source/registry/reg_eventlog.c

   1
   2 /*
   3  *  Unix SMB/CIFS implementation.
   4  *  Virtual Windows Registry Layer
   5  *  Copyright (C) Marcin Krzysztof Porwit    2005,
   6  *  Copyright (C) Brian Moran                2005.
   7  *  Copyright (C) Gerald (Jerry) Carter      2005.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_REGISTRY
  27
  28 /**********************************************************************
  29  for an eventlog, add in the default values
  30 *********************************************************************/
  31
  32 bool eventlog_init_keys(void)
  33 {
  34         /* Find all of the eventlogs, add keys for each of them */
  35         const char **elogs = lp_eventlog_list();
  36         char *evtlogpath = NULL;
  37         char *evtfilepath = NULL;
  38         REGSUBKEY_CTR *subkeys;
  39         REGVAL_CTR *values;
  40         uint32 uiMaxSize;
  41         uint32 uiRetention;
  42         uint32 uiCategoryCount;
  43         UNISTR2 data;
  44         TALLOC_CTX *ctx = talloc_tos();
  45
  46         while (elogs && *elogs) {
  47                 if (!(subkeys = TALLOC_ZERO_P(ctx, REGSUBKEY_CTR ) ) ) {
  48                         DEBUG( 0, ( "talloc() failure!\n" ) );
  49                         return False;
  50                 }
  51                 regdb_fetch_keys(KEY_EVENTLOG, subkeys);
  52                 regsubkey_ctr_addkey( subkeys, *elogs );
  53                 if ( !regdb_store_keys( KEY_EVENTLOG, subkeys ) ) {
  54                         TALLOC_FREE(subkeys);
  55                         return False;
  56                 }
  57                 TALLOC_FREE(subkeys);
  58
  59                 /* add in the key of form KEY_EVENTLOG/Application */
  60                 DEBUG( 5,
  61                        ( "Adding key of [%s] to path of [%s]\n", *elogs,
  62                          KEY_EVENTLOG ) );
  63
  64                 evtlogpath = talloc_asprintf(ctx, "%s\\%s",
  65                           KEY_EVENTLOG, *elogs);
  66                 if (!evtlogpath) {
  67                         return false;
  68                 }
  69                 /* add in the key of form KEY_EVENTLOG/Application/Application */
  70                 DEBUG( 5,
  71                        ( "Adding key of [%s] to path of [%s]\n", *elogs,
  72                          evtlogpath ) );
  73                 if (!(subkeys = TALLOC_ZERO_P(ctx, REGSUBKEY_CTR))) {
  74                         DEBUG( 0, ( "talloc() failure!\n" ) );
  75                         return False;
  76                 }
  77                 regdb_fetch_keys( evtlogpath, subkeys );
  78                 regsubkey_ctr_addkey( subkeys, *elogs );
  79
  80                 if ( !regdb_store_keys( evtlogpath, subkeys ) ) {
  81                         TALLOC_FREE(subkeys);
  82                         return False;
  83                 }
  84                 TALLOC_FREE( subkeys );
  85
  86                 /* now add the values to the KEY_EVENTLOG/Application form key */
  87                 if (!(values = TALLOC_ZERO_P(ctx, REGVAL_CTR))) {
  88                         DEBUG( 0, ( "talloc() failure!\n" ) );
  89                         return False;
  90                 }
  91                 DEBUG( 5,
  92                        ( "Storing values to eventlog path of [%s]\n",
  93                          evtlogpath ) );
  94                 regdb_fetch_values( evtlogpath, values );
  95
  96
  97                 if (!regval_ctr_key_exists(values, "MaxSize")) {
  98
  99                         /* assume we have none, add them all */
 100
 101                         /* hard code some initial values */
 102
 103                         /* uiDisplayNameId = 0x00000100; */
 104                         uiMaxSize = 0x00080000;
 105                         uiRetention = 0x93A80;
 106
 107                         regval_ctr_addvalue(values, "MaxSize", REG_DWORD,
 108                                              (char *)&uiMaxSize,
 109                                              sizeof(uint32));
 110
 111                         regval_ctr_addvalue(values, "Retention", REG_DWORD,
 112                                              (char *)&uiRetention,
 113                                              sizeof(uint32));
 114                         init_unistr2(&data, *elogs, UNI_STR_TERMINATE);
 115
 116                         regval_ctr_addvalue(values, "PrimaryModule", REG_SZ,
 117                                              (char *)data.buffer,
 118                                              data.uni_str_len *
 119                                              sizeof(uint16));
 120                         init_unistr2(&data, *elogs, UNI_STR_TERMINATE);
 121
 122                         regval_ctr_addvalue(values, "Sources", REG_MULTI_SZ,
 123                                              (char *)data.buffer,
 124                                              data.uni_str_len *
 125                                              sizeof(uint16));
 126
 127                         evtfilepath = talloc_asprintf(ctx,
 128                                         "%%SystemRoot%%\\system32\\config\\%s.tdb",
 129                                         *elogs);
 130                         if (!evtfilepath) {
 131                                 TALLOC_FREE(values);
 132                         }
 133                         init_unistr2(&data, evtfilepath, UNI_STR_TERMINATE);
 134                         regval_ctr_addvalue(values, "File", REG_EXPAND_SZ, (char *)data.buffer,
 135                                              data.uni_str_len * sizeof(uint16));
 136                         regdb_store_values(evtlogpath, values);
 137
 138                 }
 139
 140                 TALLOC_FREE(values);
 141
 142                 /* now do the values under KEY_EVENTLOG/Application/Application */
 143                 TALLOC_FREE(evtlogpath);
 144                 evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
 145                           KEY_EVENTLOG, *elogs, *elogs);
 146                 if (!evtlogpath) {
 147                         return false;
 148                 }
 149                 if (!(values = TALLOC_ZERO_P(ctx, REGVAL_CTR))) {
 150                         DEBUG( 0, ( "talloc() failure!\n" ) );
 151                         return False;
 152                 }
 153                 DEBUG( 5,
 154                        ( "Storing values to eventlog path of [%s]\n",
 155                          evtlogpath));
 156                 regdb_fetch_values(evtlogpath, values);
 157                 if (!regval_ctr_key_exists( values, "CategoryCount")) {
 158
 159                         /* hard code some initial values */
 160
 161                         uiCategoryCount = 0x00000007;
 162                         regval_ctr_addvalue( values, "CategoryCount",
 163                                              REG_DWORD,
 164                                              ( char * ) &uiCategoryCount,
 165                                              sizeof( uint32 ) );
 166                         init_unistr2( &data,
 167                                       "%SystemRoot%\\system32\\eventlog.dll",
 168                                       UNI_STR_TERMINATE );
 169
 170                         regval_ctr_addvalue( values, "CategoryMessageFile",
 171                                              REG_EXPAND_SZ,
 172                                              ( char * ) data.buffer,
 173                                              data.uni_str_len *
 174                                              sizeof( uint16 ) );
 175                         regdb_store_values( evtlogpath, values );
 176                 }
 177                 TALLOC_FREE(values);
 178                 elogs++;
 179         }
 180
 181         return true;
 182 }
 183
 184 /*********************************************************************
 185  for an eventlog, add in a source name. If the eventlog doesn't
 186  exist (not in the list) do nothing.   If a source for the log
 187  already exists, change the information (remove, replace)
 188 *********************************************************************/
 189
 190 bool eventlog_add_source( const char *eventlog, const char *sourcename,
 191                           const char *messagefile )
 192 {
 193         /* Find all of the eventlogs, add keys for each of them */
 194         /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
 195            need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
 196
 197         const char **elogs = lp_eventlog_list(  );
 198         char **wrklist, **wp;
 199         char *evtlogpath = NULL;
 200         REGSUBKEY_CTR *subkeys;
 201         REGVAL_CTR *values;
 202         REGISTRY_VALUE *rval;
 203         UNISTR2 data;
 204         uint16 *msz_wp;
 205         int mbytes, ii;
 206         bool already_in;
 207         int i;
 208         int numsources;
 209         TALLOC_CTX *ctx = talloc_tos();
 210
 211         if (!elogs) {
 212                 return False;
 213         }
 214
 215         for ( i = 0; elogs[i]; i++ ) {
 216                 if ( strequal( elogs[i], eventlog ) )
 217                         break;
 218         }
 219
 220         if ( !elogs[i] ) {
 221                 DEBUG( 0,
 222                        ( "Eventlog [%s] not found in list of valid event logs\n",
 223                          eventlog ) );
 224                 return false;   /* invalid named passed in */
 225         }
 226
 227         /* have to assume that the evenlog key itself exists at this point */
 228         /* add in a key of [sourcename] under the eventlog key */
 229
 230         /* todo add to Sources */
 231
 232         if (!( values = TALLOC_ZERO_P(ctx, REGVAL_CTR))) {
 233                 DEBUG( 0, ( "talloc() failure!\n" ));
 234                 return false;
 235         }
 236
 237         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog);
 238         if (!evtlogpath) {
 239                 TALLOC_FREE(values);
 240                 return false;
 241         }
 242
 243         regdb_fetch_values( evtlogpath, values );
 244
 245
 246         if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
 247                 DEBUG( 0, ( "No Sources value for [%s]!\n", eventlog ) );
 248                 return False;
 249         }
 250         /* perhaps this adding a new string to a multi_sz should be a fn? */
 251         /* check to see if it's there already */
 252
 253         if ( rval->type != REG_MULTI_SZ ) {
 254                 DEBUG( 0,
 255                        ( "Wrong type for Sources, should be REG_MULTI_SZ\n" ) );
 256                 return False;
 257         }
 258         /* convert to a 'regulah' chars to do some comparisons */
 259
 260         already_in = False;
 261         wrklist = NULL;
 262         dump_data( 1, rval->data_p, rval->size );
 263         if ( ( numsources =
 264                regval_convert_multi_sz( ( uint16 * ) rval->data_p, rval->size,
 265                                         &wrklist ) ) > 0 ) {
 266
 267                 ii = numsources;
 268                 /* see if it's in there already */
 269                 wp = wrklist;
 270
 271                 while ( ii && wp && *wp ) {
 272                         if ( strequal( *wp, sourcename ) ) {
 273                                 DEBUG( 5,
 274                                        ( "Source name [%s] already in list for [%s] \n",
 275                                          sourcename, eventlog ) );
 276                                 already_in = True;
 277                                 break;
 278                         }
 279                         wp++;
 280                         ii--;
 281                 }
 282         } else {
 283                 if ( numsources < 0 ) {
 284                         DEBUG( 3, ( "problem in getting the sources\n" ) );
 285                         return False;
 286                 }
 287                 DEBUG( 3,
 288                        ( "Nothing in the sources list, this might be a problem\n" ) );
 289         }
 290
 291         wp = wrklist;
 292
 293         if ( !already_in ) {
 294                 /* make a new list with an additional entry; copy values, add another */
 295                 wp = TALLOC_ARRAY(ctx, char *, numsources + 2 );
 296
 297                 if ( !wp ) {
 298                         DEBUG( 0, ( "talloc() failed \n" ) );
 299                         return False;
 300                 }
 301                 memcpy( wp, wrklist, sizeof( char * ) * numsources );
 302                 *( wp + numsources ) = ( char * ) sourcename;
 303                 *( wp + numsources + 1 ) = NULL;
 304                 mbytes = regval_build_multi_sz( wp, &msz_wp );
 305                 dump_data( 1, ( uint8 * ) msz_wp, mbytes );
 306                 regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
 307                                      ( char * ) msz_wp, mbytes );
 308                 regdb_store_values( evtlogpath, values );
 309                 TALLOC_FREE(msz_wp);
 310         } else {
 311                 DEBUG( 3,
 312                        ( "Source name [%s] found in existing list of sources\n",
 313                          sourcename ) );
 314         }
 315         TALLOC_FREE(values);
 316         TALLOC_FREE(wrklist);   /*  */
 317
 318         if ( !( subkeys = TALLOC_ZERO_P(ctx, REGSUBKEY_CTR ) ) ) {
 319                 DEBUG( 0, ( "talloc() failure!\n" ) );
 320                 return False;
 321         }
 322         TALLOC_FREE(evtlogpath);
 323         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog );
 324         if (!evtlogpath) {
 325                 TALLOC_FREE(subkeys);
 326                 return false;
 327         }
 328
 329         regdb_fetch_keys( evtlogpath, subkeys );
 330
 331         if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
 332                 DEBUG( 5,
 333                        ( " Source name [%s] for eventlog [%s] didn't exist, adding \n",
 334                          sourcename, eventlog ) );
 335                 regsubkey_ctr_addkey( subkeys, sourcename );
 336                 if ( !regdb_store_keys( evtlogpath, subkeys ) )
 337                         return False;
 338         }
 339         TALLOC_FREE(subkeys);
 340
 341         /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
 342
 343         /* now allocate room for the source's subkeys */
 344
 345         if ( !( subkeys = TALLOC_ZERO_P(ctx, REGSUBKEY_CTR ) ) ) {
 346                 DEBUG( 0, ( "talloc() failure!\n" ) );
 347                 return False;
 348         }
 349         TALLOC_FREE(evtlogpath);
 350         evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
 351                   KEY_EVENTLOG, eventlog, sourcename);
 352         if (!evtlogpath) {
 353                 TALLOC_FREE(subkeys);
 354                 return false;
 355         }
 356
 357         regdb_fetch_keys( evtlogpath, subkeys );
 358
 359         /* now add the values to the KEY_EVENTLOG/Application form key */
 360         if ( !( values = TALLOC_ZERO_P(ctx, REGVAL_CTR ) ) ) {
 361                 DEBUG( 0, ( "talloc() failure!\n" ) );
 362                 return False;
 363         }
 364         DEBUG( 5,
 365                ( "Storing EventMessageFile [%s] to eventlog path of [%s]\n",
 366                  messagefile, evtlogpath ) );
 367
 368         regdb_fetch_values( evtlogpath, values );
 369
 370         init_unistr2( &data, messagefile, UNI_STR_TERMINATE );
 371
 372         regval_ctr_addvalue( values, "EventMessageFile", REG_SZ,
 373                              ( char * ) data.buffer,
 374                              data.uni_str_len * sizeof( uint16 ) );
 375         regdb_store_values( evtlogpath, values );
 376
 377         TALLOC_FREE(values);
 378
 379         return True;
 380 }