source/rpc_parse/parse_eventlog.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1999,
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1999,
   7  *  Copyright (C) Jean François Micouleau      1998-1999.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24 #include "includes.h"
  25 #include "rpc_parse.h"
  26
  27 extern int DEBUGLEVEL;
  28
  29 /*******************************************************************
  30 ********************************************************************/
  31 BOOL make_eventlog_q_open(EVENTLOG_Q_OPEN *q_u, const char *journal, char *unk)
  32 {
  33         int len_journal = journal != NULL ? strlen(journal) : 0;
  34         int len_unk = unk != NULL ? strlen(unk) : 0;
  35
  36         q_u->ptr0=0x1;
  37         q_u->unk0=0x5c;
  38         q_u->unk1=0x01;
  39
  40         make_uni_hdr(&(q_u->hdr_source), len_journal);
  41         make_unistr2(&(q_u->uni_source), journal, len_journal);
  42
  43         make_uni_hdr(&(q_u->hdr_unk), len_unk);
  44         make_unistr2(&(q_u->uni_unk), unk, len_unk);
  45
  46         q_u->unk6=0x01; /* one of these is an access mask! */
  47         q_u->unk7=0x01; /* one of these is an access mask! */
  48
  49         return True;
  50 }
  51
  52 /*******************************************************************
  53 ********************************************************************/
  54 BOOL eventlog_io_q_open(char *desc, EVENTLOG_Q_OPEN *q_u, prs_struct *ps, int depth)
  55 {
  56         prs_debug(ps, depth, desc, "eventlog_io_q_open");
  57         depth++;
  58
  59         prs_align(ps);
  60
  61         prs_uint32("ptr0", ps, depth, &(q_u->ptr0));
  62
  63         prs_uint16("unk0", ps, depth, &(q_u->unk0));
  64         prs_uint16("unk1", ps, depth, &(q_u->unk1));
  65
  66         smb_io_unihdr("hdr_source", &(q_u->hdr_source), ps, depth);
  67         smb_io_unistr2("uni_source", &(q_u->uni_source),
  68                        q_u->hdr_source.buffer, ps, depth);
  69         prs_align(ps);
  70
  71         smb_io_unihdr("hdr_unk", &(q_u->hdr_unk), ps, depth);
  72         smb_io_unistr2("uni_unk", &(q_u->uni_unk),
  73                        q_u->hdr_unk.buffer, ps, depth);
  74         prs_align(ps);
  75
  76         prs_uint32("unk6", ps, depth, &(q_u->unk6));
  77         prs_uint32("unk7", ps, depth, &(q_u->unk7));
  78
  79         return True;
  80 }
  81
  82 /*******************************************************************
  83 ********************************************************************/
  84 BOOL eventlog_io_r_open(char *desc, EVENTLOG_R_OPEN *r_u, prs_struct *ps, int depth)
  85 {
  86         prs_debug(ps, depth, desc, "eventlog_io_r_open");
  87         depth++;
  88
  89         prs_align(ps);
  90         smb_io_pol_hnd("", &(r_u->pol), ps, depth);
  91         prs_uint32("status", ps, depth, &(r_u->status));
  92
  93         return True;
  94 }
  95
  96 /*******************************************************************
  97 ********************************************************************/
  98 BOOL make_eventlog_q_close(EVENTLOG_Q_CLOSE *q_u, POLICY_HND *pol)
  99 {
 100         if ((q_u == NULL) || (pol == NULL))
 101         {
 102                 return False;
 103         }
 104
 105         q_u->pol = *pol;
 106
 107         return True;
 108 }
 109
 110 /*******************************************************************
 111 ********************************************************************/
 112 BOOL eventlog_io_q_close(char *desc, EVENTLOG_Q_CLOSE *q_u, prs_struct *ps, int depth)
 113 {
 114         prs_debug(ps, depth, desc, "eventlog_io_q_close");
 115         depth++;
 116
 117         prs_align(ps);
 118         smb_io_pol_hnd("", &(q_u->pol), ps, depth);
 119
 120         return True;
 121 }
 122
 123 /*******************************************************************
 124 ********************************************************************/
 125 BOOL eventlog_io_r_close(char *desc, EVENTLOG_R_CLOSE *r_u, prs_struct *ps, int depth)
 126 {
 127         prs_debug(ps, depth, desc, "eventlog_io_r_close");
 128         depth++;
 129
 130         prs_align(ps);
 131         smb_io_pol_hnd("", &(r_u->pol), ps, depth);
 132         prs_uint32("status", ps, depth, &(r_u->status));
 133
 134         return True;
 135 }
 136
 137 /*******************************************************************
 138 ********************************************************************/
 139 BOOL make_eventlog_q_numofeventlogrec(EVENTLOG_Q_NUMOFEVENTLOGREC *q_u, POLICY_HND *pol)
 140 {
 141         if ((q_u == NULL) || (pol == NULL))
 142         {
 143                 return False;
 144         }
 145
 146         q_u->pol = *pol;
 147
 148         return True;
 149 }
 150
 151 /*******************************************************************
 152 ********************************************************************/
 153 BOOL eventlog_io_q_numofeventlogrec(char *desc,EVENTLOG_Q_NUMOFEVENTLOGREC  *q_u, prs_struct *ps, int depth)
 154 {
 155         prs_debug(ps, depth, desc, "eventlog_io_q_numofeventlogrec");
 156         depth++;
 157
 158         prs_align(ps);
 159         smb_io_pol_hnd("", &(q_u->pol), ps, depth);
 160
 161         return True;
 162 }
 163
 164 /*******************************************************************
 165 ********************************************************************/
 166 BOOL eventlog_io_r_numofeventlogrec(char *desc, EVENTLOG_R_NUMOFEVENTLOGREC *r_u, prs_struct *ps, int depth)
 167 {
 168         prs_debug(ps, depth, desc, "eventlog_io_r_numofeventlogrec");
 169         depth++;
 170
 171         prs_align(ps);
 172         prs_uint32("number", ps, depth, &(r_u->number));
 173         prs_uint32("status", ps, depth, &(r_u->status));
 174
 175         return True;
 176 }
 177
 178 /*******************************************************************
 179 ********************************************************************/
 180 BOOL make_eventlog_q_readeventlog(EVENTLOG_Q_READEVENTLOG *q_u, POLICY_HND *pol,
 181                                   uint32 flags, uint32 offset, uint32 number_of_bytes)
 182 {
 183         if ((q_u == NULL) || (pol == NULL))
 184         {
 185                 return False;
 186         }
 187
 188         q_u->pol = *pol;
 189         q_u->flags = flags;
 190         q_u->offset = offset;
 191         q_u->number_of_bytes = number_of_bytes;
 192
 193         return True;
 194 }
 195
 196 /*******************************************************************
 197 ********************************************************************/
 198 BOOL eventlog_io_q_readeventlog(char *desc, EVENTLOG_Q_READEVENTLOG *q_u, prs_struct *ps, int depth)
 199 {
 200         prs_debug(ps, depth, desc, "eventlog_io_q_readeventlog");
 201         depth++;
 202
 203         prs_align(ps);
 204         smb_io_pol_hnd("", &(q_u->pol), ps, depth);
 205         prs_uint32("flags",           ps, depth, &(q_u->flags));
 206         prs_uint32("offset",          ps, depth, &(q_u->offset));
 207         prs_uint32("number_of_bytes", ps, depth, &(q_u->number_of_bytes));
 208
 209         return True;
 210 }
 211
 212 /*******************************************************************
 213 ********************************************************************/
 214 static BOOL eventlog_io_eventlog(char *desc, EVENTLOGRECORD *ev, prs_struct *ps, int depth)
 215 {
 216         prs_debug(ps, depth, desc, "eventlog_io_eventlog");
 217         depth++;
 218
 219         prs_align(ps);
 220         prs_uint32("size", ps, depth, &(ev->size));
 221         prs_uint32("reserved", ps, depth, &(ev->reserved));
 222         prs_uint32("recordnumber", ps, depth, &(ev->recordnumber));
 223         prs_uint32("creationtime", ps, depth, &(ev->creationtime));
 224         prs_uint32("writetime", ps, depth, &(ev->writetime));
 225         prs_uint32("eventnumber", ps, depth, &(ev->eventnumber));
 226
 227         prs_uint16("eventtype", ps, depth, &(ev->eventtype));
 228         prs_uint16("num_of_strings", ps, depth, &(ev->num_of_strings));
 229         prs_uint16("category", ps, depth, &(ev->category));
 230         prs_uint16("reserved_flag", ps, depth, &(ev->reserved_flag));
 231
 232         prs_uint32("closingrecord", ps, depth, &(ev->closingrecord));
 233         prs_uint32("stringoffset", ps, depth, &(ev->stringoffset));
 234         prs_uint32("sid_length", ps, depth, &(ev->sid_length));
 235         prs_uint32("sid_offset", ps, depth, &(ev->sid_offset));
 236         prs_uint32("data_length", ps, depth, &(ev->data_length));
 237         prs_uint32("data_offset", ps, depth, &(ev->data_offset));
 238
 239         smb_io_unistr("", &(ev->sourcename), ps, depth);
 240         smb_io_unistr("", &(ev->computername), ps, depth);
 241
 242         if (ev->sid_length!=0)
 243                 smb_io_unistr("", &(ev->sid), ps, depth);
 244
 245         if (ev->num_of_strings!=0)
 246                 smb_io_unistr("", &(ev->strings),ps, depth);
 247
 248         if (ev->data_length)
 249                 smb_io_unistr("", &(ev->data), ps, depth);
 250
 251         prs_uint32("size2", ps, depth, &(ev->size2));
 252
 253         return True;
 254 }
 255
 256 /*******************************************************************
 257 ********************************************************************/
 258 BOOL eventlog_io_r_readeventlog(char *desc, EVENTLOG_R_READEVENTLOG *r_u, prs_struct *ps, int depth)
 259 {
 260         prs_debug(ps, depth, desc, "eventlog_io_r_readeventlog");
 261         depth++;
 262
 263         prs_align(ps);
 264         prs_uint32("number_of_bytes", ps, depth, &(r_u->number_of_bytes));
 265
 266         if (r_u->number_of_bytes!= 0)
 267                 eventlog_io_eventlog("", r_u->event, ps, depth);
 268
 269         prs_uint32("sent_size", ps, depth, &(r_u->sent_size));
 270         prs_uint32("real_size", ps, depth, &(r_u->real_size));
 271         prs_uint32("status", ps, depth, &(r_u->status));
 272
 273         return True;
 274 }
 275