1
2/*
3 *  Unix SMB/CIFS implementation.
4 *  Virtual Windows Registry Layer
5 *  Copyright (C) Marcin Krzysztof Porwit    2005,
6 *  Copyright (C) Brian Moran                2005.
7 *  Copyright (C) Gerald (Jerry) Carter      2005.
8 *
9 *  This program is free software; you can redistribute it and/or modify
10 *  it under the terms of the GNU General Public License as published by
11 *  the Free Software Foundation; either version 3 of the License, or
12 *  (at your option) any later version.
13 *
14 *  This program is distributed in the hope that it will be useful,
15 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
16 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17 *  GNU General Public License for more details.
18 *
19 *  You should have received a copy of the GNU General Public License
20 *  along with this program; if not, see <http://www.gnu.org/licenses/>.
21 */
22
23#include "includes.h"
24
25#undef DBGC_CLASS
26#define DBGC_CLASS DBGC_REGISTRY
27
28/**********************************************************************
29 for an eventlog, add in the default values
30*********************************************************************/
31
32bool eventlog_init_keys(void)
33{
34	/* Find all of the eventlogs, add keys for each of them */
35	const char **elogs = lp_eventlog_list();
36	char *evtlogpath = NULL;
37	char *evtfilepath = NULL;
38	struct regsubkey_ctr *subkeys;
39	struct regval_ctr *values;
40	uint32 uiMaxSize;
41	uint32 uiRetention;
42	uint32 uiCategoryCount;
43	DATA_BLOB data;
44	TALLOC_CTX *ctx = talloc_tos();
45	WERROR werr;
46
47	while (elogs && *elogs) {
48		werr = regsubkey_ctr_init(ctx, &subkeys);
49		if (!W_ERROR_IS_OK(werr)) {
50			DEBUG( 0, ( "talloc() failure!\n" ) );
51			return False;
52		}
53		regdb_fetch_keys(KEY_EVENTLOG, subkeys);
54		regsubkey_ctr_addkey( subkeys, *elogs );
55		if ( !regdb_store_keys( KEY_EVENTLOG, subkeys ) ) {
56			TALLOC_FREE(subkeys);
57			return False;
58		}
59		TALLOC_FREE(subkeys);
60
61		/* add in the key of form KEY_EVENTLOG/Application */
62		DEBUG( 5,
63		       ( "Adding key of [%s] to path of [%s]\n", *elogs,
64			 KEY_EVENTLOG ) );
65
66		evtlogpath = talloc_asprintf(ctx, "%s\\%s",
67			  KEY_EVENTLOG, *elogs);
68		if (!evtlogpath) {
69			return false;
70		}
71		/* add in the key of form KEY_EVENTLOG/Application/Application */
72		DEBUG( 5,
73		       ( "Adding key of [%s] to path of [%s]\n", *elogs,
74			 evtlogpath ) );
75		werr = regsubkey_ctr_init(ctx, &subkeys);
76		if (!W_ERROR_IS_OK(werr)) {
77			DEBUG( 0, ( "talloc() failure!\n" ) );
78			return False;
79		}
80		regdb_fetch_keys( evtlogpath, subkeys );
81		regsubkey_ctr_addkey( subkeys, *elogs );
82
83		if ( !regdb_store_keys( evtlogpath, subkeys ) ) {
84			TALLOC_FREE(subkeys);
85			return False;
86		}
87		TALLOC_FREE( subkeys );
88
89		/* now add the values to the KEY_EVENTLOG/Application form key */
90		if (!(values = TALLOC_ZERO_P(ctx, struct regval_ctr))) {
91			DEBUG( 0, ( "talloc() failure!\n" ) );
92			return False;
93		}
94		DEBUG( 5,
95		       ( "Storing values to eventlog path of [%s]\n",
96			 evtlogpath ) );
97		regdb_fetch_values( evtlogpath, values );
98
99
100		if (!regval_ctr_key_exists(values, "MaxSize")) {
101
102			/* assume we have none, add them all */
103
104			/* hard code some initial values */
105
106			/* uiDisplayNameId = 0x00000100; */
107			uiMaxSize = 0x00080000;
108			uiRetention = 0x93A80;
109
110			regval_ctr_addvalue(values, "MaxSize", REG_DWORD,
111					     (char *)&uiMaxSize,
112					     sizeof(uint32));
113
114			regval_ctr_addvalue(values, "Retention", REG_DWORD,
115					     (char *)&uiRetention,
116					     sizeof(uint32));
117
118			regval_ctr_addvalue_sz(values, "PrimaryModule", *elogs);
119			push_reg_sz(talloc_tos(), &data, *elogs);
120
121			regval_ctr_addvalue(values, "Sources", REG_MULTI_SZ,
122					     (char *)data.data,
123					     data.length);
124
125			evtfilepath = talloc_asprintf(ctx,
126					"%%SystemRoot%%\\system32\\config\\%s.tdb",
127					*elogs);
128			if (!evtfilepath) {
129				TALLOC_FREE(values);
130			}
131			push_reg_sz(talloc_tos(), &data, evtfilepath);
132			regval_ctr_addvalue(values, "File", REG_EXPAND_SZ, (char *)data.data,
133					     data.length);
134			regdb_store_values(evtlogpath, values);
135
136		}
137
138		TALLOC_FREE(values);
139
140		/* now do the values under KEY_EVENTLOG/Application/Application */
141		TALLOC_FREE(evtlogpath);
142		evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
143			  KEY_EVENTLOG, *elogs, *elogs);
144		if (!evtlogpath) {
145			return false;
146		}
147		if (!(values = TALLOC_ZERO_P(ctx, struct regval_ctr))) {
148			DEBUG( 0, ( "talloc() failure!\n" ) );
149			return False;
150		}
151		DEBUG( 5,
152		       ( "Storing values to eventlog path of [%s]\n",
153			 evtlogpath));
154		regdb_fetch_values(evtlogpath, values);
155		if (!regval_ctr_key_exists( values, "CategoryCount")) {
156
157			/* hard code some initial values */
158
159			uiCategoryCount = 0x00000007;
160			regval_ctr_addvalue( values, "CategoryCount",
161					     REG_DWORD,
162					     ( char * ) &uiCategoryCount,
163					     sizeof( uint32 ) );
164			push_reg_sz(talloc_tos(), &data,
165				      "%SystemRoot%\\system32\\eventlog.dll");
166
167			regval_ctr_addvalue( values, "CategoryMessageFile",
168					     REG_EXPAND_SZ,
169					     ( char * ) data.data,
170					     data.length);
171			regdb_store_values( evtlogpath, values );
172		}
173		TALLOC_FREE(values);
174		elogs++;
175	}
176
177	return true;
178}
179
180/*********************************************************************
181 for an eventlog, add in a source name. If the eventlog doesn't
182 exist (not in the list) do nothing.   If a source for the log
183 already exists, change the information (remove, replace)
184*********************************************************************/
185
186bool eventlog_add_source( const char *eventlog, const char *sourcename,
187			  const char *messagefile )
188{
189	/* Find all of the eventlogs, add keys for each of them */
190	/* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary)
191	   need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */
192
193	const char **elogs = lp_eventlog_list(  );
194	const char **wrklist, **wp;
195	char *evtlogpath = NULL;
196	struct regsubkey_ctr *subkeys;
197	struct regval_ctr *values;
198	struct regval_blob *rval;
199	int ii = 0;
200	bool already_in;
201	int i;
202	int numsources = 0;
203	TALLOC_CTX *ctx = talloc_tos();
204	WERROR werr;
205	DATA_BLOB blob;
206
207	if (!elogs) {
208		return False;
209	}
210
211	for ( i = 0; elogs[i]; i++ ) {
212		if ( strequal( elogs[i], eventlog ) )
213			break;
214	}
215
216	if ( !elogs[i] ) {
217		DEBUG( 0,
218		       ( "Eventlog [%s] not found in list of valid event logs\n",
219			 eventlog ) );
220		return false;	/* invalid named passed in */
221	}
222
223	/* have to assume that the evenlog key itself exists at this point */
224	/* add in a key of [sourcename] under the eventlog key */
225
226	/* todo add to Sources */
227
228	if (!( values = TALLOC_ZERO_P(ctx, struct regval_ctr))) {
229		DEBUG( 0, ( "talloc() failure!\n" ));
230		return false;
231	}
232
233	evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog);
234	if (!evtlogpath) {
235		TALLOC_FREE(values);
236		return false;
237	}
238
239	regdb_fetch_values( evtlogpath, values );
240
241
242	if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) {
243		DEBUG( 0, ( "No Sources value for [%s]!\n", eventlog ) );
244		return False;
245	}
246	/* perhaps this adding a new string to a multi_sz should be a fn? */
247	/* check to see if it's there already */
248
249	if ( rval->type != REG_MULTI_SZ ) {
250		DEBUG( 0,
251		       ( "Wrong type for Sources, should be REG_MULTI_SZ\n" ) );
252		return False;
253	}
254	/* convert to a 'regulah' chars to do some comparisons */
255
256	already_in = False;
257	wrklist = NULL;
258	dump_data( 1, rval->data_p, rval->size );
259
260	blob = data_blob_const(rval->data_p, rval->size);
261	if (!pull_reg_multi_sz(talloc_tos(), &blob, &wrklist)) {
262		return false;
263	}
264
265	for (ii=0; wrklist[ii]; ii++) {
266		numsources++;
267	}
268
269	if (numsources > 0) {
270		/* see if it's in there already */
271		wp = wrklist;
272
273		while (wp && *wp ) {
274			if ( strequal( *wp, sourcename ) ) {
275				DEBUG( 5,
276				       ( "Source name [%s] already in list for [%s] \n",
277					 sourcename, eventlog ) );
278				already_in = True;
279				break;
280			}
281			wp++;
282		}
283	} else {
284		DEBUG( 3,
285		       ( "Nothing in the sources list, this might be a problem\n" ) );
286	}
287
288	wp = wrklist;
289
290	if ( !already_in ) {
291		/* make a new list with an additional entry; copy values, add another */
292		wp = TALLOC_ARRAY(ctx, const char *, numsources + 2 );
293
294		if ( !wp ) {
295			DEBUG( 0, ( "talloc() failed \n" ) );
296			return False;
297		}
298		memcpy( wp, wrklist, sizeof( char * ) * numsources );
299		*( wp + numsources ) = ( char * ) sourcename;
300		*( wp + numsources + 1 ) = NULL;
301		if (!push_reg_multi_sz(ctx, &blob, wp)) {
302			return false;
303		}
304		dump_data( 1, blob.data, blob.length);
305		regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ,
306				     ( char * ) blob.data, blob.length);
307		regdb_store_values( evtlogpath, values );
308		data_blob_free(&blob);
309	} else {
310		DEBUG( 3,
311		       ( "Source name [%s] found in existing list of sources\n",
312			 sourcename ) );
313	}
314	TALLOC_FREE(values);
315	TALLOC_FREE(wrklist);	/*  */
316
317	werr = regsubkey_ctr_init(ctx, &subkeys);
318	if (!W_ERROR_IS_OK(werr)) {
319		DEBUG( 0, ( "talloc() failure!\n" ) );
320		return False;
321	}
322	TALLOC_FREE(evtlogpath);
323	evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog );
324	if (!evtlogpath) {
325		TALLOC_FREE(subkeys);
326		return false;
327	}
328
329	regdb_fetch_keys( evtlogpath, subkeys );
330
331	if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) {
332		DEBUG( 5,
333		       ( " Source name [%s] for eventlog [%s] didn't exist, adding \n",
334			 sourcename, eventlog ) );
335		regsubkey_ctr_addkey( subkeys, sourcename );
336		if ( !regdb_store_keys( evtlogpath, subkeys ) )
337			return False;
338	}
339	TALLOC_FREE(subkeys);
340
341	/* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */
342
343	/* now allocate room for the source's subkeys */
344
345	werr = regsubkey_ctr_init(ctx, &subkeys);
346	if (!W_ERROR_IS_OK(werr)) {
347		DEBUG( 0, ( "talloc() failure!\n" ) );
348		return False;
349	}
350	TALLOC_FREE(evtlogpath);
351	evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s",
352		  KEY_EVENTLOG, eventlog, sourcename);
353	if (!evtlogpath) {
354		TALLOC_FREE(subkeys);
355		return false;
356	}
357
358	regdb_fetch_keys( evtlogpath, subkeys );
359
360	/* now add the values to the KEY_EVENTLOG/Application form key */
361	if ( !( values = TALLOC_ZERO_P(ctx, struct regval_ctr ) ) ) {
362		DEBUG( 0, ( "talloc() failure!\n" ) );
363		return False;
364	}
365	DEBUG( 5,
366	       ( "Storing EventMessageFile [%s] to eventlog path of [%s]\n",
367		 messagefile, evtlogpath ) );
368
369	regdb_fetch_values( evtlogpath, values );
370
371	regval_ctr_addvalue_sz(values, "EventMessageFile", messagefile);
372	regdb_store_values( evtlogpath, values );
373
374	TALLOC_FREE(values);
375
376	return True;
377}
378