source3/rpc_parse/parse_eventlog.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Marcin Krzysztof Porwit    2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21
  22 #undef DBGC_CLASS
  23 #define DBGC_CLASS DBGC_RPC_PARSE
  24
  25 /********************************************************************
  26 ********************************************************************/
  27
  28 bool eventlog_io_q_read_eventlog(const char *desc, EVENTLOG_Q_READ_EVENTLOG *q_u,
  29                                  prs_struct *ps, int depth)
  30 {
  31         if(q_u == NULL)
  32                 return False;
  33
  34         prs_debug(ps, depth, desc, "eventlog_io_q_read_eventlog");
  35         depth++;
  36
  37         if(!(prs_align(ps)))
  38                 return False;
  39
  40         if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
  41                 return False;
  42
  43         if(!(prs_uint32("read flags", ps, depth, &(q_u->flags))))
  44                 return False;
  45
  46         if(!(prs_uint32("read offset", ps, depth, &(q_u->offset))))
  47                 return False;
  48
  49         if(!(prs_uint32("read buf size", ps, depth, &(q_u->max_read_size))))
  50                 return False;
  51
  52         return True;
  53 }
  54
  55 static bool smb_io_eventlog_entry(const char *name, prs_struct *ps, int depth, Eventlog_entry *entry)
  56 {
  57         if(entry == NULL)
  58                 return False;
  59
  60         prs_debug(ps, depth, name, "smb_io_eventlog_entry");
  61         depth++;
  62
  63         if(!prs_align(ps))
  64                 return False;
  65
  66         if(!(prs_uint32("length", ps, depth, &(entry->record.length))))
  67                 return False;
  68         if(!(prs_uint32("reserved", ps, depth, &(entry->record.reserved1))))
  69                 return False;
  70         if(!(prs_uint32("record number", ps, depth, &(entry->record.record_number))))
  71                 return False;
  72         if(!(prs_uint32("time generated", ps, depth, &(entry->record.time_generated))))
  73                 return False;
  74         if(!(prs_uint32("time written", ps, depth, &(entry->record.time_written))))
  75                 return False;
  76         if(!(prs_uint32("event id", ps, depth, &(entry->record.event_id))))
  77                 return False;
  78         if(!(prs_uint16("event type", ps, depth, &(entry->record.event_type))))
  79                 return False;
  80         if(!(prs_uint16("num strings", ps, depth, &(entry->record.num_strings))))
  81                 return False;
  82         if(!(prs_uint16("event category", ps, depth, &(entry->record.event_category))))
  83                 return False;
  84         if(!(prs_uint16("reserved2", ps, depth, &(entry->record.reserved2))))
  85                 return False;
  86         if(!(prs_uint32("closing record", ps, depth, &(entry->record.closing_record_number))))
  87                 return False;
  88         if(!(prs_uint32("string offset", ps, depth, &(entry->record.string_offset))))
  89                 return False;
  90         if(!(prs_uint32("user sid length", ps, depth, &(entry->record.user_sid_length))))
  91                 return False;
  92         if(!(prs_uint32("user sid offset", ps, depth, &(entry->record.user_sid_offset))))
  93                 return False;
  94         if(!(prs_uint32("data length", ps, depth, &(entry->record.data_length))))
  95                 return False;
  96         if(!(prs_uint32("data offset", ps, depth, &(entry->record.data_offset))))
  97                 return False;
  98         if(!(prs_align(ps)))
  99                 return False;
 100
 101         /* Now encoding data */
 102
 103         if(!(prs_uint8s(False, "buffer", ps, depth, entry->data,
 104                 entry->record.length - sizeof(Eventlog_record) - sizeof(entry->record.length))))
 105         {
 106                 return False;
 107         }
 108
 109         if(!(prs_align(ps)))
 110                 return False;
 111
 112         if(!(prs_uint32("length 2", ps, depth, &(entry->record.length))))
 113                         return False;
 114
 115         return True;
 116 }
 117
 118 /** Structure of response seems to be:
 119    DWORD num_bytes_in_resp -- MUST be the same as q_u->max_read_size
 120    for i=0..n
 121        EVENTLOGRECORD record
 122    DWORD sent_size -- sum of EVENTLOGRECORD lengths if records returned, 0 otherwise
 123    DWORD real_size -- 0 if records returned, otherwise length of next record to be returned
 124    WERROR status */
 125 bool eventlog_io_r_read_eventlog(const char *desc,
 126                                  EVENTLOG_Q_READ_EVENTLOG *q_u,
 127                                  EVENTLOG_R_READ_EVENTLOG *r_u,
 128                                  prs_struct *ps,
 129                                  int depth)
 130 {
 131         Eventlog_entry *entry;
 132         uint32 record_written = 0;
 133         uint32 record_total = 0;
 134
 135         if(r_u == NULL)
 136                 return False;
 137
 138         prs_debug(ps, depth, desc, "eventlog_io_r_read_eventlog");
 139         depth++;
 140
 141         /* First, see if we've read more logs than we can output */
 142
 143         if(r_u->num_bytes_in_resp > q_u->max_read_size) {
 144                 entry = r_u->entry;
 145
 146                 /* remove the size of the last entry from the list */
 147
 148                 while(entry->next != NULL)
 149                         entry = entry->next;
 150
 151                 r_u->num_bytes_in_resp -= entry->record.length;
 152
 153                 /* do not output the last log entry */
 154
 155                 r_u->num_records--;
 156         }
 157
 158         entry = r_u->entry;
 159         record_total = r_u->num_records;
 160
 161         if(r_u->num_bytes_in_resp != 0)
 162                 r_u->sent_size = r_u->num_bytes_in_resp;
 163         else
 164                 r_u->real_size = r_u->bytes_in_next_record;
 165
 166         if(!(prs_align(ps)))
 167                 return False;
 168         if(!(prs_uint32("bytes in resp", ps, depth, &(q_u->max_read_size))))
 169                 return False;
 170
 171         while(entry != NULL && record_written < record_total)
 172         {
 173                 DEBUG(11, ("eventlog_io_r_read_eventlog: writing record [%d] out of [%d].\n", record_written, record_total));
 174
 175                 /* Encode the actual eventlog record record */
 176
 177                 if (!(smb_io_eventlog_entry("entry", ps, depth, entry)))
 178                         return false;
 179
 180                 entry = entry->next;
 181                 record_written++;
 182
 183         }       /* end of encoding EVENTLOGRECORD */
 184
 185         /* Now pad with whitespace until the end of the response buffer */
 186
 187         if (q_u->max_read_size - r_u->num_bytes_in_resp) {
 188                 if (!r_u->end_of_entries_padding) {
 189                         return False;
 190                 }
 191
 192                 if(!(prs_uint8s(False, "end of entries padding", ps,
 193                                 depth, r_u->end_of_entries_padding,
 194                                 (q_u->max_read_size - r_u->num_bytes_in_resp)))) {
 195                         free(r_u->end_of_entries_padding);
 196                         return False;
 197                 }
 198
 199                 free(r_u->end_of_entries_padding);
 200         }
 201
 202         /* We had better be DWORD aligned here */
 203
 204         if(!(prs_uint32("sent size", ps, depth, &(r_u->sent_size))))
 205                 return False;
 206         if(!(prs_uint32("real size", ps, depth, &(r_u->real_size))))
 207                 return False;
 208         if(!(prs_ntstatus("status code", ps, depth, &r_u->status)))
 209                 return False;
 210
 211         return True;
 212 }