source/registry/reg_eventlog.c

   1
   2 /*
   3  *  Unix SMB/CIFS implementation.
   4  *  Virtual Windows Registry Layer
   5  *  Copyright (C) Marcin Krzysztof Porwit    2005,
   6  *  Copyright (C) Brian Moran                2005.
   7  *  Copyright (C) Gerald (Jerry) Carter      2005.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24 #include "includes.h"
  25
  26
  27 /**********************************************************************
  28  for an eventlog, add in the default values
  29 *********************************************************************/
  30
  31 BOOL eventlog_init_keys( void )
  32 {
  33         /* Find all of the eventlogs, add keys for each of them */
  34         const char **elogs = lp_eventlog_list(  );
  35         pstring evtlogpath;
  36         pstring evtfilepath;
  37         REGSUBKEY_CTR *subkeys;
  38         REGVAL_CTR *values;
  39         uint32 uiDisplayNameId;
  40         uint32 uiMaxSize;
  41         uint32 uiRetention;
  42         uint32 uiCategoryCount;
  43         UNISTR2 data;
  44
  45         while ( elogs && *elogs ) {
  46                 if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) {
  47                         DEBUG( 0, ( "talloc() failure!\n" ) );
  48                         return False;
  49                 }
  50                 regdb_fetch_keys( KEY_EVENTLOG, subkeys );
  51                 regsubkey_ctr_addkey( subkeys, *elogs );
  52                 if ( !regdb_store_keys( KEY_EVENTLOG, subkeys ) )
  53                         return False;
  54                 TALLOC_FREE( subkeys );
  55
  56                 /* add in the key of form KEY_EVENTLOG/Application */
  57                 DEBUG( 5,
  58                        ( "Adding key of [%s] to path of [%s]\n", *elogs,
  59                          KEY_EVENTLOG ) );
  60
  61                 slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s",
  62                           KEY_EVENTLOG, *elogs );
  63                 /* add in the key of form KEY_EVENTLOG/Application/Application */
  64                 DEBUG( 5,
  65                        ( "Adding key of [%s] to path of [%s]\n", *elogs,
  66                          evtlogpath ) );
  67                 if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) {
  68                         DEBUG( 0, ( "talloc() failure!\n" ) );
  69                         return False;
  70                 }
  71                 regdb_fetch_keys( evtlogpath, subkeys );
  72                 regsubkey_ctr_addkey( subkeys, *elogs );
  73
  74                 if ( !regdb_store_keys( evtlogpath, subkeys ) )
  75                         return False;
  76                 TALLOC_FREE( subkeys );
  77
  78                 /* now add the values to the KEY_EVENTLOG/Application form key */
  79                 if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) {
  80                         DEBUG( 0, ( "talloc() failure!\n" ) );
  81                         return False;
  82                 }
  83                 DEBUG( 5,
  84                        ( "Storing values to eventlog path of [%s]\n",
  85                          evtlogpath ) );
  86                 regdb_fetch_values( evtlogpath, values );
  87
  88
  89                 if ( !regval_ctr_key_exists( values, "MaxSize" ) ) {
  90
  91                         /* assume we have none, add them all */
  92
  93                         /* hard code some initial values */
  94
  95                         uiDisplayNameId = 0x00000100;
  96                         uiMaxSize = 0x00080000;
  97                         uiRetention = 0x93A80;
  98
  99                         regval_ctr_addvalue( values, "MaxSize", REG_DWORD,
 100                                              ( char * ) &uiMaxSize,
 101                                              sizeof( uint32 ) );
 102
 103                         regval_ctr_addvalue( values, "Retention", REG_DWORD,
 104                                              ( char * ) &uiRetention,
 105                                              sizeof( uint32 ) );
 106                         init_unistr2( &data, *elogs, UNI_STR_TERMINATE );
 107
 108                         regval_ctr_addvalue( values, "PrimaryModule", REG_SZ,
 109                                              ( char * ) data.buffer,
 110                                              data.uni_str_len *
 111                                              sizeof( uint16 ) );
 112                         init_unistr2( &data, *elogs, UNI_STR_TERMINATE );
 113
 114                         regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
 115                                              ( char * ) data.buffer,
 116                                              data.uni_str_len *
 117                                              sizeof( uint16 ) );
 118
 119                         pstr_sprintf( evtfilepath, "%%SystemRoot%%\\system32\\config\\%s.tdb", *elogs );
 120                         init_unistr2( &data, evtfilepath, UNI_STR_TERMINATE );
 121                         regval_ctr_addvalue( values, "File", REG_EXPAND_SZ, ( char * ) data.buffer,
 122                                              data.uni_str_len * sizeof( uint16 ) );
 123                         regdb_store_values( evtlogpath, values );
 124
 125                 }
 126
 127                 TALLOC_FREE( values );
 128
 129                 /* now do the values under KEY_EVENTLOG/Application/Application */
 130                 slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s\\%s",
 131                           KEY_EVENTLOG, *elogs, *elogs );
 132                 if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) {
 133                         DEBUG( 0, ( "talloc() failure!\n" ) );
 134                         return False;
 135                 }
 136                 DEBUG( 5,
 137                        ( "Storing values to eventlog path of [%s]\n",
 138                          evtlogpath ) );
 139                 regdb_fetch_values( evtlogpath, values );
 140                 if ( !regval_ctr_key_exists( values, "CategoryCount" ) ) {
 141
 142                         /* hard code some initial values */
 143
 144                         uiCategoryCount = 0x00000007;
 145                         regval_ctr_addvalue( values, "CategoryCount",
 146                                              REG_DWORD,
 147                                              ( char * ) &uiCategoryCount,
 148                                              sizeof( uint32 ) );
 149                         init_unistr2( &data,
 150                                       "%SystemRoot%\\system32\\eventlog.dll",
 151                                       UNI_STR_TERMINATE );
 152
 153                         regval_ctr_addvalue( values, "CategoryMessageFile",
 154                                              REG_EXPAND_SZ,
 155                                              ( char * ) data.buffer,
 156                                              data.uni_str_len *
 157                                              sizeof( uint16 ) );
 158                         regdb_store_values( evtlogpath, values );
 159                 }
 160                 TALLOC_FREE( values );
 161                 elogs++;
 162         }
 163
 164         return True;
 165
 166 }
 167
 168 /*********************************************************************
 169  for an eventlog, add in a source name. If the eventlog doesn't
 170  exist (not in the list) do nothing.   If a source for the log
 171  already exists, change the information (remove, replace)
 172 *********************************************************************/
 173
 174 BOOL eventlog_add_source( const char *eventlog, const char *sourcename,
 175                           const char *messagefile )
 176 {
 177         /* Find all of the eventlogs, add keys for each of them */
 178         /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
 179            need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
 180
 181         const char **elogs = lp_eventlog_list(  );
 182         char **wrklist, **wp;
 183         pstring evtlogpath;
 184         REGSUBKEY_CTR *subkeys;
 185         REGVAL_CTR *values;
 186         REGISTRY_VALUE *rval;
 187         UNISTR2 data;
 188         uint16 *msz_wp;
 189         int mbytes, ii;
 190         BOOL already_in;
 191         int i;
 192         int numsources;
 193
 194         for ( i = 0; elogs[i]; i++ ) {
 195                 if ( strequal( elogs[i], eventlog ) )
 196                         break;
 197         }
 198
 199         if ( !elogs[i] ) {
 200                 DEBUG( 0,
 201                        ( "Eventlog [%s] not found in list of valid event logs\n",
 202                          eventlog ) );
 203                 return False;   /* invalid named passed in */
 204         }
 205
 206         /* have to assume that the evenlog key itself exists at this point */
 207         /* add in a key of [sourcename] under the eventlog key */
 208
 209         /* todo add to Sources */
 210
 211         if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) {
 212                 DEBUG( 0, ( "talloc() failure!\n" ) );
 213                 return False;
 214         }
 215
 216         pstr_sprintf( evtlogpath, "%s\\%s", KEY_EVENTLOG, eventlog );
 217
 218         regdb_fetch_values( evtlogpath, values );
 219
 220
 221         if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
 222                 DEBUG( 0, ( "No Sources value for [%s]!\n", eventlog ) );
 223                 return False;
 224         }
 225         /* perhaps this adding a new string to a multi_sz should be a fn? */
 226         /* check to see if it's there already */
 227
 228         if ( rval->type != REG_MULTI_SZ ) {
 229                 DEBUG( 0,
 230                        ( "Wrong type for Sources, should be REG_MULTI_SZ\n" ) );
 231                 return False;
 232         }
 233         /* convert to a 'regulah' chars to do some comparisons */
 234
 235         already_in = False;
 236         wrklist = NULL;
 237         dump_data( 1, (const char *)rval->data_p, rval->size );
 238         if ( ( numsources =
 239                regval_convert_multi_sz( ( uint16 * ) rval->data_p, rval->size,
 240                                         &wrklist ) ) > 0 ) {
 241
 242                 ii = numsources;
 243                 /* see if it's in there already */
 244                 wp = wrklist;
 245
 246                 while ( ii && wp && *wp ) {
 247                         if ( strequal( *wp, sourcename ) ) {
 248                                 DEBUG( 5,
 249                                        ( "Source name [%s] already in list for [%s] \n",
 250                                          sourcename, eventlog ) );
 251                                 already_in = True;
 252                                 break;
 253                         }
 254                         wp++;
 255                         ii--;
 256                 }
 257         } else {
 258                 if ( numsources < 0 ) {
 259                         DEBUG( 3, ( "problem in getting the sources\n" ) );
 260                         return False;
 261                 }
 262                 DEBUG( 3,
 263                        ( "Nothing in the sources list, this might be a problem\n" ) );
 264         }
 265
 266         wp = wrklist;
 267
 268         if ( !already_in ) {
 269                 /* make a new list with an additional entry; copy values, add another */
 270                 wp = TALLOC_ARRAY( NULL, char *, numsources + 2 );
 271
 272                 if ( !wp ) {
 273                         DEBUG( 0, ( "talloc() failed \n" ) );
 274                         return False;
 275                 }
 276                 memcpy( wp, wrklist, sizeof( char * ) * numsources );
 277                 *( wp + numsources ) = ( char * ) sourcename;
 278                 *( wp + numsources + 1 ) = NULL;
 279                 mbytes = regval_build_multi_sz( wp, &msz_wp );
 280                 dump_data( 1, ( char * ) msz_wp, mbytes );
 281                 regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
 282                                      ( char * ) msz_wp, mbytes );
 283                 regdb_store_values( evtlogpath, values );
 284                 TALLOC_FREE( msz_wp );
 285         } else {
 286                 DEBUG( 3,
 287                        ( "Source name [%s] found in existing list of sources\n",
 288                          sourcename ) );
 289         }
 290         TALLOC_FREE( values );
 291         if ( wrklist )
 292                 TALLOC_FREE( wrklist ); /*  */
 293
 294         if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) {
 295                 DEBUG( 0, ( "talloc() failure!\n" ) );
 296                 return False;
 297         }
 298         pstr_sprintf( evtlogpath, "%s\\%s", KEY_EVENTLOG, eventlog );
 299
 300         regdb_fetch_keys( evtlogpath, subkeys );
 301
 302         if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
 303                 DEBUG( 5,
 304                        ( " Source name [%s] for eventlog [%s] didn't exist, adding \n",
 305                          sourcename, eventlog ) );
 306                 regsubkey_ctr_addkey( subkeys, sourcename );
 307                 if ( !regdb_store_keys( evtlogpath, subkeys ) )
 308                         return False;
 309         }
 310         TALLOC_FREE( subkeys );
 311
 312         /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
 313
 314         /* now allocate room for the source's subkeys */
 315
 316         if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) {
 317                 DEBUG( 0, ( "talloc() failure!\n" ) );
 318                 return False;
 319         }
 320         slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s\\%s",
 321                   KEY_EVENTLOG, eventlog, sourcename );
 322
 323         regdb_fetch_keys( evtlogpath, subkeys );
 324
 325         /* now add the values to the KEY_EVENTLOG/Application form key */
 326         if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) {
 327                 DEBUG( 0, ( "talloc() failure!\n" ) );
 328                 return False;
 329         }
 330         DEBUG( 5,
 331                ( "Storing EventMessageFile [%s] to eventlog path of [%s]\n",
 332                  messagefile, evtlogpath ) );
 333
 334         regdb_fetch_values( evtlogpath, values );
 335
 336         init_unistr2( &data, messagefile, UNI_STR_TERMINATE );
 337
 338         regval_ctr_addvalue( values, "EventMessageFile", REG_SZ,
 339                              ( char * ) data.buffer,
 340                              data.uni_str_len * sizeof( uint16 ) );
 341         regdb_store_values( evtlogpath, values );
 342
 343         TALLOC_FREE( values );
 344
 345         return True;
 346 }