s3-eventlog: use main talloc context in eventlog read call.
[metze/samba/wip.git] / source3 / rpc_server / srv_eventlog_nt.c
index 06697153b8e785484599f1fcd7c0da84171a4465..8f5c0e8aa2cdcbce920d2be8ef7cfd828e56b3e7 100644 (file)
@@ -1,20 +1,20 @@
-/* 
+/*
  *  Unix SMB/CIFS implementation.
  *  RPC Pipe client / server routines
  *  Copyright (C) Marcin Krzysztof Porwit    2005,
  *  Copyright (C) Brian Moran                2005,
  *  Copyright (C) Gerald (Jerry) Carter      2005.
- *  
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
  *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
- *  
+ *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *  
+ *
  *  You should have received a copy of the GNU General Public License
  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
@@ -37,14 +37,12 @@ typedef struct {
 /********************************************************************
  ********************************************************************/
 
-static void free_eventlog_info( void *ptr )
+static int eventlog_info_destructor(EVENTLOG_INFO *elog)
 {
-       EVENTLOG_INFO *elog = (EVENTLOG_INFO *)ptr;
-       
-       if ( elog->etdb )
-               elog_close_tdb( elog->etdb, False );
-       
-       TALLOC_FREE( elog );
+       if (elog->etdb) {
+               elog_close_tdb(elog->etdb, false);
+       }
+       return 0;
 }
 
 /********************************************************************
@@ -71,23 +69,22 @@ static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
 {
        char *tdbname = elog_tdbname(talloc_tos(), info->logname );
        SEC_DESC *sec_desc;
-       bool ret;
-       NTSTATUS ntstatus;
-       
-       if ( !tdbname ) 
+       NTSTATUS status;
+
+       if ( !tdbname )
                return False;
-       
+
        /* get the security descriptor for the file */
-       
+
        sec_desc = get_nt_acl_no_snum( info, tdbname );
-       SAFE_FREE( tdbname );
-       
+       TALLOC_FREE( tdbname );
+
        if ( !sec_desc ) {
-               DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n", 
+               DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n",
                        tdbname));
                return False;
        }
-       
+
        /* root free pass */
 
        if ( geteuid() == sec_initial_uid() ) {
@@ -96,21 +93,21 @@ static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
        }
 
        /* run the check, try for the max allowed */
-       
-       ret = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
-               &info->access_granted, &ntstatus );
-               
+
+       status = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
+               &info->access_granted);
+
        if ( sec_desc )
                TALLOC_FREE( sec_desc );
-               
-       if ( !ret ) {
+
+       if (!NT_STATUS_IS_OK(status)) {
                DEBUG(8,("elog_check_access: se_access_check() return %s\n",
-                       nt_errstr( ntstatus)));
+                       nt_errstr(status)));
                return False;
        }
-       
+
        /* we have to have READ permission for a successful open */
-       
+
        return ( info->access_granted & SA_RIGHT_FILE_READ_DATA );
 }
 
@@ -121,7 +118,7 @@ static bool elog_validate_logname( const char *name )
 {
        int i;
        const char **elogs = lp_eventlog_list();
-       
+
        if (!elogs) {
                return False;
        }
@@ -130,7 +127,7 @@ static bool elog_validate_logname( const char *name )
                if ( strequal( name, elogs[i] ) )
                        return True;
        }
-       
+
        return False;
 }
 
@@ -179,19 +176,20 @@ static bool get_oldest_entry_hook( EVENTLOG_INFO * info )
 static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
 {
        EVENTLOG_INFO *elog;
-       
+
        /* first thing is to validate the eventlog name */
        
        if ( !elog_validate_logname( logname ) )
                return NT_STATUS_OBJECT_PATH_INVALID;
-       
+
        if ( !(elog = TALLOC_ZERO_P( NULL, EVENTLOG_INFO )) )
                return NT_STATUS_NO_MEMORY;
-               
+       talloc_set_destructor(elog, eventlog_info_destructor);
+
        elog->logname = talloc_strdup( elog, logname );
-       
+
        /* Open the tdb first (so that we can create any new tdbs if necessary).
-          We have to do this as root and then use an internal access check 
+          We have to do this as root and then use an internal access check
           on the file permissions since you can only have a tdb open once
           in a single process */
 
@@ -202,43 +200,41 @@ static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hn
        if ( !elog->etdb ) {
                /* according to MSDN, if the logfile cannot be found, we should
                  default to the "Application" log */
-       
+
                if ( !strequal( logname, ELOG_APPL ) ) {
-               
+
                        TALLOC_FREE( elog->logname );
-                       
-                       elog->logname = talloc_strdup( elog, ELOG_APPL );                       
+
+                       elog->logname = talloc_strdup( elog, ELOG_APPL );
 
                        /* do the access check */
-                       if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
+                       if ( !elog_check_access( elog, p->server_info->ptok ) ) {
                                TALLOC_FREE( elog );
                                return NT_STATUS_ACCESS_DENIED;
                        }
-       
+
                        become_root();
                        elog->etdb = elog_open_tdb( elog->logname, False );
                        unbecome_root();
-               }       
-               
+               }
+
                if ( !elog->etdb ) {
                        TALLOC_FREE( elog );
-                       return NT_STATUS_ACCESS_DENIED; /* ??? */               
+                       return NT_STATUS_ACCESS_DENIED; /* ??? */
                }
        }
-       
+
        /* now do the access check.  Close the tdb if we fail here */
 
-       if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
-               elog_close_tdb( elog->etdb, False );
+       if ( !elog_check_access( elog, p->server_info->ptok ) ) {
                TALLOC_FREE( elog );
                return NT_STATUS_ACCESS_DENIED;
        }
-       
+
        /* create the policy handle */
-       
-       if ( !create_policy_hnd
-            ( p, hnd, free_eventlog_info, ( void * ) elog ) ) {
-               free_eventlog_info( elog );
+
+       if ( !create_policy_hnd( p, hnd, elog ) ) {
+               TALLOC_FREE(elog);
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -247,7 +243,7 @@ static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hn
        if ( !get_oldest_entry_hook( elog ) ) {
                DEBUG(3,("elog_open: Successfully opened eventlog but can't "
                        "get any information on internal records!\n"));
-       }       
+       }
 
        elog->current_record = elog->oldest_entry;
 
@@ -284,15 +280,15 @@ static int elog_size( EVENTLOG_INFO *info )
   Eventlog_entry.  returns NULL if it can't get the record for some reason.
  ********************************************************************/
 
-static Eventlog_entry *get_eventlog_record(prs_struct *ps,
+static Eventlog_entry *get_eventlog_record(TALLOC_CTX *mem_ctx,
                                TDB_CONTEXT *tdb,
                                int recno)
 {
        Eventlog_entry *ee = NULL;
        TDB_DATA ret, key;
 
-       int srecno;
-       int reclen;
+       int32_t srecno;
+       int32_t reclen;
        int len;
 
        char *wpsource = NULL;
@@ -301,10 +297,10 @@ static Eventlog_entry *get_eventlog_record(prs_struct *ps,
        char *wpstrs = NULL;
        char *puserdata = NULL;
 
-       key.dsize = sizeof(int32);
+       key.dsize = sizeof(int32_t);
 
        srecno = recno;
-       key.dptr = ( uint8 * ) &srecno;
+       key.dptr = (unsigned char *)&srecno;
 
        ret = tdb_fetch( tdb, key );
 
@@ -322,7 +318,7 @@ static Eventlog_entry *get_eventlog_record(prs_struct *ps,
        if ( !len )
                return NULL;
 
-       ee = TALLOC_ARRAY(ps->mem_ctx, Eventlog_entry, 1);
+       ee = TALLOC_ARRAY(mem_ctx, Eventlog_entry, 1);
        if (!ee) {
                return NULL;
        }
@@ -414,7 +410,7 @@ static Eventlog_entry *get_eventlog_record(prs_struct *ps,
 }
 
 /********************************************************************
- note that this can only be called AFTER the table is constructed, 
+ note that this can only be called AFTER the table is constructed,
  since it uses the table to find the tdb handle
  ********************************************************************/
 
@@ -427,28 +423,28 @@ static bool sync_eventlog_params( EVENTLOG_INFO *info )
        struct registry_value *value;
        WERROR wresult;
        char *elogname = info->logname;
-       TALLOC_CTX *ctx = talloc_tos();
+       TALLOC_CTX *ctx = talloc_stackframe();
        bool ret = false;
 
        DEBUG( 4, ( "sync_eventlog_params with %s\n", elogname ) );
 
        if ( !info->etdb ) {
                DEBUG( 4, ( "No open tdb! (%s)\n", info->logname ) );
-               return False;
+               goto done;
        }
        /* set resonable defaults.  512Kb on size and 1 week on time */
 
        uiMaxSize = 0x80000;
        uiRetention = 604800;
 
-       /* the general idea is to internally open the registry 
-          key and retrieve the values.  That way we can continue 
-          to use the same fetch/store api that we use in 
+       /* the general idea is to internally open the registry
+          key and retrieve the values.  That way we can continue
+          to use the same fetch/store api that we use in
           srv_reg_nt.c */
 
        path = talloc_asprintf(ctx, "%s/%s", KEY_EVENTLOG, elogname );
        if (!path) {
-               return false;
+               goto done;
        }
 
        wresult = reg_open_path(ctx, path, REG_KEY_READ, get_root_nt_token(),
@@ -457,15 +453,14 @@ static bool sync_eventlog_params( EVENTLOG_INFO *info )
        if ( !W_ERROR_IS_OK( wresult ) ) {
                DEBUG( 4,
                       ( "sync_eventlog_params: Failed to open key [%s] (%s)\n",
-                        path, dos_errstr( wresult ) ) );
-               return false;
+                        path, win_errstr( wresult ) ) );
+               goto done;
        }
 
        wresult = reg_queryvalue(key, key, "Retention", &value);
        if (!W_ERROR_IS_OK(wresult)) {
                DEBUG(4, ("Failed to query value \"Retention\": %s\n",
-                         dos_errstr(wresult)));
-               ret = false;
+                         win_errstr(wresult)));
                goto done;
        }
        uiRetention = value->v.dword;
@@ -473,8 +468,7 @@ static bool sync_eventlog_params( EVENTLOG_INFO *info )
        wresult = reg_queryvalue(key, key, "MaxSize", &value);
        if (!W_ERROR_IS_OK(wresult)) {
                DEBUG(4, ("Failed to query value \"MaxSize\": %s\n",
-                         dos_errstr(wresult)));
-               ret = false;
+                         win_errstr(wresult)));
                goto done;
        }
        uiMaxSize = value->v.dword;
@@ -492,15 +486,13 @@ done:
 /********************************************************************
  ********************************************************************/
 
-static Eventlog_entry *read_package_entry( prs_struct * ps,
-                                          EVENTLOG_Q_READ_EVENTLOG * q_u,
-                                          EVENTLOG_R_READ_EVENTLOG * r_u,
+static Eventlog_entry *read_package_entry( TALLOC_CTX *mem_ctx,
                                           Eventlog_entry * entry )
 {
        uint8 *offset;
        Eventlog_entry *ee_new = NULL;
 
-       ee_new = PRS_ALLOC_MEM( ps, Eventlog_entry, 1 );
+       ee_new = TALLOC_ZERO_ARRAY(mem_ctx, Eventlog_entry, 1 );
        if ( ee_new == NULL ) {
                return NULL;
        }
@@ -539,10 +531,10 @@ static Eventlog_entry *read_package_entry( prs_struct * ps,
        DEBUG( 10,
               ( "entry->record.length is [%d].\n", entry->record.length ) );
        entry->data =
-               PRS_ALLOC_MEM( ps, uint8,
-                              entry->record.length -
-                              sizeof( Eventlog_record ) -
-                              sizeof( entry->record.length ) );
+               TALLOC_ZERO_ARRAY(mem_ctx, uint8_t,
+                                 entry->record.length -
+                                 sizeof( Eventlog_record ) -
+                                 sizeof( entry->record.length ));
        if ( entry->data == NULL ) {
                return NULL;
        }
@@ -586,15 +578,17 @@ static Eventlog_entry *read_package_entry( prs_struct * ps,
 /********************************************************************
  ********************************************************************/
 
-static bool add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
+static bool add_record_to_resp( Eventlog_entry *entry,
+                               uint32_t *num_records,
+                               uint32_t *num_bytes_in_resp,
                                Eventlog_entry * ee_new )
 {
        Eventlog_entry *insert_point;
 
-       insert_point = r_u->entry;
+       insert_point = entry;
 
        if ( NULL == insert_point ) {
-               r_u->entry = ee_new;
+               entry = ee_new;
                ee_new->next = NULL;
        } else {
                while ( ( NULL != insert_point->next ) ) {
@@ -603,8 +597,8 @@ static bool add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
                ee_new->next = NULL;
                insert_point->next = ee_new;
        }
-       r_u->num_records++;
-       r_u->num_bytes_in_resp += ee_new->record.length;
+       (*num_records)++;
+       *num_bytes_in_resp += ee_new->record.length;
 
        return True;
 }
@@ -628,13 +622,13 @@ NTSTATUS _eventlog_OpenEventLogW(pipes_struct *p,
        if (r->in.logname->string) {
                logname = r->in.logname->string;
        }
-       
+
        DEBUG( 10,("_eventlog_open_eventlog: Server [%s], Log [%s]\n",
                servername, logname ));
-               
+
        /* according to MSDN, if the logfile cannot be found, we should
          default to the "Application" log */
-         
+
        if ( !NT_STATUS_IS_OK( result = elog_open( p, logname, r->out.handle )) )
                return result;
 
@@ -708,9 +702,11 @@ NTSTATUS _eventlog_ClearEventLogW(pipes_struct *p,
 }
 
 /********************************************************************
+ _eventlog_CloseEventLog
  ********************************************************************/
 
-NTSTATUS _eventlog_CloseEventLog( pipes_struct * p, struct eventlog_CloseEventLog *r )
+NTSTATUS _eventlog_CloseEventLog(pipes_struct * p,
+                                struct eventlog_CloseEventLog *r)
 {
        return elog_close( p, r->in.handle );
 }
@@ -725,7 +721,6 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
        EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
        Eventlog_entry *entry = NULL, *ee_new = NULL;
        uint32 num_records_read = 0;
-       prs_struct *ps;
        int bytes_left, record_number;
        uint32 elog_read_type, elog_read_dir;
 
@@ -764,7 +759,7 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
 
                /* assume that when the record fetch fails, that we are done */
 
-               entry = get_eventlog_record (ps, ELOG_TDB_CTX(info->etdb), record_number);
+               entry = get_eventlog_record (p->mem_ctx, ELOG_TDB_CTX(info->etdb), record_number);
                if (!entry) {
                        break;
                }
@@ -773,7 +768,7 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
 
                /* Now see if there is enough room to add */
 
-               if ( !(ee_new = read_package_entry( ps, q_u, r_u, entry )) )
+               if ( !(ee_new = read_package_entry( p->mem_ctx, entry )) )
                        return NT_STATUS_NO_MEMORY;
 
                if ( r_u->num_bytes_in_resp + ee_new->record.length > q_u->max_read_size ) {
@@ -785,7 +780,10 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
                        break;
                }
 
-               add_record_to_resp( r_u, ee_new );
+               add_record_to_resp( r_u->entry,
+                                   &r_u->num_records, &r_u->num_bytes_in_resp,
+                                   ee_new );
+
                bytes_left -= ee_new->record.length;
                TALLOC_FREE(entry);
                num_records_read = r_u->num_records - num_records_read;