3 * Unix SMB/CIFS implementation.
4 * Virtual Windows Registry Layer
5 * Copyright (C) Marcin Krzysztof Porwit 2005,
6 * Copyright (C) Brian Moran 2005.
7 * Copyright (C) Gerald (Jerry) Carter 2005.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 3 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 #include "reg_backend_db.h"
26 #include "reg_eventlog.h"
29 #define DBGC_CLASS DBGC_REGISTRY
31 /**********************************************************************
32 for an eventlog, add in the default values
33 *********************************************************************/
35 bool eventlog_init_keys(void)
37 /* Find all of the eventlogs, add keys for each of them */
38 const char **elogs
= lp_eventlog_list();
39 char *evtlogpath
= NULL
;
40 char *evtfilepath
= NULL
;
41 struct regsubkey_ctr
*subkeys
;
42 struct regval_ctr
*values
;
45 uint32 uiCategoryCount
;
47 TALLOC_CTX
*ctx
= talloc_tos();
50 while (elogs
&& *elogs
) {
51 werr
= regsubkey_ctr_init(ctx
, &subkeys
);
52 if (!W_ERROR_IS_OK(werr
)) {
53 DEBUG( 0, ( "talloc() failure!\n" ) );
56 regdb_fetch_keys(KEY_EVENTLOG
, subkeys
);
57 regsubkey_ctr_addkey( subkeys
, *elogs
);
58 if ( !regdb_store_keys( KEY_EVENTLOG
, subkeys
) ) {
64 /* add in the key of form KEY_EVENTLOG/Application */
66 ( "Adding key of [%s] to path of [%s]\n", *elogs
,
69 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s",
70 KEY_EVENTLOG
, *elogs
);
74 /* add in the key of form KEY_EVENTLOG/Application/Application */
76 ( "Adding key of [%s] to path of [%s]\n", *elogs
,
78 werr
= regsubkey_ctr_init(ctx
, &subkeys
);
79 if (!W_ERROR_IS_OK(werr
)) {
80 DEBUG( 0, ( "talloc() failure!\n" ) );
83 regdb_fetch_keys( evtlogpath
, subkeys
);
84 regsubkey_ctr_addkey( subkeys
, *elogs
);
86 if ( !regdb_store_keys( evtlogpath
, subkeys
) ) {
90 TALLOC_FREE( subkeys
);
92 /* now add the values to the KEY_EVENTLOG/Application form key */
93 if (!(values
= TALLOC_ZERO_P(ctx
, struct regval_ctr
))) {
94 DEBUG( 0, ( "talloc() failure!\n" ) );
98 ( "Storing values to eventlog path of [%s]\n",
100 regdb_fetch_values( evtlogpath
, values
);
103 if (!regval_ctr_key_exists(values
, "MaxSize")) {
105 /* assume we have none, add them all */
107 /* hard code some initial values */
109 /* uiDisplayNameId = 0x00000100; */
110 uiMaxSize
= 0x00080000;
111 uiRetention
= 0x93A80;
113 regval_ctr_addvalue(values
, "MaxSize", REG_DWORD
,
117 regval_ctr_addvalue(values
, "Retention", REG_DWORD
,
118 (uint8
*)&uiRetention
,
121 regval_ctr_addvalue_sz(values
, "PrimaryModule", *elogs
);
122 push_reg_sz(talloc_tos(), &data
, *elogs
);
124 regval_ctr_addvalue(values
, "Sources", REG_MULTI_SZ
,
128 evtfilepath
= talloc_asprintf(ctx
,
129 "%%SystemRoot%%\\system32\\config\\%s.tdb",
134 push_reg_sz(talloc_tos(), &data
, evtfilepath
);
135 regval_ctr_addvalue(values
, "File", REG_EXPAND_SZ
, data
.data
,
137 regdb_store_values(evtlogpath
, values
);
143 /* now do the values under KEY_EVENTLOG/Application/Application */
144 TALLOC_FREE(evtlogpath
);
145 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s\\%s",
146 KEY_EVENTLOG
, *elogs
, *elogs
);
150 if (!(values
= TALLOC_ZERO_P(ctx
, struct regval_ctr
))) {
151 DEBUG( 0, ( "talloc() failure!\n" ) );
155 ( "Storing values to eventlog path of [%s]\n",
157 regdb_fetch_values(evtlogpath
, values
);
158 if (!regval_ctr_key_exists( values
, "CategoryCount")) {
160 /* hard code some initial values */
162 uiCategoryCount
= 0x00000007;
163 regval_ctr_addvalue( values
, "CategoryCount",
165 (uint8
*) &uiCategoryCount
,
167 push_reg_sz(talloc_tos(), &data
,
168 "%SystemRoot%\\system32\\eventlog.dll");
170 regval_ctr_addvalue( values
, "CategoryMessageFile",
174 regdb_store_values( evtlogpath
, values
);
183 /*********************************************************************
184 for an eventlog, add in a source name. If the eventlog doesn't
185 exist (not in the list) do nothing. If a source for the log
186 already exists, change the information (remove, replace)
187 *********************************************************************/
189 bool eventlog_add_source( const char *eventlog
, const char *sourcename
,
190 const char *messagefile
)
192 /* Find all of the eventlogs, add keys for each of them */
193 /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
194 need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
196 const char **elogs
= lp_eventlog_list( );
197 const char **wrklist
, **wp
;
198 char *evtlogpath
= NULL
;
199 struct regsubkey_ctr
*subkeys
;
200 struct regval_ctr
*values
;
201 struct regval_blob
*rval
;
206 TALLOC_CTX
*ctx
= talloc_tos();
214 for ( i
= 0; elogs
[i
]; i
++ ) {
215 if ( strequal( elogs
[i
], eventlog
) )
221 ( "Eventlog [%s] not found in list of valid event logs\n",
223 return false; /* invalid named passed in */
226 /* have to assume that the evenlog key itself exists at this point */
227 /* add in a key of [sourcename] under the eventlog key */
229 /* todo add to Sources */
231 if (!( values
= TALLOC_ZERO_P(ctx
, struct regval_ctr
))) {
232 DEBUG( 0, ( "talloc() failure!\n" ));
236 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s", KEY_EVENTLOG
, eventlog
);
242 regdb_fetch_values( evtlogpath
, values
);
245 if ( !( rval
= regval_ctr_getvalue( values
, "Sources" ) ) ) {
246 DEBUG( 0, ( "No Sources value for [%s]!\n", eventlog
) );
249 /* perhaps this adding a new string to a multi_sz should be a fn? */
250 /* check to see if it's there already */
252 if ( rval
->type
!= REG_MULTI_SZ
) {
254 ( "Wrong type for Sources, should be REG_MULTI_SZ\n" ) );
257 /* convert to a 'regulah' chars to do some comparisons */
261 dump_data( 1, rval
->data_p
, rval
->size
);
263 blob
= data_blob_const(rval
->data_p
, rval
->size
);
264 if (!pull_reg_multi_sz(talloc_tos(), &blob
, &wrklist
)) {
268 for (ii
=0; wrklist
[ii
]; ii
++) {
272 if (numsources
> 0) {
273 /* see if it's in there already */
277 if ( strequal( *wp
, sourcename
) ) {
279 ( "Source name [%s] already in list for [%s] \n",
280 sourcename
, eventlog
) );
288 ( "Nothing in the sources list, this might be a problem\n" ) );
294 /* make a new list with an additional entry; copy values, add another */
295 wp
= TALLOC_ARRAY(ctx
, const char *, numsources
+ 2 );
298 DEBUG( 0, ( "talloc() failed \n" ) );
301 memcpy( wp
, wrklist
, sizeof( char * ) * numsources
);
302 *( wp
+ numsources
) = ( char * ) sourcename
;
303 *( wp
+ numsources
+ 1 ) = NULL
;
304 if (!push_reg_multi_sz(ctx
, &blob
, wp
)) {
307 dump_data( 1, blob
.data
, blob
.length
);
308 regval_ctr_addvalue( values
, "Sources", REG_MULTI_SZ
,
309 blob
.data
, blob
.length
);
310 regdb_store_values( evtlogpath
, values
);
311 data_blob_free(&blob
);
314 ( "Source name [%s] found in existing list of sources\n",
318 TALLOC_FREE(wrklist
); /* */
320 werr
= regsubkey_ctr_init(ctx
, &subkeys
);
321 if (!W_ERROR_IS_OK(werr
)) {
322 DEBUG( 0, ( "talloc() failure!\n" ) );
325 TALLOC_FREE(evtlogpath
);
326 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s", KEY_EVENTLOG
, eventlog
);
328 TALLOC_FREE(subkeys
);
332 regdb_fetch_keys( evtlogpath
, subkeys
);
334 if ( !regsubkey_ctr_key_exists( subkeys
, sourcename
) ) {
336 ( " Source name [%s] for eventlog [%s] didn't exist, adding \n",
337 sourcename
, eventlog
) );
338 regsubkey_ctr_addkey( subkeys
, sourcename
);
339 if ( !regdb_store_keys( evtlogpath
, subkeys
) )
342 TALLOC_FREE(subkeys
);
344 /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
346 /* now allocate room for the source's subkeys */
348 werr
= regsubkey_ctr_init(ctx
, &subkeys
);
349 if (!W_ERROR_IS_OK(werr
)) {
350 DEBUG( 0, ( "talloc() failure!\n" ) );
353 TALLOC_FREE(evtlogpath
);
354 evtlogpath
= talloc_asprintf(ctx
, "%s\\%s\\%s",
355 KEY_EVENTLOG
, eventlog
, sourcename
);
357 TALLOC_FREE(subkeys
);
361 regdb_fetch_keys( evtlogpath
, subkeys
);
363 /* now add the values to the KEY_EVENTLOG/Application form key */
364 if ( !( values
= TALLOC_ZERO_P(ctx
, struct regval_ctr
) ) ) {
365 DEBUG( 0, ( "talloc() failure!\n" ) );
369 ( "Storing EventMessageFile [%s] to eventlog path of [%s]\n",
370 messagefile
, evtlogpath
) );
372 regdb_fetch_values( evtlogpath
, values
);
374 regval_ctr_addvalue_sz(values
, "EventMessageFile", messagefile
);
375 regdb_store_values( evtlogpath
, values
);