1 2/* 3 * Unix SMB/CIFS implementation. 4 * Virtual Windows Registry Layer 5 * Copyright (C) Marcin Krzysztof Porwit 2005, 6 * Copyright (C) Brian Moran 2005. 7 * Copyright (C) Gerald (Jerry) Carter 2005. 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License as published by 11 * the Free Software Foundation; either version 3 of the License, or 12 * (at your option) any later version. 13 * 14 * This program is distributed in the hope that it will be useful, 15 * but WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 * GNU General Public License for more details. 18 * 19 * You should have received a copy of the GNU General Public License 20 * along with this program; if not, see <http://www.gnu.org/licenses/>. 21 */ 22 23#include "includes.h" 24 25#undef DBGC_CLASS 26#define DBGC_CLASS DBGC_REGISTRY 27 28/********************************************************************** 29 for an eventlog, add in the default values 30*********************************************************************/ 31 32bool eventlog_init_keys(void) 33{ 34 /* Find all of the eventlogs, add keys for each of them */ 35 const char **elogs = lp_eventlog_list(); 36 char *evtlogpath = NULL; 37 char *evtfilepath = NULL; 38 struct regsubkey_ctr *subkeys; 39 struct regval_ctr *values; 40 uint32 uiMaxSize; 41 uint32 uiRetention; 42 uint32 uiCategoryCount; 43 DATA_BLOB data; 44 TALLOC_CTX *ctx = talloc_tos(); 45 WERROR werr; 46 47 while (elogs && *elogs) { 48 werr = regsubkey_ctr_init(ctx, &subkeys); 49 if (!W_ERROR_IS_OK(werr)) { 50 DEBUG( 0, ( "talloc() failure!\n" ) ); 51 return False; 52 } 53 regdb_fetch_keys(KEY_EVENTLOG, subkeys); 54 regsubkey_ctr_addkey( subkeys, *elogs ); 55 if ( !regdb_store_keys( KEY_EVENTLOG, subkeys ) ) { 56 TALLOC_FREE(subkeys); 57 return False; 58 } 59 TALLOC_FREE(subkeys); 60 61 /* add in the key of form KEY_EVENTLOG/Application */ 62 DEBUG( 5, 63 ( "Adding key of [%s] to path of [%s]\n", *elogs, 64 KEY_EVENTLOG ) ); 65 66 evtlogpath = talloc_asprintf(ctx, "%s\\%s", 67 KEY_EVENTLOG, *elogs); 68 if (!evtlogpath) { 69 return false; 70 } 71 /* add in the key of form KEY_EVENTLOG/Application/Application */ 72 DEBUG( 5, 73 ( "Adding key of [%s] to path of [%s]\n", *elogs, 74 evtlogpath ) ); 75 werr = regsubkey_ctr_init(ctx, &subkeys); 76 if (!W_ERROR_IS_OK(werr)) { 77 DEBUG( 0, ( "talloc() failure!\n" ) ); 78 return False; 79 } 80 regdb_fetch_keys( evtlogpath, subkeys ); 81 regsubkey_ctr_addkey( subkeys, *elogs ); 82 83 if ( !regdb_store_keys( evtlogpath, subkeys ) ) { 84 TALLOC_FREE(subkeys); 85 return False; 86 } 87 TALLOC_FREE( subkeys ); 88 89 /* now add the values to the KEY_EVENTLOG/Application form key */ 90 if (!(values = TALLOC_ZERO_P(ctx, struct regval_ctr))) { 91 DEBUG( 0, ( "talloc() failure!\n" ) ); 92 return False; 93 } 94 DEBUG( 5, 95 ( "Storing values to eventlog path of [%s]\n", 96 evtlogpath ) ); 97 regdb_fetch_values( evtlogpath, values ); 98 99 100 if (!regval_ctr_key_exists(values, "MaxSize")) { 101 102 /* assume we have none, add them all */ 103 104 /* hard code some initial values */ 105 106 /* uiDisplayNameId = 0x00000100; */ 107 uiMaxSize = 0x00080000; 108 uiRetention = 0x93A80; 109 110 regval_ctr_addvalue(values, "MaxSize", REG_DWORD, 111 (char *)&uiMaxSize, 112 sizeof(uint32)); 113 114 regval_ctr_addvalue(values, "Retention", REG_DWORD, 115 (char *)&uiRetention, 116 sizeof(uint32)); 117 118 regval_ctr_addvalue_sz(values, "PrimaryModule", *elogs); 119 push_reg_sz(talloc_tos(), &data, *elogs); 120 121 regval_ctr_addvalue(values, "Sources", REG_MULTI_SZ, 122 (char *)data.data, 123 data.length); 124 125 evtfilepath = talloc_asprintf(ctx, 126 "%%SystemRoot%%\\system32\\config\\%s.tdb", 127 *elogs); 128 if (!evtfilepath) { 129 TALLOC_FREE(values); 130 } 131 push_reg_sz(talloc_tos(), &data, evtfilepath); 132 regval_ctr_addvalue(values, "File", REG_EXPAND_SZ, (char *)data.data, 133 data.length); 134 regdb_store_values(evtlogpath, values); 135 136 } 137 138 TALLOC_FREE(values); 139 140 /* now do the values under KEY_EVENTLOG/Application/Application */ 141 TALLOC_FREE(evtlogpath); 142 evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s", 143 KEY_EVENTLOG, *elogs, *elogs); 144 if (!evtlogpath) { 145 return false; 146 } 147 if (!(values = TALLOC_ZERO_P(ctx, struct regval_ctr))) { 148 DEBUG( 0, ( "talloc() failure!\n" ) ); 149 return False; 150 } 151 DEBUG( 5, 152 ( "Storing values to eventlog path of [%s]\n", 153 evtlogpath)); 154 regdb_fetch_values(evtlogpath, values); 155 if (!regval_ctr_key_exists( values, "CategoryCount")) { 156 157 /* hard code some initial values */ 158 159 uiCategoryCount = 0x00000007; 160 regval_ctr_addvalue( values, "CategoryCount", 161 REG_DWORD, 162 ( char * ) &uiCategoryCount, 163 sizeof( uint32 ) ); 164 push_reg_sz(talloc_tos(), &data, 165 "%SystemRoot%\\system32\\eventlog.dll"); 166 167 regval_ctr_addvalue( values, "CategoryMessageFile", 168 REG_EXPAND_SZ, 169 ( char * ) data.data, 170 data.length); 171 regdb_store_values( evtlogpath, values ); 172 } 173 TALLOC_FREE(values); 174 elogs++; 175 } 176 177 return true; 178} 179 180/********************************************************************* 181 for an eventlog, add in a source name. If the eventlog doesn't 182 exist (not in the list) do nothing. If a source for the log 183 already exists, change the information (remove, replace) 184*********************************************************************/ 185 186bool eventlog_add_source( const char *eventlog, const char *sourcename, 187 const char *messagefile ) 188{ 189 /* Find all of the eventlogs, add keys for each of them */ 190 /* need to add to the value KEY_EVENTLOG/<eventlog>/Sources string (Creating if necessary) 191 need to add KEY of source to KEY_EVENTLOG/<eventlog>/<source> */ 192 193 const char **elogs = lp_eventlog_list( ); 194 const char **wrklist, **wp; 195 char *evtlogpath = NULL; 196 struct regsubkey_ctr *subkeys; 197 struct regval_ctr *values; 198 struct regval_blob *rval; 199 int ii = 0; 200 bool already_in; 201 int i; 202 int numsources = 0; 203 TALLOC_CTX *ctx = talloc_tos(); 204 WERROR werr; 205 DATA_BLOB blob; 206 207 if (!elogs) { 208 return False; 209 } 210 211 for ( i = 0; elogs[i]; i++ ) { 212 if ( strequal( elogs[i], eventlog ) ) 213 break; 214 } 215 216 if ( !elogs[i] ) { 217 DEBUG( 0, 218 ( "Eventlog [%s] not found in list of valid event logs\n", 219 eventlog ) ); 220 return false; /* invalid named passed in */ 221 } 222 223 /* have to assume that the evenlog key itself exists at this point */ 224 /* add in a key of [sourcename] under the eventlog key */ 225 226 /* todo add to Sources */ 227 228 if (!( values = TALLOC_ZERO_P(ctx, struct regval_ctr))) { 229 DEBUG( 0, ( "talloc() failure!\n" )); 230 return false; 231 } 232 233 evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog); 234 if (!evtlogpath) { 235 TALLOC_FREE(values); 236 return false; 237 } 238 239 regdb_fetch_values( evtlogpath, values ); 240 241 242 if ( !( rval = regval_ctr_getvalue( values, "Sources" ) ) ) { 243 DEBUG( 0, ( "No Sources value for [%s]!\n", eventlog ) ); 244 return False; 245 } 246 /* perhaps this adding a new string to a multi_sz should be a fn? */ 247 /* check to see if it's there already */ 248 249 if ( rval->type != REG_MULTI_SZ ) { 250 DEBUG( 0, 251 ( "Wrong type for Sources, should be REG_MULTI_SZ\n" ) ); 252 return False; 253 } 254 /* convert to a 'regulah' chars to do some comparisons */ 255 256 already_in = False; 257 wrklist = NULL; 258 dump_data( 1, rval->data_p, rval->size ); 259 260 blob = data_blob_const(rval->data_p, rval->size); 261 if (!pull_reg_multi_sz(talloc_tos(), &blob, &wrklist)) { 262 return false; 263 } 264 265 for (ii=0; wrklist[ii]; ii++) { 266 numsources++; 267 } 268 269 if (numsources > 0) { 270 /* see if it's in there already */ 271 wp = wrklist; 272 273 while (wp && *wp ) { 274 if ( strequal( *wp, sourcename ) ) { 275 DEBUG( 5, 276 ( "Source name [%s] already in list for [%s] \n", 277 sourcename, eventlog ) ); 278 already_in = True; 279 break; 280 } 281 wp++; 282 } 283 } else { 284 DEBUG( 3, 285 ( "Nothing in the sources list, this might be a problem\n" ) ); 286 } 287 288 wp = wrklist; 289 290 if ( !already_in ) { 291 /* make a new list with an additional entry; copy values, add another */ 292 wp = TALLOC_ARRAY(ctx, const char *, numsources + 2 ); 293 294 if ( !wp ) { 295 DEBUG( 0, ( "talloc() failed \n" ) ); 296 return False; 297 } 298 memcpy( wp, wrklist, sizeof( char * ) * numsources ); 299 *( wp + numsources ) = ( char * ) sourcename; 300 *( wp + numsources + 1 ) = NULL; 301 if (!push_reg_multi_sz(ctx, &blob, wp)) { 302 return false; 303 } 304 dump_data( 1, blob.data, blob.length); 305 regval_ctr_addvalue( values, "Sources", REG_MULTI_SZ, 306 ( char * ) blob.data, blob.length); 307 regdb_store_values( evtlogpath, values ); 308 data_blob_free(&blob); 309 } else { 310 DEBUG( 3, 311 ( "Source name [%s] found in existing list of sources\n", 312 sourcename ) ); 313 } 314 TALLOC_FREE(values); 315 TALLOC_FREE(wrklist); /* */ 316 317 werr = regsubkey_ctr_init(ctx, &subkeys); 318 if (!W_ERROR_IS_OK(werr)) { 319 DEBUG( 0, ( "talloc() failure!\n" ) ); 320 return False; 321 } 322 TALLOC_FREE(evtlogpath); 323 evtlogpath = talloc_asprintf(ctx, "%s\\%s", KEY_EVENTLOG, eventlog ); 324 if (!evtlogpath) { 325 TALLOC_FREE(subkeys); 326 return false; 327 } 328 329 regdb_fetch_keys( evtlogpath, subkeys ); 330 331 if ( !regsubkey_ctr_key_exists( subkeys, sourcename ) ) { 332 DEBUG( 5, 333 ( " Source name [%s] for eventlog [%s] didn't exist, adding \n", 334 sourcename, eventlog ) ); 335 regsubkey_ctr_addkey( subkeys, sourcename ); 336 if ( !regdb_store_keys( evtlogpath, subkeys ) ) 337 return False; 338 } 339 TALLOC_FREE(subkeys); 340 341 /* at this point KEY_EVENTLOG/<eventlog>/<sourcename> key is in there. Now need to add EventMessageFile */ 342 343 /* now allocate room for the source's subkeys */ 344 345 werr = regsubkey_ctr_init(ctx, &subkeys); 346 if (!W_ERROR_IS_OK(werr)) { 347 DEBUG( 0, ( "talloc() failure!\n" ) ); 348 return False; 349 } 350 TALLOC_FREE(evtlogpath); 351 evtlogpath = talloc_asprintf(ctx, "%s\\%s\\%s", 352 KEY_EVENTLOG, eventlog, sourcename); 353 if (!evtlogpath) { 354 TALLOC_FREE(subkeys); 355 return false; 356 } 357 358 regdb_fetch_keys( evtlogpath, subkeys ); 359 360 /* now add the values to the KEY_EVENTLOG/Application form key */ 361 if ( !( values = TALLOC_ZERO_P(ctx, struct regval_ctr ) ) ) { 362 DEBUG( 0, ( "talloc() failure!\n" ) ); 363 return False; 364 } 365 DEBUG( 5, 366 ( "Storing EventMessageFile [%s] to eventlog path of [%s]\n", 367 messagefile, evtlogpath ) ); 368 369 regdb_fetch_values( evtlogpath, values ); 370 371 regval_ctr_addvalue_sz(values, "EventMessageFile", messagefile); 372 regdb_store_values( evtlogpath, values ); 373 374 TALLOC_FREE(values); 375 376 return True; 377} 378