189dc44ceSjose borrego /*
289dc44ceSjose borrego * CDDL HEADER START
389dc44ceSjose borrego *
489dc44ceSjose borrego * The contents of this file are subject to the terms of the
589dc44ceSjose borrego * Common Development and Distribution License (the "License").
689dc44ceSjose borrego * You may not use this file except in compliance with the License.
789dc44ceSjose borrego *
889dc44ceSjose borrego * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
989dc44ceSjose borrego * or http://www.opensolaris.org/os/licensing.
1089dc44ceSjose borrego * See the License for the specific language governing permissions
1189dc44ceSjose borrego * and limitations under the License.
1289dc44ceSjose borrego *
1389dc44ceSjose borrego * When distributing Covered Code, include this CDDL HEADER in each
1489dc44ceSjose borrego * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
1589dc44ceSjose borrego * If applicable, add the following below this CDDL HEADER, with the
1689dc44ceSjose borrego * fields enclosed by brackets "[]" replaced with your own identifying
1789dc44ceSjose borrego * information: Portions Copyright [yyyy] [name of copyright owner]
1889dc44ceSjose borrego *
1989dc44ceSjose borrego * CDDL HEADER END
2089dc44ceSjose borrego */
21148c5f43SAlan Wright
2289dc44ceSjose borrego /*
23148c5f43SAlan Wright * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
24*3299f39fSGordon Ross * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
2589dc44ceSjose borrego */
2689dc44ceSjose borrego
2789dc44ceSjose borrego /*
2889dc44ceSjose borrego * Event Log Service RPC (LOGR) interface definition.
2989dc44ceSjose borrego */
3089dc44ceSjose borrego #include <sys/utsname.h>
3189dc44ceSjose borrego #include <unistd.h>
3289dc44ceSjose borrego #include <strings.h>
33*3299f39fSGordon Ross #include <libmlrpc/libmlrpc.h>
3489dc44ceSjose borrego #include <smbsrv/libsmb.h>
3589dc44ceSjose borrego #include <smbsrv/nmpipes.h>
3689dc44ceSjose borrego #include <smbsrv/libmlsvc.h>
371fcced4cSJordan Brown #include <smbsrv/ndl/eventlog.ndl>
3889dc44ceSjose borrego
391fcced4cSJordan Brown
4089dc44ceSjose borrego #define LOGR_FWD +1
4189dc44ceSjose borrego #define LOGR_REW -1
4289dc44ceSjose borrego #define LOGR_RECORD_SIGNATURE 0x654C664C
4389dc44ceSjose borrego
4489dc44ceSjose borrego #define LOGR_PRI(p) ((p) & LOG_PRIMASK)
45bbf6f00cSJordan Brown #define LOGR_WNSTRLEN(S) ((strlen((S)) + 1) * sizeof (smb_wchar_t))
4689dc44ceSjose borrego
4789dc44ceSjose borrego #define LOGR_MSG_DWORD_OFFSET 12
4889dc44ceSjose borrego #define LOGR_MSG_WORD_OFFSET 4
4989dc44ceSjose borrego
5089dc44ceSjose borrego /*
5189dc44ceSjose borrego * READ flags for EventLogRead
5289dc44ceSjose borrego *
5389dc44ceSjose borrego * EVENTLOG_SEEK_READ
5489dc44ceSjose borrego * The read operation proceeds from the record specified by the
5589dc44ceSjose borrego * dwRecordOffset parameter. This flag cannot be used with
5689dc44ceSjose borrego * EVENTLOG_SEQUENTIAL_READ.
5789dc44ceSjose borrego *
5889dc44ceSjose borrego * EVENTLOG_SEQUENTIAL_READ
5989dc44ceSjose borrego * The read operation proceeds sequentially from the last call to the
6089dc44ceSjose borrego * ReadEventLog function using this handle. This flag cannot be used
6189dc44ceSjose borrego * with EVENTLOG_SEEK_READ.
6289dc44ceSjose borrego *
6389dc44ceSjose borrego * If the buffer is large enough, more than one record can be read at
6489dc44ceSjose borrego * the specified seek position; you must specify one of the following
6589dc44ceSjose borrego * flags to indicate the direction for successive read operations.
6689dc44ceSjose borrego *
6789dc44ceSjose borrego * EVENTLOG_FORWARDS_READ
6889dc44ceSjose borrego * The log is read in chronological order. This flag cannot be used
6989dc44ceSjose borrego * with EVENTLOG_BACKWARDS_READ.
7089dc44ceSjose borrego *
7189dc44ceSjose borrego * EVENTLOG_BACKWARDS_READ
7289dc44ceSjose borrego * The log is read in reverse chronological order. This flag cannot be
7389dc44ceSjose borrego * used with EVENTLOG_FORWARDS_READ.
7489dc44ceSjose borrego */
7589dc44ceSjose borrego #define EVENTLOG_SEQUENTIAL_READ 0x0001
7689dc44ceSjose borrego #define EVENTLOG_SEEK_READ 0x0002
7789dc44ceSjose borrego #define EVENTLOG_FORWARDS_READ 0x0004
7889dc44ceSjose borrego #define EVENTLOG_BACKWARDS_READ 0x0008
7989dc44ceSjose borrego
8089dc44ceSjose borrego /*
8189dc44ceSjose borrego * The types of events that can be logged.
8289dc44ceSjose borrego */
8389dc44ceSjose borrego #define EVENTLOG_SUCCESS 0x0000
8489dc44ceSjose borrego #define EVENTLOG_ERROR_TYPE 0x0001
8589dc44ceSjose borrego #define EVENTLOG_WARNING_TYPE 0x0002
8689dc44ceSjose borrego #define EVENTLOG_INFORMATION_TYPE 0x0004
8789dc44ceSjose borrego #define EVENTLOG_AUDIT_SUCCESS 0x0008
8889dc44ceSjose borrego #define EVENTLOG_AUDIT_FAILURE 0x0010
8989dc44ceSjose borrego
9089dc44ceSjose borrego /*
9189dc44ceSjose borrego * Event Identifiers
9289dc44ceSjose borrego *
9389dc44ceSjose borrego * Event identifiers uniquely identify a particular event. Each event
9489dc44ceSjose borrego * source can define its own numbered events and the description strings
9589dc44ceSjose borrego * to which they are mapped. Event viewers can present these strings to
9689dc44ceSjose borrego * the user. They should help the user understand what went wrong and
9789dc44ceSjose borrego * suggest what actions to take. Direct the description at users solving
9889dc44ceSjose borrego * their own problems, not at administrators or support technicians.
9989dc44ceSjose borrego * Make the description clear and concise and avoid culture-specific
10089dc44ceSjose borrego * phrases.
10189dc44ceSjose borrego *
10289dc44ceSjose borrego * The following diagram illustrates the format of an event identifier.
10389dc44ceSjose borrego *
10489dc44ceSjose borrego * 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1
10589dc44ceSjose borrego * 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
10689dc44ceSjose borrego * +---+-+-+-----------------------+-------------------------------+
10789dc44ceSjose borrego * |Sev|C|R| Facility | Code |
10889dc44ceSjose borrego * +---+-+-+-----------------------+-------------------------------+
10989dc44ceSjose borrego *
11089dc44ceSjose borrego * Sev
11189dc44ceSjose borrego * Indicates the severity. This is one of the following values:
11289dc44ceSjose borrego * 00 - Success
11389dc44ceSjose borrego * 01 - Informational
11489dc44ceSjose borrego * 10 - Warning
11589dc44ceSjose borrego * 11 - Error
11689dc44ceSjose borrego *
11789dc44ceSjose borrego * C
11889dc44ceSjose borrego * Indicates a customer code (1) or a system code (0).
11989dc44ceSjose borrego * R
12089dc44ceSjose borrego * Reserved bit.
12189dc44ceSjose borrego * Facility
12289dc44ceSjose borrego * Facility code.
12389dc44ceSjose borrego * Code
12489dc44ceSjose borrego * Status code for the facility.
12589dc44ceSjose borrego */
12689dc44ceSjose borrego #define EVENTID_SEVERITY_SUCCESS 0x00000000
12789dc44ceSjose borrego #define EVENTID_SEVERITY_INFO 0x40000000
12889dc44ceSjose borrego #define EVENTID_SEVERITY_WARNING 0x80000000
12989dc44ceSjose borrego #define EVENTID_SEVERITY_ERROR 0xC0000000
13089dc44ceSjose borrego
13189dc44ceSjose borrego #define EVENTID_SYSTEM_CODE 0x00000000
13289dc44ceSjose borrego #define EVENTID_CUSTOMER_CODE 0x20000000
13389dc44ceSjose borrego
13489dc44ceSjose borrego static int logr_s_EventLogClose(void *, ndr_xa_t *);
13589dc44ceSjose borrego static int logr_s_EventLogQueryCount(void *, ndr_xa_t *);
13689dc44ceSjose borrego static int logr_s_EventLogGetOldestRec(void *, ndr_xa_t *);
13789dc44ceSjose borrego static int logr_s_EventLogOpen(void *, ndr_xa_t *);
13889dc44ceSjose borrego static int logr_s_EventLogRead(void *, ndr_xa_t *);
13989dc44ceSjose borrego
14089dc44ceSjose borrego static ndr_stub_table_t logr_stub_table[] = {
14189dc44ceSjose borrego { logr_s_EventLogClose, LOGR_OPNUM_EventLogClose },
14289dc44ceSjose borrego { logr_s_EventLogQueryCount, LOGR_OPNUM_EventLogQueryCount },
14389dc44ceSjose borrego { logr_s_EventLogGetOldestRec, LOGR_OPNUM_EventLogGetOldestRec },
14489dc44ceSjose borrego { logr_s_EventLogOpen, LOGR_OPNUM_EventLogOpen },
14589dc44ceSjose borrego { logr_s_EventLogRead, LOGR_OPNUM_EventLogRead },
14689dc44ceSjose borrego {0}
14789dc44ceSjose borrego };
14889dc44ceSjose borrego
14989dc44ceSjose borrego static ndr_service_t logr_service = {
15089dc44ceSjose borrego "LOGR", /* name */
15189dc44ceSjose borrego "Event Log Service", /* desc */
15289dc44ceSjose borrego "\\eventlog", /* endpoint */
15389dc44ceSjose borrego PIPE_NTSVCS, /* sec_addr_port */
15489dc44ceSjose borrego "82273fdc-e32a-18c3-3f78-827929dc23ea", 0, /* abstract */
15589dc44ceSjose borrego NDR_TRANSFER_SYNTAX_UUID, 2, /* transfer */
15689dc44ceSjose borrego 0, /* no bind_instance_size */
15789dc44ceSjose borrego 0, /* no bind_req() */
15889dc44ceSjose borrego 0, /* no unbind_and_close() */
15989dc44ceSjose borrego 0, /* use generic_call_stub() */
16089dc44ceSjose borrego &TYPEINFO(logr_interface), /* interface ti */
16189dc44ceSjose borrego logr_stub_table /* stub_table */
16289dc44ceSjose borrego };
16389dc44ceSjose borrego
16489dc44ceSjose borrego /*
16589dc44ceSjose borrego * logr_initialize
16689dc44ceSjose borrego *
16789dc44ceSjose borrego * This function registers the LOGR RPC interface with the RPC runtime
16889dc44ceSjose borrego * library. It must be called in order to use either the client side
16989dc44ceSjose borrego * or the server side functions.
17089dc44ceSjose borrego */
17189dc44ceSjose borrego void
logr_initialize(void)17289dc44ceSjose borrego logr_initialize(void)
17389dc44ceSjose borrego {
17489dc44ceSjose borrego (void) ndr_svc_register(&logr_service);
1751fcced4cSJordan Brown logr_init();
1761fcced4cSJordan Brown }
1771fcced4cSJordan Brown
1781fcced4cSJordan Brown void
logr_finalize(void)1791fcced4cSJordan Brown logr_finalize(void)
1801fcced4cSJordan Brown {
1811fcced4cSJordan Brown logr_fini();
18289dc44ceSjose borrego }
18389dc44ceSjose borrego
18489dc44ceSjose borrego /*
18589dc44ceSjose borrego * logr_hdlookup
18689dc44ceSjose borrego *
18789dc44ceSjose borrego * Handle lookup wrapper to validate the local service and/or manager context.
18889dc44ceSjose borrego */
18989dc44ceSjose borrego static ndr_handle_t *
logr_hdlookup(ndr_xa_t * mxa,ndr_hdid_t * id)19089dc44ceSjose borrego logr_hdlookup(ndr_xa_t *mxa, ndr_hdid_t *id)
19189dc44ceSjose borrego {
19289dc44ceSjose borrego ndr_handle_t *hd;
19389dc44ceSjose borrego logr_context_t *ctx;
19489dc44ceSjose borrego
19589dc44ceSjose borrego if ((hd = ndr_hdlookup(mxa, id)) == NULL)
19689dc44ceSjose borrego return (NULL);
19789dc44ceSjose borrego
19889dc44ceSjose borrego if ((ctx = (logr_context_t *)hd->nh_data) == NULL)
19989dc44ceSjose borrego return (NULL);
20089dc44ceSjose borrego
20189dc44ceSjose borrego if (ctx->lc_source_name == NULL)
20289dc44ceSjose borrego return (NULL);
20389dc44ceSjose borrego
20489dc44ceSjose borrego return (hd);
20589dc44ceSjose borrego }
20689dc44ceSjose borrego
20789dc44ceSjose borrego /*
20889dc44ceSjose borrego * logr_context_data_free
20989dc44ceSjose borrego *
21089dc44ceSjose borrego * Callback to free the context data associated with local service
21189dc44ceSjose borrego * and/or manager context.
21289dc44ceSjose borrego */
21389dc44ceSjose borrego static void
logr_context_data_free(void * ctxp)21489dc44ceSjose borrego logr_context_data_free(void *ctxp)
21589dc44ceSjose borrego {
21689dc44ceSjose borrego logr_context_t *ctx = (logr_context_t *)ctxp;
21789dc44ceSjose borrego
21889dc44ceSjose borrego if (ctx == NULL)
21989dc44ceSjose borrego return;
22089dc44ceSjose borrego
22189dc44ceSjose borrego free(ctx->lc_source_name);
22289dc44ceSjose borrego free(ctx->lc_cached_read_data->rd_log);
22389dc44ceSjose borrego free(ctx->lc_cached_read_data);
22489dc44ceSjose borrego free(ctx);
22589dc44ceSjose borrego ctx = NULL;
22689dc44ceSjose borrego }
22789dc44ceSjose borrego
22889dc44ceSjose borrego /*
2291fcced4cSJordan Brown * logr_hdalloc
23089dc44ceSjose borrego *
23189dc44ceSjose borrego * Handle allocation wrapper to setup the local manager context.
23289dc44ceSjose borrego */
23389dc44ceSjose borrego static ndr_hdid_t *
logr_hdalloc(ndr_xa_t * mxa,char * logname)2341fcced4cSJordan Brown logr_hdalloc(ndr_xa_t *mxa, char *logname)
23589dc44ceSjose borrego {
23689dc44ceSjose borrego logr_context_t *ctx;
23789dc44ceSjose borrego
23889dc44ceSjose borrego if ((ctx = malloc(sizeof (logr_context_t))) == NULL)
23989dc44ceSjose borrego return (NULL);
24089dc44ceSjose borrego bzero(ctx, sizeof (logr_context_t));
24189dc44ceSjose borrego
2421fcced4cSJordan Brown ctx->lc_source_name = strdup(logname);
2431fcced4cSJordan Brown if (ctx->lc_source_name == NULL) {
2441fcced4cSJordan Brown free(ctx);
2451fcced4cSJordan Brown return (NULL);
2461fcced4cSJordan Brown }
2471fcced4cSJordan Brown
2481fcced4cSJordan Brown if (logr_get_snapshot(ctx) != 0) {
24989dc44ceSjose borrego free(ctx->lc_source_name);
25089dc44ceSjose borrego free(ctx);
25189dc44ceSjose borrego return (NULL);
25289dc44ceSjose borrego }
25389dc44ceSjose borrego
25489dc44ceSjose borrego return (ndr_hdalloc(mxa, ctx));
25589dc44ceSjose borrego }
25689dc44ceSjose borrego
25789dc44ceSjose borrego /*
25889dc44ceSjose borrego * logr_s_EventLogClose
25989dc44ceSjose borrego *
26089dc44ceSjose borrego * This is a request to close the LOGR interface specified by handle.
26189dc44ceSjose borrego * Free the handle and associated resources, and zero out the result
26289dc44ceSjose borrego * handle for the client.
26389dc44ceSjose borrego */
26489dc44ceSjose borrego static int
logr_s_EventLogClose(void * arg,ndr_xa_t * mxa)26589dc44ceSjose borrego logr_s_EventLogClose(void *arg, ndr_xa_t *mxa)
26689dc44ceSjose borrego {
26789dc44ceSjose borrego struct logr_EventLogClose *param = arg;
26889dc44ceSjose borrego ndr_hdid_t *id = (ndr_hdid_t *)¶m->handle;
26989dc44ceSjose borrego ndr_handle_t *hd;
27089dc44ceSjose borrego
27189dc44ceSjose borrego if ((hd = ndr_hdlookup(mxa, id)) == NULL) {
27289dc44ceSjose borrego bzero(¶m->result_handle, sizeof (logr_handle_t));
27389dc44ceSjose borrego param->status = NT_SC_ERROR(NT_STATUS_INVALID_HANDLE);
27489dc44ceSjose borrego return (NDR_DRC_OK);
27589dc44ceSjose borrego }
27689dc44ceSjose borrego logr_context_data_free(hd->nh_data);
27789dc44ceSjose borrego ndr_hdfree(mxa, id);
27889dc44ceSjose borrego
27989dc44ceSjose borrego bzero(¶m->result_handle, sizeof (logr_handle_t));
28089dc44ceSjose borrego param->status = NT_STATUS_SUCCESS;
28189dc44ceSjose borrego
28289dc44ceSjose borrego return (NDR_DRC_OK);
28389dc44ceSjose borrego }
28489dc44ceSjose borrego
28589dc44ceSjose borrego /*
28689dc44ceSjose borrego * logr_s_EventLogOpen
28789dc44ceSjose borrego *
28889dc44ceSjose borrego * Open the event log. Not supported yet.
28989dc44ceSjose borrego */
29089dc44ceSjose borrego /*ARGSUSED*/
29189dc44ceSjose borrego static int
logr_s_EventLogOpen(void * arg,ndr_xa_t * mxa)29289dc44ceSjose borrego logr_s_EventLogOpen(void *arg, ndr_xa_t *mxa)
29389dc44ceSjose borrego {
29489dc44ceSjose borrego struct logr_EventLogOpen *param = arg;
29589dc44ceSjose borrego ndr_hdid_t *id = NULL;
29689dc44ceSjose borrego ndr_handle_t *hd;
2977f667e74Sjose borrego char *log_name = NULL;
2987f667e74Sjose borrego
2991fcced4cSJordan Brown if (!ndr_is_admin(mxa)) {
3007f667e74Sjose borrego bzero(¶m->handle, sizeof (logr_handle_t));
3017f667e74Sjose borrego param->status = NT_SC_ERROR(NT_STATUS_ACCESS_DENIED);
3027f667e74Sjose borrego return (NDR_DRC_OK);
3037f667e74Sjose borrego }
30489dc44ceSjose borrego
3051fcced4cSJordan Brown if (param->log_name.length != 0)
3061fcced4cSJordan Brown log_name = (char *)param->log_name.str;
3071fcced4cSJordan Brown
3081fcced4cSJordan Brown if (!logr_is_supported(log_name)) {
3091fcced4cSJordan Brown bzero(¶m->handle, sizeof (logr_handle_t));
3101fcced4cSJordan Brown param->status = NT_SC_ERROR(NT_STATUS_ACCESS_DENIED);
3111fcced4cSJordan Brown return (NDR_DRC_OK);
3121fcced4cSJordan Brown }
3131fcced4cSJordan Brown
3141fcced4cSJordan Brown id = logr_hdalloc(mxa, log_name);
31589dc44ceSjose borrego if (id && ((hd = logr_hdlookup(mxa, id)) != NULL)) {
31689dc44ceSjose borrego hd->nh_data_free = logr_context_data_free;
31789dc44ceSjose borrego bcopy(id, ¶m->handle, sizeof (logr_handle_t));
3187f667e74Sjose borrego param->status = NT_STATUS_SUCCESS;
31989dc44ceSjose borrego } else {
32089dc44ceSjose borrego bzero(¶m->handle, sizeof (logr_handle_t));
3217f667e74Sjose borrego param->status = NT_SC_ERROR(NT_STATUS_ACCESS_DENIED);
32289dc44ceSjose borrego }
32389dc44ceSjose borrego
32489dc44ceSjose borrego return (NDR_DRC_OK);
32589dc44ceSjose borrego }
32689dc44ceSjose borrego
32789dc44ceSjose borrego /*
32889dc44ceSjose borrego * logr_s_EventLogQueryCount
32989dc44ceSjose borrego *
33089dc44ceSjose borrego * take a snapshot from system log, assign it to the given handle.
33189dc44ceSjose borrego * return number of log entries in the snapshot as result of RPC
33289dc44ceSjose borrego * call.
33389dc44ceSjose borrego */
33489dc44ceSjose borrego static int
logr_s_EventLogQueryCount(void * arg,ndr_xa_t * mxa)33589dc44ceSjose borrego logr_s_EventLogQueryCount(void *arg, ndr_xa_t *mxa)
33689dc44ceSjose borrego {
33789dc44ceSjose borrego struct logr_EventLogQueryCount *param = arg;
33889dc44ceSjose borrego ndr_hdid_t *id = (ndr_hdid_t *)¶m->handle;
33989dc44ceSjose borrego ndr_handle_t *hd;
34089dc44ceSjose borrego logr_context_t *ctx;
34189dc44ceSjose borrego logr_read_data_t *data;
34289dc44ceSjose borrego
34389dc44ceSjose borrego if ((hd = logr_hdlookup(mxa, id)) == NULL) {
34489dc44ceSjose borrego param->status = NT_SC_ERROR(NT_STATUS_INVALID_HANDLE);
34589dc44ceSjose borrego return (NDR_DRC_OK);
34689dc44ceSjose borrego }
34789dc44ceSjose borrego
34889dc44ceSjose borrego ctx = (logr_context_t *)hd->nh_data;
34989dc44ceSjose borrego data = ctx->lc_cached_read_data;
35089dc44ceSjose borrego
35189dc44ceSjose borrego param->rec_num = data->rd_tot_recnum;
35289dc44ceSjose borrego param->status = NT_STATUS_SUCCESS;
35389dc44ceSjose borrego return (NDR_DRC_OK);
35489dc44ceSjose borrego }
35589dc44ceSjose borrego
35689dc44ceSjose borrego /*
35789dc44ceSjose borrego * logr_s_EventLogGetOldestRec
35889dc44ceSjose borrego *
35989dc44ceSjose borrego * Return oldest record number in the snapshot as result of RPC call.
36089dc44ceSjose borrego */
36189dc44ceSjose borrego static int
logr_s_EventLogGetOldestRec(void * arg,ndr_xa_t * mxa)36289dc44ceSjose borrego logr_s_EventLogGetOldestRec(void *arg, ndr_xa_t *mxa)
36389dc44ceSjose borrego {
36489dc44ceSjose borrego struct logr_EventLogGetOldestRec *param = arg;
36589dc44ceSjose borrego ndr_hdid_t *id = (ndr_hdid_t *)¶m->handle;
36689dc44ceSjose borrego ndr_handle_t *hd;
36789dc44ceSjose borrego logr_context_t *ctx;
36889dc44ceSjose borrego logr_read_data_t *data;
36989dc44ceSjose borrego
37089dc44ceSjose borrego if ((hd = logr_hdlookup(mxa, id)) == NULL) {
37189dc44ceSjose borrego param->status = NT_SC_ERROR(NT_STATUS_INVALID_HANDLE);
37289dc44ceSjose borrego return (NDR_DRC_OK);
37389dc44ceSjose borrego }
37489dc44ceSjose borrego
37589dc44ceSjose borrego ctx = (logr_context_t *)hd->nh_data;
37689dc44ceSjose borrego data = ctx->lc_cached_read_data;
37789dc44ceSjose borrego
37889dc44ceSjose borrego param->oldest_rec = data->rd_log->li_idx - data->rd_tot_recnum + 1;
37989dc44ceSjose borrego
38089dc44ceSjose borrego param->status = NT_STATUS_SUCCESS;
38189dc44ceSjose borrego return (NDR_DRC_OK);
38289dc44ceSjose borrego }
38389dc44ceSjose borrego
38489dc44ceSjose borrego /*
38589dc44ceSjose borrego * logr_set_event_typeid
38689dc44ceSjose borrego *
38789dc44ceSjose borrego * Map the local system log priority to the event type and event ID
38889dc44ceSjose borrego * for Windows events.
38989dc44ceSjose borrego */
39089dc44ceSjose borrego void
logr_set_event_typeid(int le_pri,WORD * etype,DWORD * eid)39189dc44ceSjose borrego logr_set_event_typeid(int le_pri, WORD *etype, DWORD *eid)
39289dc44ceSjose borrego {
39389dc44ceSjose borrego switch (LOGR_PRI(le_pri)) {
39489dc44ceSjose borrego case LOG_EMERG:
39589dc44ceSjose borrego case LOG_ALERT:
39689dc44ceSjose borrego case LOG_CRIT:
39789dc44ceSjose borrego case LOG_ERR:
39889dc44ceSjose borrego *eid = EVENTID_SEVERITY_ERROR;
39989dc44ceSjose borrego *etype = EVENTLOG_ERROR_TYPE;
40089dc44ceSjose borrego break;
40189dc44ceSjose borrego case LOG_WARNING:
40289dc44ceSjose borrego *eid = EVENTID_SEVERITY_WARNING;
40389dc44ceSjose borrego *etype = EVENTLOG_WARNING_TYPE;
40489dc44ceSjose borrego break;
40589dc44ceSjose borrego case LOG_NOTICE:
40689dc44ceSjose borrego case LOG_INFO:
40789dc44ceSjose borrego case LOG_DEBUG:
40889dc44ceSjose borrego *eid = EVENTID_SEVERITY_INFO;
40989dc44ceSjose borrego *etype = EVENTLOG_INFORMATION_TYPE;
41089dc44ceSjose borrego break;
41189dc44ceSjose borrego default:
41289dc44ceSjose borrego *eid = EVENTID_SEVERITY_SUCCESS;
41389dc44ceSjose borrego *etype = EVENTLOG_SUCCESS;
41489dc44ceSjose borrego }
41589dc44ceSjose borrego }
41689dc44ceSjose borrego
41789dc44ceSjose borrego /*
41889dc44ceSjose borrego * logr_get_entry
41989dc44ceSjose borrego *
42089dc44ceSjose borrego * Gets a log entry.
42189dc44ceSjose borrego */
42289dc44ceSjose borrego static logr_entry_t *
logr_get_entry(logr_info_t * linfo,int entno)42389dc44ceSjose borrego logr_get_entry(logr_info_t *linfo, int entno)
42489dc44ceSjose borrego {
42589dc44ceSjose borrego return (&linfo->li_entry[entno]);
42689dc44ceSjose borrego }
42789dc44ceSjose borrego
42889dc44ceSjose borrego /*
42989dc44ceSjose borrego * logr_set_logrecord
43089dc44ceSjose borrego *
43189dc44ceSjose borrego * Fill a Windows event record based on a local system log record.
43289dc44ceSjose borrego */
43389dc44ceSjose borrego static void
logr_set_logrecord(char * src_name,logr_entry_t * le,DWORD recno,logr_record_t * rec)43489dc44ceSjose borrego logr_set_logrecord(char *src_name, logr_entry_t *le,
43589dc44ceSjose borrego DWORD recno, logr_record_t *rec)
43689dc44ceSjose borrego {
43789dc44ceSjose borrego int srcname_len = 0, hostname_len = 0, len;
43889dc44ceSjose borrego int str_offs, sh_len;
439bbf6f00cSJordan Brown smb_wchar_t wcs_hostname[MAXHOSTNAMELEN];
440bbf6f00cSJordan Brown smb_wchar_t wcs_srcname[SYS_NMLN * 2];
44189dc44ceSjose borrego
442bbf6f00cSJordan Brown (void) smb_mbstowcs(wcs_srcname, src_name,
44389dc44ceSjose borrego strlen(src_name) + 1);
44489dc44ceSjose borrego srcname_len = LOGR_WNSTRLEN(src_name);
44589dc44ceSjose borrego
44689dc44ceSjose borrego /* Because, Solaris allows remote logging, need to get hostname here */
447bbf6f00cSJordan Brown (void) smb_mbstowcs(wcs_hostname, le->le_hostname,
44889dc44ceSjose borrego strlen(le->le_hostname) + 1);
44989dc44ceSjose borrego hostname_len = LOGR_WNSTRLEN(le->le_hostname);
45089dc44ceSjose borrego
45189dc44ceSjose borrego sh_len = srcname_len + hostname_len;
45289dc44ceSjose borrego str_offs = LOGR_MSG_DWORD_OFFSET * sizeof (DWORD) +
45389dc44ceSjose borrego LOGR_MSG_WORD_OFFSET * sizeof (WORD) + sh_len;
45489dc44ceSjose borrego
45589dc44ceSjose borrego rec->Length1 = sizeof (logr_record_t);
45689dc44ceSjose borrego rec->Reserved = LOGR_RECORD_SIGNATURE;
45789dc44ceSjose borrego rec->RecordNumber = recno;
45889dc44ceSjose borrego rec->TimeGenerated = le->le_timestamp.tv_sec;
45989dc44ceSjose borrego rec->TimeWritten = le->le_timestamp.tv_sec;
46089dc44ceSjose borrego logr_set_event_typeid(le->le_pri, &rec->EventType, &rec->EventID);
46189dc44ceSjose borrego rec->NumStrings = 1;
46289dc44ceSjose borrego rec->EventCategory = 0;
46389dc44ceSjose borrego rec->ReservedFlags = 0;
46489dc44ceSjose borrego rec->ClosingRecordNumber = 0;
46589dc44ceSjose borrego rec->StringOffset = str_offs;
46689dc44ceSjose borrego rec->UserSidLength = 0;
46789dc44ceSjose borrego rec->UserSidOffset = 0;
46889dc44ceSjose borrego rec->DataLength = 0;
46989dc44ceSjose borrego rec->DataOffset = 0;
47089dc44ceSjose borrego
47189dc44ceSjose borrego bzero(rec->info, LOGR_MAXENTRYLEN);
47289dc44ceSjose borrego (void) memcpy(rec->info, wcs_srcname, srcname_len);
47389dc44ceSjose borrego (void) memcpy(rec->info + srcname_len, wcs_hostname, hostname_len);
47489dc44ceSjose borrego
47589dc44ceSjose borrego len = strlen(le->le_msg) + 1;
47689dc44ceSjose borrego if (len > 0)
47789dc44ceSjose borrego /*LINTED E_BAD_PTR_CAST_ALIGN*/
478bbf6f00cSJordan Brown (void) smb_mbstowcs((smb_wchar_t *)(rec->info + sh_len),
47989dc44ceSjose borrego le->le_msg, len);
48089dc44ceSjose borrego
48189dc44ceSjose borrego rec->Length2 = sizeof (logr_record_t);
48289dc44ceSjose borrego }
48389dc44ceSjose borrego
48489dc44ceSjose borrego /*
48589dc44ceSjose borrego * logr_s_EventLogRead
48689dc44ceSjose borrego *
48789dc44ceSjose borrego * Reads a whole number of entries from system log. The function can
48889dc44ceSjose borrego * read log entries in chronological or reverse chronological order.
48989dc44ceSjose borrego */
49089dc44ceSjose borrego static int
logr_s_EventLogRead(void * arg,ndr_xa_t * mxa)49189dc44ceSjose borrego logr_s_EventLogRead(void *arg, ndr_xa_t *mxa)
49289dc44ceSjose borrego {
49389dc44ceSjose borrego struct logr_EventLogRead *param = arg;
49489dc44ceSjose borrego ndr_hdid_t *id = (ndr_hdid_t *)¶m->handle;
49589dc44ceSjose borrego ndr_handle_t *hd;
49689dc44ceSjose borrego logr_read_data_t *rdata;
49789dc44ceSjose borrego logr_entry_t *le;
49889dc44ceSjose borrego DWORD ent_no, ent_num, ent_remain;
49989dc44ceSjose borrego logr_record_t *rec;
50089dc44ceSjose borrego BYTE *buf;
50189dc44ceSjose borrego int dir, ent_per_req, iter;
50289dc44ceSjose borrego logr_context_t *ctx;
50389dc44ceSjose borrego
50489dc44ceSjose borrego if ((hd = logr_hdlookup(mxa, id)) == NULL) {
50589dc44ceSjose borrego param->status = NT_SC_ERROR(NT_STATUS_INVALID_HANDLE);
50689dc44ceSjose borrego return (NDR_DRC_OK);
50789dc44ceSjose borrego }
50889dc44ceSjose borrego
50989dc44ceSjose borrego ctx = (logr_context_t *)hd->nh_data;
51089dc44ceSjose borrego rdata = ctx->lc_cached_read_data;
51189dc44ceSjose borrego if (rdata == NULL) {
51289dc44ceSjose borrego param->status = NT_SC_ERROR(NT_STATUS_NO_MEMORY);
51389dc44ceSjose borrego return (NDR_DRC_OK);
51489dc44ceSjose borrego }
51589dc44ceSjose borrego
51689dc44ceSjose borrego dir = (param->read_flags & EVENTLOG_FORWARDS_READ) ?
51789dc44ceSjose borrego LOGR_FWD : LOGR_REW;
51889dc44ceSjose borrego
51989dc44ceSjose borrego if (param->read_flags & EVENTLOG_SEEK_READ)
52089dc44ceSjose borrego rdata->rd_last_sentrec = param->rec_offset;
52189dc44ceSjose borrego else if (rdata->rd_first_read)
52289dc44ceSjose borrego /*
52389dc44ceSjose borrego * set last record number which is read for
52489dc44ceSjose borrego * the first iteration of sequential read.
52589dc44ceSjose borrego */
52689dc44ceSjose borrego rdata->rd_last_sentrec = (dir == LOGR_FWD)
52789dc44ceSjose borrego ? (rdata->rd_log->li_idx - rdata->rd_tot_recnum)
52889dc44ceSjose borrego : rdata->rd_log->li_idx;
52989dc44ceSjose borrego
53089dc44ceSjose borrego ent_remain = (dir == LOGR_FWD)
53189dc44ceSjose borrego ? (rdata->rd_tot_recnum - rdata->rd_last_sentrec)
53289dc44ceSjose borrego : rdata->rd_last_sentrec;
53389dc44ceSjose borrego
53489dc44ceSjose borrego /*
53589dc44ceSjose borrego * function should return as many whole log entries as
53689dc44ceSjose borrego * will fit in the buffer; it should not return partial
53789dc44ceSjose borrego * entries, even if there is room in the buffer.
53889dc44ceSjose borrego */
53989dc44ceSjose borrego ent_per_req = param->nbytes_to_read / sizeof (logr_record_t);
54089dc44ceSjose borrego if (ent_remain > ent_per_req)
54189dc44ceSjose borrego ent_remain = ent_per_req;
54289dc44ceSjose borrego
54389dc44ceSjose borrego if (ent_remain == 0) {
54489dc44ceSjose borrego /*
54589dc44ceSjose borrego * Send this error to Windows client so that it
54689dc44ceSjose borrego * can figure out that there is no more record
54789dc44ceSjose borrego * to read.
54889dc44ceSjose borrego */
54989dc44ceSjose borrego param->buf = NDR_STRDUP(mxa, "");
55089dc44ceSjose borrego param->sent_size = 0;
55189dc44ceSjose borrego param->status = NT_SC_ERROR(NT_STATUS_END_OF_FILE);
55289dc44ceSjose borrego return (NDR_DRC_OK);
55389dc44ceSjose borrego }
55489dc44ceSjose borrego
55589dc44ceSjose borrego param->buf = NDR_MALLOC(mxa, param->nbytes_to_read);
55689dc44ceSjose borrego buf = (BYTE *)param->buf;
55789dc44ceSjose borrego
55889dc44ceSjose borrego for (ent_num = 0, ent_no = rdata->rd_last_sentrec;
55989dc44ceSjose borrego ent_num < ent_remain; ent_num++, ent_no += dir) {
56089dc44ceSjose borrego
56189dc44ceSjose borrego iter = ent_no & LOGR_NMSGMASK;
56289dc44ceSjose borrego if (dir == LOGR_REW)
56389dc44ceSjose borrego iter = (ent_no - 1) & LOGR_NMSGMASK;
56489dc44ceSjose borrego
56589dc44ceSjose borrego le = logr_get_entry(rdata->rd_log, iter);
56689dc44ceSjose borrego
56789dc44ceSjose borrego /*LINTED E_BAD_PTR_CAST_ALIGN*/
56889dc44ceSjose borrego rec = (logr_record_t *)buf;
56989dc44ceSjose borrego logr_set_logrecord(ctx->lc_source_name, le, ent_no, rec);
57089dc44ceSjose borrego buf += sizeof (logr_record_t);
57189dc44ceSjose borrego }
57289dc44ceSjose borrego
57389dc44ceSjose borrego rdata->rd_last_sentrec = ent_no;
57489dc44ceSjose borrego rdata->rd_first_read = 0;
57589dc44ceSjose borrego
57689dc44ceSjose borrego param->sent_size = sizeof (logr_record_t) * ent_remain;
57789dc44ceSjose borrego param->status = NT_STATUS_SUCCESS;
57889dc44ceSjose borrego
57989dc44ceSjose borrego return (NDR_DRC_OK);
58089dc44ceSjose borrego }
581