s3-eventlog: use main talloc context in eventlog read call.
[metze/samba/wip.git] / source3 / rpc_server / srv_eventlog_nt.c
index 658928b92706a46269df40bb9acd3a8e29b6f4ad..8f5c0e8aa2cdcbce920d2be8ef7cfd828e56b3e7 100644 (file)
@@ -1,23 +1,22 @@
-/* 
+/*
  *  Unix SMB/CIFS implementation.
  *  RPC Pipe client / server routines
  *  Copyright (C) Marcin Krzysztof Porwit    2005,
  *  Copyright (C) Brian Moran                2005,
  *  Copyright (C) Gerald (Jerry) Carter      2005.
- *  
+ *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
+ *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
- *  
+ *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *  
+ *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include "includes.h"
@@ -38,14 +37,12 @@ typedef struct {
 /********************************************************************
  ********************************************************************/
 
-static void free_eventlog_info( void *ptr )
+static int eventlog_info_destructor(EVENTLOG_INFO *elog)
 {
-       EVENTLOG_INFO *elog = (EVENTLOG_INFO *)ptr;
-       
-       if ( elog->etdb )
-               elog_close_tdb( elog->etdb, False );
-       
-       TALLOC_FREE( elog );
+       if (elog->etdb) {
+               elog_close_tdb(elog->etdb, false);
+       }
+       return 0;
 }
 
 /********************************************************************
@@ -56,7 +53,7 @@ static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
 {
        EVENTLOG_INFO *info;
 
-       if ( !find_policy_by_hnd( p, handle, ( void ** ) &info ) ) {
+       if ( !find_policy_by_hnd( p, handle, (void **)(void *)&info ) ) {
                DEBUG( 2,
                       ( "find_eventlog_info_by_hnd: eventlog not found.\n" ) );
                return NULL;
@@ -68,27 +65,26 @@ static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
 /********************************************************************
 ********************************************************************/
 
-static BOOL elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
+static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
 {
-       char *tdbname = elog_tdbname( info->logname );
+       char *tdbname = elog_tdbname(talloc_tos(), info->logname );
        SEC_DESC *sec_desc;
-       BOOL ret;
-       NTSTATUS ntstatus;
-       
-       if ( !tdbname ) 
+       NTSTATUS status;
+
+       if ( !tdbname )
                return False;
-       
+
        /* get the security descriptor for the file */
-       
+
        sec_desc = get_nt_acl_no_snum( info, tdbname );
-       SAFE_FREE( tdbname );
-       
+       TALLOC_FREE( tdbname );
+
        if ( !sec_desc ) {
-               DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n", 
+               DEBUG(5,("elog_check_access: Unable to get NT ACL for %s\n",
                        tdbname));
                return False;
        }
-       
+
        /* root free pass */
 
        if ( geteuid() == sec_initial_uid() ) {
@@ -97,44 +93,48 @@ static BOOL elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
        }
 
        /* run the check, try for the max allowed */
-       
-       ret = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
-               &info->access_granted, &ntstatus );
-               
+
+       status = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
+               &info->access_granted);
+
        if ( sec_desc )
                TALLOC_FREE( sec_desc );
-               
-       if ( !ret ) {
+
+       if (!NT_STATUS_IS_OK(status)) {
                DEBUG(8,("elog_check_access: se_access_check() return %s\n",
-                       nt_errstr( ntstatus)));
+                       nt_errstr(status)));
                return False;
        }
-       
+
        /* we have to have READ permission for a successful open */
-       
+
        return ( info->access_granted & SA_RIGHT_FILE_READ_DATA );
 }
 
 /********************************************************************
  ********************************************************************/
 
-static BOOL elog_validate_logname( const char *name )
+static bool elog_validate_logname( const char *name )
 {
        int i;
        const char **elogs = lp_eventlog_list();
-       
+
+       if (!elogs) {
+               return False;
+       }
+
        for ( i=0; elogs[i]; i++ ) {
                if ( strequal( name, elogs[i] ) )
                        return True;
        }
-       
+
        return False;
 }
 
 /********************************************************************
 ********************************************************************/
 
-static BOOL get_num_records_hook( EVENTLOG_INFO * info )
+static bool get_num_records_hook( EVENTLOG_INFO * info )
 {
        int next_record;
        int oldest_record;
@@ -146,7 +146,7 @@ static BOOL get_num_records_hook( EVENTLOG_INFO * info )
 
        /* lock the tdb since we have to get 2 records */
 
-       tdb_lock_bystring( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD, 1 );
+       tdb_lock_bystring_with_timeout( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD, 1 );
        next_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
        oldest_record = tdb_fetch_int32( ELOG_TDB_CTX(info->etdb), EVT_OLDEST_ENTRY);
        tdb_unlock_bystring( ELOG_TDB_CTX(info->etdb), EVT_NEXT_RECORD);
@@ -164,7 +164,7 @@ static BOOL get_num_records_hook( EVENTLOG_INFO * info )
 /********************************************************************
  ********************************************************************/
 
-static BOOL get_oldest_entry_hook( EVENTLOG_INFO * info )
+static bool get_oldest_entry_hook( EVENTLOG_INFO * info )
 {
        /* it's the same thing */
        return get_num_records_hook( info );
@@ -176,19 +176,20 @@ static BOOL get_oldest_entry_hook( EVENTLOG_INFO * info )
 static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
 {
        EVENTLOG_INFO *elog;
-       
+
        /* first thing is to validate the eventlog name */
        
        if ( !elog_validate_logname( logname ) )
                return NT_STATUS_OBJECT_PATH_INVALID;
-       
+
        if ( !(elog = TALLOC_ZERO_P( NULL, EVENTLOG_INFO )) )
                return NT_STATUS_NO_MEMORY;
-               
+       talloc_set_destructor(elog, eventlog_info_destructor);
+
        elog->logname = talloc_strdup( elog, logname );
-       
+
        /* Open the tdb first (so that we can create any new tdbs if necessary).
-          We have to do this as root and then use an internal access check 
+          We have to do this as root and then use an internal access check
           on the file permissions since you can only have a tdb open once
           in a single process */
 
@@ -199,43 +200,41 @@ static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hn
        if ( !elog->etdb ) {
                /* according to MSDN, if the logfile cannot be found, we should
                  default to the "Application" log */
-       
+
                if ( !strequal( logname, ELOG_APPL ) ) {
-               
+
                        TALLOC_FREE( elog->logname );
-                       
-                       elog->logname = talloc_strdup( elog, ELOG_APPL );                       
+
+                       elog->logname = talloc_strdup( elog, ELOG_APPL );
 
                        /* do the access check */
-                       if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
+                       if ( !elog_check_access( elog, p->server_info->ptok ) ) {
                                TALLOC_FREE( elog );
                                return NT_STATUS_ACCESS_DENIED;
                        }
-       
+
                        become_root();
                        elog->etdb = elog_open_tdb( elog->logname, False );
                        unbecome_root();
-               }       
-               
+               }
+
                if ( !elog->etdb ) {
                        TALLOC_FREE( elog );
-                       return NT_STATUS_ACCESS_DENIED; /* ??? */               
+                       return NT_STATUS_ACCESS_DENIED; /* ??? */
                }
        }
-       
+
        /* now do the access check.  Close the tdb if we fail here */
 
-       if ( !elog_check_access( elog, p->pipe_user.nt_user_token ) ) {
-               elog_close_tdb( elog->etdb, False );
+       if ( !elog_check_access( elog, p->server_info->ptok ) ) {
                TALLOC_FREE( elog );
                return NT_STATUS_ACCESS_DENIED;
        }
-       
+
        /* create the policy handle */
-       
-       if ( !create_policy_hnd
-            ( p, hnd, free_eventlog_info, ( void * ) elog ) ) {
-               free_eventlog_info( elog );
+
+       if ( !create_policy_hnd( p, hnd, elog ) ) {
+               TALLOC_FREE(elog);
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -244,7 +243,7 @@ static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hn
        if ( !get_oldest_entry_hook( elog ) ) {
                DEBUG(3,("elog_open: Successfully opened eventlog but can't "
                        "get any information on internal records!\n"));
-       }       
+       }
 
        elog->current_record = elog->oldest_entry;
 
@@ -277,27 +276,31 @@ static int elog_size( EVENTLOG_INFO *info )
 }
 
 /********************************************************************
-  For the given tdb, get the next eventlog record into the passed 
+  For the given tdb, get the next eventlog record into the passed
   Eventlog_entry.  returns NULL if it can't get the record for some reason.
  ********************************************************************/
 
-Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
-                                    int recno, Eventlog_entry * ee )
+static Eventlog_entry *get_eventlog_record(TALLOC_CTX *mem_ctx,
+                               TDB_CONTEXT *tdb,
+                               int recno)
 {
+       Eventlog_entry *ee = NULL;
        TDB_DATA ret, key;
 
-       int srecno;
-       int reclen;
+       int32_t srecno;
+       int32_t reclen;
        int len;
-       uint8 *rbuff;
 
-       pstring *wpsource, *wpcomputer, *wpsid, *wpstrs, *puserdata;
+       char *wpsource = NULL;
+       char *wpcomputer = NULL;
+       char *wpsid = NULL;
+       char *wpstrs = NULL;
+       char *puserdata = NULL;
 
-       key.dsize = sizeof( int32 );
-       rbuff = NULL;
+       key.dsize = sizeof(int32_t);
 
        srecno = recno;
-       key.dptr = ( char * ) &srecno;
+       key.dptr = (unsigned char *)&srecno;
 
        ret = tdb_fetch( tdb, key );
 
@@ -315,10 +318,11 @@ Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
        if ( !len )
                return NULL;
 
-       /* ee = PRS_ALLOC_MEM(ps, Eventlog_entry, 1); */
-
-       if ( !ee )
+       ee = TALLOC_ARRAY(mem_ctx, Eventlog_entry, 1);
+       if (!ee) {
                return NULL;
+       }
+       ZERO_STRUCTP(ee);
 
        len = tdb_unpack( ret.dptr, ret.dsize, "ddddddwwwwddddddBBdBBBd",
                          &ee->record.length, &ee->record.reserved1,
@@ -346,118 +350,149 @@ Eventlog_entry *get_eventlog_record( prs_struct * ps, TDB_CONTEXT * tdb,
        /* have to do the following because the tdb_unpack allocs a buff, stuffs a pointer to the buff
           into it's 2nd argment for 'B' */
 
-       if ( wpcomputer )
-               memcpy( ee->data_record.computer_name, wpcomputer,
-                       ee->data_record.computer_name_len );
-       if ( wpsource )
-               memcpy( ee->data_record.source_name, wpsource,
-                       ee->data_record.source_name_len );
-
-       if ( wpsid )
-               memcpy( ee->data_record.sid, wpsid,
-                       ee->record.user_sid_length );
-       if ( wpstrs )
-               memcpy( ee->data_record.strings, wpstrs,
-                       ee->data_record.strings_len );
-
-       /* note that userdata is a pstring */
-       if ( puserdata )
-               memcpy( ee->data_record.user_data, puserdata,
-                       ee->data_record.user_data_len );
-
-       SAFE_FREE( wpcomputer );
-       SAFE_FREE( wpsource );
-       SAFE_FREE( wpsid );
-       SAFE_FREE( wpstrs );
-       SAFE_FREE( puserdata );
+       if (wpcomputer) {
+               ee->data_record.computer_name = (smb_ucs2_t *)TALLOC_MEMDUP(
+                       ee, wpcomputer, ee->data_record.computer_name_len);
+               if (!ee->data_record.computer_name) {
+                       TALLOC_FREE(ee);
+                       goto out;
+               }
+       }
+       if (wpsource) {
+               ee->data_record.source_name = (smb_ucs2_t *)TALLOC_MEMDUP(
+                       ee, wpsource, ee->data_record.source_name_len);
+               if (!ee->data_record.source_name) {
+                       TALLOC_FREE(ee);
+                       goto out;
+               }
+       }
+
+       if (wpsid) {
+               ee->data_record.sid = (smb_ucs2_t *)TALLOC_MEMDUP(
+                       ee, wpsid, ee->record.user_sid_length);
+               if (!ee->data_record.sid) {
+                       TALLOC_FREE(ee);
+                       goto out;
+               }
+       }
+       if (wpstrs) {
+               ee->data_record.strings = (smb_ucs2_t *)TALLOC_MEMDUP(
+                       ee, wpstrs, ee->data_record.strings_len);
+               if (!ee->data_record.strings) {
+                       TALLOC_FREE(ee);
+                       goto out;
+               }
+       }
+
+       if (puserdata) {
+               ee->data_record.user_data = (char *)TALLOC_MEMDUP(
+                       ee, puserdata, ee->data_record.user_data_len);
+               if (!ee->data_record.user_data) {
+                       TALLOC_FREE(ee);
+                       goto out;
+               }
+       }
+
+  out:
+
+       SAFE_FREE(wpcomputer);
+       SAFE_FREE(wpsource);
+       SAFE_FREE(wpsid);
+       SAFE_FREE(wpstrs);
+       SAFE_FREE(puserdata);
 
        DEBUG( 10, ( "get_eventlog_record: read back %d\n", len ) );
        DEBUG( 10,
               ( "get_eventlog_record: computer_name %d is ",
                 ee->data_record.computer_name_len ) );
-       SAFE_FREE( ret.dptr );
+       SAFE_FREE(ret.dptr);
        return ee;
 }
 
 /********************************************************************
- note that this can only be called AFTER the table is constructed, 
+ note that this can only be called AFTER the table is constructed,
  since it uses the table to find the tdb handle
  ********************************************************************/
 
-static BOOL sync_eventlog_params( EVENTLOG_INFO *info )
+static bool sync_eventlog_params( EVENTLOG_INFO *info )
 {
-       pstring path;
+       char *path = NULL;
        uint32 uiMaxSize;
        uint32 uiRetention;
-       REGISTRY_KEY *keyinfo;
-       REGISTRY_VALUE *val;
-       REGVAL_CTR *values;
+       struct registry_key *key;
+       struct registry_value *value;
        WERROR wresult;
        char *elogname = info->logname;
+       TALLOC_CTX *ctx = talloc_stackframe();
+       bool ret = false;
 
        DEBUG( 4, ( "sync_eventlog_params with %s\n", elogname ) );
 
        if ( !info->etdb ) {
                DEBUG( 4, ( "No open tdb! (%s)\n", info->logname ) );
-               return False;
+               goto done;
        }
        /* set resonable defaults.  512Kb on size and 1 week on time */
 
        uiMaxSize = 0x80000;
        uiRetention = 604800;
 
-       /* the general idea is to internally open the registry 
-          key and retreive the values.  That way we can continue 
-          to use the same fetch/store api that we use in 
+       /* the general idea is to internally open the registry
+          key and retrieve the values.  That way we can continue
+          to use the same fetch/store api that we use in
           srv_reg_nt.c */
 
-       pstr_sprintf( path, "%s/%s", KEY_EVENTLOG, elogname );
+       path = talloc_asprintf(ctx, "%s/%s", KEY_EVENTLOG, elogname );
+       if (!path) {
+               goto done;
+       }
 
-       wresult =
-               regkey_open_internal( &keyinfo, path, get_root_nt_token(  ),
-                                     REG_KEY_READ );
+       wresult = reg_open_path(ctx, path, REG_KEY_READ, get_root_nt_token(),
+                               &key);
 
        if ( !W_ERROR_IS_OK( wresult ) ) {
                DEBUG( 4,
                       ( "sync_eventlog_params: Failed to open key [%s] (%s)\n",
-                        path, dos_errstr( wresult ) ) );
-               return False;
+                        path, win_errstr( wresult ) ) );
+               goto done;
        }
 
-       if ( !( values = TALLOC_ZERO_P( keyinfo, REGVAL_CTR ) ) ) {
-               TALLOC_FREE( keyinfo );
-               DEBUG( 0, ( "control_eventlog_hook: talloc() failed!\n" ) );
-
-               return False;
+       wresult = reg_queryvalue(key, key, "Retention", &value);
+       if (!W_ERROR_IS_OK(wresult)) {
+               DEBUG(4, ("Failed to query value \"Retention\": %s\n",
+                         win_errstr(wresult)));
+               goto done;
        }
-       fetch_reg_values( keyinfo, values );
+       uiRetention = value->v.dword;
 
-       if ( ( val = regval_ctr_getvalue( values, "Retention" ) ) != NULL )
-               uiRetention = IVAL( regval_data_p( val ), 0 );
-
-       if ( ( val = regval_ctr_getvalue( values, "MaxSize" ) ) != NULL )
-               uiMaxSize = IVAL( regval_data_p( val ), 0 );
-
-       regkey_close_internal( keyinfo );
+       wresult = reg_queryvalue(key, key, "MaxSize", &value);
+       if (!W_ERROR_IS_OK(wresult)) {
+               DEBUG(4, ("Failed to query value \"MaxSize\": %s\n",
+                         win_errstr(wresult)));
+               goto done;
+       }
+       uiMaxSize = value->v.dword;
 
        tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_MAXSIZE, uiMaxSize );
        tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_RETENTION, uiRetention );
 
-       return True;
+       ret = true;
+
+done:
+       TALLOC_FREE(ctx);
+       return ret;
 }
 
 /********************************************************************
  ********************************************************************/
 
-static Eventlog_entry *read_package_entry( prs_struct * ps,
-                                          EVENTLOG_Q_READ_EVENTLOG * q_u,
-                                          EVENTLOG_R_READ_EVENTLOG * r_u,
+static Eventlog_entry *read_package_entry( TALLOC_CTX *mem_ctx,
                                           Eventlog_entry * entry )
 {
        uint8 *offset;
        Eventlog_entry *ee_new = NULL;
 
-       ee_new = PRS_ALLOC_MEM( ps, Eventlog_entry, 1 );
+       ee_new = TALLOC_ZERO_ARRAY(mem_ctx, Eventlog_entry, 1 );
        if ( ee_new == NULL ) {
                return NULL;
        }
@@ -496,10 +531,10 @@ static Eventlog_entry *read_package_entry( prs_struct * ps,
        DEBUG( 10,
               ( "entry->record.length is [%d].\n", entry->record.length ) );
        entry->data =
-               PRS_ALLOC_MEM( ps, uint8,
-                              entry->record.length -
-                              sizeof( Eventlog_record ) -
-                              sizeof( entry->record.length ) );
+               TALLOC_ZERO_ARRAY(mem_ctx, uint8_t,
+                                 entry->record.length -
+                                 sizeof( Eventlog_record ) -
+                                 sizeof( entry->record.length ));
        if ( entry->data == NULL ) {
                return NULL;
        }
@@ -543,15 +578,17 @@ static Eventlog_entry *read_package_entry( prs_struct * ps,
 /********************************************************************
  ********************************************************************/
 
-static BOOL add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
+static bool add_record_to_resp( Eventlog_entry *entry,
+                               uint32_t *num_records,
+                               uint32_t *num_bytes_in_resp,
                                Eventlog_entry * ee_new )
 {
        Eventlog_entry *insert_point;
 
-       insert_point = r_u->entry;
+       insert_point = entry;
 
        if ( NULL == insert_point ) {
-               r_u->entry = ee_new;
+               entry = ee_new;
                ee_new->next = NULL;
        } else {
                while ( ( NULL != insert_point->next ) ) {
@@ -560,50 +597,45 @@ static BOOL add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
                ee_new->next = NULL;
                insert_point->next = ee_new;
        }
-       r_u->num_records++;
-       r_u->num_bytes_in_resp += ee_new->record.length;
+       (*num_records)++;
+       *num_bytes_in_resp += ee_new->record.length;
 
        return True;
 }
 
 /********************************************************************
+ _eventlog_OpenEventLogW
  ********************************************************************/
 
-NTSTATUS _eventlog_open_eventlog( pipes_struct * p,
-                               EVENTLOG_Q_OPEN_EVENTLOG * q_u,
-                               EVENTLOG_R_OPEN_EVENTLOG * r_u )
+NTSTATUS _eventlog_OpenEventLogW(pipes_struct *p,
+                                struct eventlog_OpenEventLogW *r)
 {
-       fstring servername, logname;
+       const char *servername = "";
+       const char *logname = "";
        EVENTLOG_INFO *info;
        NTSTATUS result;
 
-       fstrcpy( servername, "" );
-       if ( q_u->servername.string ) {
-               rpcstr_pull( servername, q_u->servername.string->buffer,
-                            sizeof( servername ),
-                            q_u->servername.string->uni_str_len * 2, 0 );
+       if (r->in.servername->string) {
+               servername = r->in.servername->string;
        }
 
-       fstrcpy( logname, "" );
-       if ( q_u->logname.string ) {
-               rpcstr_pull( logname, q_u->logname.string->buffer,
-                            sizeof( logname ),
-                            q_u->logname.string->uni_str_len * 2, 0 );
+       if (r->in.logname->string) {
+               logname = r->in.logname->string;
        }
-       
+
        DEBUG( 10,("_eventlog_open_eventlog: Server [%s], Log [%s]\n",
                servername, logname ));
-               
+
        /* according to MSDN, if the logfile cannot be found, we should
          default to the "Application" log */
-         
-       if ( !NT_STATUS_IS_OK( result = elog_open( p, logname, &r_u->handle )) )
+
+       if ( !NT_STATUS_IS_OK( result = elog_open( p, logname, r->out.handle )) )
                return result;
 
-       if ( !(info = find_eventlog_info_by_hnd( p, &r_u->handle )) ) {
+       if ( !(info = find_eventlog_info_by_hnd( p, r->out.handle )) ) {
                DEBUG(0,("_eventlog_open_eventlog: eventlog (%s) opened but unable to find handle!\n",
                        logname ));
-               elog_close( p, &r_u->handle );
+               elog_close( p, r->out.handle );
                return NT_STATUS_INVALID_HANDLE;
        }
 
@@ -616,24 +648,35 @@ NTSTATUS _eventlog_open_eventlog( pipes_struct * p,
 }
 
 /********************************************************************
+ _eventlog_ClearEventLogW
  This call still needs some work
  ********************************************************************/
-
-NTSTATUS _eventlog_clear_eventlog( pipes_struct * p,
-                                EVENTLOG_Q_CLEAR_EVENTLOG * q_u,
-                                EVENTLOG_R_CLEAR_EVENTLOG * r_u )
+/** The windows client seems to be doing something funny with the file name
+   A call like
+      ClearEventLog(handle, "backup_file")
+   on the client side will result in the backup file name looking like this on the
+   server side:
+      \??\${CWD of client}\backup_file
+   If an absolute path gets specified, such as
+      ClearEventLog(handle, "C:\\temp\\backup_file")
+   then it is still mangled by the client into this:
+      \??\C:\temp\backup_file
+   when it is on the wire.
+   I'm not sure where the \?? is coming from, or why the ${CWD} of the client process
+   would be added in given that the backup file gets written on the server side. */
+
+NTSTATUS _eventlog_ClearEventLogW(pipes_struct *p,
+                                 struct eventlog_ClearEventLogW *r)
 {
-       EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
-       pstring backup_file_name;
+       EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
+       const char *backup_file_name = NULL;
 
        if ( !info )
                return NT_STATUS_INVALID_HANDLE;
 
-       pstrcpy( backup_file_name, "" );
-       if ( q_u->backupfile.string ) {
-               rpcstr_pull( backup_file_name, q_u->backupfile.string->buffer,
-                            sizeof( backup_file_name ),
-                            q_u->backupfile.string->uni_str_len * 2, 0 );
+       if (r->in.backupfile && r->in.backupfile->string) {
+
+               backup_file_name = r->in.backupfile->string;
 
                DEBUG(8,( "_eventlog_clear_eventlog: Using [%s] as the backup "
                        "file name for log [%s].",
@@ -647,7 +690,7 @@ NTSTATUS _eventlog_clear_eventlog( pipes_struct * p,
 
        /* Force a close and reopen */
 
-       elog_close_tdb( info->etdb, True ); 
+       elog_close_tdb( info->etdb, True );
        become_root();
        info->etdb = elog_open_tdb( info->logname, True );
        unbecome_root();
@@ -659,13 +702,13 @@ NTSTATUS _eventlog_clear_eventlog( pipes_struct * p,
 }
 
 /********************************************************************
+ _eventlog_CloseEventLog
  ********************************************************************/
 
-NTSTATUS _eventlog_close_eventlog( pipes_struct * p,
-                                EVENTLOG_Q_CLOSE_EVENTLOG * q_u,
-                                EVENTLOG_R_CLOSE_EVENTLOG * r_u )
+NTSTATUS _eventlog_CloseEventLog(pipes_struct * p,
+                                struct eventlog_CloseEventLog *r)
 {
-       return elog_close( p, &q_u->handle );
+       return elog_close( p, r->in.handle );
 }
 
 /********************************************************************
@@ -676,20 +719,23 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
                                EVENTLOG_R_READ_EVENTLOG * r_u )
 {
        EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
-       Eventlog_entry entry, *ee_new;
+       Eventlog_entry *entry = NULL, *ee_new = NULL;
        uint32 num_records_read = 0;
-       prs_struct *ps;
        int bytes_left, record_number;
        uint32 elog_read_type, elog_read_dir;
 
+       if (info == NULL) {
+               return NT_STATUS_INVALID_HANDLE;
+       }
+
        info->flags = q_u->flags;
        ps = &p->out_data.rdata;
 
        bytes_left = q_u->max_read_size;
 
-       if ( !info->etdb ) 
+       if ( !info->etdb )
                return NT_STATUS_ACCESS_DENIED;
-               
+
        /* check for valid flags.  Can't use the sequential and seek flags together */
 
        elog_read_type = q_u->flags & (EVENTLOG_SEQUENTIAL_READ|EVENTLOG_SEEK_READ);
@@ -706,37 +752,42 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
 
        if ( elog_read_type & EVENTLOG_SEQUENTIAL_READ )
                record_number = info->current_record;
-       else 
+       else
                record_number = q_u->offset;
 
        while ( bytes_left > 0 ) {
 
                /* assume that when the record fetch fails, that we are done */
 
-               if ( !get_eventlog_record ( ps, ELOG_TDB_CTX(info->etdb), record_number, &entry ) ) 
+               entry = get_eventlog_record (p->mem_ctx, ELOG_TDB_CTX(info->etdb), record_number);
+               if (!entry) {
                        break;
+               }
 
                DEBUG( 8, ( "Retrieved record %d\n", record_number ) );
-                              
+
                /* Now see if there is enough room to add */
 
-               if ( !(ee_new = read_package_entry( ps, q_u, r_u,&entry )) )
+               if ( !(ee_new = read_package_entry( p->mem_ctx, entry )) )
                        return NT_STATUS_NO_MEMORY;
 
                if ( r_u->num_bytes_in_resp + ee_new->record.length > q_u->max_read_size ) {
                        r_u->bytes_in_next_record = ee_new->record.length;
 
                        /* response would be too big to fit in client-size buffer */
-                               
+
                        bytes_left = 0;
                        break;
                }
-                       
-               add_record_to_resp( r_u, ee_new );
+
+               add_record_to_resp( r_u->entry,
+                                   &r_u->num_records, &r_u->num_bytes_in_resp,
+                                   ee_new );
+
                bytes_left -= ee_new->record.length;
-               ZERO_STRUCT( entry );
+               TALLOC_FREE(entry);
                num_records_read = r_u->num_records - num_records_read;
-                               
+
                DEBUG( 10, ( "_eventlog_read_eventlog: read [%d] records for a total "
                        "of [%d] records using [%d] bytes out of a max of [%d].\n",
                         num_records_read, r_u->num_records,
@@ -747,48 +798,171 @@ NTSTATUS _eventlog_read_eventlog( pipes_struct * p,
                        record_number++;
                else
                        record_number--;
-               
+
                /* update the eventlog record pointer */
-               
+
                info->current_record = record_number;
        }
 
-       /* crazy by WinXP uses NT_STATUS_BUFFER_TOO_SMALL to 
+       /* crazy by WinXP uses NT_STATUS_BUFFER_TOO_SMALL to
           say when there are no more records */
 
        return (num_records_read ? NT_STATUS_OK : NT_STATUS_BUFFER_TOO_SMALL);
 }
 
 /********************************************************************
+ _eventlog_GetOldestRecord
  ********************************************************************/
 
-NTSTATUS _eventlog_get_oldest_entry( pipes_struct * p,
-                                  EVENTLOG_Q_GET_OLDEST_ENTRY * q_u,
-                                  EVENTLOG_R_GET_OLDEST_ENTRY * r_u )
+NTSTATUS _eventlog_GetOldestRecord(pipes_struct *p,
+                                  struct eventlog_GetOldestRecord *r)
 {
-       EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
+       EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
+
+       if (info == NULL) {
+               return NT_STATUS_INVALID_HANDLE;
+       }
 
        if ( !( get_oldest_entry_hook( info ) ) )
                return NT_STATUS_ACCESS_DENIED;
 
-       r_u->oldest_entry = info->oldest_entry;
+       *r->out.oldest_entry = info->oldest_entry;
 
        return NT_STATUS_OK;
 }
 
 /********************************************************************
+_eventlog_GetNumRecords
  ********************************************************************/
 
-NTSTATUS _eventlog_get_num_records( pipes_struct * p,
-                                 EVENTLOG_Q_GET_NUM_RECORDS * q_u,
-                                 EVENTLOG_R_GET_NUM_RECORDS * r_u )
+NTSTATUS _eventlog_GetNumRecords(pipes_struct *p,
+                                struct eventlog_GetNumRecords *r)
 {
-       EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, &q_u->handle );
+       EVENTLOG_INFO *info = find_eventlog_info_by_hnd( p, r->in.handle );
+
+       if (info == NULL) {
+               return NT_STATUS_INVALID_HANDLE;
+       }
 
        if ( !( get_num_records_hook( info ) ) )
                return NT_STATUS_ACCESS_DENIED;
 
-       r_u->num_records = info->num_records;
+       *r->out.number = info->num_records;
 
        return NT_STATUS_OK;
 }
+
+NTSTATUS _eventlog_BackupEventLogW(pipes_struct *p, struct eventlog_BackupEventLogW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_DeregisterEventSource(pipes_struct *p, struct eventlog_DeregisterEventSource *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ChangeNotify(pipes_struct *p, struct eventlog_ChangeNotify *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_RegisterEventSourceW(pipes_struct *p, struct eventlog_RegisterEventSourceW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_OpenBackupEventLogW(pipes_struct *p, struct eventlog_OpenBackupEventLogW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ReadEventLogW(pipes_struct *p, struct eventlog_ReadEventLogW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ReportEventW(pipes_struct *p, struct eventlog_ReportEventW *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ClearEventLogA(pipes_struct *p, struct eventlog_ClearEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_BackupEventLogA(pipes_struct *p, struct eventlog_BackupEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_OpenEventLogA(pipes_struct *p, struct eventlog_OpenEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_RegisterEventSourceA(pipes_struct *p, struct eventlog_RegisterEventSourceA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_OpenBackupEventLogA(pipes_struct *p, struct eventlog_OpenBackupEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ReadEventLogA(pipes_struct *p, struct eventlog_ReadEventLogA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_ReportEventA(pipes_struct *p, struct eventlog_ReportEventA *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_RegisterClusterSvc(pipes_struct *p, struct eventlog_RegisterClusterSvc *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_DeregisterClusterSvc(pipes_struct *p, struct eventlog_DeregisterClusterSvc *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_WriteClusterEvents(pipes_struct *p, struct eventlog_WriteClusterEvents *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_GetLogIntormation(pipes_struct *p, struct eventlog_GetLogIntormation *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+NTSTATUS _eventlog_FlushEventLog(pipes_struct *p, struct eventlog_FlushEventLog *r)
+{
+       p->rng_fault_state = True;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+