diff options
Diffstat (limited to 'source3/rpc_parse/parse_eventlog.c')
-rw-r--r-- | source3/rpc_parse/parse_eventlog.c | 457 |
1 files changed, 457 insertions, 0 deletions
diff --git a/source3/rpc_parse/parse_eventlog.c b/source3/rpc_parse/parse_eventlog.c new file mode 100644 index 0000000000..9bb0a13169 --- /dev/null +++ b/source3/rpc_parse/parse_eventlog.c @@ -0,0 +1,457 @@ +/* + * Unix SMB/CIFS implementation. + * RPC Pipe client / server routines + * Copyright (C) Marcin Krzysztof Porwit 2005. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_RPC_PARSE + +/* + * called from eventlog_q_open_eventlog (srv_eventlog.c) + */ + +BOOL eventlog_io_q_open_eventlog(const char *desc, EVENTLOG_Q_OPEN_EVENTLOG *q_u, + prs_struct *ps, int depth) +{ + if(q_u == NULL) + return False; + + /* Data format seems to be: + UNKNOWN structure + uint32 unknown + uint16 unknown + uint16 unknown + Eventlog name + uint16 eventlog name length + uint16 eventlog name size + Character Array + uint32 unknown + uint32 max count + uint32 offset + uint32 actual count + UNISTR2 log file name + Server Name + uint16 server name length + uint16 server name size + Character Array + UNISTR2 server name + */ + + prs_debug(ps, depth, desc, "eventlog_io_q_open_eventlog"); + depth++; + + if(!prs_align(ps)) + return False; + + /* Munch unknown bits */ + + if(!prs_uint32("", ps, depth, &q_u->unknown1)) + return False; + if(!prs_uint16("", ps, depth, &q_u->unknown2)) + return False; + if(!prs_uint16("", ps, depth, &q_u->unknown3)) + return False; + if(!prs_align(ps)) + return False; + + /* Get name of log source */ + + if(!prs_uint16("sourcename_length", ps, depth, &q_u->sourcename_length)) + return False; + if(!prs_uint16("sourcename_size", ps, depth, &q_u->sourcename_size)) + return False; + if(!prs_uint32("sourcename_ptr", ps, depth, &q_u->sourcename_ptr)) + return False; + if(!smb_io_unistr2("", &q_u->sourcename, q_u->sourcename_ptr, ps, depth)) + return False; + if(!prs_align(ps)) + return False; + + /* Get server name */ + + if(!prs_uint32("servername_ptr", ps, depth, &q_u->servername_ptr)) + return False; + if(!smb_io_unistr2("", &q_u->servername, q_u->servername_ptr, ps, depth)) + return False; + + return True; +} + +BOOL eventlog_io_r_open_eventlog(const char *desc, EVENTLOG_R_OPEN_EVENTLOG *r_u, + prs_struct *ps, int depth) +{ + if(r_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_r_open_eventlog"); + depth++; + + if(!prs_align(ps)) + return False; + + if(!(smb_io_pol_hnd("log handle", &(r_u->handle), ps, depth))) + return False; + + if(!(prs_werror("status code", ps, depth, &(r_u->status)))) + return False; + + return True; +} + +BOOL eventlog_io_q_get_num_records(const char *desc, EVENTLOG_Q_GET_NUM_RECORDS *q_u, + prs_struct *ps, int depth) +{ + if(q_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_q_get_num_records"); + depth++; + + if(!(prs_align(ps))) + return False; + + if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth))) + return False; + + return True; +} + +BOOL eventlog_io_r_get_num_records(const char *desc, EVENTLOG_R_GET_NUM_RECORDS *r_u, + prs_struct *ps, int depth) +{ + if(r_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_r_get_num_records"); + depth++; + + if(!(prs_align(ps))) + return False; + + if(!(prs_uint32("num records", ps, depth, &(r_u->num_records)))) + return False; + + if(!(prs_werror("status code", ps, depth, &(r_u->status)))) + return False; + + return True; +} + +BOOL eventlog_io_q_get_oldest_entry(const char *desc, EVENTLOG_Q_GET_OLDEST_ENTRY *q_u, + prs_struct *ps, int depth) +{ + if(q_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_q_get_oldest_entry"); + depth++; + + if(!(prs_align(ps))) + return False; + + if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth))) + return False; + + return True; +} + +BOOL eventlog_io_r_get_oldest_entry(const char *desc, EVENTLOG_R_GET_OLDEST_ENTRY *r_u, + prs_struct *ps, int depth) +{ + if(r_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_r_get_oldest_entry"); + depth++; + + if(!(prs_align(ps))) + return False; + + if(!(prs_uint32("oldest entry", ps, depth, &(r_u->oldest_entry)))) + return False; + + if(!(prs_werror("status code", ps, depth, &(r_u->status)))) + return False; + + return True; +} + +BOOL eventlog_io_q_close_eventlog(const char *desc, EVENTLOG_Q_CLOSE_EVENTLOG *q_u, + prs_struct *ps, int depth) +{ + if(q_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_q_close_eventlog"); + depth++; + + if(!(prs_align(ps))) + return False; + + if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth))) + return False; + + return True; +} + +BOOL eventlog_io_r_close_eventlog(const char *desc, EVENTLOG_R_CLOSE_EVENTLOG *r_u, + prs_struct *ps, int depth) +{ + if(r_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_r_close_eventlog"); + depth++; + + if(!(prs_align(ps))) + return False; + + if(!(smb_io_pol_hnd("log handle", &(r_u->handle), ps, depth))) + return False; + + if(!(prs_werror("status code", ps, depth, &(r_u->status)))) + return False; + + return True; +} + +BOOL eventlog_io_q_read_eventlog(const char *desc, EVENTLOG_Q_READ_EVENTLOG *q_u, + prs_struct *ps, int depth) +{ + if(q_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_q_read_eventlog"); + depth++; + + if(!(prs_align(ps))) + return False; + + if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth))) + return False; + + if(!(prs_uint32("read flags", ps, depth, &(q_u->flags)))) + return False; + + if(!(prs_uint32("read offset", ps, depth, &(q_u->offset)))) + return False; + + if(!(prs_uint32("read buf size", ps, depth, &(q_u->max_read_size)))) + return False; + + return True; +} +/* Structure of response seems to be: + DWORD num_bytes_in_resp -- MUST be the same as q_u->max_read_size + for i=0..n + EVENTLOGRECORD record + DWORD sent_size -- sum of EVENTLOGRECORD lengths if records returned, 0 otherwise + DWORD real_size -- 0 if records returned, otherwise length of next record to be returned + WERROR status */ +BOOL eventlog_io_r_read_eventlog(const char *desc, + EVENTLOG_Q_READ_EVENTLOG *q_u, + EVENTLOG_R_READ_EVENTLOG *r_u, + prs_struct *ps, + int depth) +{ + Eventlog_entry *entry; + uint32 record_written = 0; + uint32 record_total = 0; + + if(r_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_r_read_eventlog"); + depth++; + + /* First, see if we've read more logs than we can output */ + + if(r_u->num_bytes_in_resp > q_u->max_read_size) { + entry = r_u->entry; + + /* remove the size of the last entry from the list */ + + while(entry->next != NULL) + entry = entry->next; + + r_u->num_bytes_in_resp -= entry->record.length; + + /* do not output the last log entry */ + + r_u->num_records--; + } + + entry = r_u->entry; + record_total = r_u->num_records; + + if(r_u->num_bytes_in_resp != 0) + r_u->sent_size = r_u->num_bytes_in_resp; + else + r_u->real_size = entry->record.length; + + if(!(prs_align(ps))) + return False; + if(!(prs_uint32("bytes in resp", ps, depth, &(q_u->max_read_size)))) + return False; + + while(entry != NULL && record_written < record_total) + { + DEBUG(10, ("eventlog_io_r_read_eventlog: writing record [%d] out of [%d].\n", record_written, record_total)); + + /* Encode the actual eventlog record record */ + + if(!(prs_uint32("length", ps, depth, &(entry->record.length)))) + return False; + if(!(prs_uint32("reserved", ps, depth, &(entry->record.reserved1)))) + return False; + if(!(prs_uint32("record number", ps, depth, &(entry->record.record_number)))) + return False; + if(!(prs_uint32("time generated", ps, depth, &(entry->record.time_generated)))) + return False; + if(!(prs_uint32("time written", ps, depth, &(entry->record.time_written)))) + return False; + if(!(prs_uint32("event id", ps, depth, &(entry->record.event_id)))) + return False; + if(!(prs_uint16("event type", ps, depth, &(entry->record.event_type)))) + return False; + if(!(prs_uint16("num strings", ps, depth, &(entry->record.num_strings)))) + return False; + if(!(prs_uint16("event category", ps, depth, &(entry->record.event_category)))) + return False; + if(!(prs_uint16("reserved2", ps, depth, &(entry->record.reserved2)))) + return False; + if(!(prs_uint32("closing record", ps, depth, &(entry->record.closing_record_number)))) + return False; + if(!(prs_uint32("string offset", ps, depth, &(entry->record.string_offset)))) + return False; + if(!(prs_uint32("user sid length", ps, depth, &(entry->record.user_sid_length)))) + return False; + if(!(prs_uint32("user sid offset", ps, depth, &(entry->record.user_sid_offset)))) + return False; + if(!(prs_uint32("data length", ps, depth, &(entry->record.data_length)))) + return False; + if(!(prs_uint32("data offset", ps, depth, &(entry->record.data_offset)))) + return False; + if(!(prs_align(ps))) + return False; + + /* Now encoding data */ + + if(!(prs_uint8s(False, "buffer", ps, depth, entry->data, + entry->record.length - sizeof(Eventlog_record) - sizeof(entry->record.length)))) + { + return False; + } + + if(!(prs_align(ps))) + return False; + if(!(prs_uint32("length 2", ps, depth, &(entry->record.length)))) + return False; + + entry = entry->next; + record_written++; + + } /* end of encoding EVENTLOGRECORD */ + + /* Now pad with whitespace until the end of the response buffer */ + + r_u->end_of_entries_padding = (uint8 *)calloc(q_u->max_read_size - r_u->num_bytes_in_resp, sizeof(uint8)); + + if(!(prs_uint8s(False, "end of entries padding", ps, + depth, r_u->end_of_entries_padding, + (q_u->max_read_size - r_u->num_bytes_in_resp)))) + { + return False; + } + + free(r_u->end_of_entries_padding); + + /* We had better be DWORD aligned here */ + + if(!(prs_uint32("sent size", ps, depth, &(r_u->sent_size)))) + return False; + if(!(prs_uint32("real size", ps, depth, &(r_u->real_size)))) + return False; + if(!(prs_werror("status code", ps, depth, &(r_u->status)))) + return False; + + return True; +} + +/* The windows client seems to be doing something funny with the file name + A call like + ClearEventLog(handle, "backup_file") + on the client side will result in the backup file name looking like this on the + server side: + \??\${CWD of client}\backup_file + If an absolute path gets specified, such as + ClearEventLog(handle, "C:\\temp\\backup_file") + then it is still mangled by the client into this: + \??\C:\temp\backup_file + when it is on the wire. + I'm not sure where the \?? is coming from, or why the ${CWD} of the client process + would be added in given that the backup file gets written on the server side. */ + +BOOL eventlog_io_q_clear_eventlog(const char *desc, EVENTLOG_Q_CLEAR_EVENTLOG *q_u, + prs_struct *ps, int depth) +{ + if(q_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_q_clear_eventlog"); + depth++; + + if(!prs_align(ps)) + return False; + if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth))) + return False; + if(!prs_align(ps)) + return False; + if(!(prs_uint32("unknown1", ps, depth, &q_u->unknown1))) + return False; + if(!(prs_uint16("backup_file_length", ps, depth, &q_u->backup_file_length))) + return False; + if(!(prs_uint16("backup_file_size", ps, depth, &q_u->backup_file_size))) + return False; + if(!prs_uint32("backup_file_ptr", ps, depth, &q_u->backup_file_ptr)) + return False; + if(!smb_io_unistr2("backup file", &q_u->backup_file, q_u->backup_file_ptr, ps, depth)) + return False; + + return True; + +} + +BOOL eventlog_io_r_clear_eventlog(const char *desc, EVENTLOG_R_CLEAR_EVENTLOG *r_u, + prs_struct *ps, int depth) +{ + if(r_u == NULL) + return False; + + prs_debug(ps, depth, desc, "eventlog_io_r_clear_eventlog"); + depth++; + + if(!prs_align(ps)) + return False; + if(!(prs_werror("status code", ps, depth, &(r_u->status)))) + return False; + + return True; +} |