summaryrefslogtreecommitdiff
path: root/source3/rpc_server/srv_eventlog_lib.c
diff options
context:
space:
mode:
Diffstat (limited to 'source3/rpc_server/srv_eventlog_lib.c')
-rw-r--r--source3/rpc_server/srv_eventlog_lib.c742
1 files changed, 742 insertions, 0 deletions
diff --git a/source3/rpc_server/srv_eventlog_lib.c b/source3/rpc_server/srv_eventlog_lib.c
new file mode 100644
index 0000000000..e232a30078
--- /dev/null
+++ b/source3/rpc_server/srv_eventlog_lib.c
@@ -0,0 +1,742 @@
+/*
+ * Unix SMB/CIFS implementation.
+ * Eventlog utility routines
+ * Copyright (C) Marcin Krzysztof Porwit 2005,
+ * Copyright (C) Brian Moran 2005.
+ * Copyright (C) Gerald (Jerry) Carter 2005.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "includes.h"
+
+/* maintain a list of open eventlog tdbs with reference counts */
+
+static ELOG_TDB *open_elog_list;
+
+/********************************************************************
+ Init an Eventlog TDB, and return it. If null, something bad
+ happened.
+********************************************************************/
+
+TDB_CONTEXT *elog_init_tdb( char *tdbfilename )
+{
+ TDB_CONTEXT *tdb;
+
+ DEBUG(10,("elog_init_tdb: Initializing eventlog tdb (%s)\n",
+ tdbfilename));
+
+ tdb = tdb_open_log( tdbfilename, 0, TDB_DEFAULT,
+ O_RDWR|O_CREAT|O_TRUNC, 0660 );
+
+ if ( !tdb ) {
+ DEBUG( 0, ( "Can't open tdb for [%s]\n", tdbfilename ) );
+ return NULL;
+ }
+
+ /* initialize with defaults, copy real values in here from registry */
+
+ tdb_store_int32( tdb, EVT_OLDEST_ENTRY, 1 );
+ tdb_store_int32( tdb, EVT_NEXT_RECORD, 1 );
+ tdb_store_int32( tdb, EVT_MAXSIZE, 0x80000 );
+ tdb_store_int32( tdb, EVT_RETENTION, 0x93A80 );
+
+ tdb_store_int32( tdb, EVT_VERSION, EVENTLOG_DATABASE_VERSION_V1 );
+
+ return tdb;
+}
+
+/********************************************************************
+ make the tdb file name for an event log, given destination buffer
+ and size. Caller must free memory.
+********************************************************************/
+
+char *elog_tdbname(TALLOC_CTX *ctx, const char *name )
+{
+ char *path = talloc_asprintf(ctx, "%s/%s.tdb",
+ state_path("eventlog"),
+ name);
+ if (!path) {
+ return NULL;
+ }
+ strlower_m(path);
+ return path;
+}
+
+
+/********************************************************************
+ this function is used to count up the number of bytes in a
+ particular TDB
+********************************************************************/
+
+struct trav_size_struct {
+ int size;
+ int rec_count;
+};
+
+static int eventlog_tdb_size_fn( TDB_CONTEXT * tdb, TDB_DATA key, TDB_DATA data,
+ void *state )
+{
+ struct trav_size_struct *tsize = (struct trav_size_struct *)state;
+
+ tsize->size += data.dsize;
+ tsize->rec_count++;
+
+ return 0;
+}
+
+/********************************************************************
+ returns the size of the eventlog, and if MaxSize is a non-null
+ ptr, puts the MaxSize there. This is purely a way not to have yet
+ another function that solely reads the maxsize of the eventlog.
+ Yeah, that's it.
+********************************************************************/
+
+int elog_tdb_size( TDB_CONTEXT * tdb, int *MaxSize, int *Retention )
+{
+ struct trav_size_struct tsize;
+
+ if ( !tdb )
+ return 0;
+
+ ZERO_STRUCT( tsize );
+
+ tdb_traverse( tdb, eventlog_tdb_size_fn, &tsize );
+
+ if ( MaxSize != NULL ) {
+ *MaxSize = tdb_fetch_int32( tdb, EVT_MAXSIZE );
+ }
+
+ if ( Retention != NULL ) {
+ *Retention = tdb_fetch_int32( tdb, EVT_RETENTION );
+ }
+
+ DEBUG( 1,
+ ( "eventlog size: [%d] for [%d] records\n", tsize.size,
+ tsize.rec_count ) );
+ return tsize.size;
+}
+
+/********************************************************************
+ Discard early event logs until we have enough for 'needed' bytes...
+ NO checking done beforehand to see that we actually need to do
+ this, and it's going to pluck records one-by-one. So, it's best
+ to determine that this needs to be done before doing it.
+
+ Setting whack_by_date to True indicates that eventlogs falling
+ outside of the retention range need to go...
+
+ return True if we made enough room to accommodate needed bytes
+********************************************************************/
+
+static bool make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32 needed,
+ bool whack_by_date )
+{
+ int start_record, i, new_start;
+ int end_record;
+ int nbytes, reclen, len, Retention, MaxSize;
+ int tresv1, trecnum, timegen, timewr;
+ TDB_DATA key, ret;
+ time_t current_time, exp_time;
+
+ /* discard some eventlogs */
+
+ /* read eventlogs from oldest_entry -- there can't be any discontinuity in recnos,
+ although records not necessarily guaranteed to have successive times */
+ /* */
+
+ /* lock */
+ tdb_lock_bystring_with_timeout( the_tdb, EVT_NEXT_RECORD, 1 );
+ /* read */
+ end_record = tdb_fetch_int32( the_tdb, EVT_NEXT_RECORD );
+ start_record = tdb_fetch_int32( the_tdb, EVT_OLDEST_ENTRY );
+ Retention = tdb_fetch_int32( the_tdb, EVT_RETENTION );
+ MaxSize = tdb_fetch_int32( the_tdb, EVT_MAXSIZE );
+
+ time( &current_time );
+
+ /* calculate ... */
+ exp_time = current_time - Retention; /* discard older than exp_time */
+
+ /* todo - check for sanity in next_record */
+ nbytes = 0;
+
+ DEBUG( 3,
+ ( "MaxSize [%d] Retention [%d] Current Time [%d] exp_time [%d]\n",
+ MaxSize, Retention, (uint32)current_time, (uint32)exp_time ) );
+ DEBUG( 3,
+ ( "Start Record [%d] End Record [%d]\n", start_record,
+ end_record ) );
+
+ for ( i = start_record; i < end_record; i++ ) {
+ /* read a record, add the amt to nbytes */
+ key.dsize = sizeof( int32 );
+ key.dptr = ( uint8 * ) ( int32 * ) & i;
+ ret = tdb_fetch( the_tdb, key );
+ if ( ret.dsize == 0 ) {
+ DEBUG( 8,
+ ( "Can't find a record for the key, record [%d]\n",
+ i ) );
+ tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
+ return False;
+ }
+ nbytes += ret.dsize; /* note this includes overhead */
+
+ len = tdb_unpack( ret.dptr, ret.dsize, "ddddd", &reclen,
+ &tresv1, &trecnum, &timegen, &timewr );
+ if (len == -1) {
+ DEBUG( 10,("make_way_for_eventlogs: tdb_unpack failed.\n"));
+ tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
+ return False;
+ }
+
+ DEBUG( 8,
+ ( "read record %d, record size is [%d], total so far [%d]\n",
+ i, reclen, nbytes ) );
+
+ SAFE_FREE( ret.dptr );
+
+ /* note that other servers may just stop writing records when the size limit
+ is reached, and there are no records older than 'retention'. This doesn't
+ like a very useful thing to do, so instead we whack (as in sleeps with the
+ fishes) just enough records to fit the what we need. This behavior could
+ be changed to 'match', if the need arises. */
+
+ if ( !whack_by_date && ( nbytes >= needed ) )
+ break; /* done */
+ if ( whack_by_date && ( timegen >= exp_time ) )
+ break; /* done */
+ }
+
+ DEBUG( 3,
+ ( "nbytes [%d] needed [%d] start_record is [%d], should be set to [%d]\n",
+ nbytes, needed, start_record, i ) );
+ /* todo - remove eventlog entries here and set starting record to start_record... */
+ new_start = i;
+ if ( start_record != new_start ) {
+ for ( i = start_record; i < new_start; i++ ) {
+ key.dsize = sizeof( int32 );
+ key.dptr = ( uint8 * ) ( int32 * ) & i;
+ tdb_delete( the_tdb, key );
+ }
+
+ tdb_store_int32( the_tdb, EVT_OLDEST_ENTRY, new_start );
+ }
+ tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
+ return True;
+}
+
+/********************************************************************
+ some hygiene for an eventlog - see how big it is, and then
+ calculate how many bytes we need to remove
+********************************************************************/
+
+bool prune_eventlog( TDB_CONTEXT * tdb )
+{
+ int MaxSize, Retention, CalcdSize;
+
+ if ( !tdb ) {
+ DEBUG( 4, ( "No eventlog tdb handle\n" ) );
+ return False;
+ }
+
+ CalcdSize = elog_tdb_size( tdb, &MaxSize, &Retention );
+ DEBUG( 3,
+ ( "Calculated size [%d] MaxSize [%d]\n", CalcdSize,
+ MaxSize ) );
+
+ if ( CalcdSize > MaxSize ) {
+ return make_way_for_eventlogs( tdb, CalcdSize - MaxSize,
+ False );
+ }
+
+ return make_way_for_eventlogs( tdb, 0, True );
+}
+
+/********************************************************************
+********************************************************************/
+
+bool can_write_to_eventlog( TDB_CONTEXT * tdb, int32 needed )
+{
+ int calcd_size;
+ int MaxSize, Retention;
+
+ /* see if we can write to the eventlog -- do a policy enforcement */
+ if ( !tdb )
+ return False; /* tdb is null, so we can't write to it */
+
+
+ if ( needed < 0 )
+ return False;
+ MaxSize = 0;
+ Retention = 0;
+
+ calcd_size = elog_tdb_size( tdb, &MaxSize, &Retention );
+
+ if ( calcd_size <= MaxSize )
+ return True; /* you betcha */
+ if ( calcd_size + needed < MaxSize )
+ return True;
+
+ if ( Retention == 0xffffffff ) {
+ return False; /* see msdn - we can't write no room, discard */
+ }
+ /*
+ note don't have to test, but always good to show intent, in case changes needed
+ later
+ */
+
+ if ( Retention == 0x00000000 ) {
+ /* discard record(s) */
+ /* todo - decide when to remove a bunch vs. just what we need... */
+ return make_way_for_eventlogs( tdb, calcd_size - MaxSize,
+ True );
+ }
+
+ return make_way_for_eventlogs( tdb, calcd_size - MaxSize, False );
+}
+
+/*******************************************************************
+*******************************************************************/
+
+ELOG_TDB *elog_open_tdb( char *logname, bool force_clear )
+{
+ TDB_CONTEXT *tdb = NULL;
+ uint32 vers_id;
+ ELOG_TDB *ptr;
+ char *tdbpath = NULL;
+ ELOG_TDB *tdb_node = NULL;
+ char *eventlogdir;
+ TALLOC_CTX *ctx = talloc_tos();
+
+ /* first see if we have an open context */
+
+ for ( ptr=open_elog_list; ptr; ptr=ptr->next ) {
+ if ( strequal( ptr->name, logname ) ) {
+ ptr->ref_count++;
+
+ /* trick to alow clearing of the eventlog tdb.
+ The force_clear flag should imply that someone
+ has done a force close. So make sure the tdb
+ is NULL. If this is a normal open, then just
+ return the existing reference */
+
+ if ( force_clear ) {
+ SMB_ASSERT( ptr->tdb == NULL );
+ break;
+ }
+ else
+ return ptr;
+ }
+ }
+
+ /* make sure that the eventlog dir exists */
+
+ eventlogdir = state_path( "eventlog" );
+ if ( !directory_exist( eventlogdir, NULL ) )
+ mkdir( eventlogdir, 0755 );
+
+ /* get the path on disk */
+
+ tdbpath = elog_tdbname(ctx, logname);
+ if (!tdbpath) {
+ return NULL;
+ }
+
+ DEBUG(7,("elog_open_tdb: Opening %s...(force_clear == %s)\n",
+ tdbpath, force_clear?"True":"False" ));
+
+ /* the tdb wasn't already open or this is a forced clear open */
+
+ if ( !force_clear ) {
+
+ tdb = tdb_open_log( tdbpath, 0, TDB_DEFAULT, O_RDWR , 0 );
+ if ( tdb ) {
+ vers_id = tdb_fetch_int32( tdb, EVT_VERSION );
+
+ if ( vers_id != EVENTLOG_DATABASE_VERSION_V1 ) {
+ DEBUG(1,("elog_open_tdb: Invalid version [%d] on file [%s].\n",
+ vers_id, tdbpath));
+ tdb_close( tdb );
+ tdb = elog_init_tdb( tdbpath );
+ }
+ }
+ }
+
+ if ( !tdb )
+ tdb = elog_init_tdb( tdbpath );
+
+ /* if we got a valid context, then add it to the list */
+
+ if ( tdb ) {
+ /* on a forced clear, just reset the tdb context if we already
+ have an open entry in the list */
+
+ if ( ptr ) {
+ ptr->tdb = tdb;
+ return ptr;
+ }
+
+ if ( !(tdb_node = TALLOC_ZERO_P( NULL, ELOG_TDB)) ) {
+ DEBUG(0,("elog_open_tdb: talloc() failure!\n"));
+ tdb_close( tdb );
+ return NULL;
+ }
+
+ tdb_node->name = talloc_strdup( tdb_node, logname );
+ tdb_node->tdb = tdb;
+ tdb_node->ref_count = 1;
+
+ DLIST_ADD( open_elog_list, tdb_node );
+ }
+
+ return tdb_node;
+}
+
+/*******************************************************************
+ Wrapper to handle reference counts to the tdb
+*******************************************************************/
+
+int elog_close_tdb( ELOG_TDB *etdb, bool force_close )
+{
+ TDB_CONTEXT *tdb;
+
+ if ( !etdb )
+ return 0;
+
+ etdb->ref_count--;
+
+ SMB_ASSERT( etdb->ref_count >= 0 );
+
+ if ( etdb->ref_count == 0 ) {
+ tdb = etdb->tdb;
+ DLIST_REMOVE( open_elog_list, etdb );
+ TALLOC_FREE( etdb );
+ return tdb_close( tdb );
+ }
+
+ if ( force_close ) {
+ tdb = etdb->tdb;
+ etdb->tdb = NULL;
+ return tdb_close( tdb );
+ }
+
+ return 0;
+}
+
+
+/*******************************************************************
+ write an eventlog entry. Note that we have to lock, read next
+ eventlog, increment, write, write the record, unlock
+
+ coming into this, ee has the eventlog record, and the auxilliary date
+ (computer name, etc.) filled into the other structure. Before packing
+ into a record, this routine will calc the appropriate padding, etc.,
+ and then blast out the record in a form that can be read back in
+*******************************************************************/
+
+#define MARGIN 512
+
+int write_eventlog_tdb( TDB_CONTEXT * the_tdb, Eventlog_entry * ee )
+{
+ int32 next_record;
+ uint8 *packed_ee;
+ TALLOC_CTX *mem_ctx = NULL;
+ TDB_DATA kbuf, ebuf;
+ uint32 n_packed;
+
+ if ( !ee )
+ return 0;
+
+ mem_ctx = talloc_init( "write_eventlog_tdb" );
+
+ if ( mem_ctx == NULL )
+ return 0;
+
+ /* discard any entries that have bogus time, which usually indicates a bogus entry as well. */
+ if ( ee->record.time_generated == 0 )
+ return 0;
+
+ /* todo - check for sanity in next_record */
+
+ fixup_eventlog_entry( ee );
+
+ if ( !can_write_to_eventlog( the_tdb, ee->record.length ) ) {
+ DEBUG( 3, ( "Can't write to Eventlog, no room \n" ) );
+ talloc_destroy( mem_ctx );
+ return 0;
+ }
+
+ /* alloc mem for the packed version */
+ packed_ee = (uint8 *)TALLOC( mem_ctx, ee->record.length + MARGIN );
+ if ( !packed_ee ) {
+ talloc_destroy( mem_ctx );
+ return 0;
+ }
+
+ /* need to read the record number and insert it into the entry here */
+
+ /* lock */
+ tdb_lock_bystring_with_timeout( the_tdb, EVT_NEXT_RECORD, 1 );
+ /* read */
+ next_record = tdb_fetch_int32( the_tdb, EVT_NEXT_RECORD );
+
+ n_packed =
+ tdb_pack( (uint8 *)packed_ee, ee->record.length + MARGIN,
+ "ddddddwwwwddddddBBdBBBd", ee->record.length,
+ ee->record.reserved1, next_record,
+ ee->record.time_generated, ee->record.time_written,
+ ee->record.event_id, ee->record.event_type,
+ ee->record.num_strings, ee->record.event_category,
+ ee->record.reserved2,
+ ee->record.closing_record_number,
+ ee->record.string_offset,
+ ee->record.user_sid_length,
+ ee->record.user_sid_offset, ee->record.data_length,
+ ee->record.data_offset,
+ ee->data_record.source_name_len,
+ ee->data_record.source_name,
+ ee->data_record.computer_name_len,
+ ee->data_record.computer_name,
+ ee->data_record.sid_padding,
+ ee->record.user_sid_length, ee->data_record.sid,
+ ee->data_record.strings_len,
+ ee->data_record.strings,
+ ee->data_record.user_data_len,
+ ee->data_record.user_data,
+ ee->data_record.data_padding );
+
+ /*DEBUG(3,("write_eventlog_tdb: packed into %d\n",n_packed)); */
+
+ /* increment the record count */
+
+ kbuf.dsize = sizeof( int32 );
+ kbuf.dptr = (uint8 * ) & next_record;
+
+ ebuf.dsize = n_packed;
+ ebuf.dptr = (uint8 *)packed_ee;
+
+ if ( tdb_store( the_tdb, kbuf, ebuf, 0 ) ) {
+ /* DEBUG(1,("write_eventlog_tdb: Can't write record %d to eventlog\n",next_record)); */
+ tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
+ talloc_destroy( mem_ctx );
+ return 0;
+ }
+ next_record++;
+ tdb_store_int32( the_tdb, EVT_NEXT_RECORD, next_record );
+ tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
+ talloc_destroy( mem_ctx );
+ return ( next_record - 1 );
+}
+
+/*******************************************************************
+ calculate the correct fields etc for an eventlog entry
+*******************************************************************/
+
+void fixup_eventlog_entry( Eventlog_entry * ee )
+{
+ /* fix up the eventlog entry structure as necessary */
+
+ ee->data_record.sid_padding =
+ ( ( 4 -
+ ( ( ee->data_record.source_name_len +
+ ee->data_record.computer_name_len ) % 4 ) ) % 4 );
+ ee->data_record.data_padding =
+ ( 4 -
+ ( ( ee->data_record.strings_len +
+ ee->data_record.user_data_len ) % 4 ) ) % 4;
+ ee->record.length = sizeof( Eventlog_record );
+ ee->record.length += ee->data_record.source_name_len;
+ ee->record.length += ee->data_record.computer_name_len;
+ if ( ee->record.user_sid_length == 0 ) {
+ /* Should not pad to a DWORD boundary for writing out the sid if there is
+ no SID, so just propagate the padding to pad the data */
+ ee->data_record.data_padding += ee->data_record.sid_padding;
+ ee->data_record.sid_padding = 0;
+ }
+ /* DEBUG(10, ("sid_padding is [%d].\n", ee->data_record.sid_padding)); */
+ /* DEBUG(10, ("data_padding is [%d].\n", ee->data_record.data_padding)); */
+
+ ee->record.length += ee->data_record.sid_padding;
+ ee->record.length += ee->record.user_sid_length;
+ ee->record.length += ee->data_record.strings_len;
+ ee->record.length += ee->data_record.user_data_len;
+ ee->record.length += ee->data_record.data_padding;
+ /* need another copy of length at the end of the data */
+ ee->record.length += sizeof( ee->record.length );
+}
+
+/********************************************************************
+ Note that it's a pretty good idea to initialize the Eventlog_entry
+ structure to zero's before calling parse_logentry on an batch of
+ lines that may resolve to a record. ALSO, it's a good idea to
+ remove any linefeeds (that's EOL to you and me) on the lines
+ going in.
+********************************************************************/
+
+bool parse_logentry( char *line, Eventlog_entry * entry, bool * eor )
+{
+ TALLOC_CTX *ctx = talloc_tos();
+ char *start = NULL, *stop = NULL;
+
+ start = line;
+
+ /* empty line signyfiying record delimeter, or we're at the end of the buffer */
+ if ( start == NULL || strlen( start ) == 0 ) {
+ DEBUG( 6,
+ ( "parse_logentry: found end-of-record indicator.\n" ) );
+ *eor = True;
+ return True;
+ }
+ if ( !( stop = strchr( line, ':' ) ) ) {
+ return False;
+ }
+
+ DEBUG( 6, ( "parse_logentry: trying to parse [%s].\n", line ) );
+
+ if ( 0 == strncmp( start, "LEN", stop - start ) ) {
+ /* This will get recomputed later anyway -- probably not necessary */
+ entry->record.length = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "RS1", stop - start ) ) {
+ /* For now all these reserved entries seem to have the same value,
+ which can be hardcoded to int(1699505740) for now */
+ entry->record.reserved1 = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "RCN", stop - start ) ) {
+ entry->record.record_number = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "TMG", stop - start ) ) {
+ entry->record.time_generated = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "TMW", stop - start ) ) {
+ entry->record.time_written = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "EID", stop - start ) ) {
+ entry->record.event_id = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "ETP", stop - start ) ) {
+ if ( strstr( start, "ERROR" ) ) {
+ entry->record.event_type = EVENTLOG_ERROR_TYPE;
+ } else if ( strstr( start, "WARNING" ) ) {
+ entry->record.event_type = EVENTLOG_WARNING_TYPE;
+ } else if ( strstr( start, "INFO" ) ) {
+ entry->record.event_type = EVENTLOG_INFORMATION_TYPE;
+ } else if ( strstr( start, "AUDIT_SUCCESS" ) ) {
+ entry->record.event_type = EVENTLOG_AUDIT_SUCCESS;
+ } else if ( strstr( start, "AUDIT_FAILURE" ) ) {
+ entry->record.event_type = EVENTLOG_AUDIT_FAILURE;
+ } else if ( strstr( start, "SUCCESS" ) ) {
+ entry->record.event_type = EVENTLOG_SUCCESS;
+ } else {
+ /* some other eventlog type -- currently not defined in MSDN docs, so error out */
+ return False;
+ }
+ }
+
+/*
+ else if(0 == strncmp(start, "NST", stop - start))
+ {
+ entry->record.num_strings = atoi(stop + 1);
+ }
+*/
+ else if ( 0 == strncmp( start, "ECT", stop - start ) ) {
+ entry->record.event_category = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "RS2", stop - start ) ) {
+ entry->record.reserved2 = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "CRN", stop - start ) ) {
+ entry->record.closing_record_number = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "USL", stop - start ) ) {
+ entry->record.user_sid_length = atoi( stop + 1 );
+ } else if ( 0 == strncmp( start, "SRC", stop - start ) ) {
+ stop++;
+ while ( isspace( stop[0] ) ) {
+ stop++;
+ }
+ entry->data_record.source_name_len = rpcstr_push_talloc(ctx,
+ &entry->data_record.source_name,
+ stop);
+ if (entry->data_record.source_name_len == (uint32_t)-1 ||
+ entry->data_record.source_name == NULL) {
+ return false;
+ }
+ } else if ( 0 == strncmp( start, "SRN", stop - start ) ) {
+ stop++;
+ while ( isspace( stop[0] ) ) {
+ stop++;
+ }
+ entry->data_record.computer_name_len = rpcstr_push_talloc(ctx,
+ &entry->data_record.computer_name,
+ stop);
+ if (entry->data_record.computer_name_len == (uint32_t)-1 ||
+ entry->data_record.computer_name == NULL) {
+ return false;
+ }
+ } else if ( 0 == strncmp( start, "SID", stop - start ) ) {
+ stop++;
+ while ( isspace( stop[0] ) ) {
+ stop++;
+ }
+ entry->record.user_sid_length = rpcstr_push_talloc(ctx,
+ &entry->data_record.sid,
+ stop);
+ if (entry->record.user_sid_length == (uint32_t)-1 ||
+ entry->data_record.sid == NULL) {
+ return false;
+ }
+ } else if ( 0 == strncmp( start, "STR", stop - start ) ) {
+ smb_ucs2_t *temp = NULL;
+ size_t tmp_len;
+ uint32_t old_len;
+ /* skip past initial ":" */
+ stop++;
+ /* now skip any other leading whitespace */
+ while ( isspace(stop[0])) {
+ stop++;
+ }
+ tmp_len = rpcstr_push_talloc(ctx,
+ &temp,
+ stop);
+ if (tmp_len == (size_t)-1 || !temp) {
+ return false;
+ }
+ old_len = entry->data_record.strings_len;
+ entry->data_record.strings = (smb_ucs2_t *)TALLOC_REALLOC_ARRAY(ctx,
+ entry->data_record.strings,
+ char,
+ old_len + tmp_len);
+ if (!entry->data_record.strings) {
+ return false;
+ }
+ memcpy(entry->data_record.strings + old_len,
+ temp,
+ tmp_len);
+ entry->data_record.strings_len += tmp_len;
+ entry->record.num_strings++;
+ } else if ( 0 == strncmp( start, "DAT", stop - start ) ) {
+ /* skip past initial ":" */
+ stop++;
+ /* now skip any other leading whitespace */
+ while ( isspace( stop[0] ) ) {
+ stop++;
+ }
+ entry->data_record.user_data_len = strlen(stop);
+ entry->data_record.user_data = talloc_strdup(ctx,
+ stop);
+ if (!entry->data_record.user_data) {
+ return false;
+ }
+ } else {
+ /* some other eventlog entry -- not implemented, so dropping on the floor */
+ DEBUG( 10, ( "Unknown entry [%s]. Ignoring.\n", line ) );
+ /* For now return true so that we can keep on parsing this mess. Eventually
+ we will return False here. */
+ return true;
+ }
+ return true;
+}
generated by cgit (git 2.34.1) at 2025-03-31 06:15:28 +0000