*/
#include "includes.h"
+#include "../librpc/gen_ndr/srv_eventlog.h"
+#include "lib/eventlog/eventlog.h"
+#include "registry.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_RPC_SRV
********************************************************************/
static EVENTLOG_INFO *find_eventlog_info_by_hnd( pipes_struct * p,
- POLICY_HND * handle )
+ struct policy_handle * handle )
{
EVENTLOG_INFO *info;
static bool elog_check_access( EVENTLOG_INFO *info, NT_USER_TOKEN *token )
{
char *tdbname = elog_tdbname(talloc_tos(), info->logname );
- SEC_DESC *sec_desc;
+ struct security_descriptor *sec_desc;
+ struct security_ace *ace;
NTSTATUS status;
if ( !tdbname )
return False;
}
+ ace = talloc_zero(sec_desc, struct security_ace);
+ if (ace == NULL) {
+ TALLOC_FREE(sec_desc);
+ return false;
+ }
+
+ ace->type = SEC_ACE_TYPE_ACCESS_ALLOWED;
+ ace->flags = 0;
+ ace->access_mask = REG_KEY_ALL;
+ ace->trustee = global_sid_System;
+
+ status = security_descriptor_dacl_add(sec_desc, ace);
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(sec_desc);
+ return false;
+ }
+
/* root free pass */
if ( geteuid() == sec_initial_uid() ) {
- DEBUG(5,("elog_check_access: using root's token\n"));
- token = get_root_nt_token();
+ DEBUG(5,("elog_check_access: running as root, using system token\n"));
+ token = get_system_token();
}
/* run the check, try for the max allowed */
status = se_access_check( sec_desc, token, MAXIMUM_ALLOWED_ACCESS,
&info->access_granted);
- if ( sec_desc )
- TALLOC_FREE( sec_desc );
+ TALLOC_FREE(sec_desc);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(8,("elog_check_access: se_access_check() return %s\n",
/* we have to have READ permission for a successful open */
- return ( info->access_granted & SA_RIGHT_FILE_READ_DATA );
+ return ( info->access_granted & SEC_FILE_READ_DATA );
}
/********************************************************************
/********************************************************************
********************************************************************/
-static NTSTATUS elog_open( pipes_struct * p, const char *logname, POLICY_HND *hnd )
+static NTSTATUS elog_open( pipes_struct * p, const char *logname, struct policy_handle *hnd )
{
EVENTLOG_INFO *elog;
/********************************************************************
********************************************************************/
-static NTSTATUS elog_close( pipes_struct *p, POLICY_HND *hnd )
+static NTSTATUS elog_close( pipes_struct *p, struct policy_handle *hnd )
{
if ( !( close_policy_hnd( p, hnd ) ) ) {
return NT_STATUS_INVALID_HANDLE;
return elog_tdb_size( ELOG_TDB_CTX(info->etdb), NULL, NULL );
}
-/********************************************************************
- For the given tdb, get the next eventlog record into the passed
- Eventlog_entry. returns NULL if it can't get the record for some reason.
- ********************************************************************/
-
-static Eventlog_entry *get_eventlog_record(TALLOC_CTX *mem_ctx,
- TDB_CONTEXT *tdb,
- int recno)
-{
- Eventlog_entry *ee = NULL;
- TDB_DATA ret, key;
-
- int32_t srecno;
- int32_t reclen;
- int len;
-
- char *wpsource = NULL;
- char *wpcomputer = NULL;
- char *wpsid = NULL;
- char *wpstrs = NULL;
- char *puserdata = NULL;
-
- key.dsize = sizeof(int32_t);
-
- srecno = recno;
- key.dptr = (unsigned char *)&srecno;
-
- ret = tdb_fetch( tdb, key );
-
- if ( ret.dsize == 0 ) {
- DEBUG( 8,
- ( "Can't find a record for the key, record %d\n",
- recno ) );
- return NULL;
- }
-
- len = tdb_unpack( ret.dptr, ret.dsize, "d", &reclen );
-
- DEBUG( 10, ( "Unpacking record %d, size is %d\n", srecno, len ) );
-
- if ( !len )
- return NULL;
-
- ee = TALLOC_ARRAY(mem_ctx, Eventlog_entry, 1);
- if (!ee) {
- return NULL;
- }
- ZERO_STRUCTP(ee);
-
- len = tdb_unpack( ret.dptr, ret.dsize, "ddddddwwwwddddddBBdBBBd",
- &ee->record.length, &ee->record.reserved1,
- &ee->record.record_number,
- &ee->record.time_generated,
- &ee->record.time_written, &ee->record.event_id,
- &ee->record.event_type, &ee->record.num_strings,
- &ee->record.event_category, &ee->record.reserved2,
- &ee->record.closing_record_number,
- &ee->record.string_offset,
- &ee->record.user_sid_length,
- &ee->record.user_sid_offset,
- &ee->record.data_length, &ee->record.data_offset,
- &ee->data_record.source_name_len, &wpsource,
- &ee->data_record.computer_name_len, &wpcomputer,
- &ee->data_record.sid_padding,
- &ee->record.user_sid_length, &wpsid,
- &ee->data_record.strings_len, &wpstrs,
- &ee->data_record.user_data_len, &puserdata,
- &ee->data_record.data_padding );
- DEBUG( 10,
- ( "Read record %d, len in tdb was %d\n",
- ee->record.record_number, len ) );
-
- /* have to do the following because the tdb_unpack allocs a buff, stuffs a pointer to the buff
- into it's 2nd argment for 'B' */
-
- if (wpcomputer) {
- ee->data_record.computer_name = (smb_ucs2_t *)TALLOC_MEMDUP(
- ee, wpcomputer, ee->data_record.computer_name_len);
- if (!ee->data_record.computer_name) {
- TALLOC_FREE(ee);
- goto out;
- }
- }
- if (wpsource) {
- ee->data_record.source_name = (smb_ucs2_t *)TALLOC_MEMDUP(
- ee, wpsource, ee->data_record.source_name_len);
- if (!ee->data_record.source_name) {
- TALLOC_FREE(ee);
- goto out;
- }
- }
-
- if (wpsid) {
- ee->data_record.sid = (smb_ucs2_t *)TALLOC_MEMDUP(
- ee, wpsid, ee->record.user_sid_length);
- if (!ee->data_record.sid) {
- TALLOC_FREE(ee);
- goto out;
- }
- }
- if (wpstrs) {
- ee->data_record.strings = (smb_ucs2_t *)TALLOC_MEMDUP(
- ee, wpstrs, ee->data_record.strings_len);
- if (!ee->data_record.strings) {
- TALLOC_FREE(ee);
- goto out;
- }
- }
-
- if (puserdata) {
- ee->data_record.user_data = (char *)TALLOC_MEMDUP(
- ee, puserdata, ee->data_record.user_data_len);
- if (!ee->data_record.user_data) {
- TALLOC_FREE(ee);
- goto out;
- }
- }
-
- out:
-
- SAFE_FREE(wpcomputer);
- SAFE_FREE(wpsource);
- SAFE_FREE(wpsid);
- SAFE_FREE(wpstrs);
- SAFE_FREE(puserdata);
-
- DEBUG( 10, ( "get_eventlog_record: read back %d\n", len ) );
- DEBUG( 10,
- ( "get_eventlog_record: computer_name %d is ",
- ee->data_record.computer_name_len ) );
- SAFE_FREE(ret.dptr);
- return ee;
-}
-
/********************************************************************
note that this can only be called AFTER the table is constructed,
since it uses the table to find the tdb handle
static bool sync_eventlog_params( EVENTLOG_INFO *info )
{
char *path = NULL;
- uint32 uiMaxSize;
- uint32 uiRetention;
+ uint32_t uiMaxSize = 0;
+ uint32_t uiRetention = 0;
struct registry_key *key;
struct registry_value *value;
WERROR wresult;
to use the same fetch/store api that we use in
srv_reg_nt.c */
- path = talloc_asprintf(ctx, "%s/%s", KEY_EVENTLOG, elogname );
+ path = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, elogname);
if (!path) {
goto done;
}
- wresult = reg_open_path(ctx, path, REG_KEY_READ, get_root_nt_token(),
+ wresult = reg_open_path(ctx, path, REG_KEY_READ, get_system_token(),
&key);
if ( !W_ERROR_IS_OK( wresult ) ) {
win_errstr(wresult)));
goto done;
}
- uiRetention = value->v.dword;
+
+ if (value->data.length >= 4) {
+ uiRetention = IVAL(value->data.data, 0);
+ }
wresult = reg_queryvalue(key, key, "MaxSize", &value);
if (!W_ERROR_IS_OK(wresult)) {
win_errstr(wresult)));
goto done;
}
- uiMaxSize = value->v.dword;
+ if (value->data.length >= 4) {
+ uiMaxSize = IVAL(value->data.data, 0);
+ }
tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_MAXSIZE, uiMaxSize );
tdb_store_int32( ELOG_TDB_CTX(info->etdb), EVT_RETENTION, uiRetention );
return ret;
}
-/********************************************************************
- ********************************************************************/
-
-static Eventlog_entry *read_package_entry( TALLOC_CTX *mem_ctx,
- Eventlog_entry * entry )
-{
- uint8 *offset;
- Eventlog_entry *ee_new = NULL;
-
- ee_new = TALLOC_ZERO_ARRAY(mem_ctx, Eventlog_entry, 1 );
- if ( ee_new == NULL ) {
- return NULL;
- }
-
- entry->data_record.sid_padding =
- ( ( 4 -
- ( ( entry->data_record.source_name_len +
- entry->data_record.computer_name_len ) % 4 ) ) % 4 );
- entry->data_record.data_padding =
- ( 4 -
- ( ( entry->data_record.strings_len +
- entry->data_record.user_data_len ) % 4 ) ) % 4;
- entry->record.length = sizeof( Eventlog_record );
- entry->record.length += entry->data_record.source_name_len;
- entry->record.length += entry->data_record.computer_name_len;
- if ( entry->record.user_sid_length == 0 ) {
- /* Should not pad to a DWORD boundary for writing out the sid if there is
- no SID, so just propagate the padding to pad the data */
- entry->data_record.data_padding +=
- entry->data_record.sid_padding;
- entry->data_record.sid_padding = 0;
- }
- DEBUG( 10,
- ( "sid_padding is [%d].\n", entry->data_record.sid_padding ) );
- DEBUG( 10,
- ( "data_padding is [%d].\n",
- entry->data_record.data_padding ) );
-
- entry->record.length += entry->data_record.sid_padding;
- entry->record.length += entry->record.user_sid_length;
- entry->record.length += entry->data_record.strings_len;
- entry->record.length += entry->data_record.user_data_len;
- entry->record.length += entry->data_record.data_padding;
- /* need another copy of length at the end of the data */
- entry->record.length += sizeof( entry->record.length );
- DEBUG( 10,
- ( "entry->record.length is [%d].\n", entry->record.length ) );
- entry->data =
- TALLOC_ZERO_ARRAY(mem_ctx, uint8_t,
- entry->record.length -
- sizeof( Eventlog_record ) -
- sizeof( entry->record.length ));
- if ( entry->data == NULL ) {
- return NULL;
- }
- offset = entry->data;
- memcpy( offset, entry->data_record.source_name,
- entry->data_record.source_name_len );
- offset += entry->data_record.source_name_len;
- memcpy( offset, entry->data_record.computer_name,
- entry->data_record.computer_name_len );
- offset += entry->data_record.computer_name_len;
- /* SID needs to be DWORD-aligned */
- offset += entry->data_record.sid_padding;
- entry->record.user_sid_offset =
- sizeof( Eventlog_record ) + ( offset - entry->data );
- memcpy( offset, entry->data_record.sid,
- entry->record.user_sid_length );
- offset += entry->record.user_sid_length;
- /* Now do the strings */
- entry->record.string_offset =
- sizeof( Eventlog_record ) + ( offset - entry->data );
- memcpy( offset, entry->data_record.strings,
- entry->data_record.strings_len );
- offset += entry->data_record.strings_len;
- /* Now do the data */
- entry->record.data_length = entry->data_record.user_data_len;
- entry->record.data_offset =
- sizeof( Eventlog_record ) + ( offset - entry->data );
- memcpy( offset, entry->data_record.user_data,
- entry->data_record.user_data_len );
- offset += entry->data_record.user_data_len;
-
- memcpy( &( ee_new->record ), &entry->record,
- sizeof( Eventlog_record ) );
- memcpy( &( ee_new->data_record ), &entry->data_record,
- sizeof( Eventlog_data_record ) );
- ee_new->data = entry->data;
-
- return ee_new;
-}
-
-/********************************************************************
- ********************************************************************/
-
-static bool add_record_to_resp( EVENTLOG_R_READ_EVENTLOG * r_u,
- Eventlog_entry * ee_new )
-{
- Eventlog_entry *insert_point;
-
- insert_point = r_u->entry;
-
- if ( NULL == insert_point ) {
- r_u->entry = ee_new;
- ee_new->next = NULL;
- } else {
- while ( ( NULL != insert_point->next ) ) {
- insert_point = insert_point->next;
- }
- ee_new->next = NULL;
- insert_point->next = ee_new;
- }
- r_u->num_records++;
- r_u->num_bytes_in_resp += ee_new->record.length;
-
- return True;
-}
-
/********************************************************************
_eventlog_OpenEventLogW
********************************************************************/
DEBUG(10,("_eventlog_OpenEventLogW: Size [%d]\n", elog_size( info )));
- sync_eventlog_params( info );
+ if (!sync_eventlog_params(info)) {
+ elog_close(p, r->out.handle);
+ return NT_STATUS_EVENTLOG_FILE_CORRUPT;
+ }
prune_eventlog( ELOG_TDB_CTX(info->etdb) );
return NT_STATUS_OK;
/* check for WRITE access to the file */
- if ( !(info->access_granted&SA_RIGHT_FILE_WRITE_DATA) )
+ if ( !(info->access_granted & SEC_FILE_WRITE_DATA) )
return NT_STATUS_ACCESS_DENIED;
/* Force a close and reopen */
break;
}
- ndr_err = ndr_push_struct_blob(&blob, p->mem_ctx, NULL, e,
+ ndr_err = ndr_push_struct_blob(&blob, p->mem_ctx, e,
(ndr_push_flags_fn_t)ndr_push_EVENTLOGRECORD);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ndr_map_error2ntstatus(ndr_err);
return NT_STATUS_NOT_IMPLEMENTED;
}
+/********************************************************************
+_eventlog_GetLogInformation
+ ********************************************************************/
+
+NTSTATUS _eventlog_GetLogInformation(pipes_struct *p,
+ struct eventlog_GetLogInformation *r)
+{
+ EVENTLOG_INFO *info = find_eventlog_info_by_hnd(p, r->in.handle);
+ struct EVENTLOG_FULL_INFORMATION f;
+ enum ndr_err_code ndr_err;
+ DATA_BLOB blob;
+
+ if (!info) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ if (r->in.level != 0) {
+ return NT_STATUS_INVALID_LEVEL;
+ }
+
+ *r->out.bytes_needed = 4;
+
+ if (r->in.buf_size < 4) {
+ return NT_STATUS_BUFFER_TOO_SMALL;
+ }
+
+ /* FIXME: this should be retrieved from the handle */
+ f.full = false;
+
+ ndr_err = ndr_push_struct_blob(&blob, p->mem_ctx, &f,
+ (ndr_push_flags_fn_t)ndr_push_EVENTLOG_FULL_INFORMATION);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return ndr_map_error2ntstatus(ndr_err);
+ }
+
+ if (DEBUGLEVEL >= 10) {
+ NDR_PRINT_DEBUG(EVENTLOG_FULL_INFORMATION, &f);
+ }
+
+ memcpy(r->out.buffer, blob.data, 4);
+
+ return NT_STATUS_OK;
+}
+
+/********************************************************************
+_eventlog_FlushEventLog
+ ********************************************************************/
+
+NTSTATUS _eventlog_FlushEventLog(pipes_struct *p,
+ struct eventlog_FlushEventLog *r)
+{
+ EVENTLOG_INFO *info = find_eventlog_info_by_hnd(p, r->in.handle);
+ if (!info) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ return NT_STATUS_ACCESS_DENIED;
+}
+
+/********************************************************************
+ ********************************************************************/
+
+static NTSTATUS evlog_report_to_record(TALLOC_CTX *mem_ctx,
+ const struct eventlog_ReportEventW *r,
+ const char *logname,
+ struct EVENTLOGRECORD *e)
+{
+ uint32_t i;
+ ZERO_STRUCTP(e);
+
+ e->TimeGenerated = r->in.timestamp;
+ e->TimeWritten = time(NULL);
+ e->EventID = r->in.event_id;
+ e->EventType = r->in.event_type;
+ e->NumStrings = r->in.num_of_strings;
+ e->EventCategory = r->in.event_category;
+ e->ReservedFlags = r->in.flags;
+ e->DataLength = r->in.data_size;
+ e->SourceName = talloc_strdup(mem_ctx, logname);
+ NT_STATUS_HAVE_NO_MEMORY(e->SourceName);
+ if (r->in.servername->string) {
+ e->Computername = r->in.servername->string;
+ } else {
+ e->Computername = talloc_strdup(mem_ctx, "");
+ NT_STATUS_HAVE_NO_MEMORY(e->Computername);
+ }
+ if (r->in.user_sid) {
+ e->UserSid = *r->in.user_sid;
+ }
+ e->Strings = talloc_array(mem_ctx, const char *, e->NumStrings);
+ NT_STATUS_HAVE_NO_MEMORY(e->Strings);
+
+ for (i=0; i < e->NumStrings; i++) {
+ e->Strings[i] = talloc_strdup(e->Strings,
+ r->in.strings[i]->string);
+ NT_STATUS_HAVE_NO_MEMORY(e->Strings[i]);
+ }
+ e->Data = r->in.data;
+
+ return NT_STATUS_OK;
+}
+
+/********************************************************************
+_eventlog_ReportEventW
+ ********************************************************************/
+
+NTSTATUS _eventlog_ReportEventW(pipes_struct *p,
+ struct eventlog_ReportEventW *r)
+{
+ NTSTATUS status;
+ struct EVENTLOGRECORD record;
+
+ EVENTLOG_INFO *info = find_eventlog_info_by_hnd(p, r->in.handle);
+ if (!info) {
+ return NT_STATUS_INVALID_HANDLE;
+ }
+
+ status = evlog_report_to_record(p->mem_ctx, r, info->logname, &record);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = evlog_push_record(p->mem_ctx,
+ ELOG_TDB_CTX(info->etdb),
+ &record,
+ r->out.record_number);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/********************************************************************
+ ********************************************************************/
+
NTSTATUS _eventlog_DeregisterEventSource(pipes_struct *p, struct eventlog_DeregisterEventSource *r)
{
p->rng_fault_state = True;
return NT_STATUS_NOT_IMPLEMENTED;
}
-NTSTATUS _eventlog_ReportEventW(pipes_struct *p, struct eventlog_ReportEventW *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
NTSTATUS _eventlog_ClearEventLogA(pipes_struct *p, struct eventlog_ClearEventLogA *r)
{
p->rng_fault_state = True;
return NT_STATUS_NOT_IMPLEMENTED;
}
-NTSTATUS _eventlog_GetLogIntormation(pipes_struct *p, struct eventlog_GetLogIntormation *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-NTSTATUS _eventlog_FlushEventLog(pipes_struct *p, struct eventlog_FlushEventLog *r)
-{
- p->rng_fault_state = True;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
NTSTATUS _eventlog_ReportEventAndSourceW(pipes_struct *p, struct eventlog_ReportEventAndSourceW *r)
{
p->rng_fault_state = True;
git.samba.org / nivanova / samba-autobuild / .git / blobdiff