?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
tiny simplification
[Samba/gebeck_regimport.git] / source3 / rpc_server / srv_eventlog_lib.c
blob269e2f318e52fcaa6b281c50c662f18aab44a863
1 /*
2 * Unix SMB/CIFS implementation.
3 * Eventlog utility routines
4 * Copyright (C) Marcin Krzysztof Porwit 2005,
5 * Copyright (C) Brian Moran 2005.
6 * Copyright (C) Gerald (Jerry) Carter 2005.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23
24 /* maintain a list of open eventlog tdbs with reference counts */
25
26 static ELOG_TDB *open_elog_list;
27
28 /********************************************************************
29 Init an Eventlog TDB, and return it. If null, something bad
30 happened.
31 ********************************************************************/
32
33 TDB_CONTEXT *elog_init_tdb( char *tdbfilename )
34 {
35 TDB_CONTEXT *tdb;
36
37 DEBUG(10,("elog_init_tdb: Initializing eventlog tdb (%s)\n",
38 tdbfilename));
39
40 tdb = tdb_open_log( tdbfilename, 0, TDB_DEFAULT,
41 O_RDWR|O_CREAT|O_TRUNC, 0660 );
42
43 if ( !tdb ) {
44 DEBUG( 0, ( "Can't open tdb for [%s]\n", tdbfilename ) );
45 return NULL;
46 }
47
48 /* initialize with defaults, copy real values in here from registry */
49
50 tdb_store_int32( tdb, EVT_OLDEST_ENTRY, 1 );
51 tdb_store_int32( tdb, EVT_NEXT_RECORD, 1 );
52 tdb_store_int32( tdb, EVT_MAXSIZE, 0x80000 );
53 tdb_store_int32( tdb, EVT_RETENTION, 0x93A80 );
54
55 tdb_store_int32( tdb, EVT_VERSION, EVENTLOG_DATABASE_VERSION_V1 );
56
57 return tdb;
58 }
59
60 /********************************************************************
61 make the tdb file name for an event log, given destination buffer
62 and size. Caller must free memory.
63 ********************************************************************/
64
65 char *elog_tdbname(TALLOC_CTX *ctx, const char *name )
66 {
67 char *path = talloc_asprintf(ctx, "%s/%s.tdb",
68 state_path("eventlog"),
69 name);
70 if (!path) {
71 return NULL;
72 }
73 strlower_m(path);
74 return path;
75 }
76
77
78 /********************************************************************
79 this function is used to count up the number of bytes in a
80 particular TDB
81 ********************************************************************/
82
83 struct trav_size_struct {
84 int size;
85 int rec_count;
86 };
87
88 static int eventlog_tdb_size_fn( TDB_CONTEXT * tdb, TDB_DATA key, TDB_DATA data,
89 void *state )
90 {
91 struct trav_size_struct *tsize = (struct trav_size_struct *)state;
92
93 tsize->size += data.dsize;
94 tsize->rec_count++;
95
96 return 0;
97 }
98
99 /********************************************************************
100 returns the size of the eventlog, and if MaxSize is a non-null
101 ptr, puts the MaxSize there. This is purely a way not to have yet
102 another function that solely reads the maxsize of the eventlog.
103 Yeah, that's it.
104 ********************************************************************/
105
106 int elog_tdb_size( TDB_CONTEXT * tdb, int *MaxSize, int *Retention )
107 {
108 struct trav_size_struct tsize;
109
110 if ( !tdb )
111 return 0;
112
113 ZERO_STRUCT( tsize );
114
115 tdb_traverse( tdb, eventlog_tdb_size_fn, &tsize );
116
117 if ( MaxSize != NULL ) {
118 *MaxSize = tdb_fetch_int32( tdb, EVT_MAXSIZE );
119 }
120
121 if ( Retention != NULL ) {
122 *Retention = tdb_fetch_int32( tdb, EVT_RETENTION );
123 }
124
125 DEBUG( 1,
126 ( "eventlog size: [%d] for [%d] records\n", tsize.size,
127 tsize.rec_count ) );
128 return tsize.size;
129 }
130
131 /********************************************************************
132 Discard early event logs until we have enough for 'needed' bytes...
133 NO checking done beforehand to see that we actually need to do
134 this, and it's going to pluck records one-by-one. So, it's best
135 to determine that this needs to be done before doing it.
136
137 Setting whack_by_date to True indicates that eventlogs falling
138 outside of the retention range need to go...
139
140 return True if we made enough room to accommodate needed bytes
141 ********************************************************************/
142
143 static bool make_way_for_eventlogs( TDB_CONTEXT * the_tdb, int32 needed,
144 bool whack_by_date )
145 {
146 int start_record, i, new_start;
147 int end_record;
148 int nbytes, reclen, len, Retention, MaxSize;
149 int tresv1, trecnum, timegen, timewr;
150 TDB_DATA key, ret;
151 time_t current_time, exp_time;
152
153 /* discard some eventlogs */
154
155 /* read eventlogs from oldest_entry -- there can't be any discontinuity in recnos,
156 although records not necessarily guaranteed to have successive times */
157 /* */
158
159 /* lock */
160 tdb_lock_bystring_with_timeout( the_tdb, EVT_NEXT_RECORD, 1 );
161 /* read */
162 end_record = tdb_fetch_int32( the_tdb, EVT_NEXT_RECORD );
163 start_record = tdb_fetch_int32( the_tdb, EVT_OLDEST_ENTRY );
164 Retention = tdb_fetch_int32( the_tdb, EVT_RETENTION );
165 MaxSize = tdb_fetch_int32( the_tdb, EVT_MAXSIZE );
166
167 time( &current_time );
168
169 /* calculate ... */
170 exp_time = current_time - Retention; /* discard older than exp_time */
171
172 /* todo - check for sanity in next_record */
173 nbytes = 0;
174
175 DEBUG( 3,
176 ( "MaxSize [%d] Retention [%d] Current Time [%d] exp_time [%d]\n",
177 MaxSize, Retention, (uint32)current_time, (uint32)exp_time ) );
178 DEBUG( 3,
179 ( "Start Record [%d] End Record [%d]\n", start_record,
180 end_record ) );
181
182 for ( i = start_record; i < end_record; i++ ) {
183 /* read a record, add the amt to nbytes */
184 key.dsize = sizeof( int32 );
185 key.dptr = ( uint8 * ) ( int32 * ) & i;
186 ret = tdb_fetch( the_tdb, key );
187 if ( ret.dsize == 0 ) {
188 DEBUG( 8,
189 ( "Can't find a record for the key, record [%d]\n",
190 i ) );
191 tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
192 return False;
193 }
194 nbytes += ret.dsize; /* note this includes overhead */
195
196 len = tdb_unpack( ret.dptr, ret.dsize, "ddddd", &reclen,
197 &tresv1, &trecnum, &timegen, &timewr );
198 if (len == -1) {
199 DEBUG( 10,("make_way_for_eventlogs: tdb_unpack failed.\n"));
200 tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
201 return False;
202 }
203
204 DEBUG( 8,
205 ( "read record %d, record size is [%d], total so far [%d]\n",
206 i, reclen, nbytes ) );
207
208 SAFE_FREE( ret.dptr );
209
210 /* note that other servers may just stop writing records when the size limit
211 is reached, and there are no records older than 'retention'. This doesn't
212 like a very useful thing to do, so instead we whack (as in sleeps with the
213 fishes) just enough records to fit the what we need. This behavior could
214 be changed to 'match', if the need arises. */
215
216 if ( !whack_by_date && ( nbytes >= needed ) )
217 break; /* done */
218 if ( whack_by_date && ( timegen >= exp_time ) )
219 break; /* done */
220 }
221
222 DEBUG( 3,
223 ( "nbytes [%d] needed [%d] start_record is [%d], should be set to [%d]\n",
224 nbytes, needed, start_record, i ) );
225 /* todo - remove eventlog entries here and set starting record to start_record... */
226 new_start = i;
227 if ( start_record != new_start ) {
228 for ( i = start_record; i < new_start; i++ ) {
229 key.dsize = sizeof( int32 );
230 key.dptr = ( uint8 * ) ( int32 * ) & i;
231 tdb_delete( the_tdb, key );
232 }
233
234 tdb_store_int32( the_tdb, EVT_OLDEST_ENTRY, new_start );
235 }
236 tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
237 return True;
238 }
239
240 /********************************************************************
241 some hygiene for an eventlog - see how big it is, and then
242 calculate how many bytes we need to remove
243 ********************************************************************/
244
245 bool prune_eventlog( TDB_CONTEXT * tdb )
246 {
247 int MaxSize, Retention, CalcdSize;
248
249 if ( !tdb ) {
250 DEBUG( 4, ( "No eventlog tdb handle\n" ) );
251 return False;
252 }
253
254 CalcdSize = elog_tdb_size( tdb, &MaxSize, &Retention );
255 DEBUG( 3,
256 ( "Calculated size [%d] MaxSize [%d]\n", CalcdSize,
257 MaxSize ) );
258
259 if ( CalcdSize > MaxSize ) {
260 return make_way_for_eventlogs( tdb, CalcdSize - MaxSize,
261 False );
262 }
263
264 return make_way_for_eventlogs( tdb, 0, True );
265 }
266
267 /********************************************************************
268 ********************************************************************/
269
270 bool can_write_to_eventlog( TDB_CONTEXT * tdb, int32 needed )
271 {
272 int calcd_size;
273 int MaxSize, Retention;
274
275 /* see if we can write to the eventlog -- do a policy enforcement */
276 if ( !tdb )
277 return False; /* tdb is null, so we can't write to it */
278
279
280 if ( needed < 0 )
281 return False;
282 MaxSize = 0;
283 Retention = 0;
284
285 calcd_size = elog_tdb_size( tdb, &MaxSize, &Retention );
286
287 if ( calcd_size <= MaxSize )
288 return True; /* you betcha */
289 if ( calcd_size + needed < MaxSize )
290 return True;
291
292 if ( Retention == 0xffffffff ) {
293 return False; /* see msdn - we can't write no room, discard */
294 }
295 /*
296 note don't have to test, but always good to show intent, in case changes needed
297 later
298 */
299
300 if ( Retention == 0x00000000 ) {
301 /* discard record(s) */
302 /* todo - decide when to remove a bunch vs. just what we need... */
303 return make_way_for_eventlogs( tdb, calcd_size - MaxSize,
304 True );
305 }
306
307 return make_way_for_eventlogs( tdb, calcd_size - MaxSize, False );
308 }
309
310 /*******************************************************************
311 *******************************************************************/
312
313 ELOG_TDB *elog_open_tdb( char *logname, bool force_clear )
314 {
315 TDB_CONTEXT *tdb = NULL;
316 uint32 vers_id;
317 ELOG_TDB *ptr;
318 char *tdbpath = NULL;
319 ELOG_TDB *tdb_node = NULL;
320 char *eventlogdir;
321 TALLOC_CTX *ctx = talloc_tos();
322
323 /* first see if we have an open context */
324
325 for ( ptr=open_elog_list; ptr; ptr=ptr->next ) {
326 if ( strequal( ptr->name, logname ) ) {
327 ptr->ref_count++;
328
329 /* trick to alow clearing of the eventlog tdb.
330 The force_clear flag should imply that someone
331 has done a force close. So make sure the tdb
332 is NULL. If this is a normal open, then just
333 return the existing reference */
334
335 if ( force_clear ) {
336 SMB_ASSERT( ptr->tdb == NULL );
337 break;
338 }
339 else
340 return ptr;
341 }
342 }
343
344 /* make sure that the eventlog dir exists */
345
346 eventlogdir = state_path( "eventlog" );
347 if ( !directory_exist( eventlogdir, NULL ) )
348 mkdir( eventlogdir, 0755 );
349
350 /* get the path on disk */
351
352 tdbpath = elog_tdbname(ctx, logname);
353 if (!tdbpath) {
354 return NULL;
355 }
356
357 DEBUG(7,("elog_open_tdb: Opening %s...(force_clear == %s)\n",
358 tdbpath, force_clear?"True":"False" ));
359
360 /* the tdb wasn't already open or this is a forced clear open */
361
362 if ( !force_clear ) {
363
364 tdb = tdb_open_log( tdbpath, 0, TDB_DEFAULT, O_RDWR , 0 );
365 if ( tdb ) {
366 vers_id = tdb_fetch_int32( tdb, EVT_VERSION );
367
368 if ( vers_id != EVENTLOG_DATABASE_VERSION_V1 ) {
369 DEBUG(1,("elog_open_tdb: Invalid version [%d] on file [%s].\n",
370 vers_id, tdbpath));
371 tdb_close( tdb );
372 tdb = elog_init_tdb( tdbpath );
373 }
374 }
375 }
376
377 if ( !tdb )
378 tdb = elog_init_tdb( tdbpath );
379
380 /* if we got a valid context, then add it to the list */
381
382 if ( tdb ) {
383 /* on a forced clear, just reset the tdb context if we already
384 have an open entry in the list */
385
386 if ( ptr ) {
387 ptr->tdb = tdb;
388 return ptr;
389 }
390
391 if ( !(tdb_node = TALLOC_ZERO_P( NULL, ELOG_TDB)) ) {
392 DEBUG(0,("elog_open_tdb: talloc() failure!\n"));
393 tdb_close( tdb );
394 return NULL;
395 }
396
397 tdb_node->name = talloc_strdup( tdb_node, logname );
398 tdb_node->tdb = tdb;
399 tdb_node->ref_count = 1;
400
401 DLIST_ADD( open_elog_list, tdb_node );
402 }
403
404 return tdb_node;
405 }
406
407 /*******************************************************************
408 Wrapper to handle reference counts to the tdb
409 *******************************************************************/
410
411 int elog_close_tdb( ELOG_TDB *etdb, bool force_close )
412 {
413 TDB_CONTEXT *tdb;
414
415 if ( !etdb )
416 return 0;
417
418 etdb->ref_count--;
419
420 SMB_ASSERT( etdb->ref_count >= 0 );
421
422 if ( etdb->ref_count == 0 ) {
423 tdb = etdb->tdb;
424 DLIST_REMOVE( open_elog_list, etdb );
425 TALLOC_FREE( etdb );
426 return tdb_close( tdb );
427 }
428
429 if ( force_close ) {
430 tdb = etdb->tdb;
431 etdb->tdb = NULL;
432 return tdb_close( tdb );
433 }
434
435 return 0;
436 }
437
438
439 /*******************************************************************
440 write an eventlog entry. Note that we have to lock, read next
441 eventlog, increment, write, write the record, unlock
442
443 coming into this, ee has the eventlog record, and the auxilliary date
444 (computer name, etc.) filled into the other structure. Before packing
445 into a record, this routine will calc the appropriate padding, etc.,
446 and then blast out the record in a form that can be read back in
447 *******************************************************************/
448
449 #define MARGIN 512
450
451 int write_eventlog_tdb( TDB_CONTEXT * the_tdb, Eventlog_entry * ee )
452 {
453 int32 next_record;
454 uint8 *packed_ee;
455 TALLOC_CTX *mem_ctx = NULL;
456 TDB_DATA kbuf, ebuf;
457 uint32 n_packed;
458
459 if ( !ee )
460 return 0;
461
462 mem_ctx = talloc_init( "write_eventlog_tdb" );
463
464 if ( mem_ctx == NULL )
465 return 0;
466
467 if ( !ee )
468 return 0;
469 /* discard any entries that have bogus time, which usually indicates a bogus entry as well. */
470 if ( ee->record.time_generated == 0 )
471 return 0;
472
473 /* todo - check for sanity in next_record */
474
475 fixup_eventlog_entry( ee );
476
477 if ( !can_write_to_eventlog( the_tdb, ee->record.length ) ) {
478 DEBUG( 3, ( "Can't write to Eventlog, no room \n" ) );
479 talloc_destroy( mem_ctx );
480 return 0;
481 }
482
483 /* alloc mem for the packed version */
484 packed_ee = (uint8 *)TALLOC( mem_ctx, ee->record.length + MARGIN );
485 if ( !packed_ee ) {
486 talloc_destroy( mem_ctx );
487 return 0;
488 }
489
490 /* need to read the record number and insert it into the entry here */
491
492 /* lock */
493 tdb_lock_bystring_with_timeout( the_tdb, EVT_NEXT_RECORD, 1 );
494 /* read */
495 next_record = tdb_fetch_int32( the_tdb, EVT_NEXT_RECORD );
496
497 n_packed =
498 tdb_pack( (uint8 *)packed_ee, ee->record.length + MARGIN,
499 "ddddddwwwwddddddBBdBBBd", ee->record.length,
500 ee->record.reserved1, next_record,
501 ee->record.time_generated, ee->record.time_written,
502 ee->record.event_id, ee->record.event_type,
503 ee->record.num_strings, ee->record.event_category,
504 ee->record.reserved2,
505 ee->record.closing_record_number,
506 ee->record.string_offset,
507 ee->record.user_sid_length,
508 ee->record.user_sid_offset, ee->record.data_length,
509 ee->record.data_offset,
510 ee->data_record.source_name_len,
511 ee->data_record.source_name,
512 ee->data_record.computer_name_len,
513 ee->data_record.computer_name,
514 ee->data_record.sid_padding,
515 ee->record.user_sid_length, ee->data_record.sid,
516 ee->data_record.strings_len,
517 ee->data_record.strings,
518 ee->data_record.user_data_len,
519 ee->data_record.user_data,
520 ee->data_record.data_padding );
521
522 /*DEBUG(3,("write_eventlog_tdb: packed into %d\n",n_packed)); */
523
524 /* increment the record count */
525
526 kbuf.dsize = sizeof( int32 );
527 kbuf.dptr = (uint8 * ) & next_record;
528
529 ebuf.dsize = n_packed;
530 ebuf.dptr = (uint8 *)packed_ee;
531
532 if ( tdb_store( the_tdb, kbuf, ebuf, 0 ) ) {
533 /* DEBUG(1,("write_eventlog_tdb: Can't write record %d to eventlog\n",next_record)); */
534 tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
535 talloc_destroy( mem_ctx );
536 return 0;
537 }
538 next_record++;
539 tdb_store_int32( the_tdb, EVT_NEXT_RECORD, next_record );
540 tdb_unlock_bystring( the_tdb, EVT_NEXT_RECORD );
541 talloc_destroy( mem_ctx );
542 return ( next_record - 1 );
543 }
544
545 /*******************************************************************
546 calculate the correct fields etc for an eventlog entry
547 *******************************************************************/
548
549 void fixup_eventlog_entry( Eventlog_entry * ee )
550 {
551 /* fix up the eventlog entry structure as necessary */
552
553 ee->data_record.sid_padding =
554 ( ( 4 -
555 ( ( ee->data_record.source_name_len +
556 ee->data_record.computer_name_len ) % 4 ) ) % 4 );
557 ee->data_record.data_padding =
558 ( 4 -
559 ( ( ee->data_record.strings_len +
560 ee->data_record.user_data_len ) % 4 ) ) % 4;
561 ee->record.length = sizeof( Eventlog_record );
562 ee->record.length += ee->data_record.source_name_len;
563 ee->record.length += ee->data_record.computer_name_len;
564 if ( ee->record.user_sid_length == 0 ) {
565 /* Should not pad to a DWORD boundary for writing out the sid if there is
566 no SID, so just propagate the padding to pad the data */
567 ee->data_record.data_padding += ee->data_record.sid_padding;
568 ee->data_record.sid_padding = 0;
569 }
570 /* DEBUG(10, ("sid_padding is [%d].\n", ee->data_record.sid_padding)); */
571 /* DEBUG(10, ("data_padding is [%d].\n", ee->data_record.data_padding)); */
572
573 ee->record.length += ee->data_record.sid_padding;
574 ee->record.length += ee->record.user_sid_length;
575 ee->record.length += ee->data_record.strings_len;
576 ee->record.length += ee->data_record.user_data_len;
577 ee->record.length += ee->data_record.data_padding;
578 /* need another copy of length at the end of the data */
579 ee->record.length += sizeof( ee->record.length );
580 }
581
582 /********************************************************************
583 Note that it's a pretty good idea to initialize the Eventlog_entry
584 structure to zero's before calling parse_logentry on an batch of
585 lines that may resolve to a record. ALSO, it's a good idea to
586 remove any linefeeds (that's EOL to you and me) on the lines
587 going in.
588 ********************************************************************/
589
590 bool parse_logentry( char *line, Eventlog_entry * entry, bool * eor )
591 {
592 TALLOC_CTX *ctx = talloc_tos();
593 char *start = NULL, *stop = NULL;
594
595 start = line;
596
597 /* empty line signyfiying record delimeter, or we're at the end of the buffer */
598 if ( start == NULL || strlen( start ) == 0 ) {
599 DEBUG( 6,
600 ( "parse_logentry: found end-of-record indicator.\n" ) );
601 *eor = True;
602 return True;
603 }
604 if ( !( stop = strchr( line, ':' ) ) ) {
605 return False;
606 }
607
608 DEBUG( 6, ( "parse_logentry: trying to parse [%s].\n", line ) );
609
610 if ( 0 == strncmp( start, "LEN", stop - start ) ) {
611 /* This will get recomputed later anyway -- probably not necessary */
612 entry->record.length = atoi( stop + 1 );
613 } else if ( 0 == strncmp( start, "RS1", stop - start ) ) {
614 /* For now all these reserved entries seem to have the same value,
615 which can be hardcoded to int(1699505740) for now */
616 entry->record.reserved1 = atoi( stop + 1 );
617 } else if ( 0 == strncmp( start, "RCN", stop - start ) ) {
618 entry->record.record_number = atoi( stop + 1 );
619 } else if ( 0 == strncmp( start, "TMG", stop - start ) ) {
620 entry->record.time_generated = atoi( stop + 1 );
621 } else if ( 0 == strncmp( start, "TMW", stop - start ) ) {
622 entry->record.time_written = atoi( stop + 1 );
623 } else if ( 0 == strncmp( start, "EID", stop - start ) ) {
624 entry->record.event_id = atoi( stop + 1 );
625 } else if ( 0 == strncmp( start, "ETP", stop - start ) ) {
626 if ( strstr( start, "ERROR" ) ) {
627 entry->record.event_type = EVENTLOG_ERROR_TYPE;
628 } else if ( strstr( start, "WARNING" ) ) {
629 entry->record.event_type = EVENTLOG_WARNING_TYPE;
630 } else if ( strstr( start, "INFO" ) ) {
631 entry->record.event_type = EVENTLOG_INFORMATION_TYPE;
632 } else if ( strstr( start, "AUDIT_SUCCESS" ) ) {
633 entry->record.event_type = EVENTLOG_AUDIT_SUCCESS;
634 } else if ( strstr( start, "AUDIT_FAILURE" ) ) {
635 entry->record.event_type = EVENTLOG_AUDIT_FAILURE;
636 } else if ( strstr( start, "SUCCESS" ) ) {
637 entry->record.event_type = EVENTLOG_SUCCESS;
638 } else {
639 /* some other eventlog type -- currently not defined in MSDN docs, so error out */
640 return False;
641 }
642 }
643
644 /*
645 else if(0 == strncmp(start, "NST", stop - start))
646 {
647 entry->record.num_strings = atoi(stop + 1);
648 }
649 */
650 else if ( 0 == strncmp( start, "ECT", stop - start ) ) {
651 entry->record.event_category = atoi( stop + 1 );
652 } else if ( 0 == strncmp( start, "RS2", stop - start ) ) {
653 entry->record.reserved2 = atoi( stop + 1 );
654 } else if ( 0 == strncmp( start, "CRN", stop - start ) ) {
655 entry->record.closing_record_number = atoi( stop + 1 );
656 } else if ( 0 == strncmp( start, "USL", stop - start ) ) {
657 entry->record.user_sid_length = atoi( stop + 1 );
658 } else if ( 0 == strncmp( start, "SRC", stop - start ) ) {
659 stop++;
660 while ( isspace( stop[0] ) ) {
661 stop++;
662 }
663 entry->data_record.source_name_len = rpcstr_push_talloc(ctx,
664 &entry->data_record.source_name,
665 stop);
666 if (entry->data_record.source_name_len == (uint32_t)-1 ||
667 entry->data_record.source_name == NULL) {
668 return false;
669 }
670 } else if ( 0 == strncmp( start, "SRN", stop - start ) ) {
671 stop++;
672 while ( isspace( stop[0] ) ) {
673 stop++;
674 }
675 entry->data_record.computer_name_len = rpcstr_push_talloc(ctx,
676 &entry->data_record.computer_name,
677 stop);
678 if (entry->data_record.computer_name_len == (uint32_t)-1 ||
679 entry->data_record.computer_name == NULL) {
680 return false;
681 }
682 } else if ( 0 == strncmp( start, "SID", stop - start ) ) {
683 stop++;
684 while ( isspace( stop[0] ) ) {
685 stop++;
686 }
687 entry->record.user_sid_length = rpcstr_push_talloc(ctx,
688 &entry->data_record.sid,
689 stop);
690 if (entry->record.user_sid_length == (uint32_t)-1 ||
691 entry->data_record.sid == NULL) {
692 return false;
693 }
694 } else if ( 0 == strncmp( start, "STR", stop - start ) ) {
695 smb_ucs2_t *temp = NULL;
696 size_t tmp_len;
697 uint32_t old_len;
698 /* skip past initial ":" */
699 stop++;
700 /* now skip any other leading whitespace */
701 while ( isspace(stop[0])) {
702 stop++;
703 }
704 tmp_len = rpcstr_push_talloc(ctx,
705 &temp,
706 stop);
707 if (tmp_len == (size_t)-1 || !temp) {
708 return false;
709 }
710 old_len = entry->data_record.strings_len;
711 entry->data_record.strings = (smb_ucs2_t *)TALLOC_REALLOC_ARRAY(ctx,
712 entry->data_record.strings,
713 char,
714 old_len + tmp_len);
715 if (!entry->data_record.strings) {
716 return false;
717 }
718 memcpy(entry->data_record.strings + old_len,
719 temp,
720 tmp_len);
721 entry->data_record.strings_len += tmp_len;
722 entry->record.num_strings++;
723 } else if ( 0 == strncmp( start, "DAT", stop - start ) ) {
724 /* skip past initial ":" */
725 stop++;
726 /* now skip any other leading whitespace */
727 while ( isspace( stop[0] ) ) {
728 stop++;
729 }
730 entry->data_record.user_data_len = strlen(stop);
731 entry->data_record.user_data = talloc_strdup(ctx,
732 stop);
733 if (!entry->data_record.user_data) {
734 return false;
735 }
736 } else {
737 /* some other eventlog entry -- not implemented, so dropping on the floor */
738 DEBUG( 10, ( "Unknown entry [%s]. Ignoring.\n", line ) );
739 /* For now return true so that we can keep on parsing this mess. Eventually
740 we will return False here. */
741 return true;
742 }
743 return true;
744 }
reg import