The branch, master has been updated via de7f0a70c8293f1b87f9c821f16fd3c6f7b184b7 (commit) via 16f83ae75003107084c50b8e45d1922889158d80 (commit) via dd306249f23cacc01d6e6ea375450714109ebaa7 (commit) from 5e637e0afa01e227f2aa9e042da2f15b4d807083 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit de7f0a70c8293f1b87f9c821f16fd3c6f7b184b7 Author: Günther Deschner <g...@samba.org> Date: Mon Feb 2 17:24:28 2009 +0100 s3-eventlogadm: use struct eventlog_Record_tdb for storing entries in tdbs. Guenther commit 16f83ae75003107084c50b8e45d1922889158d80 Author: Günther Deschner <g...@samba.org> Date: Wed Feb 4 10:01:38 2009 +0100 s3-eventlog: add fixup_eventlog_record_tdb. Guenther commit dd306249f23cacc01d6e6ea375450714109ebaa7 Author: Günther Deschner <g...@samba.org> Date: Wed Jan 21 19:36:19 2009 +0100 s3-eventlog: add evlog_push_record_tdb function. This is almost a copy of write_eventlog_tdb() and still needs to be modified to use tdb transactions. Guenther ----------------------------------------------------------------------- Summary of changes: source3/include/proto.h | 7 +- source3/rpc_server/srv_eventlog_lib.c | 207 ++++++++++++++++++++++++--------- source3/utils/eventlogadm.c | 23 +++-- 3 files changed, 174 insertions(+), 63 deletions(-) Changeset truncated at 500 lines: diff --git a/source3/include/proto.h b/source3/include/proto.h index bf4976e..9f0caa2 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -6262,10 +6262,15 @@ ELOG_TDB *elog_open_tdb( const char *logname, bool force_clear, bool read_only ) int elog_close_tdb( ELOG_TDB *etdb, bool force_close ); int write_eventlog_tdb( TDB_CONTEXT * the_tdb, Eventlog_entry * ee ); void fixup_eventlog_entry( Eventlog_entry * ee ); -bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bool * eor ); +bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, struct eventlog_Record_tdb *entry, bool * eor ); +size_t fixup_eventlog_record_tdb(struct eventlog_Record_tdb *r); struct eventlog_Record_tdb *evlog_pull_record_tdb(TALLOC_CTX *mem_ctx, TDB_CONTEXT *tdb, uint32_t record_number); +NTSTATUS evlog_push_record_tdb(TALLOC_CTX *mem_ctx, + TDB_CONTEXT *tdb, + struct eventlog_Record_tdb *r, + uint32_t *record_number); /* The following definitions come from rpc_server/srv_eventlog_nt.c */ diff --git a/source3/rpc_server/srv_eventlog_lib.c b/source3/rpc_server/srv_eventlog_lib.c index d6c4f1a..85200d5 100644 --- a/source3/rpc_server/srv_eventlog_lib.c +++ b/source3/rpc_server/srv_eventlog_lib.c @@ -594,7 +594,7 @@ void fixup_eventlog_entry( Eventlog_entry * ee ) going in. ********************************************************************/ -bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bool * eor ) +bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, struct eventlog_Record_tdb *entry, bool * eor ) { char *start = NULL, *stop = NULL; @@ -615,32 +615,32 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo if ( 0 == strncmp( start, "LEN", stop - start ) ) { /* This will get recomputed later anyway -- probably not necessary */ - entry->record.length = atoi( stop + 1 ); + entry->size = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "RS1", stop - start ) ) { /* For now all these reserved entries seem to have the same value, which can be hardcoded to int(1699505740) for now */ - entry->record.reserved1 = atoi( stop + 1 ); + entry->reserved = talloc_strdup(mem_ctx, "eLfL"); } else if ( 0 == strncmp( start, "RCN", stop - start ) ) { - entry->record.record_number = atoi( stop + 1 ); + entry->record_number = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "TMG", stop - start ) ) { - entry->record.time_generated = atoi( stop + 1 ); + entry->time_generated = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "TMW", stop - start ) ) { - entry->record.time_written = atoi( stop + 1 ); + entry->time_written = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "EID", stop - start ) ) { - entry->record.event_id = atoi( stop + 1 ); + entry->event_id = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "ETP", stop - start ) ) { if ( strstr( start, "ERROR" ) ) { - entry->record.event_type = EVENTLOG_ERROR_TYPE; + entry->event_type = EVENTLOG_ERROR_TYPE; } else if ( strstr( start, "WARNING" ) ) { - entry->record.event_type = EVENTLOG_WARNING_TYPE; + entry->event_type = EVENTLOG_WARNING_TYPE; } else if ( strstr( start, "INFO" ) ) { - entry->record.event_type = EVENTLOG_INFORMATION_TYPE; + entry->event_type = EVENTLOG_INFORMATION_TYPE; } else if ( strstr( start, "AUDIT_SUCCESS" ) ) { - entry->record.event_type = EVENTLOG_AUDIT_SUCCESS; + entry->event_type = EVENTLOG_AUDIT_SUCCESS; } else if ( strstr( start, "AUDIT_FAILURE" ) ) { - entry->record.event_type = EVENTLOG_AUDIT_FAILURE; + entry->event_type = EVENTLOG_AUDIT_FAILURE; } else if ( strstr( start, "SUCCESS" ) ) { - entry->record.event_type = EVENTLOG_SUCCESS; + entry->event_type = EVENTLOG_SUCCESS; } else { /* some other eventlog type -- currently not defined in MSDN docs, so error out */ return False; @@ -650,27 +650,26 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo /* else if(0 == strncmp(start, "NST", stop - start)) { - entry->record.num_strings = atoi(stop + 1); + entry->num_of_strings = atoi(stop + 1); } */ else if ( 0 == strncmp( start, "ECT", stop - start ) ) { - entry->record.event_category = atoi( stop + 1 ); + entry->event_category = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "RS2", stop - start ) ) { - entry->record.reserved2 = atoi( stop + 1 ); + entry->reserved_flags = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "CRN", stop - start ) ) { - entry->record.closing_record_number = atoi( stop + 1 ); + entry->closing_record_number = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "USL", stop - start ) ) { - entry->record.user_sid_length = atoi( stop + 1 ); + entry->sid_length = atoi( stop + 1 ); } else if ( 0 == strncmp( start, "SRC", stop - start ) ) { stop++; while ( isspace( stop[0] ) ) { stop++; } - entry->data_record.source_name_len = rpcstr_push_talloc(mem_ctx, - &entry->data_record.source_name, - stop); - if (entry->data_record.source_name_len == (uint32_t)-1 || - entry->data_record.source_name == NULL) { + entry->source_name_len = strlen_m_term(stop); + entry->source_name = talloc_strdup(mem_ctx, stop); + if (entry->source_name_len == (uint32_t)-1 || + entry->source_name == NULL) { return false; } } else if ( 0 == strncmp( start, "SRN", stop - start ) ) { @@ -678,54 +677,43 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo while ( isspace( stop[0] ) ) { stop++; } - entry->data_record.computer_name_len = rpcstr_push_talloc(mem_ctx, - &entry->data_record.computer_name, - stop); - if (entry->data_record.computer_name_len == (uint32_t)-1 || - entry->data_record.computer_name == NULL) { + entry->computer_name_len = strlen_m_term(stop); + entry->computer_name = talloc_strdup(mem_ctx, stop); + if (entry->computer_name_len == (uint32_t)-1 || + entry->computer_name == NULL) { return false; } } else if ( 0 == strncmp( start, "SID", stop - start ) ) { + smb_ucs2_t *dummy = NULL; stop++; while ( isspace( stop[0] ) ) { stop++; } - entry->record.user_sid_length = rpcstr_push_talloc(mem_ctx, - &entry->data_record.sid, + entry->sid_length = rpcstr_push_talloc(mem_ctx, + &dummy, stop); - if (entry->record.user_sid_length == (uint32_t)-1 || - entry->data_record.sid == NULL) { + entry->sid = data_blob_talloc(mem_ctx, dummy, entry->sid_length); + if (entry->sid_length == (uint32_t)-1 || + entry->sid.data == NULL) { return false; } } else if ( 0 == strncmp( start, "STR", stop - start ) ) { - smb_ucs2_t *temp = NULL; size_t tmp_len; - uint32_t old_len; /* skip past initial ":" */ stop++; /* now skip any other leading whitespace */ while ( isspace(stop[0])) { stop++; } - tmp_len = rpcstr_push_talloc(mem_ctx, - &temp, - stop); - if (tmp_len == (size_t)-1 || !temp) { + tmp_len = strlen_m_term(stop); + if (tmp_len == (size_t)-1) { return false; } - old_len = entry->data_record.strings_len; - entry->data_record.strings = (smb_ucs2_t *)TALLOC_REALLOC_ARRAY(mem_ctx, - entry->data_record.strings, - char, - old_len + tmp_len); - if (!entry->data_record.strings) { + if (!add_string_to_array(mem_ctx, stop, &entry->strings, + (int *)&entry->num_of_strings)) { return false; } - memcpy(((char *)entry->data_record.strings) + old_len, - temp, - tmp_len); - entry->data_record.strings_len += tmp_len; - entry->record.num_strings++; + entry->strings_len += tmp_len; } else if ( 0 == strncmp( start, "DAT", stop - start ) ) { /* skip past initial ":" */ stop++; @@ -733,10 +721,9 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo while ( isspace( stop[0] ) ) { stop++; } - entry->data_record.user_data_len = strlen(stop); - entry->data_record.user_data = talloc_strdup(mem_ctx, - stop); - if (!entry->data_record.user_data) { + entry->data_length = strlen_m(stop); + entry->data = data_blob_talloc(mem_ctx, stop, entry->data_length); + if (!entry->data.data) { return false; } } else { @@ -749,6 +736,46 @@ bool parse_logentry( TALLOC_CTX *mem_ctx, char *line, Eventlog_entry * entry, bo return true; } +/******************************************************************* + calculate the correct fields etc for an eventlog entry +*******************************************************************/ + +size_t fixup_eventlog_record_tdb(struct eventlog_Record_tdb *r) +{ + size_t size = 56; /* static size of integers before buffers start */ + + r->source_name_len = strlen_m_term(r->source_name) * 2; + r->computer_name_len = strlen_m_term(r->computer_name) * 2; + r->strings_len = ndr_size_string_array(r->strings, + r->num_of_strings, LIBNDR_FLAG_STR_NULLTERM) * 2; + + /* fix up the eventlog entry structure as necessary */ + r->sid_padding = ( ( 4 - ( ( r->source_name_len + r->computer_name_len ) % 4 ) ) % 4 ); + r->padding = ( 4 - ( ( r->strings_len + r->data_length ) % 4 ) ) % 4; + + if (r->sid_length == 0) { + /* Should not pad to a DWORD boundary for writing out the sid if there is + no SID, so just propagate the padding to pad the data */ + r->padding += r->sid_padding; + r->sid_padding = 0; + } + + size += r->source_name_len; + size += r->computer_name_len; + size += r->sid_padding; + size += r->sid_length; + size += r->strings_len; + size += r->data_length; + size += r->padding; + /* need another copy of length at the end of the data */ + size += sizeof(r->size); + + r->size = size; + + return size; +} + + /******************************************************************** ********************************************************************/ @@ -803,3 +830,77 @@ struct eventlog_Record_tdb *evlog_pull_record_tdb(TALLOC_CTX *mem_ctx, return r; } + +/******************************************************************** + write an eventlog entry. Note that we have to lock, read next + eventlog, increment, write, write the record, unlock + + coming into this, ee has the eventlog record, and the auxilliary date + (computer name, etc.) filled into the other structure. Before packing + into a record, this routine will calc the appropriate padding, etc., + and then blast out the record in a form that can be read back in + ********************************************************************/ + +NTSTATUS evlog_push_record_tdb(TALLOC_CTX *mem_ctx, + TDB_CONTEXT *tdb, + struct eventlog_Record_tdb *r, + uint32_t *record_number) +{ + TDB_DATA kbuf, ebuf; + DATA_BLOB blob; + enum ndr_err_code ndr_err; + int ret; + + if (!r) { + return NT_STATUS_INVALID_PARAMETER; + } + + if (!can_write_to_eventlog(tdb, r->size)) { + return NT_STATUS_EVENTLOG_CANT_START; + } + + /* need to read the record number and insert it into the entry here */ + + /* lock */ + ret = tdb_lock_bystring_with_timeout(tdb, EVT_NEXT_RECORD, 1); + if (ret == -1) { + return NT_STATUS_LOCK_NOT_GRANTED; + } + + /* read */ + r->record_number = tdb_fetch_int32(tdb, EVT_NEXT_RECORD); + + ndr_err = ndr_push_struct_blob(&blob, mem_ctx, NULL, r, + (ndr_push_flags_fn_t)ndr_push_eventlog_Record_tdb); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + tdb_unlock_bystring(tdb, EVT_NEXT_RECORD); + return ndr_map_error2ntstatus(ndr_err); + } + + /* increment the record count */ + + kbuf.dsize = sizeof(int32_t); + kbuf.dptr = (uint8_t *)&r->record_number; + + ebuf.dsize = blob.length; + ebuf.dptr = blob.data; + + ret = tdb_store(tdb, kbuf, ebuf, 0); + if (ret == -1) { + tdb_unlock_bystring(tdb, EVT_NEXT_RECORD); + return NT_STATUS_EVENTLOG_FILE_CORRUPT; + } + + ret = tdb_store_int32(tdb, EVT_NEXT_RECORD, r->record_number + 1); + if (ret == -1) { + tdb_unlock_bystring(tdb, EVT_NEXT_RECORD); + return NT_STATUS_EVENTLOG_FILE_CORRUPT; + } + tdb_unlock_bystring(tdb, EVT_NEXT_RECORD); + + if (record_number) { + *record_number = r->record_number; + } + + return NT_STATUS_OK; +} diff --git a/source3/utils/eventlogadm.c b/source3/utils/eventlogadm.c index b957ec2..d134ea8 100644 --- a/source3/utils/eventlogadm.c +++ b/source3/utils/eventlogadm.c @@ -5,6 +5,7 @@ * * * Copyright (C) Brian Moran 2005. + * Copyright (C) Guenther Deschner 2009. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -84,12 +85,13 @@ static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename FILE *f1; char *argfname; ELOG_TDB *etdb; + NTSTATUS status; /* fixed constants are bad bad bad */ char linein[1024]; bool is_eor; - Eventlog_entry ee; - int rcnum; + struct eventlog_Record_tdb ee; + uint32_t record_number; TALLOC_CTX *mem_ctx = talloc_tos(); f1 = stdin; @@ -128,22 +130,25 @@ static int DoWriteCommand( int argc, char **argv, bool debugflag, char *exename /* should we do something with the return code? */ if ( is_eor ) { - fixup_eventlog_entry( &ee ); + fixup_eventlog_record_tdb( &ee ); if ( opt_debug ) - printf( "record number [%d], tg [%d] , tw [%d]\n", ee.record.record_number, ee.record.time_generated, ee.record.time_written ); + printf( "record number [%d], tg [%d] , tw [%d]\n", + ee.record_number, (int)ee.time_generated, (int)ee.time_written ); - if ( ee.record.time_generated != 0 ) { + if ( ee.time_generated != 0 ) { /* printf("Writing to the event log\n"); */ - rcnum = write_eventlog_tdb( ELOG_TDB_CTX(etdb), &ee ); - if ( !rcnum ) { - printf( "Can't write to the event log\n" ); + status = evlog_push_record_tdb( mem_ctx, ELOG_TDB_CTX(etdb), + &ee, &record_number ); + if ( !NT_STATUS_IS_OK(status) ) { + printf( "Can't write to the event log: %s\n", + nt_errstr(status) ); } else { if ( opt_debug ) printf( "Wrote record %d\n", - rcnum ); + record_number ); } } else { if ( opt_debug ) -- Samba Shared Repository