1 files changed, 0 insertions, 451 deletions
diff --git a/src/fluent-bit/plugins/in_winlog/pack.c b/src/fluent-bit/plugins/in_winlog/pack.c
deleted file mode 100644
index 4547d5514..000000000
--- a/src/fluent-bit/plugins/in_winlog/pack.c
+++ /dev/null
@@ -1,451 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-
-/*  Fluent Bit
- *  ==========
- *  Copyright (C) 2015-2022 The Fluent Bit Authors
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- */
-
-#include <fluent-bit/flb_compat.h>
-#include <fluent-bit/flb_mem.h>
-#include <fluent-bit/flb_utils.h>
-#include <fluent-bit/flb_pack.h>
-#include <fluent-bit/flb_input_plugin.h>
-#include <msgpack.h>
-#include <sddl.h>
-#include <locale.h>
-#include "winlog.h"
-
-#define REGKEY_MAXLEN 256
-#define FMT_ISO8601 "%Y-%m-%d %H:%M:%S %z"
-#define FMT_EVTLOG L"SYSTEM\\CurrentControlSet\\Services\\EventLog\\%S\\%s"
-#define FMT_EVTALT L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers\\%s"
-
-/* 127 is the max number of function params */
-#define PARAM_MAXNUM 127
-
-#define SRCNAME(evt) ((wchar_t *) ((char *) (evt) + sizeof(EVENTLOGRECORD)))
-#define BINDATA(evt) ((unsigned char *) (evt) + (evt)->DataOffset)
-
-static void pack_nullstr(msgpack_packer *mp_pck)
-{
-    msgpack_pack_str(mp_pck, 0);
-    msgpack_pack_str_body(mp_pck, "", 0);
-}
-
-static int pack_wstr(msgpack_packer *mp_pck, wchar_t *wstr, int use_ansi)
-{
-    int size;
-    char *buf;
-    UINT codePage = CP_UTF8;
-    if (use_ansi) {
-        codePage = CP_ACP;
-    }
-
-    /* Compute the buffer size first */
-    size = WideCharToMultiByte(codePage, 0, wstr, -1, NULL, 0, NULL, NULL);
-    if (size == 0) {
-        return -1;
-    }
-
-    buf = flb_malloc(size);
-    if (buf == NULL) {
-        flb_errno();
-        return -1;
-    }
-
-    /* Convert UTF-16 into UTF-8/System code Page encoding */
-    size = WideCharToMultiByte(codePage, 0, wstr, -1, buf, size, NULL, NULL);
-    if (size == 0) {
-        flb_free(buf);
-        return -1;
-    }
-
-    /* Pack buf except the trailing '\0' */
-    msgpack_pack_str(mp_pck, size - 1);
-    msgpack_pack_str_body(mp_pck, buf, size - 1);
-    flb_free(buf);
-    return 0;
-}
-
-static int pack_time(msgpack_packer *mp_pck, int time)
-{
-    size_t len;
-    struct tm tm;
-    char buf[64];
-    _locale_t locale;
-
-    if (_localtime32_s(&tm, &time)) {
-        flb_errno();
-        return -1;
-    }
-
-    locale = _get_current_locale();
-    if (locale == NULL) {
-        return -1;
-    }
-
-    len = _strftime_l(buf, 64, FMT_ISO8601, &tm, locale);
-    if (len == 0) {
-        flb_errno();
-        _free_locale(locale);
-        return -1;
-    }
-    _free_locale(locale);
-    msgpack_pack_str(mp_pck, len);
-    msgpack_pack_str_body(mp_pck, buf, len);
-
-    return 0;
-}
-
-static int pack_event_type(msgpack_packer *mp_pck, int type)
-{
-    switch (type) {
-    case EVENTLOG_SUCCESS:
-        msgpack_pack_str(mp_pck, 7);
-        msgpack_pack_str_body(mp_pck, "Success", 7);
-        break;
-    case EVENTLOG_INFORMATION_TYPE:
-        msgpack_pack_str(mp_pck, 11);
-        msgpack_pack_str_body(mp_pck, "Information", 11);
-        break;
-    case EVENTLOG_WARNING_TYPE:
-        msgpack_pack_str(mp_pck, 7);
-        msgpack_pack_str_body(mp_pck, "Warning", 7);
-        break;
-    case EVENTLOG_ERROR_TYPE:
-        msgpack_pack_str(mp_pck, 5);
-        msgpack_pack_str_body(mp_pck, "Error", 5);
-        break;
-    case EVENTLOG_AUDIT_SUCCESS:
-        msgpack_pack_str(mp_pck, 12);
-        msgpack_pack_str_body(mp_pck, "SuccessAudit", 12);
-        break;
-    case EVENTLOG_AUDIT_FAILURE:
-        msgpack_pack_str(mp_pck, 12);
-        msgpack_pack_str_body(mp_pck, "FailureAudit", 12);
-        break;
-    default:
-        return -1;
-    }
-    return 0;
-}
-
-static int pack_binary(msgpack_packer *mp_pck, unsigned char *bin, int len)
-{
-    const char *hex = "0123456789abcdef";
-    char *buf;
-    int size = len * 2;
-    int i;
-
-    if (len == 0) {
-        pack_nullstr(mp_pck);
-        return 0;
-    }
-
-    buf = flb_malloc(size);
-    if (buf == NULL) {
-        flb_errno();
-        return -1;
-    }
-
-    for (i = 0; i < len; i++) {
-        buf[2*i]   = hex[bin[i] / 16];
-        buf[2*i+1] = hex[bin[i] % 16];
-    }
-    msgpack_pack_str(mp_pck, size);
-    msgpack_pack_str_body(mp_pck, buf, size);
-    flb_free(buf);
-    return 0;
-}
-
-static int pack_sid(msgpack_packer *mp_pck, PEVENTLOGRECORD evt,
-                    struct winlog_config *ctx)
-{
-    size_t size;
-    char *buf;
-    char *sid = (char *) evt + evt->UserSidOffset;
-
-    if (evt->UserSidLength == 0) {
-        pack_nullstr(mp_pck);
-        return 0;
-    }
-
-    if (!ConvertSidToStringSidA(sid, &buf)) {
-        flb_plg_error(ctx->ins, "fail to convert SID: %i", GetLastError());
-        return -1;
-    }
-
-    size = strlen(buf);
-    msgpack_pack_str(mp_pck, size);
-    msgpack_pack_str_body(mp_pck, buf, size);
-
-    LocalFree(buf);
-    return 0;
-}
-
-static wchar_t *read_registry(HKEY hkey, wchar_t *key, wchar_t *val)
-{
-    int ret;
-    int size;
-    wchar_t *buf;
-    unsigned int flags = RRF_RT_REG_EXPAND_SZ | RRF_RT_REG_SZ;
-
-    /* Get the buffer size first */
-    ret = RegGetValueW(hkey, key, val, flags, NULL, NULL, &size);
-    if (ret != ERROR_SUCCESS) {
-        return NULL;
-    }
-
-    buf = flb_malloc(size);
-    if (buf == NULL) {
-        flb_errno();
-        return NULL;
-    }
-
-    /* Read data into buffer */
-    ret = RegGetValueW(hkey, key, val, flags, NULL, buf, &size);
-    if (ret != ERROR_SUCCESS) {
-        flb_free(buf);
-        return NULL;
-    }
-    return buf;
-}
-
-static wchar_t *query_guid(wchar_t *guid)
-{
-    int ret;
-    wchar_t key[REGKEY_MAXLEN];
-
-    ret = swprintf_s(key, REGKEY_MAXLEN, FMT_EVTALT, guid);
-    if (ret == -1) {
-        flb_errno();
-        return NULL;
-    }
-
-    return read_registry(HKEY_LOCAL_MACHINE, key, L"MessageFileName");
-}
-
-static int pack_message(msgpack_packer *mp_pck, PEVENTLOGRECORD evt,
-                        struct winlog_channel *ch, struct winlog_config *ctx)
-{
-    int ret;
-    int i;
-    HMODULE hfile;
-    wchar_t key[REGKEY_MAXLEN];
-    wchar_t *msg;
-    wchar_t *paths;
-    wchar_t *path;
-    wchar_t *guid;
-    wchar_t *state;
-    wchar_t *tmp;
-    DWORD_PTR *args = NULL;
-
-    ret = swprintf_s(key, REGKEY_MAXLEN, FMT_EVTLOG, ch->name, SRCNAME(evt));
-    if (ret == -1) {
-        flb_errno();
-        return -1;
-    }
-
-    guid = read_registry(HKEY_LOCAL_MACHINE, key, L"ProviderGuid");
-    if (guid) {
-        paths = query_guid(guid);
-        flb_free(guid);
-    }
-    else {
-        paths = read_registry(HKEY_LOCAL_MACHINE, key, L"EventMessageFile");
-    }
-
-    if (paths == NULL) {
-        return -1;
-    }
-
-    if (evt->NumStrings) {
-        args = flb_calloc(PARAM_MAXNUM, sizeof(DWORD_PTR));
-        if (args == NULL) {
-            flb_errno();
-            flb_free(paths);
-            return -1;
-        }
-
-        tmp = (wchar_t *) ((char *) evt + evt->StringOffset);
-        for (i = 0; i < evt->NumStrings; i++) {
-            args[i] = (DWORD_PTR) tmp;
-            tmp += wcslen(tmp) + 1;
-        }
-    }
-
-    path = paths;
-    wcstok_s(path, L";", &state);
-    while (path) {
-        hfile = LoadLibraryExW(path, NULL, LOAD_LIBRARY_AS_DATAFILE);
-        if (hfile == NULL) {
-            path = wcstok_s(NULL , L";", &state);
-            continue;
-        }
-
-        ret = FormatMessageW(FORMAT_MESSAGE_FROM_HMODULE |
-                             FORMAT_MESSAGE_ALLOCATE_BUFFER |
-                             FORMAT_MESSAGE_ARGUMENT_ARRAY,
-                             hfile,        /* lpSource */
-                             evt->EventID, /* dwMessageId */
-                             0,            /* dwLanguageId */
-                             (LPWSTR) &msg,/* lpBuffer */
-                             0,            /* nSize */
-                             (va_list *) args);
-        if (ret > 0) {
-            ret = pack_wstr(mp_pck, msg, ctx->use_ansi);
-            LocalFree(msg);
-            FreeLibrary(hfile);
-            flb_free(paths);
-            flb_free(args);
-            return ret;
-        }
-        FreeLibrary(hfile);
-        path = wcstok_s(NULL , L";", &state);
-    }
-
-    flb_free(paths);
-    flb_free(args);
-    return -1;
-}
-
-static void pack_strings(msgpack_packer *mp_pck, PEVENTLOGRECORD evt, int use_ansi)
-{
-    int i;
-    int len;
-    wchar_t *wstr = (wchar_t *) ((char *) evt + evt->StringOffset);
-
-    msgpack_pack_array(mp_pck, evt->NumStrings);
-
-    for (i = 0; i < evt->NumStrings; i++) {
-        if (pack_wstr(mp_pck, wstr, use_ansi)) {
-            pack_nullstr(mp_pck);
-        }
-        wstr += wcslen(wstr) + 1;
-    }
-}
-
-void winlog_pack_event(msgpack_packer *mp_pck, PEVENTLOGRECORD evt,
-                       struct winlog_channel *ch, struct winlog_config *ctx)
-{
-    wchar_t *source_name = SRCNAME(evt);
-    wchar_t *computer_name = source_name + wcslen(source_name) + 1;
-    size_t len;
-    int count = 13;
-
-    if (ctx->string_inserts) {
-        count++;
-    }
-
-    msgpack_pack_array(mp_pck, 2);
-    flb_pack_time_now(mp_pck);
-
-    msgpack_pack_map(mp_pck, count);
-
-    /* RecordNumber */
-    msgpack_pack_str(mp_pck, 12);
-    msgpack_pack_str_body(mp_pck, "RecordNumber", 12);
-    msgpack_pack_uint32(mp_pck, evt->RecordNumber);
-
-    /* TimeGenerated */
-    msgpack_pack_str(mp_pck, 13);
-    msgpack_pack_str_body(mp_pck, "TimeGenerated", 13);
-    if (pack_time(mp_pck, evt->TimeGenerated)) {
-        flb_plg_error(ctx->ins, "invalid TimeGenerated %i", evt->TimeGenerated);
-        pack_nullstr(mp_pck);
-    }
-
-    /* TimeWritten */
-    msgpack_pack_str(mp_pck, 11);
-    msgpack_pack_str_body(mp_pck, "TimeWritten", 11);
-    if (pack_time(mp_pck, evt->TimeWritten)) {
-        flb_plg_error(ctx->ins, "invalid TimeWritten %i", evt->TimeWritten);
-        pack_nullstr(mp_pck);
-    }
-
-    /* EventId */
-    msgpack_pack_str(mp_pck, 7);
-    msgpack_pack_str_body(mp_pck, "EventID", 7);
-    msgpack_pack_uint16(mp_pck, evt->EventID & 0xffff);
-
-    /* Qualifiers */
-    msgpack_pack_str(mp_pck, 10);
-    msgpack_pack_str_body(mp_pck, "Qualifiers", 10);
-    msgpack_pack_uint16(mp_pck, evt->EventID >> 16);
-
-    /* EventType */
-    msgpack_pack_str(mp_pck, 9);
-    msgpack_pack_str_body(mp_pck, "EventType", 9);
-    if (pack_event_type(mp_pck, evt->EventType)) {
-        flb_plg_error(ctx->ins, "invalid EventType %i", evt->EventType);
-        pack_nullstr(mp_pck);
-    }
-
-    /* EventCategory */
-    msgpack_pack_str(mp_pck, 13);
-    msgpack_pack_str_body(mp_pck, "EventCategory", 13);
-    msgpack_pack_uint16(mp_pck, evt->EventCategory);
-
-    /* Channel */
-    len = strlen(ch->name);
-    msgpack_pack_str(mp_pck, 7);
-    msgpack_pack_str_body(mp_pck, "Channel", 7);
-    msgpack_pack_str(mp_pck, len);
-    msgpack_pack_str_body(mp_pck, ch->name, len);
-
-    /* Source Name */
-    msgpack_pack_str(mp_pck, 10);
-    msgpack_pack_str_body(mp_pck, "SourceName", 10);
-    if (pack_wstr(mp_pck, source_name, ctx->use_ansi)) {
-        flb_plg_error(ctx->ins, "invalid SourceName '%ls'", source_name);
-        pack_nullstr(mp_pck);
-    }
-
-    /* Computer Name */
-    msgpack_pack_str(mp_pck, 12);
-    msgpack_pack_str_body(mp_pck, "ComputerName", 12);
-    if (pack_wstr(mp_pck, computer_name, ctx->use_ansi)) {
-        flb_plg_error(ctx->ins, "invalid ComputerName '%ls'", computer_name);
-        pack_nullstr(mp_pck);
-    }
-
-    /* Event-specific Data */
-    msgpack_pack_str(mp_pck, 4);
-    msgpack_pack_str_body(mp_pck, "Data", 4);
-    if (pack_binary(mp_pck, BINDATA(evt), evt->DataLength)) {
-        pack_nullstr(mp_pck);
-    }
-
-    /* Sid */
-    msgpack_pack_str(mp_pck, 3);
-    msgpack_pack_str_body(mp_pck, "Sid", 3);
-    if (pack_sid(mp_pck, evt, ctx)) {
-        pack_nullstr(mp_pck);
-    }
-
-    /* Message */
-    msgpack_pack_str(mp_pck, 7);
-    msgpack_pack_str_body(mp_pck, "Message", 7);
-    if (pack_message(mp_pck, evt, ch, ctx)) {
-        pack_nullstr(mp_pck);
-    }
-
-    /* StringInserts (optional) */
-    if (ctx->string_inserts) {
-        msgpack_pack_str(mp_pck, 13);
-        msgpack_pack_str_body(mp_pck, "StringInserts", 13);
-        pack_strings(mp_pck, evt, ctx->use_ansi);
-    }
-}