only have a tdb open once
 198            in a single process */
 199
 200         become_root();
 201         elog->etdb = elog_open_tdb( elog->logname, False, False );
 202         unbecome_root();
 203
 204         if ( !elog->etdb ) {
 205                 /* according to MSDN, if the logfile cannot be found, we should
 206                   default to the "Application" log */
 207
 208                 if ( !strequal( logname, ELOG_APPL ) ) {
 209
 210                         TALLOC_FREE( elog->logname );
 211
 212                         elog->logname = talloc_strdup( elog, ELOG_APPL );
 213
 214                         /* do the access check */
 215                         if ( !elog_check_access( elog, p->server_info->ptok ) ) {
 216                                 TALLOC_FREE( elog );
 217                                 return NT_STATUS_ACCESS_DENIED;
 218                         }
 219
 220                         become_root();
 221                         elog->etdb = elog_open_tdb( elog->logname, False, False );
 222                         unbecome_root();
 223                 }
 224
 225                 if ( !elog->etdb ) {
 226                         TALLOC_FREE( elog );
 227                         return NT_STATUS_ACCESS_DENIED; /* ??? */
 228                 }
 229         }
 230
 231         /* now do the access check.  Close the tdb if we fail here */
 232
 233         if ( !elog_check_access( elog, p->server_info->ptok ) ) {
 234                 TALLOC_FREE( elog );
 235                 return NT_STATUS_ACCESS_DENIED;
 236         }
 237
 238         /* create the policy handle */
 239
 240         if ( !create_policy_hnd( p, hnd, elog ) ) {
 241                 TALLOC_FREE(elog);
 242                 return NT_STATUS_NO_MEMORY;
 243         }
 244
 245         /* set the initial current_record pointer */
 246
 247         if ( !get_oldest_entry_hook( elog ) ) {
 248                 DEBUG(3,("elog_open: Successfully opened eventlog but can't "
 249                         "get any information on internal records!\n"));
 250         }
 251
 252         elog->current_record = elog->oldest_entry;
 253
 254         return NT_STATUS_OK;
 255 }
 256
 257 /********************************************************************
 258  ********************************************************************/
 259
 260 static NTSTATUS elog_close( pipes_struct *p, struct policy_handle *hnd )
 261 {
 262         if ( !( close_policy_hnd( p, hnd ) ) ) {
 263                 return NT_STATUS_INVALID_HANDLE;
 264         }
 265
 266         return NT_STATUS_OK;
 267 }
 268
 269 /*******************************************************************
 270  *******************************************************************/
 271
 272 static int elog_size( EVENTLOG_INFO *info )
 273 {
 274         if ( !info || !info->etdb ) {
 275                 DEBUG(0,("elog_size: Invalid info* structure!\n"));
 276                 return 0;
 277         }
 278
 279         return elog_tdb_size( ELOG_TDB_CTX(info->etdb), NULL, NULL );
 280 }
 281
 282 /********************************************************************
 283  note that this can only be called AFTER the table is constructed,
 284  since it uses the table to find the tdb handle
 285  ********************************************************************/
 286
 287 static bool sync_eventlog_params( EVENTLOG_INFO *info )
 288 {
 289         char *path = NULL;
 290         uint32 uiMaxSize;
 291         uint32 uiRetention;
 292         struct registry_key *key;
 293         struct registry_value *value;
 294         WERROR wresult;
 295         char *elogname = info->logname;
 296         TALLOC_CTX *ctx = talloc_stackframe();
 297         bool ret = false;
 298
 299         DEBUG( 4, ( "sync_eventlog_params with %s\n", elogname ) );
 300
 301         if ( !info->etdb ) {
 302                 DEBUG( 4, ( "No open tdb! (%s)\n", info->logname ) );
 303                 goto done;
 304         }
 305         /* set resonable defaults.  512Kb on size and 1 week on time */
 306
 307         uiMaxSize = 0x80000;
 308         uiRetention = 604800;
 309
 310         /* the general idea is to internally open the registry
 311            key and retrieve the values.  That way we can continue
 312            to use the same fetch/store api that we use in
 313            srv_reg_nt.c */
 314
 315         path = talloc_asprintf(ctx, "%s/%s", KEY_EVENTLOG, elogname );
 316         if (!path) {
 317                 goto done;
 318         }
 319
 320         wresult = reg_open_path(ctx, path, REG_KEY_READ, get_root_nt_token(),
 321                                 &key);
 322
 323         if ( !W_ERROR_IS_OK( wresult ) ) {
 324                 DEBUG( 4,
 325                        ( "sync_eventlog_params: Failed to open key [%s] (%s)\n",
 326                          path, win_errstr( wresult ) ) );
 327                 goto done;
 328         }
 329
 330         wresult = reg_queryvalue(key, key, "Retention", &value);
 331         if (!W_ERROR_IS_OK(wresult)) {
 332                 DEBUG(4, ("Failed to query value \"Retention\": %s\n",
 333                           win_errstr(wresult)));
 334                 goto done;
 335         }
 336         uiRetention = value->v.dword;
 337
 338         wresult = reg_queryvalue(key, key, "MaxSize", &value);
 339         if (!W_ERROR_IS_OK(wresult)) {
 340                 DEBUG(4, ("Failed to query value \"MaxSize\": %s\n",
 341                           win_errstr(wresult)));
 342                 goto done;
 343         }
 344         uiMaxSize = value->v.dword;
 345
 346         tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_MAXSIZE, uiMaxSize );
 347         tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_RETENTION, uiRetention );
 348
 349         ret = true;
 350
 351 done:
 352         TALLOC_FREE(ctx);
 353         return ret;
 354 }
 355
 356 /********************************************************************
 357  _eventlog_OpenEventLogW
 358  ********************************************************************/
 359
 360 NTSTATUS _eventlog_OpenEventLogW(pipes_struct *p,
 361                                  struct eventlog_OpenEventLogW *r)
 362 {
 363         EVENTLOG_INFO *info;
 364         NTSTATUS result;
 365
 366         DEBUG( 10,("_eventlog_OpenEventLogW: Server [%s], Log [%s]\n",
 367                 r->in.servername->string, r->in.logname->string ));
 368
 369         /* according to MSDN, if the logfile cannot be found, we should
 370           default to the "Application" log */
 371
 372         if ( !NT_STATUS_IS_OK( result = elog_open( p, r->in.logname->string, r->out.handle )) )
 373                 return result;
 374
 375         if ( !(info = find_eventlog_info_by_hnd( p, r->out.handle )) ) {
 376                 DEBUG(0,("_eventlog_OpenEventLogW: eventlog (%s) opened but unable to find handle!\n",
 377                         r->in.logname->string ));
 378                 elog_close( p, r->out.handle );
 379                 return NT_STATUS_INVALID_HANDLE;
 380         }
 381
 382         DEBUG(10,("_eventlog_OpenEventLogW: Size [%d]\n", elog_size( info )));
 383
 384         sync_eventlog_params( info );
 385         prune_eventlog( ELOG_TDB_CTX(info->etdb) );
 386
 387         return NT_STATUS_OK;
 388 }
 389
 390 /********************************************************************
 391  _eventlog_ClearEventLogW
 392  This call still needs some work
 393  ********************************************************************/
 394 /** The windows client seems to be doing something funny with the file name
 395    A call like
 396       ClearEventLog(handle, "backup_file")
 397    on the client side will result in the backup file name looking like this on the
 398    server side:
 399       \??\${CWD of client}\backup_file
 400    If an absolute path gets specified, such as
 401       ClearEventLog(handle, "C:\\temp\\backup_file")
 402    then it is still mangled by the client into this:
 403       \??\C:\temp\backup_file
 404    when it is on the wire.
 405    I'm not sure where the \?? is coming from, or why the ${CWD} of the client process
 406    would be added in given that the backup file gets written on the server side. */
 407
 408 NTSTATUS _eventlog_ClearEventLogW(pipes_struct *p,
 409                                   struct eventlog_ClearEventLogW *r)
 410 {
 411         EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
 412
 413         if ( !info )
 414                 return NT_STATUS_INVALID_HANDLE;
 415
 416         if (r->in.backupfile && r->in.backupfile->string) {
 417
 418                 DEBUG(8,( "_eventlog_ClearEventLogW: Using [%s] as the backup "
 419                         "file name for log [%s].",
 420                          r->in.backupfile->string, info->logname ) );
 421         }
 422
 423         /* check for WRITE access to the file */
 424
 425         if ( !(info->access_granted&SA_RIGHT_FILE_WRITE_DATA) )
 426                 return NT_STATUS_ACCESS_DENIED;
 427
 428         /* Force a close and reopen */
 429
 430         elog_close_tdb( info->etdb, True );
 431         become_root();
 432         info->etdb = elog_open_tdb( info->logname, True, False );
 433         unbecome_root();
 434
 435         if ( !info->etdb )
 436                 return NT_STATUS_ACCESS_DENIED;
 437
 438         return NT_STATUS_OK;
 439 }
 440
 441 /********************************************************************
 442  _eventlog_CloseEventLog
 443  ********************************************************************/
 444
 445 NTSTATUS _eventlog_CloseEventLog(pipes_struct * p,
 446                                  struct eventlog_CloseEventLog *r)
 447 {
 448         NTSTATUS status;
 449
 450         status = elog_close( p, r->in.handle );
 451         if (!NT_STATUS_IS_OK(status)) {
 452                 return status;
 453         }
 454
 455         ZERO_STRUCTP(r->out.handle);
 456
 457         return NT_STATUS_OK;
 458 }
 459
 460 /********************************************************************
 461  _eventlog_ReadEventLogW
 462  ********************************************************************/
 463
 464 NTSTATUS _eventlog_ReadEventLogW(pipes_struct *p,
 465                                  struct eventlog_ReadEventLogW *r)
 466 {
 467         EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
 468         uint32_t num_records_read = 0;
 469         int bytes_left, record_number;
 470         uint32_t elog_read_type, elog_read_dir;
 471
 472         if (!info) {
 473                 return NT_STATUS_INVALID_HANDLE;
 474         }
 475
 476         info->flags     = r->in.flags;
 477         bytes_left      = r->in.number_of_bytes;
 478
 479         if (!info->etdb) {
 480                 return NT_STATUS_ACCESS_DENIED;
 481         }
 482
 483         /* check for valid flags.  Can't use the sequential and seek flags together */
 484
 485         elog_read_type = r->in.flags & (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ);
 486         elog_read_dir  = r->in.flags & (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ);
 487
 488         if (r->in.flags == 0 ||
 489             elog_read_type == (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ) ||
 490             elog_read_dir == (EVENTLOG_FORWARDS_READ|EVENTLOG_BACKWARDS_READ))
 491         {
 492                 DEBUG(3,("_eventlog_ReadEventLogW: "
 493                         "Invalid flags [0x%08x] for ReadEventLog\n",
 494                         r->in.flags));
 495                 return NT_STATUS_INVALID_PARAMETER;
 496         }
 497
 498         /* a sequential read should ignore the offset */
 499
 500         if (elog_read_type & EVENTLOG_SEQUENTIAL_READ) {
 501                 record_number = info->current_record;
 502         } else {
 503                 record_number = r->in.offset;
 504         }
 505
 506         if (r->in.number_of_bytes == 0) {
 507                 struct EVENTLOGRECORD *e;
 508                 e = evlog_pull_record(p->mem_ctx, ELOG_TDB_CTX(info->etdb),
 509                                       record_number);
 510                 if (!e) {
 511                         return NT_STATUS_END_OF_FILE;
 512                 }
 513                 *r->out.real_size = e->Length;
 514                 return NT_STATUS_BUFFER_TOO_SMALL;
 515         }
 516
 517         while (bytes_left > 0) {
 518
 519                 DATA_BLOB blob;
 520                 enum ndr_err_code ndr_err;
 521                 struct EVENTLOGRECORD *e;
 522
 523                 e = evlog_pull_record(p->mem_ctx, ELOG_TDB_CTX(info->etdb),
 524                                       record_number);
 525                 if (!e) {
 526                         break;
 527                 }
 528
 529                 ndr_err = ndr_push_struct_blob(&blob, p->mem_ctx, e,
 530                               (ndr_push_flags_fn_t)ndr_push_EVENTLOGRECORD);
 531                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 532                         return ndr_map_error2ntstatus(ndr_err);
 533                 }
 534
 535                 if (DEBUGLEVEL >= 10) {
 536                         NDR_PRINT_DEBUG(EVENTLOGRECORD, e);
 537                 }
 538
 539                 if (blob.length > r->in.number_of_bytes) {
 540                         *r->out.real_size = blob.length;
 541                         return NT_STATUS_BUFFER_TOO_SMALL;
 542                 }
 543
 544                 if (*r->out.sent_size + blob.length > r->in.number_of_bytes) {
 545                         break;
 546                 }
 547
 548                 bytes_left -= blob.length;
 549
 550                 if (info->flags & EVENTLOG_FORWARDS_READ) {
 551                         record_number++;
 552                 } else {
 553                         record_number--;
 554                 }
 555
 556                 /* update the eventlog record pointer */
 557
 558                 info->current_record = record_number;
 559
 560                 memcpy(&r->out.data[*(r->out.sent_size)],
 561                        blob.data, blob.length);
 562                 *(r->out.sent_size) += blob.length;
 563
 564                 num_records_read++;
 565         }
 566
 567         if (r->in.offset == 0 && record_number == 0 && *r->out.sent_size == 0) {
 568                 return NT_STATUS_END_OF_FILE;
 569         }
 570
 571         return NT_STATUS_OK;
 572 }
 573
 574 /********************************************************************
 575  _eventlog_GetOldestRecord
 576  ********************************************************************/
 577
 578 NTSTATUS _eventlog_GetOldestRecord(pipes_struct *p,
 579                                    struct eventlog_GetOldestRecord *r)
 580 {
 581         EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
 582
 583         if (info == NULL) {
 584                 return NT_STATUS_INVALID_HANDLE;
 585         }
 586
 587         if ( !( get_oldest_entry_hook( info ) ) )
 588                 return NT_STATUS_ACCESS_DENIED;
 589
 590         *r->out.oldest_entry = info->oldest_entry;
 591
 592         return NT_STATUS_OK;
 593 }
 594
 595 /********************************************************************
 596 _eventlog_GetNumRecords
 597  ********************************************************************/
 598
 599 NTSTATUS _eventlog_GetNumRecords(pipes_struct *p,
 600                                  struct eventlog_GetNumRecords *r)
 601 {
 602         EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
 603
 604         if (info == NULL) {
 605                 return NT_STATUS_INVALID_HANDLE;
 606         }
 607
 608         if ( !( get_num_records_hook( info ) ) )
 609                 return NT_STATUS_ACCESS_DENIED;
 610
 611         *r->out.number = info->num_records;
 612
 613         return NT_STATUS_OK;
 614 }
 615
 616 NTSTATUS _eventlog_BackupEventLogW(pipes_struct *p, struct eventlog_BackupEventLogW *r)
 617 {
 618         p->rng_fault_state = True;
 619         return NT_STATUS_NOT_IMPLEMENTED;
 620 }
 621
 622 /********************************************************************
 623 _eventlog_GetLogInformation
 624  ********************************************************************/
 625
 626 NTSTATUS _eventlog_GetLogInformation(pipes_struct *p,
 627                                      struct eventlog_GetLogInformation *r)
 628 {
 629         EVENTLOG_INFO *info = find_eventlog_info_by_hnd(p, r->in.handle);
 630         struct EVENTLOG_FULL_INFORMATION f;
 631         enum ndr_err_code ndr_err;
 632         DATA_BLOB blob;
 633
 634         if (!info) {
 635                 return NT_STATUS_INVALID_HANDLE;
 636         }
 637
 638         if (r->in.level != 0) {
 639                 return NT_STATUS_INVALID_LEVEL;
 640         }
 641
 642         *r->out.bytes_needed = 4;
 643
 644         if (r->in.buf_size < 4) {
 645                 return NT_STATUS_BUFFER_TOO_SMALL;
 646         }
 647
 648         /* FIXME: this should be retrieved from the handle */
 649         f.full = false;
 650
 651         ndr_err = ndr_push_struct_blob(&blob, p->mem_ctx, &f,
 652                       (ndr_push_flags_fn_t)ndr_push_EVENTLOG_FULL_INFORMATION);
 653         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 654                 return ndr_map_error2ntstatus(ndr_err);
 655         }
 656
 657         if (DEBUGLEVEL >= 10) {
 658                 NDR_PRINT_DEBUG(EVENTLOG_FULL_INFORMATION, &f);
 659         }
 660
 661         memcpy(r->out.buffer, blob.data, 4);
 662
 663         return NT_STATUS_OK;
 664 }
 665
 666 /********************************************************************
 667 _eventlog_FlushEventLog
 668  ********************************************************************/
 669
 670 NTSTATUS _eventlog_FlushEventLog(pipes_struct *p,
 671                                  struct eventlog_FlushEventLog *r)
 672 {
 673         EVENTLOG_INFO *info = find_eventlog_info_by_hnd(p, r->in.handle);
 674         if (!info) {
 675                 return NT_STATUS_INVALID_HANDLE;
 676         }
 677
 678         return NT_STATUS_ACCESS_DENIED;
 679 }
 680
 681 /********************************************************************
 682  ********************************************************************/
 683
 684 static NTSTATUS evlog_report_to_record(TALLOC_CTX *mem_ctx,
 685                                        const struct eventlog_ReportEventW *r,
 686                                        const char *logname,
 687                                        struct EVENTLOGRECORD *e)
 688 {
 689         uint32_t i;
 690         ZERO_STRUCTP(e);
 691
 692         e->TimeGenerated        = r->in.timestamp;
 693         e->TimeWritten          = time(NULL);
 694         e->EventID              = r->in.event_id;
 695         e->EventType            = r->in.event_type;
 696         e->NumStrings           = r->in.num_of_strings;
 697         e->EventCategory        = r->in.event_category;
 698         e->ReservedFlags        = r->in.flags;
 699         e->DataLength           = r->in.data_size;
 700         e->SourceName           = talloc_strdup(mem_ctx, logname);
 701         NT_STATUS_HAVE_NO_MEMORY(e->SourceName);
 702         if (r->in.servername->string) {
 703                 e->Computername = r->in.servername->string;
 704         } else {
 705                 e->Computername = talloc_strdup(mem_ctx, "");
 706                 NT_STATUS_HAVE_NO_MEMORY(e->Computername);
 707         }
 708         if (r->in.user_sid) {
 709                 e->UserSid      = *r->in.user_sid;
 710         }
 711         e->Strings              = talloc_array(mem_ctx, const char *, e->NumStrings);
 712         NT_STATUS_HAVE_NO_MEMORY(e->Strings);
 713
 714         for (i=0; i < e->NumStrings; i++) {
 715                 e->Strings[i] = talloc_strdup(e->Strings,
 716                                               r->in.strings[i]->string);
 717                 NT_STATUS_HAVE_NO_MEMORY(e->Strings[i]);
 718         }
 719         e->Data                 = r->in.data;
 720
 721         return NT_STATUS_OK;
 722 }
 723
 724 /********************************************************************
 725 _eventlog_ReportEventW
 726  ********************************************************************/
 727
 728 NTSTATUS _eventlog_ReportEventW(pipes_struct *p,
 729                                 struct eventlog_ReportEventW *r)
 730 {
 731         NTSTATUS status;
 732         struct EVENTLOGRECORD record;
 733
 734         EVENTLOG_INFO *info = find_eventlog_info_by_hnd(p, r->in.handle);
 735         if (!info) {
 736                 return NT_STATUS_INVALID_HANDLE;
 737         }
 738
 739         status = evlog_report_to_record(p->mem_ctx, r, info->logname, &record);
 740         if (!NT_STATUS_IS_OK(status)) {
 741                 return status;
 742         }
 743
 744         status = evlog_push_record(p->mem_ctx,
 745                                    ELOG_TDB_CTX(info->etdb),
 746                                    &record,
 747                                    r->out.record_number);
 748         if (!NT_STATUS_IS_OK(status)) {
 749                 return status;
 750         }
 751
 752         return NT_STATUS_OK;
 753 }
 754
 755 /********************************************************************
 756  ********************************************************************/
 757
 758 NTSTATUS _eventlog_DeregisterEventSource(pipes_struct *p, struct eventlog_DeregisterEventSource *r)
 759 {
 760         p->rng_fault_state = True;
 761         return NT_STATUS_NOT_IMPLEMENTED;
 762 }
 763
 764 NTSTATUS _eventlog_ChangeNotify(pipes_struct *p, struct eventlog_ChangeNotify *r)
 765 {
 766         p->rng_fault_state = True;
 767         return NT_STATUS_NOT_IMPLEMENTED;
 768 }
 769
 770 NTSTATUS _eventlog_RegisterEventSourceW(pipes_struct *p, struct eventlog_RegisterEventSourceW *r)
 771 {
 772         p->rng_fault_state = True;
 773         return NT_STATUS_NOT_IMPLEMENTED;
 774 }
 775
 776 NTSTATUS _eventlog_OpenBackupEventLogW(pipes_struct *p, struct eventlog_OpenBackupEventLogW *r)
 777 {
 778         p->rng_fault_state = True;
 779         return NT_STATUS_NOT_IMPLEMENTED;
 780 }
 781
 782 NTSTATUS _eventlog_ClearEventLogA(pipes_struct *p, struct eventlog_ClearEventLogA *r)
 783 {
 784         p->rng_fault_state = True;
 785         return NT_STATUS_NOT_IMPLEMENTED;
 786 }
 787
 788 NTSTATUS _eventlog_BackupEventLogA(pipes_struct *p, struct eventlog_BackupEventLogA *r)
 789 {
 790         p->rng_fault_state = True;
 791         return NT_STATUS_NOT_IMPLEMENTED;
 792 }
 793
 794 NTSTATUS _eventlog_OpenEventLogA(pipes_struct *p, struct eventlog_OpenEventLogA *r)
 795 {
 796         p->rng_fault_state = True;
 797         return NT_STATUS_NOT_IMPLEMENTED;
 798 }
 799
 800 NTSTATUS _eventlog_RegisterEventSourceA(pipes_struct *p, struct eventlog_RegisterEventSourceA *r)
 801 {
 802         p->rng_fault_state = True;
 803         return NT_STATUS_NOT_IMPLEMENTED;
 804 }
 805
 806 NTSTATUS _eventlog_OpenBackupEventLogA(pipes_struct *p, struct eventlog_OpenBackupEventLogA *r)
 807 {
 808         p->rng_fault_state = True;
 809         return NT_STATUS_NOT_IMPLEMENTED;
 810 }
 811
 812 NTSTATUS _eventlog_ReadEventLogA(pipes_struct *p, struct eventlog_ReadEventLogA *r)
 813 {
 814         p->rng_fault_state = True;
 815         return NT_STATUS_NOT_IMPLEMENTED;
 816 }
 817
 818 NTSTATUS _eventlog_ReportEventA(pipes_struct *p, struct eventlog_ReportEventA *r)
 819 {
 820         p->rng_fault_state = True;
 821         return NT_STATUS_NOT_IMPLEMENTED;
 822 }
 823
 824 NTSTATUS _eventlog_RegisterClusterSvc(pipes_struct *p, struct eventlog_RegisterClusterSvc *r)
 825 {
 826         p->rng_fault_state = True;
 827         return NT_STATUS_NOT_IMPLEMENTED;
 828 }
 829
 830 NTSTATUS _eventlog_DeregisterClusterSvc(pipes_struct *p, struct eventlog_DeregisterClusterSvc *r)
 831 {
 832         p->rng_fault_state = True;
 833         return NT_STATUS_NOT_IMPLEMENTED;
 834 }
 835
 836 NTSTATUS _eventlog_WriteClusterEvents(pipes_struct *p, struct eventlog_WriteClusterEvents *r)
 837 {
 838         p->rng_fault_state = True;
 839         return NT_STATUS_NOT_IMPLEMENTED;
 840 }
 841
 842 NTSTATUS _eventlog_ReportEventAndSourceW(pipes_struct *p, struct eventlog_ReportEventAndSourceW *r)
 843 {
 844         p->rng_fault_state = True;
 845         return NT_STATUS_NOT_IMPLEMENTED;
 846 }