win32-eventlog 0.4.4 → 0.4.5

data/CHANGES

@@ -1,3 +1,9 @@
+= 0.4.5 - 25-Aug-2007
+* Fixed two potential issues where reading from remote event log sources
+  could fail either due to permissions (reading DLL's) or because local
+  registry entries didn't necessarily match the remote registry entries.
+  Thanks go to Andrew Garberoglio and Ivan Shiel for the spot.
+
 = 0.4.4 - 31-Jul-2007
 * The EventLogError class is now EventLog::Error.
 * The MCError class is now MC::Error.

data/lib/win32/eventlog.rb

@@ -37,7 +37,7 @@ module Win32
       extend Windows::Error
       extend Windows::Registry
       
-      VERSION = '0.4.4'
+      VERSION = '0.4.5'
       
       # Aliased read flags
       FORWARDS_READ   = EVENTLOG_FORWARDS_READ
@@ -199,7 +199,7 @@ module Win32
             raise Error, error
          end
          
-         hkey = hkey.unpack('L').first
+         hkey = hkey.unpack('L')[0]
          
          if hash['category_count']
             data = [hash['category_count']].pack('L')
@@ -322,7 +322,7 @@ module Win32
             raise 'GetEventLogInformation() failed: ' + get_last_error
          end
 
-         buf[0,4].unpack('L').first != 0
+         buf[0,4].unpack('L')[0] != 0
       end
       
       # Returns the absolute record number of the oldest record.  Note that
@@ -337,7 +337,7 @@ module Win32
             raise Error, error
          end
          
-         rec.unpack('L').first
+         rec.unpack('L')[0]
       end
       
       # Returns the total number of records for the given event log.
@@ -351,7 +351,7 @@ module Win32
             raise Error, error
          end
          
-         total.unpack('L').first
+         total.unpack('L')[0]
       end
       
       # Yields an EventLogStruct every time a record is written to the event
@@ -465,20 +465,29 @@ module Win32
          read   = [0].pack('L')
          needed = [0].pack('L')
          array  = []
+         lkey   = HKEY_LOCAL_MACHINE
          
          unless flags
             flags = FORWARDS_READ | SEQUENTIAL_READ
          end
+
+         if @server
+            hkey = [0].pack('L')
+            if RegConnectRegistry(@server, HKEY_LOCAL_MACHINE, hkey) != 0
+               raise Error, get_last_error
+            end
+            lkey = hkey.unpack('L').first
+         end
          
          while ReadEventLog(@handle, flags, offset, buf, size, read, needed) ||
             GetLastError() == ERROR_INSUFFICIENT_BUFFER
             
             if GetLastError() == ERROR_INSUFFICIENT_BUFFER
-               buf += 0.chr * needed.unpack('L').first
+               buf += 0.chr * needed.unpack('L')[0]
                ReadEventLog(@handle, flags, offset, buf, size, read, needed)
             end
                        
-            dwread = read.unpack('L').first
+            dwread = read.unpack('L')[0]
                
             while dwread > 0
                struct       = EventLogStruct.new
@@ -486,17 +495,17 @@ module Win32
                computer     = buf[56 + event_source.length + 1..-1].nstrip
                
                user = get_user(buf)
-               strings, desc = get_description(buf, event_source)
+               strings, desc = get_description(buf, event_source, lkey)
       
                struct.source         = event_source
                struct.computer       = computer
-               struct.record_number  = buf[8,4].unpack('L').first
-               struct.time_generated = Time.at(buf[12,4].unpack('L').first)
-               struct.time_written   = Time.at(buf[16,4].unpack('L').first)
-               struct.event_id       = buf[20,4].unpack('L').first & 0x0000FFFF
-               struct.event_type     = get_event_type(buf[24,2].unpack('S').first)
+               struct.record_number  = buf[8,4].unpack('L')[0]
+               struct.time_generated = Time.at(buf[12,4].unpack('L')[0])
+               struct.time_written   = Time.at(buf[16,4].unpack('L')[0])
+               struct.event_id       = buf[20,4].unpack('L')[0] & 0x0000FFFF
+               struct.event_type     = get_event_type(buf[24,2].unpack('S')[0])
                struct.user           = user
-               struct.category       = buf[28,2].unpack('S').first
+               struct.category       = buf[28,2].unpack('S')[0]
                struct.string_inserts = strings
                struct.description 	 = desc
 
@@ -507,12 +516,12 @@ module Win32
                end
                
                if flags & EVENTLOG_BACKWARDS_READ > 0
-                  offset = buf[8,4].unpack('L').first - 1
+                  offset = buf[8,4].unpack('L')[0] - 1
                else
-                  offset = buf[8,4].unpack('L').first + 1
+                  offset = buf[8,4].unpack('L')[0] + 1
                end
                
-               length = buf[0,4].unpack('L').first # Length
+               length = buf[0,4].unpack('L')[0] # Length
 
                dwread -= length
                buf = buf[length..-1]
@@ -635,26 +644,35 @@ module Win32
          buf    = 0.chr * BUFFER_SIZE # 64k buffer
          read   = [0].pack('L')
          needed = [0].pack('L')
+         lkey   = HKEY_LOCAL_MACHINE
     
          flags = EVENTLOG_BACKWARDS_READ | EVENTLOG_SEQUENTIAL_READ
          ReadEventLog(@handle, flags, 0, buf, buf.size, read, needed)
+
+         if @server
+            hkey = [0].pack('L')
+            if RegConnectRegistry(@server, HKEY_LOCAL_MACHINE, hkey) != 0
+               raise Error, get_last_error
+            end
+            lkey = hkey.unpack('L').first
+         end
       
          event_source = buf[56..-1].nstrip
          computer     = buf[56 + event_source.length + 1..-1].nstrip
-         event_type   = get_event_type(buf[24,2].unpack('S').first)
+         event_type   = get_event_type(buf[24,2].unpack('S')[0])
          user         = get_user(buf)
-         desc         = get_description(buf, event_source)
+         desc         = get_description(buf, event_source, lkey)
       
          struct = EventLogStruct.new
          struct.source         = event_source
          struct.computer       = computer
-         struct.record_number  = buf[8,4].unpack('L').first
-         struct.time_generated = Time.at(buf[12,4].unpack('L').first)
-         struct.time_written   = Time.at(buf[16,4].unpack('L').first)
-         struct.event_id       = buf[20,4].unpack('L').first & 0x0000FFFF
+         struct.record_number  = buf[8,4].unpack('L')[0]
+         struct.time_generated = Time.at(buf[12,4].unpack('L')[0])
+         struct.time_written   = Time.at(buf[16,4].unpack('L')[0])
+         struct.event_id       = buf[20,4].unpack('L')[0] & 0x0000FFFF
          struct.event_type     = event_type
          struct.user           = user
-         struct.category       = buf[28,2].unpack('S').first
+         struct.category       = buf[28,2].unpack('S')[0]
          struct.description 	 = desc
          
          struct
@@ -664,9 +682,9 @@ module Win32
       # event description (String) based on data from the EVENTLOGRECORD
       # buffer.
       # 
-      def get_description(rec, event_source)    
-         str     = rec[rec[36,4].unpack('L').first .. -1]         
-         num     = rec[26,2].unpack('S').first # NumStrings
+      def get_description(rec, event_source, lkey)
+         str     = rec[rec[36,4].unpack('L')[0] .. -1]         
+         num     = rec[26,2].unpack('S')[0] # NumStrings
          hkey    = [0].pack('L')
          key     = BASE_KEY + "#{@source}\\#{event_source}"
          buf     = 0.chr * 1024
@@ -677,14 +695,14 @@ module Win32
          else
 	         va_list = str.split(0.chr)[0...num]
 	         va_list_ptr = va_list.map{ |x|
-	            [x + 0.chr].pack('P').unpack('L').first
+	            [x + 0.chr].pack('P').unpack('L')[0]
 	         }.pack('L*')
          end
-         	         	
-         if RegOpenKeyEx(HKEY_LOCAL_MACHINE, key, 0, KEY_READ, hkey) == 0
+         
+         if RegOpenKeyEx(lkey, key, 0, KEY_READ, hkey) == 0
             value = 'EventMessageFile'
             file  = 0.chr * MAX_SIZE
-            hkey  = hkey.unpack('L').first
+            hkey  = hkey.unpack('L')[0]
             size  = [file.length].pack('L')
             
             if RegQueryValueEx(hkey, value, 0, 0, file, size) == 0
@@ -695,8 +713,8 @@ module Win32
                exe = exe.nstrip
                
                exe.split(';').each{ |file|
-                  hmodule  = LoadLibraryEx(file, 0, LOAD_LIBRARY_AS_DATAFILE)
-                  event_id = rec[20,4].unpack('L').first
+                  hmodule  = LoadLibraryEx(file, 0, DONT_RESOLVE_DLL_REFERENCES)
+                  event_id = rec[20,4].unpack('L')[0]
                   if hmodule != 0
                      FormatMessage(
                         FORMAT_MESSAGE_FROM_HMODULE |
@@ -723,7 +741,7 @@ module Win32
       # EVENTLOGRECORD buffer.
       # 
       def get_user(buf)      
-         return nil if buf[40,4].unpack('L').first <= 0 # UserSidLength
+         return nil if buf[40,4].unpack('L')[0] <= 0 # UserSidLength
 
          name        = 0.chr * MAX_SIZE
          name_size   = [name.size].pack('L')
@@ -731,11 +749,11 @@ module Win32
          domain_size = [domain.size].pack('L')
          snu         = 0.chr * 4
          
-         offset = buf[44,4].unpack('L').first # UserSidOffset
+         offset = buf[44,4].unpack('L')[0] # UserSidOffset
       
          val = LookupAccountSid(
             @server,
-            [buf].pack('P').unpack('L').first + offset,
+            [buf].pack('P').unpack('L')[0] + offset,
             name,
             name_size,
             domain,

data/test/tc_eventlog.rb

@@ -23,7 +23,7 @@ class TC_EventLog < Test::Unit::TestCase
    end
  
    def test_version
-      assert_equal('0.4.4', EventLog::VERSION)
+      assert_equal('0.4.5', EventLog::VERSION)
    end
    
    # Use the alias to validate it as well.

data/win32-eventlog.gemspec

@@ -2,7 +2,7 @@ require "rubygems"
 
 spec = Gem::Specification.new do |gem|
    gem.name        = "win32-eventlog"
-   gem.version     = "0.4.4"
+   gem.version     = "0.4.5"
    gem.author      = "Daniel J. Berger"
    gem.email       = "djberg96@gmail.com"
    gem.homepage    = "http://www.rubyforge.org/projects/win32utils"

metadata

@@ -1,10 +1,10 @@
 --- !ruby/object:Gem::Specification 
-rubygems_version: 0.9.2
+rubygems_version: 0.9.4
 specification_version: 1
 name: win32-eventlog
 version: !ruby/object:Gem::Version 
-  version: 0.4.4
-date: 2007-07-31 00:00:00 -06:00
+  version: 0.4.5
+date: 2007-08-25 00:00:00 -06:00
 summary: Interface for the MS Windows Event Log.
 require_paths: 
 - lib