sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

s3-net: add "net eventlog dump".

Browse Source 
This allows to dump a native (non-wrapped) win32 *.evt eventlog file.

Guenther
This commit is contained in:
Günther Deschner 2009-01-23 15:00:17 +01:00
parent 65200328ee
commit 21d23bf7e8
4 changed files with 118 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
source3/Makefile.in
View File

@ -530,6 +530,7 @@ REG_FULL_OBJ = $(REG_SMBCONF_OBJ) \
registry/reg_perfcount.o \
registry/reg_util_legacy.o
LIB_EVENTLOG_OBJ = rpc_server/srv_eventlog_lib.o
RPC_LSA_OBJ = rpc_server/srv_lsa_nt.o ../librpc/gen_ndr/srv_lsa.o
@ -566,7 +567,7 @@ RPC_DFS_OBJ = ../librpc/gen_ndr/srv_dfs.o rpc_server/srv_dfs_nt.o
RPC_SPOOLSS_OBJ = rpc_server/srv_spoolss.o rpc_server/srv_spoolss_nt.o
RPC_EVENTLOG_OBJ = rpc_server/srv_eventlog.o rpc_server/srv_eventlog_nt.o \
rpc_server/srv_eventlog_lib.o ../librpc/gen_ndr/srv_eventlog.o
$(LIB_EVENTLOG_OBJ) ../librpc/gen_ndr/srv_eventlog.o
RPC_PIPE_OBJ = rpc_server/srv_pipe_hnd.o \
rpc_server/srv_pipe.o rpc_server/srv_lsa_hnd.o
@ -896,7 +897,8 @@ NET_OBJ1 = utils/net.o utils/net_ads.o utils/net_help.o \
$(PASSWD_UTIL_OBJ) utils/net_dns.o utils/net_ads_gpo.o \
utils/net_conf.o utils/net_join.o utils/net_user.o \
utils/net_group.o utils/net_file.o utils/net_registry.o \
auth/token_util.o utils/net_dom.o utils/net_share.o utils/net_lua.o
auth/token_util.o utils/net_dom.o utils/net_share.o utils/net_lua.o \
utils/net_eventlog.o
# these are not processed by make proto
NET_OBJ2 = utils/net_registry_util.o utils/net_help_common.o
@ -914,7 +916,8 @@ NET_OBJ = $(NET_OBJ1) \
$(REG_SMBCONF_OBJ) @LIBNETAPI_STATIC@ $(LIBNET_OBJ) \
$(LIBSMBCONF_OBJ) \
@LIBWBCLIENT_STATIC@ \
$(PRIVILEGES_BASIC_OBJ) @LIBLUA_STATIC@
$(PRIVILEGES_BASIC_OBJ) @LIBLUA_STATIC@ \
$(LIB_EVENTLOG_OBJ)
CUPS_OBJ = client/smbspool.o $(PARAM_OBJ) $(LIBSMB_OBJ) \
$(LIB_NONSMBD_OBJ) $(KRBCLIENT_OBJ) $(POPT_LIB_OBJ) \
@ -983,7 +986,7 @@ EVTLOGADM_OBJ0 = utils/eventlogadm.o
EVTLOGADM_OBJ = $(EVTLOGADM_OBJ0) $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
$(LIBSAMBA_OBJ) \
registry/reg_eventlog.o rpc_server/srv_eventlog_lib.o \
registry/reg_eventlog.o $(LIB_EVENTLOG_OBJ) \
../librpc/gen_ndr/ndr_eventlog.o \
../librpc/gen_ndr/ndr_lsa.o

8
source3/utils/net.c
View File

@ -589,6 +589,14 @@ static struct functable net_func[] = {
" Use 'net help lua' to get more information about 'net "
"lua' commands."
},
{ "eventlog",
net_eventlog,
NET_TRANSPORT_LOCAL,
"Dump Win32 *.evt eventlog files",
" Use 'net help eventlog' to get more information about 'net "
"eventlog' commands."
},
#ifdef WITH_FAKE_KASERVER
{ "afs",
net_afs,

100
source3/utils/net_eventlog.c Normal file
View File

@ -0,0 +1,100 @@
/*
* Samba Unix/Linux SMB client library
* Distributed SMB/CIFS Server Management Utility
* Local win32 eventlog interface
*
* Copyright (C) Guenther Deschner 2009
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "utils/net.h"
/**
* Dump an *evt win32 eventlog file
*
* @param argc Standard main() style argc.
* @param argv Standard main() style argv. Initial components are already
* stripped.
*
* @return A shell status integer (0 for success).
**/
static int net_eventlog_dump(struct net_context *c, int argc,
const char **argv)
{
int ret = -1;
TALLOC_CTX *ctx = talloc_stackframe();
enum ndr_err_code ndr_err;
DATA_BLOB blob;
struct EVENTLOG_EVT_FILE evt;
char *s;
if (argc < 1 || c->display_usage) {
d_fprintf(stderr, "usage: net eventlog dump <file.evt>\n");
goto done;
}
blob.data = (uint8_t *)file_load(argv[0], &blob.length, 0, ctx);
if (!blob.data) {
d_fprintf(stderr, "failed to load evt file: %s\n", argv[0]);
goto done;
}
ndr_err = ndr_pull_struct_blob(&blob, ctx, NULL, &evt,
(ndr_pull_flags_fn_t)ndr_pull_EVENTLOG_EVT_FILE);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
d_fprintf(stderr, "evt pull failed: %s\n", ndr_errstr(ndr_err));
goto done;
}
s = NDR_PRINT_STRUCT_STRING(ctx, EVENTLOG_EVT_FILE, &evt);
if (s) {
printf("%s\n", s);
}
ret = 0;
done:
TALLOC_FREE(ctx);
return ret;
}
/**
* 'net rpc eventlog' entrypoint.
* @param argc Standard main() style argc.
* @param argv Standard main() style argv. Initial components are already
* stripped.
**/
int net_eventlog(struct net_context *c, int argc, const char **argv)
{
int ret = -1;
struct functable func[] = {
{
"dump",
net_eventlog_dump,
NET_TRANSPORT_LOCAL,
"Dump eventlog",
"net eventlog dump\n"
" Dump win32 *.evt eventlog file"
},
{ NULL, NULL, 0, NULL, NULL }
};
ret = net_run_function(c, argc, argv, "net eventlog", func);
return ret;
}

3
source3/utils/net_proto.h
View File

@ -427,6 +427,9 @@ int net_usershare(struct net_context *c, int argc, const char **argv);
int net_lua(struct net_context *c, int argc, const char **argv);
/* The following definitions come from utils/net_eventlog.c */
int net_eventlog(struct net_context *c, int argc, const char **argv);
/* The following definitions come from utils/net_util.c */