diff options
Diffstat (limited to '')
| -rw-r--r-- | source3/utils/eventlogadm.c | 506 |
1 files changed, 506 insertions, 0 deletions
diff --git a/source3/utils/eventlogadm.c b/source3/utils/eventlogadm.c new file mode 100644 index 0000000..f831927 --- /dev/null +++ b/source3/utils/eventlogadm.c @@ -0,0 +1,506 @@ + +/* + * Samba Unix/Linux SMB client utility + * Write Eventlog records to a tdb, perform other eventlog related functions + * + * + * Copyright (C) Brian Moran 2005. + * Copyright (C) Guenther Deschner 2009. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, see <http://www.gnu.org/licenses/>. + */ + + +#include "includes.h" +#include "lib/eventlog/eventlog.h" +#include "registry.h" +#include "registry/reg_api.h" +#include "registry/reg_init_basic.h" +#include "registry/reg_util_token.h" +#include "registry/reg_backend_db.h" +#include "../libcli/registry/util_reg.h" +#include "cmdline_contexts.h" +#include "lib/util/string_wrappers.h" + +extern int optind; +extern char *optarg; + +int opt_debug = 0; + +static void usage( char *s ) +{ + printf( "\nUsage: %s [OPTION]\n\n", s ); + printf( " -o write <Eventlog Name> \t\t\t\t\tWrites records to eventlog from STDIN\n" ); + printf( " -o addsource <EventlogName> <sourcename> <msgfileDLLname> \tAdds the specified source & DLL eventlog registry entry\n" ); + printf( " -o dump <Eventlog Name> <starting_record>\t\t\t\t\tDump stored eventlog entries on STDOUT\n" ); + printf( "\nMiscellaneous options:\n" ); + printf( " -s <filename>\t\t\t\t\t\t\tUse configuration file <filename>.\n"); + printf( " -d\t\t\t\t\t\t\t\tturn debug on\n" ); + printf( " -h\t\t\t\t\t\t\t\tdisplay help\n\n" ); +} + +static void display_eventlog_names( void ) +{ + const char **elogs; + int i; + + elogs = lp_eventlog_list( ); + printf( "Active eventlog names:\n" ); + printf( "--------------------------------------\n" ); + if ( elogs ) { + for ( i = 0; elogs[i]; i++ ) { + printf( "\t%s\n", elogs[i] ); + } + } + else + printf( "\t<None specified>\n"); +} + +/********************************************************************* + for an eventlog, add in a source name. If the eventlog doesn't + exist (not in the list) do nothing. If a source for the log + already exists, change the information (remove, replace) +*********************************************************************/ +static bool eventlog_add_source( const char *eventlog, const char *sourcename, + const char *messagefile ) +{ + /* Find all of the eventlogs, add keys for each of them */ + /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary) + need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */ + + const char **elogs = lp_eventlog_list( ); + const char **wrklist, **wp; + char *evtlogpath = NULL; + int ii = 0; + bool already_in; + int i; + int numsources = 0; + TALLOC_CTX *ctx = talloc_stackframe(); + WERROR werr; + struct registry_key *key_hive, *key_eventlog, *key_source; + struct security_token *token = NULL; + const char *hive_name, *relpath; + enum winreg_CreateAction action; + struct registry_value *value; + static const uint32_t ACCESS = REG_KEY_READ | REG_KEY_WRITE; + bool ret = false; + + if (!elogs) { + d_printf("No Eventlogs configured\n"); + goto done; + } + + for ( i = 0; elogs[i]; i++ ) { + if ( strequal( elogs[i], eventlog ) ) + break; + } + + if ( !elogs[i] ) { + d_printf("Eventlog [%s] not found in list of valid event logs\n", + eventlog); + goto done; + } + + /* have to assume that the evenlog key itself exists at this point */ + /* add in a key of [sourcename] under the eventlog key */ + + /* todo add to Sources */ + + evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog); + if (!evtlogpath) { + d_printf("Out of memory\n"); + goto done; + } + + relpath = evtlogpath + sizeof(KEY_EVENTLOG); + hive_name = talloc_strndup(ctx, evtlogpath, relpath - evtlogpath); + if (!hive_name) { + d_printf("Out of memory\n"); + goto done; + } + relpath++; + + werr = ntstatus_to_werror(registry_create_admin_token(ctx, &token)); + if (!W_ERROR_IS_OK(werr)) { + d_printf("Failed to create admin token: %s\n", win_errstr(werr)); + goto done; + } + + werr = reg_openhive(ctx, hive_name, ACCESS, token, &key_hive); + if (!W_ERROR_IS_OK(werr)) { + d_printf("Failed to open hive [%s]: %s\n", hive_name, win_errstr(werr)); + goto done; + } + + werr = reg_openkey(ctx, key_hive, relpath, ACCESS, &key_eventlog); + if (!W_ERROR_IS_OK(werr)) { + d_printf("Failed to open key [%s]: %s\n", evtlogpath, win_errstr(werr)); + goto done; + } + + werr = reg_queryvalue(ctx, key_eventlog, "Sources", &value); + if (!W_ERROR_IS_OK(werr)) { + d_printf("Failed to get value \"Sources\" for [%s]: %s\n", evtlogpath, win_errstr(werr)); + goto done; + } + /* perhaps this adding a new string to a multi_sz should be a fn? */ + /* check to see if it's there already */ + + if ( value->type != REG_MULTI_SZ ) { + d_printf("Wrong type for \"Sources\", should be REG_MULTI_SZ\n"); + goto done; + } + /* convert to a 'regulah' chars to do some comparisons */ + + already_in = false; + wrklist = NULL; + dump_data(1, value->data.data, value->data.length); + + if (!pull_reg_multi_sz(ctx, &value->data, &wrklist)) { + d_printf("Failed to pull REG_MULTI_SZ from \"Sources\"\n"); + goto done; + } + + for (ii=0; wrklist[ii]; ii++) { + numsources++; + } + + if (numsources > 0) { + /* see if it's in there already */ + wp = wrklist; + + while (wp && *wp ) { + if ( strequal( *wp, sourcename ) ) { + d_printf("Source name [%s] already in list for [%s] \n", + sourcename, eventlog); + already_in = true; + break; + } + wp++; + } + } else { + d_printf("Nothing in the sources list, this might be a problem\n"); + } + + if ( !already_in ) { + /* make a new list with an additional entry; copy values, add another */ + wp = talloc_realloc(ctx, wrklist, const char *, numsources + 2 ); + if ( !wp ) { + d_printf("Out of memory\n"); + goto done; + } + + wp[numsources] = sourcename; + wp[numsources+1] = NULL; + if (!push_reg_multi_sz(ctx, &value->data, wp)) { + d_printf("Failed to push Sources\n"); + goto done; + } + dump_data( 1, value->data.data, value->data.length); + werr = reg_setvalue(key_eventlog, "Sources", value); + if (!W_ERROR_IS_OK(werr)) { + d_printf("Failed to set value Sources: %s\n", win_errstr(werr)); + goto done; + } + } else { + d_printf("Source name [%s] found in existing list of sources\n", + sourcename); + } + + werr = reg_createkey(ctx, key_eventlog, sourcename, ACCESS, &key_source, &action); + if (!W_ERROR_IS_OK(werr)) { + d_printf("Failed to create subkey \"%s\" of \"%s\": %s\n", sourcename, evtlogpath, win_errstr(werr)); + goto done; + } + + if (action == REG_CREATED_NEW_KEY) { + d_printf(" Source name [%s] for eventlog [%s] didn't exist, adding \n", + sourcename, eventlog); + } + + /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */ + + /* now add the values to the KEY_EVENTLOG/Application form key */ + d_printf("Storing EventMessageFile [%s] to eventlog path of [%s]\n", + messagefile, evtlogpath); + + if (!push_reg_sz(ctx, &value->data, messagefile)) { + d_printf("Failed to push \"EventMessageFile\"\n"); + goto done; + } + value->type = REG_SZ; + + werr = reg_setvalue(key_source, "EventMessageFile", value); + if (!W_ERROR_IS_OK(werr)) { + d_printf("Failed to set value \"EventMessageFile\": %s\n", win_errstr(werr)); + return false; + } + ret = true; +done: + talloc_free(ctx); + return ret; +} + +static int DoAddSourceCommand( int argc, char **argv, bool debugflag, char *exename ) +{ + WERROR werr; + + if ( argc < 3 ) { + printf( "need more arguments:\n" ); + printf( "-o addsource EventlogName SourceName /path/to/EventMessageFile.dll\n" ); + return -1; + } + + /* must open the registry before we access it */ + werr = registry_init_common(); + if (!W_ERROR_IS_OK(werr)) { + printf("Can't open the registry: %s.\n", win_errstr(werr)); + return -1; + } + werr = regdb_transaction_start(); + if (!W_ERROR_IS_OK(werr)) { + printf("Can't start transaction on registry: %s.\n", win_errstr(werr)); + return -1; + } + + if ( !eventlog_add_source( argv[0], argv[1], argv[2] ) ) { + regdb_transaction_cancel(); + return -2; + } + werr = regdb_transaction_commit(); + if (!W_ERROR_IS_OK(werr)) { + printf("Failed to commit transaction on registry: %s.\n", win_errstr(werr)); + return -1; + } + return 0; +} + +static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename ) +{ + FILE *f1; + char *argfname; + ELOG_TDB *etdb; + NTSTATUS status; + + /* fixed constants are bad bad bad */ + char linein[1024]; + bool is_eor; + struct eventlog_Record_tdb ee; + uint32_t record_number = 0; + TALLOC_CTX *mem_ctx = talloc_tos(); + + f1 = stdin; + if ( !f1 ) { + printf( "Can't open STDIN\n" ); + return -1; + } + + if ( debugflag ) { + printf( "Starting write for eventlog [%s]\n", argv[0] ); + display_eventlog_names( ); + } + + argfname = argv[0]; + + if ( !( etdb = elog_open_tdb( argfname, False, False ) ) ) { + printf( "can't open the eventlog TDB (%s)\n", argfname ); + return -1; + } + + ZERO_STRUCT( ee ); /* MUST initialize between records */ + + while ( !feof( f1 ) ) { + if (fgets( linein, sizeof( linein ) - 1, f1 ) == NULL) { + break; + } + if ((strlen(linein) > 0) + && (linein[strlen(linein)-1] == '\n')) { + linein[strlen(linein)-1] = 0; + } + + if ( debugflag ) + printf( "Read line [%s]\n", linein ); + + is_eor = False; + + + parse_logentry( mem_ctx, ( char * ) &linein, &ee, &is_eor ); + /* should we do something with the return code? */ + + if ( is_eor ) { + fixup_eventlog_record_tdb( &ee ); + + if ( opt_debug ) + printf( "record number [%d], tg [%d] , tw [%d]\n", + ee.record_number, (int)ee.time_generated, (int)ee.time_written ); + + if ( ee.time_generated != 0 ) { + + /* printf("Writing to the event log\n"); */ + + status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb), + &ee, &record_number ); + if ( !NT_STATUS_IS_OK(status) ) { + printf( "Can't write to the event log: %s\n", + nt_errstr(status) ); + } else { + if ( opt_debug ) + printf( "Wrote record %d\n", + record_number ); + } + } else { + if ( opt_debug ) + printf( "<null record>\n" ); + } + ZERO_STRUCT( ee ); /* MUST initialize between records */ + } + } + + elog_close_tdb( etdb , False ); + + return 0; +} + +static int DoDumpCommand(int argc, char **argv, bool debugflag, char *exename) +{ + ELOG_TDB *etdb; + TALLOC_CTX *mem_ctx = talloc_tos(); + uint32_t count = 1; + + if (argc > 2) { + return -1; + } + + if (argc > 1) { + count = atoi(argv[1]); + } + + etdb = elog_open_tdb(argv[0], false, true); + if (!etdb) { + printf("can't open the eventlog TDB (%s)\n", argv[0]); + return -1; + } + + while (1) { + + struct eventlog_Record_tdb *r; + char *s; + + r = evlog_pull_record_tdb(mem_ctx, etdb->tdb, count); + if (!r) { + break; + } + + printf("displaying record: %d\n", count); + + s = NDR_PRINT_STRUCT_STRING(mem_ctx, eventlog_Record_tdb, r); + if (s) { + printf("%s\n", s); + talloc_free(s); + } + count++; + } + + elog_close_tdb(etdb, false); + + return 0; +} + +/* would be nice to use the popT stuff here, however doing so forces us to drag in a lot of other infrastructure */ + +int main( int argc, char *argv[] ) +{ + int opt, rc; + char *exename; + char *configfile = NULL; + TALLOC_CTX *frame = talloc_stackframe(); + + + fstring opname; + + smb_init_locale(); + + opt_debug = 0; /* todo set this from getopts */ + + exename = argv[0]; + + /* default */ + + fstrcpy( opname, "write" ); /* the default */ + +#if 0 /* TESTING CODE */ + eventlog_add_source( "System", "TestSourceX", "SomeTestPathX" ); +#endif + while ( ( opt = getopt( argc, argv, "dho:s:" ) ) != EOF ) { + switch ( opt ) { + + case 'o': + fstrcpy( opname, optarg ); + break; + + case 'h': + usage( exename ); + display_eventlog_names( ); + exit( 0 ); + break; + + case 'd': + opt_debug = 1; + break; + case 's': + configfile = talloc_strdup(frame, optarg); + break; + + } + } + + argc -= optind; + argv += optind; + + if ( argc < 1 ) { + printf( "\nNot enough arguments!\n" ); + usage( exename ); + exit( 1 ); + } + + if ( configfile == NULL ) { + lp_load_global(get_dyn_CONFIGFILE()); + } else if (!lp_load_global(configfile)) { + printf("Unable to parse configfile '%s'\n",configfile); + exit( 1 ); + } + + /* note that the separate command types should call usage if they need to... */ + while ( 1 ) { + if ( !strcasecmp_m( opname, "addsource" ) ) { + rc = DoAddSourceCommand( argc, argv, opt_debug, + exename ); + break; + } + if ( !strcasecmp_m( opname, "write" ) ) { + rc = DoWriteCommand( argc, argv, opt_debug, exename ); + break; + } + if ( !strcasecmp_m( opname, "dump" ) ) { + rc = DoDumpCommand( argc, argv, opt_debug, exename ); + break; + } + printf( "unknown command [%s]\n", opname ); + usage( exename ); + exit( 1 ); + break; + } + TALLOC_FREE(frame); + return rc; +} |