source3/rpc_parse/parse_eventlog.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Marcin Krzysztof Porwit    2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 #include "includes.h"
  22
  23 #undef DBGC_CLASS
  24 #define DBGC_CLASS DBGC_RPC_PARSE
  25
  26 /*
  27  * called from eventlog_q_open_eventlog (srv_eventlog.c)
  28  */
  29
  30 BOOL eventlog_io_q_open_eventlog(const char *desc, EVENTLOG_Q_OPEN_EVENTLOG *q_u,
  31                                  prs_struct *ps, int depth)
  32 {
  33         if(q_u == NULL)
  34                 return False;
  35
  36     /** Data format seems to be:
  37        UNKNOWN structure
  38          uint32            unknown
  39          uint16            unknown
  40          uint16            unknown
  41        Eventlog name
  42          uint16            eventlog name length
  43          uint16            eventlog name size
  44          Character Array
  45            uint32          unknown
  46            uint32          max count
  47            uint32          offset
  48            uint32          actual count
  49            UNISTR2         log file name
  50        Server Name
  51          uint16            server name length
  52          uint16            server name size
  53          Character Array
  54            UNISTR2         server name
  55     */
  56
  57         prs_debug(ps, depth, desc, "eventlog_io_q_open_eventlog");
  58         depth++;
  59
  60         if(!prs_align(ps))
  61                 return False;
  62
  63         /* Munch unknown bits */
  64
  65         if(!prs_uint32("", ps, depth, &q_u->unknown1))
  66                 return False;
  67         if(!prs_uint16("", ps, depth, &q_u->unknown2))
  68                 return False;
  69         if(!prs_uint16("", ps, depth, &q_u->unknown3))
  70                 return False;
  71         if(!prs_align(ps))
  72                 return False;
  73
  74         /* Get name of log source */
  75
  76         if(!prs_uint16("sourcename_length", ps, depth, &q_u->sourcename_length))
  77                 return False;
  78         if(!prs_uint16("sourcename_size", ps, depth, &q_u->sourcename_size))
  79                 return False;
  80         if(!prs_uint32("sourcename_ptr", ps, depth, &q_u->sourcename_ptr))
  81                 return False;
  82         if(!smb_io_unistr2("", &q_u->sourcename, q_u->sourcename_ptr, ps, depth))
  83                 return False;
  84         if(!prs_align(ps))
  85                 return False;
  86
  87         /* Get server name */
  88
  89         if(!prs_uint32("servername_ptr", ps, depth, &q_u->servername_ptr))
  90                 return False;
  91         if(!smb_io_unistr2("", &q_u->servername, q_u->servername_ptr, ps, depth))
  92                 return False;
  93
  94         return True;
  95 }
  96
  97 BOOL eventlog_io_r_open_eventlog(const char *desc, EVENTLOG_R_OPEN_EVENTLOG *r_u,
  98                                  prs_struct *ps, int depth)
  99 {
 100         if(r_u == NULL)
 101                 return False;
 102
 103         prs_debug(ps, depth, desc, "eventlog_io_r_open_eventlog");
 104         depth++;
 105
 106         if(!prs_align(ps))
 107                 return False;
 108
 109         if(!(smb_io_pol_hnd("log handle", &(r_u->handle), ps, depth)))
 110                 return False;
 111
 112         if(!(prs_werror("status code", ps, depth, &(r_u->status))))
 113                 return False;
 114
 115         return True;
 116 }
 117
 118 BOOL eventlog_io_q_get_num_records(const char *desc, EVENTLOG_Q_GET_NUM_RECORDS *q_u,
 119                                    prs_struct *ps, int depth)
 120 {
 121         if(q_u == NULL)
 122                 return False;
 123
 124         prs_debug(ps, depth, desc, "eventlog_io_q_get_num_records");
 125         depth++;
 126
 127         if(!(prs_align(ps)))
 128                 return False;
 129
 130         if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
 131                 return False;
 132
 133         return True;
 134 }
 135
 136 BOOL eventlog_io_r_get_num_records(const char *desc, EVENTLOG_R_GET_NUM_RECORDS *r_u,
 137                                    prs_struct *ps, int depth)
 138 {
 139         if(r_u == NULL)
 140                 return False;
 141
 142         prs_debug(ps, depth, desc, "eventlog_io_r_get_num_records");
 143         depth++;
 144
 145         if(!(prs_align(ps)))
 146                 return False;
 147
 148         if(!(prs_uint32("num records", ps, depth, &(r_u->num_records))))
 149                 return False;
 150
 151         if(!(prs_werror("status code", ps, depth, &(r_u->status))))
 152                 return False;
 153
 154         return True;
 155 }
 156
 157 BOOL eventlog_io_q_get_oldest_entry(const char *desc, EVENTLOG_Q_GET_OLDEST_ENTRY *q_u,
 158                                     prs_struct *ps, int depth)
 159 {
 160         if(q_u == NULL)
 161                 return False;
 162
 163         prs_debug(ps, depth, desc, "eventlog_io_q_get_oldest_entry");
 164         depth++;
 165
 166         if(!(prs_align(ps)))
 167                 return False;
 168
 169         if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
 170                 return False;
 171
 172         return True;
 173 }
 174
 175 BOOL eventlog_io_r_get_oldest_entry(const char *desc, EVENTLOG_R_GET_OLDEST_ENTRY *r_u,
 176                                     prs_struct *ps, int depth)
 177 {
 178         if(r_u == NULL)
 179                 return False;
 180
 181         prs_debug(ps, depth, desc, "eventlog_io_r_get_oldest_entry");
 182         depth++;
 183
 184         if(!(prs_align(ps)))
 185                 return False;
 186
 187         if(!(prs_uint32("oldest entry", ps, depth, &(r_u->oldest_entry))))
 188                 return False;
 189
 190         if(!(prs_werror("status code", ps, depth, &(r_u->status))))
 191                 return False;
 192
 193         return True;
 194 }
 195
 196 BOOL eventlog_io_q_close_eventlog(const char *desc, EVENTLOG_Q_CLOSE_EVENTLOG *q_u,
 197                                   prs_struct *ps, int depth)
 198 {
 199         if(q_u == NULL)
 200                 return False;
 201
 202         prs_debug(ps, depth, desc, "eventlog_io_q_close_eventlog");
 203         depth++;
 204
 205         if(!(prs_align(ps)))
 206                 return False;
 207
 208         if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
 209                 return False;
 210
 211         return True;
 212 }
 213
 214 BOOL eventlog_io_r_close_eventlog(const char *desc, EVENTLOG_R_CLOSE_EVENTLOG *r_u,
 215                                   prs_struct *ps, int depth)
 216 {
 217         if(r_u == NULL)
 218                 return False;
 219
 220         prs_debug(ps, depth, desc, "eventlog_io_r_close_eventlog");
 221         depth++;
 222
 223         if(!(prs_align(ps)))
 224                 return False;
 225
 226         if(!(smb_io_pol_hnd("log handle", &(r_u->handle), ps, depth)))
 227                 return False;
 228
 229         if(!(prs_werror("status code", ps, depth, &(r_u->status))))
 230                 return False;
 231
 232         return True;
 233 }
 234
 235 BOOL eventlog_io_q_read_eventlog(const char *desc, EVENTLOG_Q_READ_EVENTLOG *q_u,
 236                                  prs_struct *ps, int depth)
 237 {
 238         if(q_u == NULL)
 239                 return False;
 240
 241         prs_debug(ps, depth, desc, "eventlog_io_q_read_eventlog");
 242         depth++;
 243
 244         if(!(prs_align(ps)))
 245                 return False;
 246
 247         if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
 248                 return False;
 249
 250         if(!(prs_uint32("read flags", ps, depth, &(q_u->flags))))
 251                 return False;
 252
 253         if(!(prs_uint32("read offset", ps, depth, &(q_u->offset))))
 254                 return False;
 255
 256         if(!(prs_uint32("read buf size", ps, depth, &(q_u->max_read_size))))
 257                 return False;
 258
 259         return True;
 260 }
 261 /** Structure of response seems to be:
 262    DWORD num_bytes_in_resp -- MUST be the same as q_u->max_read_size
 263    for i=0..n
 264        EVENTLOGRECORD record
 265    DWORD sent_size -- sum of EVENTLOGRECORD lengths if records returned, 0 otherwise
 266    DWORD real_size -- 0 if records returned, otherwise length of next record to be returned
 267    WERROR status */
 268 BOOL eventlog_io_r_read_eventlog(const char *desc,
 269                                  EVENTLOG_Q_READ_EVENTLOG *q_u,
 270                                  EVENTLOG_R_READ_EVENTLOG *r_u,
 271                                  prs_struct *ps,
 272                                  int depth)
 273 {
 274         Eventlog_entry *entry;
 275         uint32 record_written = 0;
 276         uint32 record_total = 0;
 277
 278         if(r_u == NULL)
 279                 return False;
 280
 281         prs_debug(ps, depth, desc, "eventlog_io_r_read_eventlog");
 282         depth++;
 283
 284         /* First, see if we've read more logs than we can output */
 285
 286         if(r_u->num_bytes_in_resp > q_u->max_read_size) {
 287                 entry = r_u->entry;
 288
 289                 /* remove the size of the last entry from the list */
 290
 291                 while(entry->next != NULL)
 292                         entry = entry->next;
 293
 294                 r_u->num_bytes_in_resp -= entry->record.length;
 295
 296                 /* do not output the last log entry */
 297
 298                 r_u->num_records--;
 299         }
 300
 301         entry = r_u->entry;
 302         record_total = r_u->num_records;
 303
 304         if(r_u->num_bytes_in_resp != 0)
 305                 r_u->sent_size = r_u->num_bytes_in_resp;
 306         else
 307                 r_u->real_size = r_u->bytes_in_next_record;
 308
 309         if(!(prs_align(ps)))
 310                 return False;
 311         if(!(prs_uint32("bytes in resp", ps, depth, &(q_u->max_read_size))))
 312                 return False;
 313
 314         while(entry != NULL && record_written < record_total)
 315         {
 316                 DEBUG(10, ("eventlog_io_r_read_eventlog: writing record [%d] out of [%d].\n", record_written, record_total));
 317
 318                 /* Encode the actual eventlog record record */
 319
 320                 if(!(prs_uint32("length", ps, depth, &(entry->record.length))))
 321                         return False;
 322                 if(!(prs_uint32("reserved", ps, depth, &(entry->record.reserved1))))
 323                         return False;
 324                 if(!(prs_uint32("record number", ps, depth, &(entry->record.record_number))))
 325                         return False;
 326                 if(!(prs_uint32("time generated", ps, depth, &(entry->record.time_generated))))
 327                         return False;
 328                 if(!(prs_uint32("time written", ps, depth, &(entry->record.time_written))))
 329                         return False;
 330                 if(!(prs_uint32("event id", ps, depth, &(entry->record.event_id))))
 331                         return False;
 332                 if(!(prs_uint16("event type", ps, depth, &(entry->record.event_type))))
 333                         return False;
 334                 if(!(prs_uint16("num strings", ps, depth, &(entry->record.num_strings))))
 335                         return False;
 336                 if(!(prs_uint16("event category", ps, depth, &(entry->record.event_category))))
 337                         return False;
 338                 if(!(prs_uint16("reserved2", ps, depth, &(entry->record.reserved2))))
 339                         return False;
 340                 if(!(prs_uint32("closing record", ps, depth, &(entry->record.closing_record_number))))
 341                         return False;
 342                 if(!(prs_uint32("string offset", ps, depth, &(entry->record.string_offset))))
 343                         return False;
 344                 if(!(prs_uint32("user sid length", ps, depth, &(entry->record.user_sid_length))))
 345                         return False;
 346                 if(!(prs_uint32("user sid offset", ps, depth, &(entry->record.user_sid_offset))))
 347                         return False;
 348                 if(!(prs_uint32("data length", ps, depth, &(entry->record.data_length))))
 349                         return False;
 350                 if(!(prs_uint32("data offset", ps, depth, &(entry->record.data_offset))))
 351                         return False;
 352                 if(!(prs_align(ps)))
 353                         return False;
 354
 355                 /* Now encoding data */
 356
 357                 if(!(prs_uint8s(False, "buffer", ps, depth, entry->data,
 358                         entry->record.length - sizeof(Eventlog_record) - sizeof(entry->record.length))))
 359                 {
 360                         return False;
 361                 }
 362
 363                 if(!(prs_align(ps)))
 364                         return False;
 365                 if(!(prs_uint32("length 2", ps, depth, &(entry->record.length))))
 366                         return False;
 367
 368                 entry = entry->next;
 369                 record_written++;
 370
 371         }       /* end of encoding EVENTLOGRECORD */
 372
 373         /* Now pad with whitespace until the end of the response buffer */
 374
 375         r_u->end_of_entries_padding =
 376                 SMB_CALLOC_ARRAY(uint8,
 377                                  q_u->max_read_size - r_u->num_bytes_in_resp);
 378
 379         if(!(prs_uint8s(False, "end of entries padding", ps,
 380                 depth, r_u->end_of_entries_padding,
 381                 (q_u->max_read_size - r_u->num_bytes_in_resp))))
 382         {
 383                 return False;
 384         }
 385
 386         free(r_u->end_of_entries_padding);
 387
 388         /* We had better be DWORD aligned here */
 389
 390         if(!(prs_uint32("sent size", ps, depth, &(r_u->sent_size))))
 391                 return False;
 392         if(!(prs_uint32("real size", ps, depth, &(r_u->real_size))))
 393                 return False;
 394         if(!(prs_werror("status code", ps, depth, &(r_u->status))))
 395                 return False;
 396
 397         return True;
 398 }
 399
 400 /** The windows client seems to be doing something funny with the file name
 401    A call like
 402       ClearEventLog(handle, "backup_file")
 403    on the client side will result in the backup file name looking like this on the
 404    server side:
 405       \??\${CWD of client}\backup_file
 406    If an absolute path gets specified, such as
 407       ClearEventLog(handle, "C:\\temp\\backup_file")
 408    then it is still mangled by the client into this:
 409       \??\C:\temp\backup_file
 410    when it is on the wire.
 411    I'm not sure where the \?? is coming from, or why the ${CWD} of the client process
 412    would be added in given that the backup file gets written on the server side. */
 413
 414 BOOL eventlog_io_q_clear_eventlog(const char *desc, EVENTLOG_Q_CLEAR_EVENTLOG *q_u,
 415                                   prs_struct *ps, int depth)
 416 {
 417         if(q_u == NULL)
 418                 return False;
 419
 420         prs_debug(ps, depth, desc, "eventlog_io_q_clear_eventlog");
 421         depth++;
 422
 423         if(!prs_align(ps))
 424                 return False;
 425         if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
 426                 return False;
 427         if(!prs_align(ps))
 428                 return False;
 429         if(!(prs_uint32("unknown1", ps, depth, &q_u->unknown1)))
 430                 return False;
 431         if(!(prs_uint16("backup_file_length", ps, depth, &q_u->backup_file_length)))
 432                 return False;
 433         if(!(prs_uint16("backup_file_size", ps, depth, &q_u->backup_file_size)))
 434                 return False;
 435         if(!prs_uint32("backup_file_ptr", ps, depth, &q_u->backup_file_ptr))
 436                 return False;
 437         if(!smb_io_unistr2("backup file", &q_u->backup_file, q_u->backup_file_ptr, ps, depth))
 438                 return False;
 439
 440         return True;
 441
 442 }
 443
 444 BOOL eventlog_io_r_clear_eventlog(const char *desc, EVENTLOG_R_CLEAR_EVENTLOG *r_u,
 445                                   prs_struct *ps, int depth)
 446 {
 447         if(r_u == NULL)
 448                 return False;
 449
 450         prs_debug(ps, depth, desc, "eventlog_io_r_clear_eventlog");
 451         depth++;
 452
 453         if(!prs_align(ps))
 454                 return False;
 455         if(!(prs_werror("status code", ps, depth, &(r_u->status))))
 456                 return False;
 457
 458         return True;
 459 }