/* * Unix SMB/CIFS implementation. * Virtual Windows Registry Layer * Copyright (C) Marcin Krzysztof Porwit 2005, * Copyright (C) Brian Moran 2005. * Copyright (C) Gerald (Jerry) Carter 2005. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ #include "includes.h" /********************************************************************** for an eventlog, add in the default values *********************************************************************/ BOOL eventlog_init_keys( void ) { /* Find all of the eventlogs, add keys for each of them */ const char **elogs = lp_eventlog_list( ); pstring evtlogpath; pstring evtfilepath; REGSUBKEY_CTR *subkeys; REGVAL_CTR *values; uint32 uiDisplayNameId; uint32 uiMaxSize; uint32 uiRetention; uint32 uiCategoryCount; UNISTR2 data; while ( elogs && *elogs ) { if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) { DEBUG( 0, ( "talloc() failure!\n" ) ); return False; } regdb_fetch_keys( KEY_EVENTLOG, subkeys ); regsubkey_ctr_addkey( subkeys, *elogs ); if ( !regdb_store_keys( KEY_EVENTLOG, subkeys ) ) return False; TALLOC_FREE( subkeys ); /* add in the key of form KEY_EVENTLOG/Application */ DEBUG( 5, ( "Adding key of [%s] to path of [%s]\n", *elogs, KEY_EVENTLOG ) ); slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s", KEY_EVENTLOG, *elogs ); /* add in the key of form KEY_EVENTLOG/Application/Application */ DEBUG( 5, ( "Adding key of [%s] to path of [%s]\n", *elogs, evtlogpath ) ); if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) { DEBUG( 0, ( "talloc() failure!\n" ) ); return False; } regdb_fetch_keys( evtlogpath, subkeys ); regsubkey_ctr_addkey( subkeys, *elogs ); if ( !regdb_store_keys( evtlogpath, subkeys ) ) return False; TALLOC_FREE( subkeys ); /* now add the values to the KEY_EVENTLOG/Application form key */ if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) { DEBUG( 0, ( "talloc() failure!\n" ) ); return False; } DEBUG( 5, ( "Storing values to eventlog path of [%s]\n", evtlogpath ) ); regdb_fetch_values( evtlogpath, values ); if ( !regval_ctr_key_exists( values, "MaxSize" ) ) { /* assume we have none, add them all */ /* hard code some initial values */ uiDisplayNameId = 0x00000100; uiMaxSize = 0x00080000; uiRetention = 0x93A80; regval_ctr_addvalue( values, "MaxSize", REG_DWORD, ( char * ) &uiMaxSize, sizeof( uint32 ) ); regval_ctr_addvalue( values, "Retention", REG_DWORD, ( char * ) &uiRetention, sizeof( uint32 ) ); init_unistr2( &data, *elogs, UNI_STR_TERMINATE ); regval_ctr_addvalue( values, "PrimaryModule", REG_SZ, ( char * ) data.buffer, data.uni_str_len * sizeof( uint16 ) ); init_unistr2( &data, *elogs, UNI_STR_TERMINATE ); regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ, ( char * ) data.buffer, data.uni_str_len * sizeof( uint16 ) ); pstr_sprintf( evtfilepath, "%%SystemRoot%%\\system32\\config\\%s.tdb", *elogs ); init_unistr2( &data, evtfilepath, UNI_STR_TERMINATE ); regval_ctr_addvalue( values, "File", REG_EXPAND_SZ, ( char * ) data.buffer, data.uni_str_len * sizeof( uint16 ) ); regdb_store_values( evtlogpath, values ); } TALLOC_FREE( values ); /* now do the values under KEY_EVENTLOG/Application/Application */ slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s\\%s", KEY_EVENTLOG, *elogs, *elogs ); if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) { DEBUG( 0, ( "talloc() failure!\n" ) ); return False; } DEBUG( 5, ( "Storing values to eventlog path of [%s]\n", evtlogpath ) ); regdb_fetch_values( evtlogpath, values ); if ( !regval_ctr_key_exists( values, "CategoryCount" ) ) { /* hard code some initial values */ uiCategoryCount = 0x00000007; regval_ctr_addvalue( values, "CategoryCount", REG_DWORD, ( char * ) &uiCategoryCount, sizeof( uint32 ) ); init_unistr2( &data, "%SystemRoot%\\system32\\eventlog.dll", UNI_STR_TERMINATE ); regval_ctr_addvalue( values, "CategoryMessageFile", REG_EXPAND_SZ, ( char * ) data.buffer, data.uni_str_len * sizeof( uint16 ) ); regdb_store_values( evtlogpath, values ); } TALLOC_FREE( values ); elogs++; } return True; } /********************************************************************* for an eventlog, add in a source name. If the eventlog doesn't exist (not in the list) do nothing. If a source for the log already exists, change the information (remove, replace) *********************************************************************/ BOOL eventlog_add_source( const char *eventlog, const char *sourcename, const char *messagefile ) { /* Find all of the eventlogs, add keys for each of them */ /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary) need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */ const char **elogs = lp_eventlog_list( ); char **wrklist, **wp; pstring evtlogpath; REGSUBKEY_CTR *subkeys; REGVAL_CTR *values; REGISTRY_VALUE *rval; UNISTR2 data; uint16 *msz_wp; int mbytes, ii; BOOL already_in; int i; int numsources; for ( i = 0; elogs[i]; i++ ) { if ( strequal( elogs[i], eventlog ) ) break; } if ( !elogs[i] ) { DEBUG( 0, ( "Eventlog [%s] not found in list of valid event logs\n", eventlog ) ); return False; /* invalid named passed in */ } /* have to assume that the evenlog key itself exists at this point */ /* add in a key of [sourcename] under the eventlog key */ /* todo add to Sources */ if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) { DEBUG( 0, ( "talloc() failure!\n" ) ); return False; } pstr_sprintf( evtlogpath, "%s\\%s", KEY_EVENTLOG, eventlog ); regdb_fetch_values( evtlogpath, values ); if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) { DEBUG( 0, ( "No Sources value for [%s]!\n", eventlog ) ); return False; } /* perhaps this adding a new string to a multi_sz should be a fn? */ /* check to see if it's there already */ if ( rval->type != REG_MULTI_SZ ) { DEBUG( 0, ( "Wrong type for Sources, should be REG_MULTI_SZ\n" ) ); return False; } /* convert to a 'regulah' chars to do some comparisons */ already_in = False; wrklist = NULL; dump_data( 1, (const char *)rval->data_p, rval->size ); if ( ( numsources = regval_convert_multi_sz( ( uint16 * ) rval->data_p, rval->size, &wrklist ) ) > 0 ) { ii = numsources; /* see if it's in there already */ wp = wrklist; while ( ii && wp && *wp ) { if ( strequal( *wp, sourcename ) ) { DEBUG( 5, ( "Source name [%s] already in list for [%s] \n", sourcename, eventlog ) ); already_in = True; break; } wp++; ii--; } } else { if ( numsources < 0 ) { DEBUG( 3, ( "problem in getting the sources\n" ) ); return False; } DEBUG( 3, ( "Nothing in the sources list, this might be a problem\n" ) ); } wp = wrklist; if ( !already_in ) { /* make a new list with an additional entry; copy values, add another */ wp = TALLOC_ARRAY( NULL, char *, numsources + 2 ); if ( !wp ) { DEBUG( 0, ( "talloc() failed \n" ) ); return False; } memcpy( wp, wrklist, sizeof( char * ) * numsources ); *( wp + numsources ) = ( char * ) sourcename; *( wp + numsources + 1 ) = NULL; mbytes = regval_build_multi_sz( wp, &msz_wp ); dump_data( 1, ( char * ) msz_wp, mbytes ); regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ, ( char * ) msz_wp, mbytes ); regdb_store_values( evtlogpath, values ); TALLOC_FREE( msz_wp ); } else { DEBUG( 3, ( "Source name [%s] found in existing list of sources\n", sourcename ) ); } TALLOC_FREE( values ); if ( wrklist ) TALLOC_FREE( wrklist ); /* */ if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) { DEBUG( 0, ( "talloc() failure!\n" ) ); return False; } pstr_sprintf( evtlogpath, "%s\\%s", KEY_EVENTLOG, eventlog ); regdb_fetch_keys( evtlogpath, subkeys ); if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) { DEBUG( 5, ( " Source name [%s] for eventlog [%s] didn't exist, adding \n", sourcename, eventlog ) ); regsubkey_ctr_addkey( subkeys, sourcename ); if ( !regdb_store_keys( evtlogpath, subkeys ) ) return False; } TALLOC_FREE( subkeys ); /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */ /* now allocate room for the source's subkeys */ if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) { DEBUG( 0, ( "talloc() failure!\n" ) ); return False; } slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s\\%s", KEY_EVENTLOG, eventlog, sourcename ); regdb_fetch_keys( evtlogpath, subkeys ); /* now add the values to the KEY_EVENTLOG/Application form key */ if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) { DEBUG( 0, ( "talloc() failure!\n" ) ); return False; } DEBUG( 5, ( "Storing EventMessageFile [%s] to eventlog path of [%s]\n", messagefile, evtlogpath ) ); regdb_fetch_values( evtlogpath, values ); init_unistr2( &data, messagefile, UNI_STR_TERMINATE ); regval_ctr_addvalue( values, "EventMessageFile", REG_SZ, ( char * ) data.buffer, data.uni_str_len * sizeof( uint16 ) ); regdb_store_values( evtlogpath, values ); TALLOC_FREE( values ); return True; }