source: branches/samba-3.3.x/source/rpc_parse/parse_eventlog.c@ 206

Last change on this file since 206 was 206, checked in by Herwig Bauernfeind, 17 years ago

Import Samba 3.3 branch at 3.0.0 level (psmedley's port)
File size: 5.8 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Marcin Krzysztof Porwit 2005.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20#include "includes.h"
21
22#undef DBGC_CLASS
23#define DBGC_CLASS DBGC_RPC_PARSE
24
25/********************************************************************
26********************************************************************/
27
28bool eventlog_io_q_read_eventlog(const char *desc, EVENTLOG_Q_READ_EVENTLOG *q_u,
29 prs_struct *ps, int depth)
30{
31 if(q_u == NULL)
32 return False;
33
34 prs_debug(ps, depth, desc, "eventlog_io_q_read_eventlog");
35 depth++;
36
37 if(!(prs_align(ps)))
38 return False;
39
40 if(!(smb_io_pol_hnd("log handle", &(q_u->handle), ps, depth)))
41 return False;
42
43 if(!(prs_uint32("read flags", ps, depth, &(q_u->flags))))
44 return False;
45
46 if(!(prs_uint32("read offset", ps, depth, &(q_u->offset))))
47 return False;
48
49 if(!(prs_uint32("read buf size", ps, depth, &(q_u->max_read_size))))
50 return False;
51
52 return True;
53}
54/** Structure of response seems to be:
55 DWORD num_bytes_in_resp -- MUST be the same as q_u->max_read_size
56 for i=0..n
57 EVENTLOGRECORD record
58 DWORD sent_size -- sum of EVENTLOGRECORD lengths if records returned, 0 otherwise
59 DWORD real_size -- 0 if records returned, otherwise length of next record to be returned
60 WERROR status */
61bool eventlog_io_r_read_eventlog(const char *desc,
62 EVENTLOG_Q_READ_EVENTLOG *q_u,
63 EVENTLOG_R_READ_EVENTLOG *r_u,
64 prs_struct *ps,
65 int depth)
66{
67 Eventlog_entry *entry;
68 uint32 record_written = 0;
69 uint32 record_total = 0;
70
71 if(r_u == NULL)
72 return False;
73
74 prs_debug(ps, depth, desc, "eventlog_io_r_read_eventlog");
75 depth++;
76
77 /* First, see if we've read more logs than we can output */
78
79 if(r_u->num_bytes_in_resp > q_u->max_read_size) {
80 entry = r_u->entry;
81
82 /* remove the size of the last entry from the list */
83
84 while(entry->next != NULL)
85 entry = entry->next;
86
87 r_u->num_bytes_in_resp -= entry->record.length;
88
89 /* do not output the last log entry */
90
91 r_u->num_records--;
92 }
93
94 entry = r_u->entry;
95 record_total = r_u->num_records;
96
97 if(r_u->num_bytes_in_resp != 0)
98 r_u->sent_size = r_u->num_bytes_in_resp;
99 else
100 r_u->real_size = r_u->bytes_in_next_record;
101
102 if(!(prs_align(ps)))
103 return False;
104 if(!(prs_uint32("bytes in resp", ps, depth, &(q_u->max_read_size))))
105 return False;
106
107 while(entry != NULL && record_written < record_total)
108 {
109 DEBUG(11, ("eventlog_io_r_read_eventlog: writing record [%d] out of [%d].\n", record_written, record_total));
110
111 /* Encode the actual eventlog record record */
112
113 if(!(prs_uint32("length", ps, depth, &(entry->record.length))))
114 return False;
115 if(!(prs_uint32("reserved", ps, depth, &(entry->record.reserved1))))
116 return False;
117 if(!(prs_uint32("record number", ps, depth, &(entry->record.record_number))))
118 return False;
119 if(!(prs_uint32("time generated", ps, depth, &(entry->record.time_generated))))
120 return False;
121 if(!(prs_uint32("time written", ps, depth, &(entry->record.time_written))))
122 return False;
123 if(!(prs_uint32("event id", ps, depth, &(entry->record.event_id))))
124 return False;
125 if(!(prs_uint16("event type", ps, depth, &(entry->record.event_type))))
126 return False;
127 if(!(prs_uint16("num strings", ps, depth, &(entry->record.num_strings))))
128 return False;
129 if(!(prs_uint16("event category", ps, depth, &(entry->record.event_category))))
130 return False;
131 if(!(prs_uint16("reserved2", ps, depth, &(entry->record.reserved2))))
132 return False;
133 if(!(prs_uint32("closing record", ps, depth, &(entry->record.closing_record_number))))
134 return False;
135 if(!(prs_uint32("string offset", ps, depth, &(entry->record.string_offset))))
136 return False;
137 if(!(prs_uint32("user sid length", ps, depth, &(entry->record.user_sid_length))))
138 return False;
139 if(!(prs_uint32("user sid offset", ps, depth, &(entry->record.user_sid_offset))))
140 return False;
141 if(!(prs_uint32("data length", ps, depth, &(entry->record.data_length))))
142 return False;
143 if(!(prs_uint32("data offset", ps, depth, &(entry->record.data_offset))))
144 return False;
145 if(!(prs_align(ps)))
146 return False;
147
148 /* Now encoding data */
149
150 if(!(prs_uint8s(False, "buffer", ps, depth, entry->data,
151 entry->record.length - sizeof(Eventlog_record) - sizeof(entry->record.length))))
152 {
153 return False;
154 }
155
156 if(!(prs_align(ps)))
157 return False;
158 if(!(prs_uint32("length 2", ps, depth, &(entry->record.length))))
159 return False;
160
161 entry = entry->next;
162 record_written++;
163
164 } /* end of encoding EVENTLOGRECORD */
165
166 /* Now pad with whitespace until the end of the response buffer */
167
168 if (q_u->max_read_size - r_u->num_bytes_in_resp) {
169 r_u->end_of_entries_padding = PRS_ALLOC_MEM(ps, uint8_t, q_u->max_read_size - r_u->num_bytes_in_resp);
170 if (!r_u->end_of_entries_padding) {
171 return False;
172 }
173
174 if(!(prs_uint8s(False, "end of entries padding", ps,
175 depth, r_u->end_of_entries_padding,
176 (q_u->max_read_size - r_u->num_bytes_in_resp)))) {
177 return False;
178 }
179 }
180
181 /* We had better be DWORD aligned here */
182
183 if(!(prs_uint32("sent size", ps, depth, &(r_u->sent_size))))
184 return False;
185 if(!(prs_uint32("real size", ps, depth, &(r_u->real_size))))
186 return False;
187 if(!(prs_ntstatus("status code", ps, depth, &r_u->status)))
188 return False;
189
190 return True;
191}
Note: See TracBrowser for help on using the repository browser.