source3/registry/reg_eventlog.c

   1
   2 /*
   3  *  Unix SMB/CIFS implementation.
   4  *  Virtual Windows Registry Layer
   5  *  Copyright (C) Marcin Krzysztof Porwit    2005,
   6  *  Copyright (C) Brian Moran                2005.
   7  *  Copyright (C) Gerald (Jerry) Carter      2005.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 3 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include "includes.h"
  24 #include "registry.h"
  25 #include "reg_backend_db.h"
  26 #include "reg_eventlog.h"
  27 #include "reg_objects.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_REGISTRY
  31
  32 /**********************************************************************
  33  for an eventlog, add in the default values
  34 *********************************************************************/
  35
  36 bool eventlog_init_keys(void)
  37 {
  38         /* Find all of the eventlogs, add keys for each of them */
  39         const char **elogs = lp_eventlog_list();
  40         char *evtlogpath = NULL;
  41         char *evtfilepath = NULL;
  42         struct regsubkey_ctr *subkeys;
  43         struct regval_ctr *values;
  44         uint32 uiMaxSize;
  45         uint32 uiRetention;
  46         uint32 uiCategoryCount;
  47         DATA_BLOB data;
  48         TALLOC_CTX *ctx = talloc_tos();
  49         WERROR werr;
  50
  51         while (elogs && *elogs) {
  52                 werr = regsubkey_ctr_init(ctx, &subkeys);
  53                 if (!W_ERROR_IS_OK(werr)) {
  54                         DEBUG( 0, ( "talloc() failure!\n" ) );
  55                         return False;
  56                 }
  57                 regdb_fetch_keys(KEY_EVENTLOG, subkeys);
  58                 regsubkey_ctr_addkey( subkeys, *elogs );
  59                 if ( !regdb_store_keys( KEY_EVENTLOG, subkeys ) ) {
  60                         TALLOC_FREE(subkeys);
  61                         return False;
  62                 }
  63                 TALLOC_FREE(subkeys);
  64
  65                 /* add in the key of form KEY_EVENTLOG/Application */
  66                 DEBUG( 5,
  67                        ( "Adding key of [%s] to path of [%s]\n", *elogs,
  68                          KEY_EVENTLOG ) );
  69
  70                 evtlogpath = talloc_asprintf(ctx, "%s\\%s",
  71                           KEY_EVENTLOG, *elogs);
  72                 if (!evtlogpath) {
  73                         return false;
  74                 }
  75                 /* add in the key of form KEY_EVENTLOG/Application/Application */
  76                 DEBUG( 5,
  77                        ( "Adding key of [%s] to path of [%s]\n", *elogs,
  78                          evtlogpath ) );
  79                 werr = regsubkey_ctr_init(ctx, &subkeys);
  80                 if (!W_ERROR_IS_OK(werr)) {
  81                         DEBUG( 0, ( "talloc() failure!\n" ) );
  82                         return False;
  83                 }
  84                 regdb_fetch_keys( evtlogpath, subkeys );
  85                 regsubkey_ctr_addkey( subkeys, *elogs );
  86
  87                 if ( !regdb_store_keys( evtlogpath, subkeys ) ) {
  88                         TALLOC_FREE(subkeys);
  89                         return False;
  90                 }
  91                 TALLOC_FREE( subkeys );
  92
  93                 /* now add the values to the KEY_EVENTLOG/Application form key */
  94
  95                 werr = regval_ctr_init(ctx, &values);
  96                 if (!W_ERROR_IS_OK(werr)) {
  97                         DEBUG( 0, ( "talloc() failure!\n" ) );
  98                         return False;
  99                 }
 100                 DEBUG( 5,
 101                        ( "Storing values to eventlog path of [%s]\n",
 102                          evtlogpath ) );
 103                 regdb_fetch_values( evtlogpath, values );
 104
 105
 106                 if (!regval_ctr_key_exists(values, "MaxSize")) {
 107
 108                         /* assume we have none, add them all */
 109
 110                         /* hard code some initial values */
 111
 112                         /* uiDisplayNameId = 0x00000100; */
 113                         uiMaxSize = 0x00080000;
 114                         uiRetention = 0x93A80;
 115
 116                         regval_ctr_addvalue(values, "MaxSize", REG_DWORD,
 117                                              (uint8 *)&uiMaxSize,
 118                                              sizeof(uint32));
 119
 120                         regval_ctr_addvalue(values, "Retention", REG_DWORD,
 121                                              (uint8 *)&uiRetention,
 122                                              sizeof(uint32));
 123
 124                         regval_ctr_addvalue_sz(values, "PrimaryModule", *elogs);
 125                         push_reg_sz(talloc_tos(), &data, *elogs);
 126
 127                         regval_ctr_addvalue(values, "Sources", REG_MULTI_SZ,
 128                                              data.data,
 129                                              data.length);
 130
 131                         evtfilepath = talloc_asprintf(ctx,
 132                                         "%%SystemRoot%%\\system32\\config\\%s.tdb",
 133                                         *elogs);
 134                         if (!evtfilepath) {
 135                                 TALLOC_FREE(values);
 136                         }
 137                         push_reg_sz(talloc_tos(), &data, evtfilepath);
 138                         regval_ctr_addvalue(values, "File", REG_EXPAND_SZ, data.data,
 139                                              data.length);
 140                         regdb_store_values(evtlogpath, values);
 141
 142                 }
 143
 144                 TALLOC_FREE(values);
 145
 146                 /* now do the values under KEY_EVENTLOG/Application/Application */
 147                 TALLOC_FREE(evtlogpath);
 148                 evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
 149                           KEY_EVENTLOG, *elogs, *elogs);
 150                 if (!evtlogpath) {
 151                         return false;
 152                 }
 153
 154                 werr = regval_ctr_init(ctx, &values);
 155                 if (!W_ERROR_IS_OK(werr)) {
 156                         DEBUG( 0, ( "talloc() failure!\n" ) );
 157                         return False;
 158                 }
 159                 DEBUG( 5,
 160                        ( "Storing values to eventlog path of [%s]\n",
 161                          evtlogpath));
 162                 regdb_fetch_values(evtlogpath, values);
 163                 if (!regval_ctr_key_exists( values, "CategoryCount")) {
 164
 165                         /* hard code some initial values */
 166
 167                         uiCategoryCount = 0x00000007;
 168                         regval_ctr_addvalue( values, "CategoryCount",
 169                                              REG_DWORD,
 170                                              (uint8 *) &uiCategoryCount,
 171                                              sizeof( uint32 ) );
 172                         push_reg_sz(talloc_tos(), &data,
 173                                       "%SystemRoot%\\system32\\eventlog.dll");
 174
 175                         regval_ctr_addvalue( values, "CategoryMessageFile",
 176                                              REG_EXPAND_SZ,
 177                                              data.data,
 178                                              data.length);
 179                         regdb_store_values( evtlogpath, values );
 180                 }
 181                 TALLOC_FREE(values);
 182                 elogs++;
 183         }
 184
 185         return true;
 186 }
 187
 188 /*********************************************************************
 189  for an eventlog, add in a source name. If the eventlog doesn't
 190  exist (not in the list) do nothing.   If a source for the log
 191  already exists, change the information (remove, replace)
 192 *********************************************************************/
 193
 194 bool eventlog_add_source( const char *eventlog, const char *sourcename,
 195                           const char *messagefile )
 196 {
 197         /* Find all of the eventlogs, add keys for each of them */
 198         /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
 199            need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
 200
 201         const char **elogs = lp_eventlog_list(  );
 202         const char **wrklist, **wp;
 203         char *evtlogpath = NULL;
 204         struct regsubkey_ctr *subkeys;
 205         struct regval_ctr *values;
 206         struct regval_blob *rval;
 207         int ii = 0;
 208         bool already_in;
 209         int i;
 210         int numsources = 0;
 211         TALLOC_CTX *ctx = talloc_tos();
 212         WERROR werr;
 213         DATA_BLOB blob;
 214
 215         if (!elogs) {
 216                 return False;
 217         }
 218
 219         for ( i = 0; elogs[i]; i++ ) {
 220                 if ( strequal( elogs[i], eventlog ) )
 221                         break;
 222         }
 223
 224         if ( !elogs[i] ) {
 225                 DEBUG( 0,
 226                        ( "Eventlog [%s] not found in list of valid event logs\n",
 227                          eventlog ) );
 228                 return false;   /* invalid named passed in */
 229         }
 230
 231         /* have to assume that the evenlog key itself exists at this point */
 232         /* add in a key of [sourcename] under the eventlog key */
 233
 234         /* todo add to Sources */
 235
 236         werr = regval_ctr_init(ctx, &values);
 237         if(!W_ERROR_IS_OK(werr)) {
 238                 DEBUG( 0, ( "talloc() failure!\n" ));
 239                 return false;
 240         }
 241
 242         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog);
 243         if (!evtlogpath) {
 244                 TALLOC_FREE(values);
 245                 return false;
 246         }
 247
 248         regdb_fetch_values( evtlogpath, values );
 249
 250
 251         if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
 252                 DEBUG( 0, ( "No Sources value for [%s]!\n", eventlog ) );
 253                 return False;
 254         }
 255         /* perhaps this adding a new string to a multi_sz should be a fn? */
 256         /* check to see if it's there already */
 257
 258         if ( regval_type(rval) != REG_MULTI_SZ ) {
 259                 DEBUG( 0,
 260                        ( "Wrong type for Sources, should be REG_MULTI_SZ\n" ) );
 261                 return False;
 262         }
 263         /* convert to a 'regulah' chars to do some comparisons */
 264
 265         already_in = False;
 266         wrklist = NULL;
 267         dump_data(1, regval_data_p(rval), regval_size(rval));
 268
 269         blob = data_blob_const(regval_data_p(rval), regval_size(rval));
 270         if (!pull_reg_multi_sz(talloc_tos(), &blob, &wrklist)) {
 271                 return false;
 272         }
 273
 274         for (ii=0; wrklist[ii]; ii++) {
 275                 numsources++;
 276         }
 277
 278         if (numsources > 0) {
 279                 /* see if it's in there already */
 280                 wp = wrklist;
 281
 282                 while (wp && *wp ) {
 283                         if ( strequal( *wp, sourcename ) ) {
 284                                 DEBUG( 5,
 285                                        ( "Source name [%s] already in list for [%s] \n",
 286                                          sourcename, eventlog ) );
 287                                 already_in = True;
 288                                 break;
 289                         }
 290                         wp++;
 291                 }
 292         } else {
 293                 DEBUG( 3,
 294                        ( "Nothing in the sources list, this might be a problem\n" ) );
 295         }
 296
 297         wp = wrklist;
 298
 299         if ( !already_in ) {
 300                 /* make a new list with an additional entry; copy values, add another */
 301                 wp = TALLOC_ARRAY(ctx, const char *, numsources + 2 );
 302
 303                 if ( !wp ) {
 304                         DEBUG( 0, ( "talloc() failed \n" ) );
 305                         return False;
 306                 }
 307                 memcpy( wp, wrklist, sizeof( char * ) * numsources );
 308                 *( wp + numsources ) = ( char * ) sourcename;
 309                 *( wp + numsources + 1 ) = NULL;
 310                 if (!push_reg_multi_sz(ctx, &blob, wp)) {
 311                         return false;
 312                 }
 313                 dump_data( 1, blob.data, blob.length);
 314                 regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
 315                                      blob.data, blob.length);
 316                 regdb_store_values( evtlogpath, values );
 317                 data_blob_free(&blob);
 318         } else {
 319                 DEBUG( 3,
 320                        ( "Source name [%s] found in existing list of sources\n",
 321                          sourcename ) );
 322         }
 323         TALLOC_FREE(values);
 324         TALLOC_FREE(wrklist);   /*  */
 325
 326         werr = regsubkey_ctr_init(ctx, &subkeys);
 327         if (!W_ERROR_IS_OK(werr)) {
 328                 DEBUG( 0, ( "talloc() failure!\n" ) );
 329                 return False;
 330         }
 331         TALLOC_FREE(evtlogpath);
 332         evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog );
 333         if (!evtlogpath) {
 334                 TALLOC_FREE(subkeys);
 335                 return false;
 336         }
 337
 338         regdb_fetch_keys( evtlogpath, subkeys );
 339
 340         if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
 341                 DEBUG( 5,
 342                        ( " Source name [%s] for eventlog [%s] didn't exist, adding \n",
 343                          sourcename, eventlog ) );
 344                 regsubkey_ctr_addkey( subkeys, sourcename );
 345                 if ( !regdb_store_keys( evtlogpath, subkeys ) )
 346                         return False;
 347         }
 348         TALLOC_FREE(subkeys);
 349
 350         /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
 351
 352         /* now allocate room for the source's subkeys */
 353
 354         werr = regsubkey_ctr_init(ctx, &subkeys);
 355         if (!W_ERROR_IS_OK(werr)) {
 356                 DEBUG( 0, ( "talloc() failure!\n" ) );
 357                 return False;
 358         }
 359         TALLOC_FREE(evtlogpath);
 360         evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
 361                   KEY_EVENTLOG, eventlog, sourcename);
 362         if (!evtlogpath) {
 363                 TALLOC_FREE(subkeys);
 364                 return false;
 365         }
 366
 367         regdb_fetch_keys( evtlogpath, subkeys );
 368
 369         /* now add the values to the KEY_EVENTLOG/Application form key */
 370         werr = regval_ctr_init(ctx, &values);
 371         if (!W_ERROR_IS_OK(werr)) {
 372                 DEBUG( 0, ( "talloc() failure!\n" ) );
 373                 return False;
 374         }
 375         DEBUG( 5,
 376                ( "Storing EventMessageFile [%s] to eventlog path of [%s]\n",
 377                  messagefile, evtlogpath ) );
 378
 379         regdb_fetch_values( evtlogpath, values );
 380
 381         regval_ctr_addvalue_sz(values, "EventMessageFile", messagefile);
 382         regdb_store_values( evtlogpath, values );
 383
 384         TALLOC_FREE(values);
 385
 386         return True;
 387 }