source3/registry/reg_eventlog.c

   1
   2 /*
   3  *  Unix SMB/CIFS implementation.
   4  *  Virtual Windows Registry Layer
   5  *  Copyright (C) Marcin Krzysztof Porwit    2005,
   6  *  Copyright (C) Brian Moran                2005.
   7  *  Copyright (C) Gerald (Jerry) Carter      2005.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24 #include "includes.h"
  25
  26
  27 /**********************************************************************
  28  for an eventlog, add in the default values
  29 *********************************************************************/
  30
  31 BOOL eventlog_init_keys( void )
  32 {
  33         /* Find all of the eventlogs, add keys for each of them */
  34         const char **elogs = lp_eventlog_list(  );
  35         pstring evtlogpath;
  36         REGSUBKEY_CTR *subkeys;
  37         REGVAL_CTR *values;
  38         uint32 uiDisplayNameId;
  39         uint32 uiMaxSize;
  40         uint32 uiRetention;
  41         uint32 uiCategoryCount;
  42         UNISTR2 data;
  43
  44         while ( elogs && *elogs ) {
  45                 if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) {
  46                         DEBUG( 0, ( "talloc() failure!\n" ) );
  47                         return False;
  48                 }
  49                 regdb_fetch_keys( KEY_EVENTLOG, subkeys );
  50                 regsubkey_ctr_addkey( subkeys, *elogs );
  51                 if ( !regdb_store_keys( KEY_EVENTLOG, subkeys ) )
  52                         return False;
  53                 TALLOC_FREE( subkeys );
  54
  55                 /* add in the key of form KEY_EVENTLOG/Application */
  56                 DEBUG( 5,
  57                        ( "Adding key of [%s] to path of [%s]\n", *elogs,
  58                          KEY_EVENTLOG ) );
  59
  60                 slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s",
  61                           KEY_EVENTLOG, *elogs );
  62                 /* add in the key of form KEY_EVENTLOG/Application/Application */
  63                 DEBUG( 5,
  64                        ( "Adding key of [%s] to path of [%s]\n", *elogs,
  65                          evtlogpath ) );
  66                 if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) {
  67                         DEBUG( 0, ( "talloc() failure!\n" ) );
  68                         return False;
  69                 }
  70                 regdb_fetch_keys( evtlogpath, subkeys );
  71                 regsubkey_ctr_addkey( subkeys, *elogs );
  72
  73                 if ( !regdb_store_keys( evtlogpath, subkeys ) )
  74                         return False;
  75                 TALLOC_FREE( subkeys );
  76
  77                 /* now add the values to the KEY_EVENTLOG/Application form key */
  78                 if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) {
  79                         DEBUG( 0, ( "talloc() failure!\n" ) );
  80                         return False;
  81                 }
  82                 DEBUG( 5,
  83                        ( "Storing values to eventlog path of [%s]\n",
  84                          evtlogpath ) );
  85                 regdb_fetch_values( evtlogpath, values );
  86
  87
  88                 if ( !regval_ctr_key_exists( values, "MaxSize" ) ) {
  89
  90                         /* assume we have none, add them all */
  91
  92                         /* hard code some initial values */
  93
  94                         uiDisplayNameId = 0x00000100;
  95                         uiMaxSize = 0x00080000;
  96                         uiRetention = 0x93A80;
  97
  98                         regval_ctr_addvalue( values, "MaxSize", REG_DWORD,
  99                                              ( char * ) &uiMaxSize,
 100                                              sizeof( uint32 ) );
 101                         regval_ctr_addvalue( values, "Retention", REG_DWORD,
 102                                              ( char * ) &uiRetention,
 103                                              sizeof( uint32 ) );
 104                         init_unistr2( &data, *elogs, UNI_STR_TERMINATE );
 105                         regval_ctr_addvalue( values, "PrimaryModule", REG_SZ,
 106                                              ( char * ) data.buffer,
 107                                              data.uni_str_len *
 108                                              sizeof( uint16 ) );
 109                         init_unistr2( &data, *elogs, UNI_STR_TERMINATE );
 110
 111                         regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
 112                                              ( char * ) data.buffer,
 113                                              data.uni_str_len *
 114                                              sizeof( uint16 ) );
 115                         regdb_store_values( evtlogpath, values );
 116
 117                 }
 118
 119                 TALLOC_FREE( values );
 120
 121                 /* now do the values under KEY_EVENTLOG/Application/Application */
 122                 slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s\\%s",
 123                           KEY_EVENTLOG, *elogs, *elogs );
 124                 if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) {
 125                         DEBUG( 0, ( "talloc() failure!\n" ) );
 126                         return False;
 127                 }
 128                 DEBUG( 5,
 129                        ( "Storing values to eventlog path of [%s]\n",
 130                          evtlogpath ) );
 131                 regdb_fetch_values( evtlogpath, values );
 132                 if ( !regval_ctr_key_exists( values, "CategoryCount" ) ) {
 133
 134                         /* hard code some initial values */
 135
 136                         uiCategoryCount = 0x00000007;
 137                         regval_ctr_addvalue( values, "CategoryCount",
 138                                              REG_DWORD,
 139                                              ( char * ) &uiCategoryCount,
 140                                              sizeof( uint32 ) );
 141                         init_unistr2( &data,
 142                                       "%SystemRoot%\\system32\\eventlog.dll",
 143                                       UNI_STR_TERMINATE );
 144
 145                         regval_ctr_addvalue( values, "CategoryMessageFile",
 146                                              REG_EXPAND_SZ,
 147                                              ( char * ) data.buffer,
 148                                              data.uni_str_len *
 149                                              sizeof( uint16 ) );
 150                         regdb_store_values( evtlogpath, values );
 151                 }
 152                 TALLOC_FREE( values );
 153                 elogs++;
 154         }
 155
 156         return True;
 157
 158 }
 159
 160 /*********************************************************************
 161  for an eventlog, add in a source name. If the eventlog doesn't
 162  exist (not in the list) do nothing.   If a source for the log
 163  already exists, change the information (remove, replace)
 164 *********************************************************************/
 165
 166 BOOL eventlog_add_source( const char *eventlog, const char *sourcename,
 167                           const char *messagefile )
 168 {
 169         /* Find all of the eventlogs, add keys for each of them */
 170         /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
 171            need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
 172
 173         const char **elogs = lp_eventlog_list(  );
 174         char **wrklist, **wp;
 175         pstring evtlogpath;
 176         REGSUBKEY_CTR *subkeys;
 177         REGVAL_CTR *values;
 178         REGISTRY_VALUE *rval;
 179         UNISTR2 data;
 180         uint16 *msz_wp;
 181         int mbytes, ii;
 182         BOOL already_in;
 183         int i;
 184         int numsources;
 185
 186         for ( i = 0; elogs[i]; i++ ) {
 187                 if ( strequal( elogs[i], eventlog ) )
 188                         break;
 189         }
 190
 191         if ( !elogs[i] ) {
 192                 DEBUG( 0,
 193                        ( "Eventlog [%s] not found in list of valid event logs\n",
 194                          eventlog ) );
 195                 return False;   /* invalid named passed in */
 196         }
 197
 198         /* have to assume that the evenlog key itself exists at this point */
 199         /* add in a key of [sourcename] under the eventlog key */
 200
 201         /* todo add to Sources */
 202
 203         if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) {
 204                 DEBUG( 0, ( "talloc() failure!\n" ) );
 205                 return False;
 206         }
 207
 208         pstr_sprintf( evtlogpath, "%s\\%s", KEY_EVENTLOG, eventlog );
 209
 210         regdb_fetch_values( evtlogpath, values );
 211
 212
 213         if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
 214                 DEBUG( 0, ( "No Sources value for [%s]!\n", eventlog ) );
 215                 return False;
 216         }
 217         /* perhaps this adding a new string to a multi_sz should be a fn? */
 218         /* check to see if it's there already */
 219
 220         if ( rval->type != REG_MULTI_SZ ) {
 221                 DEBUG( 0,
 222                        ( "Wrong type for Sources, should be REG_MULTI_SZ\n" ) );
 223                 return False;
 224         }
 225         /* convert to a 'regulah' chars to do some comparisons */
 226
 227         already_in = False;
 228         wrklist = NULL;
 229         dump_data( 1, (const char *)rval->data_p, rval->size );
 230         if ( ( numsources =
 231                regval_convert_multi_sz( ( uint16 * ) rval->data_p, rval->size,
 232                                         &wrklist ) ) > 0 ) {
 233
 234                 ii = numsources;
 235                 /* see if it's in there already */
 236                 wp = wrklist;
 237
 238                 while ( ii && wp && *wp ) {
 239                         if ( strequal( *wp, sourcename ) ) {
 240                                 DEBUG( 5,
 241                                        ( "Source name [%s] already in list for [%s] \n",
 242                                          sourcename, eventlog ) );
 243                                 already_in = True;
 244                                 break;
 245                         }
 246                         wp++;
 247                         ii--;
 248                 }
 249         } else {
 250                 if ( numsources < 0 ) {
 251                         DEBUG( 3, ( "problem in getting the sources\n" ) );
 252                         return False;
 253                 }
 254                 DEBUG( 3,
 255                        ( "Nothing in the sources list, this might be a problem\n" ) );
 256         }
 257
 258         wp = wrklist;
 259
 260         if ( !already_in ) {
 261                 /* make a new list with an additional entry; copy values, add another */
 262                 wp = TALLOC_ARRAY( NULL, char *, numsources + 2 );
 263
 264                 if ( !wp ) {
 265                         DEBUG( 0, ( "talloc() failed \n" ) );
 266                         return False;
 267                 }
 268                 memcpy( wp, wrklist, sizeof( char * ) * numsources );
 269                 *( wp + numsources ) = ( char * ) sourcename;
 270                 *( wp + numsources + 1 ) = NULL;
 271                 mbytes = regval_build_multi_sz( wp, &msz_wp );
 272                 dump_data( 1, ( char * ) msz_wp, mbytes );
 273                 regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
 274                                      ( char * ) msz_wp, mbytes );
 275                 regdb_store_values( evtlogpath, values );
 276                 TALLOC_FREE( msz_wp );
 277         } else {
 278                 DEBUG( 3,
 279                        ( "Source name [%s] found in existing list of sources\n",
 280                          sourcename ) );
 281         }
 282         TALLOC_FREE( values );
 283         if ( wrklist )
 284                 TALLOC_FREE( wrklist ); /*  */
 285
 286         if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) {
 287                 DEBUG( 0, ( "talloc() failure!\n" ) );
 288                 return False;
 289         }
 290         pstr_sprintf( evtlogpath, "%s\\%s", KEY_EVENTLOG, eventlog );
 291
 292         regdb_fetch_keys( evtlogpath, subkeys );
 293
 294         if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
 295                 DEBUG( 5,
 296                        ( " Source name [%s] for eventlog [%s] didn't exist, adding \n",
 297                          sourcename, eventlog ) );
 298                 regsubkey_ctr_addkey( subkeys, sourcename );
 299                 if ( !regdb_store_keys( evtlogpath, subkeys ) )
 300                         return False;
 301         }
 302         TALLOC_FREE( subkeys );
 303
 304         /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
 305
 306         /* now allocate room for the source's subkeys */
 307
 308         if ( !( subkeys = TALLOC_ZERO_P( NULL, REGSUBKEY_CTR ) ) ) {
 309                 DEBUG( 0, ( "talloc() failure!\n" ) );
 310                 return False;
 311         }
 312         slprintf( evtlogpath, sizeof( evtlogpath ) - 1, "%s\\%s\\%s",
 313                   KEY_EVENTLOG, eventlog, sourcename );
 314
 315         regdb_fetch_keys( evtlogpath, subkeys );
 316
 317         /* now add the values to the KEY_EVENTLOG/Application form key */
 318         if ( !( values = TALLOC_ZERO_P( NULL, REGVAL_CTR ) ) ) {
 319                 DEBUG( 0, ( "talloc() failure!\n" ) );
 320                 return False;
 321         }
 322         DEBUG( 5,
 323                ( "Storing EventMessageFile [%s] to eventlog path of [%s]\n",
 324                  messagefile, evtlogpath ) );
 325
 326         regdb_fetch_values( evtlogpath, values );
 327
 328         init_unistr2( &data, messagefile, UNI_STR_TERMINATE );
 329
 330         regval_ctr_addvalue( values, "EventMessageFile", REG_SZ,
 331                              ( char * ) data.buffer,
 332                              data.uni_str_len * sizeof( uint16 ) );
 333         regdb_store_values( evtlogpath, values );
 334
 335         TALLOC_FREE( values );
 336
 337         return True;
 338 }