source/rpc_parse/parse_eventlog.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Marcin Krzysztof Porwit    2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21
  22 #undef DBGC_CLASS
  23 #define DBGC_CLASS DBGC_RPC_PARSE
  24
  25 /********************************************************************
  26 ********************************************************************/
  27
  28 bool eventlog_io_q_read_eventlog(const char *desc, EVENTLOG_Q_READ_EVENTLOG *q_u,
  29                                  prs_struct *ps, int depth)
  30 {
  31         if(q_u == NULL)
  32                 return False;
  33
  34         prs_debug(ps, depth, desc, "eventlog_io_q_read_eventlog");
  35         depth++;
  36
  37         if(!(prs_align(ps)))
  38                 return False;
  39
  40         if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
  41                 return False;
  42
  43         if(!(prs_uint32("read flags", ps, depth, &(q_u->flags))))
  44                 return False;
  45
  46         if(!(prs_uint32("read offset", ps, depth, &(q_u->offset))))
  47                 return False;
  48
  49         if(!(prs_uint32("read buf size", ps, depth, &(q_u->max_read_size))))
  50                 return False;
  51
  52         return True;
  53 }
  54 /** Structure of response seems to be:
  55    DWORD num_bytes_in_resp -- MUST be the same as q_u->max_read_size
  56    for i=0..n
  57        EVENTLOGRECORD record
  58    DWORD sent_size -- sum of EVENTLOGRECORD lengths if records returned, 0 otherwise
  59    DWORD real_size -- 0 if records returned, otherwise length of next record to be returned
  60    WERROR status */
  61 bool eventlog_io_r_read_eventlog(const char *desc,
  62                                  EVENTLOG_Q_READ_EVENTLOG *q_u,
  63                                  EVENTLOG_R_READ_EVENTLOG *r_u,
  64                                  prs_struct *ps,
  65                                  int depth)
  66 {
  67         Eventlog_entry *entry;
  68         uint32 record_written = 0;
  69         uint32 record_total = 0;
  70
  71         if(r_u == NULL)
  72                 return False;
  73
  74         prs_debug(ps, depth, desc, "eventlog_io_r_read_eventlog");
  75         depth++;
  76
  77         /* First, see if we've read more logs than we can output */
  78
  79         if(r_u->num_bytes_in_resp > q_u->max_read_size) {
  80                 entry = r_u->entry;
  81
  82                 /* remove the size of the last entry from the list */
  83
  84                 while(entry->next != NULL)
  85                         entry = entry->next;
  86
  87                 r_u->num_bytes_in_resp -= entry->record.length;
  88
  89                 /* do not output the last log entry */
  90
  91                 r_u->num_records--;
  92         }
  93
  94         entry = r_u->entry;
  95         record_total = r_u->num_records;
  96
  97         if(r_u->num_bytes_in_resp != 0)
  98                 r_u->sent_size = r_u->num_bytes_in_resp;
  99         else
 100                 r_u->real_size = r_u->bytes_in_next_record;
 101
 102         if(!(prs_align(ps)))
 103                 return False;
 104         if(!(prs_uint32("bytes in resp", ps, depth, &(q_u->max_read_size))))
 105                 return False;
 106
 107         while(entry != NULL && record_written < record_total)
 108         {
 109                 DEBUG(11, ("eventlog_io_r_read_eventlog: writing record [%d] out of [%d].\n", record_written, record_total));
 110
 111                 /* Encode the actual eventlog record record */
 112
 113                 if(!(prs_uint32("length", ps, depth, &(entry->record.length))))
 114                         return False;
 115                 if(!(prs_uint32("reserved", ps, depth, &(entry->record.reserved1))))
 116                         return False;
 117                 if(!(prs_uint32("record number", ps, depth, &(entry->record.record_number))))
 118                         return False;
 119                 if(!(prs_uint32("time generated", ps, depth, &(entry->record.time_generated))))
 120                         return False;
 121                 if(!(prs_uint32("time written", ps, depth, &(entry->record.time_written))))
 122                         return False;
 123                 if(!(prs_uint32("event id", ps, depth, &(entry->record.event_id))))
 124                         return False;
 125                 if(!(prs_uint16("event type", ps, depth, &(entry->record.event_type))))
 126                         return False;
 127                 if(!(prs_uint16("num strings", ps, depth, &(entry->record.num_strings))))
 128                         return False;
 129                 if(!(prs_uint16("event category", ps, depth, &(entry->record.event_category))))
 130                         return False;
 131                 if(!(prs_uint16("reserved2", ps, depth, &(entry->record.reserved2))))
 132                         return False;
 133                 if(!(prs_uint32("closing record", ps, depth, &(entry->record.closing_record_number))))
 134                         return False;
 135                 if(!(prs_uint32("string offset", ps, depth, &(entry->record.string_offset))))
 136                         return False;
 137                 if(!(prs_uint32("user sid length", ps, depth, &(entry->record.user_sid_length))))
 138                         return False;
 139                 if(!(prs_uint32("user sid offset", ps, depth, &(entry->record.user_sid_offset))))
 140                         return False;
 141                 if(!(prs_uint32("data length", ps, depth, &(entry->record.data_length))))
 142                         return False;
 143                 if(!(prs_uint32("data offset", ps, depth, &(entry->record.data_offset))))
 144                         return False;
 145                 if(!(prs_align(ps)))
 146                         return False;
 147
 148                 /* Now encoding data */
 149
 150                 if(!(prs_uint8s(False, "buffer", ps, depth, entry->data,
 151                         entry->record.length - sizeof(Eventlog_record) - sizeof(entry->record.length))))
 152                 {
 153                         return False;
 154                 }
 155
 156                 if(!(prs_align(ps)))
 157                         return False;
 158                 if(!(prs_uint32("length 2", ps, depth, &(entry->record.length))))
 159                         return False;
 160
 161                 entry = entry->next;
 162                 record_written++;
 163
 164         }       /* end of encoding EVENTLOGRECORD */
 165
 166         /* Now pad with whitespace until the end of the response buffer */
 167
 168         if (q_u->max_read_size - r_u->num_bytes_in_resp) {
 169                 r_u->end_of_entries_padding = PRS_ALLOC_MEM(ps, uint8_t, q_u->max_read_size - r_u->num_bytes_in_resp);
 170                 if (!r_u->end_of_entries_padding) {
 171                         return False;
 172                 }
 173
 174                 if(!(prs_uint8s(False, "end of entries padding", ps,
 175                                 depth, r_u->end_of_entries_padding,
 176                                 (q_u->max_read_size - r_u->num_bytes_in_resp)))) {
 177                         return False;
 178                 }
 179         }
 180
 181         /* We had better be DWORD aligned here */
 182
 183         if(!(prs_uint32("sent size", ps, depth, &(r_u->sent_size))))
 184                 return False;
 185         if(!(prs_uint32("real size", ps, depth, &(r_u->real_size))))
 186                 return False;
 187         if(!(prs_ntstatus("status code", ps, depth, &r_u->status)))
 188                 return False;
 189
 190         return True;
 191 }