/*
- * Unix SMB/Netbios implementation.
- * Version 1.9.
+ * Unix SMB/CIFS implementation.
* RPC Pipe client / server routines
- * Copyright (C) Andrew Tridgell 1992-1998,
- * Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
- * Copyright (C) Jean François Micouleau 1998-1999.
- *
+ * Copyright (C) Marcin Krzysztof Porwit 2005.
+ *
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
#include "includes.h"
-extern int DEBUGLEVEL;
-
-/*******************************************************************
-********************************************************************/
-void make_eventlog_q_open(EVENTLOG_Q_OPEN *q_u, char *journal, char *unk)
-{
- int len_journal = journal != NULL ? strlen(journal) : 0;
- int len_unk = unk != NULL ? strlen(unk) : 0;
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_RPC_PARSE
- q_u->ptr0=0x1;
- q_u->unk0=0x5c;
- q_u->unk1=0x01;
+/********************************************************************
+********************************************************************/
- make_uni_hdr(&(q_u->hdr_source), len_journal);
- make_unistr2(&(q_u->uni_source), journal, len_journal);
-
- make_uni_hdr(&(q_u->hdr_unk), len_unk);
- make_unistr2(&(q_u->uni_unk), unk, len_unk);
+BOOL prs_ev_open_unknown0( const char *desc, prs_struct *ps, int depth, EVENTLOG_OPEN_UNKNOWN0 *u )
+{
+ if ( !u )
+ return False;
- q_u->unk6=0x01;
- q_u->unk7=0x01;
+ if ( !prs_uint16("", ps, depth, &u->unknown1) )
+ return False;
+ if ( !prs_uint16("", ps, depth, &u->unknown2) )
+ return False;
+
+ return True;
}
-/*******************************************************************
-********************************************************************/
-void eventlog_io_q_open(char *desc, EVENTLOG_Q_OPEN *q_u, prs_struct *ps, int depth)
+/********************************************************************
+********************************************************************/
+
+BOOL eventlog_io_q_open_eventlog(const char *desc, EVENTLOG_Q_OPEN_EVENTLOG *q_u,
+ prs_struct *ps, int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_q_open");
+ if(q_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_q_open_eventlog");
depth++;
- prs_align(ps);
+ if(!prs_align(ps))
+ return False;
- prs_uint32("ptr0", ps, depth, &(q_u->ptr0));
+ if ( !prs_pointer("", ps, depth, (void*)&q_u->unknown0, sizeof(EVENTLOG_OPEN_UNKNOWN0), (PRS_POINTER_CAST)prs_ev_open_unknown0))
+ return False;
- prs_uint16("unk0", ps, depth, &(q_u->unk0));
- prs_uint16("unk1", ps, depth, &(q_u->unk1));
+ if ( !prs_unistr4("logname", ps, depth, &q_u->logname) )
+ return False;
+ if ( !prs_align(ps) )
+ return False;
- smb_io_unihdr("hdr_source", &(q_u->hdr_source), ps, depth);
- smb_io_unistr2("uni_source", &(q_u->uni_source),
- q_u->hdr_source.buffer, ps, depth);
- prs_align(ps);
+ if ( !prs_unistr4("servername", ps, depth, &q_u->servername) )
+ return False;
+ if ( !prs_align(ps) )
+ return False;
- smb_io_unihdr("hdr_unk", &(q_u->hdr_unk), ps, depth);
- smb_io_unistr2("uni_unk", &(q_u->uni_unk),
- q_u->hdr_unk.buffer, ps, depth);
- prs_align(ps);
+ if ( !prs_uint32("unknown1", ps, depth, &q_u->unknown1) )
+ return False;
+ if ( !prs_uint32("unknown2", ps, depth, &q_u->unknown2) )
+ return False;
- prs_uint32("unk6", ps, depth, &(q_u->unk6));
- prs_uint32("unk7", ps, depth, &(q_u->unk7));
+ return True;
}
-/*******************************************************************
-********************************************************************/
-void eventlog_io_r_open(char *desc, EVENTLOG_R_OPEN *r_u, prs_struct *ps, int depth)
+BOOL eventlog_io_r_open_eventlog(const char *desc, EVENTLOG_R_OPEN_EVENTLOG *r_u,
+ prs_struct *ps, int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_r_open");
+ if(r_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_r_open_eventlog");
depth++;
- prs_align(ps);
- smb_io_pol_hnd("", &(r_u->pol), ps, depth);
- prs_uint32("status", ps, depth, &(r_u->status));
-}
+ if(!prs_align(ps))
+ return False;
-/*******************************************************************
-********************************************************************/
-void make_eventlog_q_close(EVENTLOG_Q_CLOSE *q_u, POLICY_HND *pol)
-{
- memcpy(&(q_u->pol.data), pol->data, sizeof(q_u->pol.data));
+ if(!(smb_io_pol_hnd("log handle", &(r_u->handle), ps, depth)))
+ return False;
+
+ if(!(prs_ntstatus("status code", ps, depth, &r_u->status)))
+ return False;
+
+ return True;
}
-/*******************************************************************
-********************************************************************/
-void eventlog_io_q_close(char *desc, EVENTLOG_Q_CLOSE *q_u, prs_struct *ps, int depth)
+BOOL eventlog_io_q_get_num_records(const char *desc, EVENTLOG_Q_GET_NUM_RECORDS *q_u,
+ prs_struct *ps, int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_q_close");
+ if(q_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_q_get_num_records");
depth++;
- prs_align(ps);
- smb_io_pol_hnd("", &(q_u->pol), ps, depth);
+ if(!(prs_align(ps)))
+ return False;
+
+ if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
+ return False;
+
+ return True;
}
-/*******************************************************************
-********************************************************************/
-void eventlog_io_r_close(char *desc, EVENTLOG_R_CLOSE *r_u, prs_struct *ps, int depth)
+BOOL eventlog_io_r_get_num_records(const char *desc, EVENTLOG_R_GET_NUM_RECORDS *r_u,
+ prs_struct *ps, int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_r_close");
+ if(r_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_r_get_num_records");
depth++;
- prs_align(ps);
- smb_io_pol_hnd("", &(r_u->pol), ps, depth);
- prs_uint32("status", ps, depth, &(r_u->status));
-}
+ if(!(prs_align(ps)))
+ return False;
-/*******************************************************************
-********************************************************************/
-void make_eventlog_q_numofeventlogrec(EVENTLOG_Q_NUMOFEVENTLOGREC *q_u, POLICY_HND *pol)
-{
- memcpy(&(q_u->pol.data), pol->data, sizeof(q_u->pol.data));
+ if(!(prs_uint32("num records", ps, depth, &(r_u->num_records))))
+ return False;
+ if(!(prs_ntstatus("status code", ps, depth, &r_u->status)))
+ return False;
+
+ return True;
}
-/*******************************************************************
-********************************************************************/
-void eventlog_io_q_numofeventlogrec(char *desc,EVENTLOG_Q_NUMOFEVENTLOGREC *q_u, prs_struct *ps, int depth)
+BOOL eventlog_io_q_get_oldest_entry(const char *desc, EVENTLOG_Q_GET_OLDEST_ENTRY *q_u,
+ prs_struct *ps, int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_q_numofeventlogrec");
+ if(q_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_q_get_oldest_entry");
depth++;
+
+ if(!(prs_align(ps)))
+ return False;
- prs_align(ps);
- smb_io_pol_hnd("", &(q_u->pol), ps, depth);
+ if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
+ return False;
+ return True;
}
-/*******************************************************************
-********************************************************************/
-void eventlog_io_r_numofeventlogrec(char *desc, EVENTLOG_R_NUMOFEVENTLOGREC *r_u, prs_struct *ps, int depth)
+BOOL eventlog_io_r_get_oldest_entry(const char *desc, EVENTLOG_R_GET_OLDEST_ENTRY *r_u,
+ prs_struct *ps, int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_r_numofeventlogrec");
+ if(r_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_r_get_oldest_entry");
depth++;
- prs_align(ps);
- prs_uint32("number", ps, depth, &(r_u->number));
- prs_uint32("status", ps, depth, &(r_u->status));
-}
+ if(!(prs_align(ps)))
+ return False;
-/*******************************************************************
-********************************************************************/
-void make_eventlog_q_readeventlog(EVENTLOG_Q_READEVENTLOG *q_u, POLICY_HND *pol,
- uint32 flags, uint32 offset, uint32 number_of_bytes)
-{
- memcpy(&(q_u->pol.data), pol->data, sizeof(q_u->pol.data));
- q_u->flags=flags;
- q_u->offset=offset;
- q_u->number_of_bytes=number_of_bytes;
+ if(!(prs_uint32("oldest entry", ps, depth, &(r_u->oldest_entry))))
+ return False;
+
+ if(!(prs_ntstatus("status code", ps, depth, &r_u->status)))
+ return False;
+
+ return True;
}
-/*******************************************************************
-********************************************************************/
-void eventlog_io_q_readeventlog(char *desc, EVENTLOG_Q_READEVENTLOG *q_u, prs_struct *ps, int depth)
+BOOL eventlog_io_q_read_eventlog(const char *desc, EVENTLOG_Q_READ_EVENTLOG *q_u,
+ prs_struct *ps, int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_q_readeventlog");
+ if(q_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_q_read_eventlog");
depth++;
- prs_align(ps);
- smb_io_pol_hnd("", &(q_u->pol), ps, depth);
- prs_uint32("flags", ps, depth, &(q_u->flags));
- prs_uint32("offset", ps, depth, &(q_u->offset));
- prs_uint32("number_of_bytes", ps, depth, &(q_u->number_of_bytes));
-}
+ if(!(prs_align(ps)))
+ return False;
+
+ if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
+ return False;
+
+ if(!(prs_uint32("read flags", ps, depth, &(q_u->flags))))
+ return False;
+
+ if(!(prs_uint32("read offset", ps, depth, &(q_u->offset))))
+ return False;
+
+ if(!(prs_uint32("read buf size", ps, depth, &(q_u->max_read_size))))
+ return False;
-/*******************************************************************
-********************************************************************/
-static void eventlog_io_eventlog(char *desc, EVENTLOGRECORD *ev, prs_struct *ps, int depth)
+ return True;
+}
+/** Structure of response seems to be:
+ DWORD num_bytes_in_resp -- MUST be the same as q_u->max_read_size
+ for i=0..n
+ EVENTLOGRECORD record
+ DWORD sent_size -- sum of EVENTLOGRECORD lengths if records returned, 0 otherwise
+ DWORD real_size -- 0 if records returned, otherwise length of next record to be returned
+ WERROR status */
+BOOL eventlog_io_r_read_eventlog(const char *desc,
+ EVENTLOG_Q_READ_EVENTLOG *q_u,
+ EVENTLOG_R_READ_EVENTLOG *r_u,
+ prs_struct *ps,
+ int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_eventlog");
+ Eventlog_entry *entry;
+ uint32 record_written = 0;
+ uint32 record_total = 0;
+
+ if(r_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_r_read_eventlog");
depth++;
- prs_align(ps);
- prs_uint32("size", ps, depth, &(ev->size));
- prs_uint32("reserved", ps, depth, &(ev->reserved));
- prs_uint32("recordnumber", ps, depth, &(ev->recordnumber));
- prs_uint32("creationtime", ps, depth, &(ev->creationtime));
- prs_uint32("writetime", ps, depth, &(ev->writetime));
- prs_uint32("eventnumber", ps, depth, &(ev->eventnumber));
-
- prs_uint16("eventtype", ps, depth, &(ev->eventtype));
- prs_uint16("num_of_strings", ps, depth, &(ev->num_of_strings));
- prs_uint16("category", ps, depth, &(ev->category));
- prs_uint16("reserved_flag", ps, depth, &(ev->reserved_flag));
-
- prs_uint32("closingrecord", ps, depth, &(ev->closingrecord));
- prs_uint32("stringoffset", ps, depth, &(ev->stringoffset));
- prs_uint32("sid_length", ps, depth, &(ev->sid_length));
- prs_uint32("sid_offset", ps, depth, &(ev->sid_offset));
- prs_uint32("data_length", ps, depth, &(ev->data_length));
- prs_uint32("data_offset", ps, depth, &(ev->data_offset));
-
- smb_io_unistr("", &(ev->sourcename), ps, depth);
- smb_io_unistr("", &(ev->computername), ps, depth);
-
- if (ev->sid_length!=0)
- smb_io_unistr("", &(ev->sid), ps, depth);
+ /* First, see if we've read more logs than we can output */
+
+ if(r_u->num_bytes_in_resp > q_u->max_read_size) {
+ entry = r_u->entry;
+
+ /* remove the size of the last entry from the list */
+
+ while(entry->next != NULL)
+ entry = entry->next;
+
+ r_u->num_bytes_in_resp -= entry->record.length;
+
+ /* do not output the last log entry */
- if (ev->num_of_strings!=0)
- smb_io_unistr("", &(ev->strings),ps, depth);
+ r_u->num_records--;
+ }
+
+ entry = r_u->entry;
+ record_total = r_u->num_records;
+
+ if(r_u->num_bytes_in_resp != 0)
+ r_u->sent_size = r_u->num_bytes_in_resp;
+ else
+ r_u->real_size = r_u->bytes_in_next_record;
+
+ if(!(prs_align(ps)))
+ return False;
+ if(!(prs_uint32("bytes in resp", ps, depth, &(q_u->max_read_size))))
+ return False;
+
+ while(entry != NULL && record_written < record_total)
+ {
+ DEBUG(11, ("eventlog_io_r_read_eventlog: writing record [%d] out of [%d].\n", record_written, record_total));
+
+ /* Encode the actual eventlog record record */
+
+ if(!(prs_uint32("length", ps, depth, &(entry->record.length))))
+ return False;
+ if(!(prs_uint32("reserved", ps, depth, &(entry->record.reserved1))))
+ return False;
+ if(!(prs_uint32("record number", ps, depth, &(entry->record.record_number))))
+ return False;
+ if(!(prs_uint32("time generated", ps, depth, &(entry->record.time_generated))))
+ return False;
+ if(!(prs_uint32("time written", ps, depth, &(entry->record.time_written))))
+ return False;
+ if(!(prs_uint32("event id", ps, depth, &(entry->record.event_id))))
+ return False;
+ if(!(prs_uint16("event type", ps, depth, &(entry->record.event_type))))
+ return False;
+ if(!(prs_uint16("num strings", ps, depth, &(entry->record.num_strings))))
+ return False;
+ if(!(prs_uint16("event category", ps, depth, &(entry->record.event_category))))
+ return False;
+ if(!(prs_uint16("reserved2", ps, depth, &(entry->record.reserved2))))
+ return False;
+ if(!(prs_uint32("closing record", ps, depth, &(entry->record.closing_record_number))))
+ return False;
+ if(!(prs_uint32("string offset", ps, depth, &(entry->record.string_offset))))
+ return False;
+ if(!(prs_uint32("user sid length", ps, depth, &(entry->record.user_sid_length))))
+ return False;
+ if(!(prs_uint32("user sid offset", ps, depth, &(entry->record.user_sid_offset))))
+ return False;
+ if(!(prs_uint32("data length", ps, depth, &(entry->record.data_length))))
+ return False;
+ if(!(prs_uint32("data offset", ps, depth, &(entry->record.data_offset))))
+ return False;
+ if(!(prs_align(ps)))
+ return False;
- if (ev->data_length)
- smb_io_unistr("", &(ev->data), ps, depth);
+ /* Now encoding data */
+
+ if(!(prs_uint8s(False, "buffer", ps, depth, entry->data,
+ entry->record.length - sizeof(Eventlog_record) - sizeof(entry->record.length))))
+ {
+ return False;
+ }
+
+ if(!(prs_align(ps)))
+ return False;
+ if(!(prs_uint32("length 2", ps, depth, &(entry->record.length))))
+ return False;
+
+ entry = entry->next;
+ record_written++;
+
+ } /* end of encoding EVENTLOGRECORD */
- prs_uint32("size2", ps, depth, &(ev->size2));
+ /* Now pad with whitespace until the end of the response buffer */
+
+ if (q_u->max_read_size - r_u->num_bytes_in_resp) {
+ if (!r_u->end_of_entries_padding) {
+ return False;
+ }
+
+ if(!(prs_uint8s(False, "end of entries padding", ps,
+ depth, r_u->end_of_entries_padding,
+ (q_u->max_read_size - r_u->num_bytes_in_resp)))) {
+ free(r_u->end_of_entries_padding);
+ return False;
+ }
+
+ free(r_u->end_of_entries_padding);
+ }
+
+ /* We had better be DWORD aligned here */
+
+ if(!(prs_uint32("sent size", ps, depth, &(r_u->sent_size))))
+ return False;
+ if(!(prs_uint32("real size", ps, depth, &(r_u->real_size))))
+ return False;
+ if(!(prs_ntstatus("status code", ps, depth, &r_u->status)))
+ return False;
+
+ return True;
}
-/*******************************************************************
-********************************************************************/
-void eventlog_io_r_readeventlog(char *desc, EVENTLOG_R_READEVENTLOG *r_u, prs_struct *ps, int depth)
+/** The windows client seems to be doing something funny with the file name
+ A call like
+ ClearEventLog(handle, "backup_file")
+ on the client side will result in the backup file name looking like this on the
+ server side:
+ \??\${CWD of client}\backup_file
+ If an absolute path gets specified, such as
+ ClearEventLog(handle, "C:\\temp\\backup_file")
+ then it is still mangled by the client into this:
+ \??\C:\temp\backup_file
+ when it is on the wire.
+ I'm not sure where the \?? is coming from, or why the ${CWD} of the client process
+ would be added in given that the backup file gets written on the server side. */
+
+BOOL eventlog_io_q_clear_eventlog(const char *desc, EVENTLOG_Q_CLEAR_EVENTLOG *q_u,
+ prs_struct *ps, int depth)
{
- prs_debug(ps, depth, desc, "eventlog_io_r_readeventlog");
+ if(q_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_q_clear_eventlog");
depth++;
- prs_align(ps);
- prs_uint32("number_of_bytes", ps, depth, &(r_u->number_of_bytes));
+ if(!prs_align(ps))
+ return False;
+ if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
+ return False;
- if (r_u->number_of_bytes!= 0)
- eventlog_io_eventlog("", r_u->event, ps, depth);
+ if ( !prs_unistr4("backupfile", ps, depth, &q_u->backupfile) )
+ return False;
+
+ return True;
- prs_uint32("sent_size", ps, depth, &(r_u->sent_size));
- prs_uint32("real_size", ps, depth, &(r_u->real_size));
- prs_uint32("status", ps, depth, &(r_u->status));
}
+BOOL eventlog_io_r_clear_eventlog(const char *desc, EVENTLOG_R_CLEAR_EVENTLOG *r_u,
+ prs_struct *ps, int depth)
+{
+ if(r_u == NULL)
+ return False;
+
+ prs_debug(ps, depth, desc, "eventlog_io_r_clear_eventlog");
+ depth++;
+
+ if(!prs_align(ps))
+ return False;
+ if(!(prs_ntstatus("status code", ps, depth, &r_u->status)))
+ return False;
+
+ return True;
+}
git.samba.org / sfrench / samba-autobuild / .git / blobdiff