winevt_c 0.7.2 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1069bcfe57cfd91d05fcff1a7314929c01c675d30678b8a624c926eb0a91b09f
-  data.tar.gz: bea008c2cf452539b59a9d22800183797babcbb5158e5f6688dd3fd749dc4e3d
+  metadata.gz: fd29b4664130c80249811fb66df434aaa9219d6d375bcdaa7adfdd3fe72dd25e
+  data.tar.gz: 2a1e3ec7cb528269ebb65f4b1df72d6045f882d865956fb85def8bcb925d6944
 SHA512:
-  metadata.gz: 81ef978d005e6c87607cc187509f8e5ae52b33b7687100148139b050c09d61cbb813fe1e77f8ccc0a02fa881d6a8066b6f7c959f45be3ff65c79e77b03dbd247
-  data.tar.gz: c27480331ce8d8cfab82cd00ef4bd940e3a4224076db6641e9bb49019a2d88dac2ee73790153a20cf2bbafa1db6844b876f59cb53c249251460b6eb97b895c99
+  metadata.gz: 0f80978e4268c233d2e309c0e9556f38386b35300381c04f4d84226ce239a85ccb48b20a2c2a3c59c3d0557347e95ff11e0ca11945eaa128ba2c78c67ebc9250
+  data.tar.gz: a8ff4fae4995b41910352186898d54c929a918f86a6a4efe29c0a5c93433d9c95d91be5c9f81fdb52ff5f2307cbb2e2e61790a22fe076b7221ba03c89aed48d5

data/README.md

@@ -31,6 +31,61 @@ Or install it yourself as:
 ## Usage
 
 Usage examples are found in [example directory](example).
+
+### Multilingual description
+
+Currently, the following locales should be supported to output description:
+
+locale    | language
+---------:|:--------
+bg\_BG    | Bulgarian
+zh\_CN    | Simplified Chinese
+zh\_TW    | Traditional Chinese
+zh\_HK    | Chinese (Hong Kong)
+zh\_SG    | Chinese (Singapore)
+hr\_HR    | Croatian
+cz\_CZ    | Czech
+da\_DK    | Danish
+nl\_NL    | Dutch
+nl\_BG    | Dutch (Belgium)
+en\_US    | English (United States)
+en\_GB    | English (UK)
+en\_AU    | English (Australia)
+en\_CA    | English (Canada)
+en\_NZ    | English (New Zealand)
+en\_IE    | English (Ireland)
+fi\_FI    | Finnish
+fr\_FR    | French
+fr\_BE    | French (Belgium)
+fr\_CA    | French (Canada)
+fr\_CH    | French (Swiss)
+de\_DE    | German
+de\_CH    | German (Swiss)
+de\_AT    | German (Austria)
+el\_GR    | Greek (Ελληνικά)
+hu\_HU    | Hungarian
+is\_IS    | Icelandic
+it\_IT    | Italian (Italy)
+it\_CH    | Italian (Swiss)
+ja\_JP    | Japanese
+ko\_KO    | Korean
+no\_NO    | Norwegian (Bokmål)
+nb\_NO    | Norwegian (Bokmål)
+nn\_NO    | Norwegian (Nynorsk)
+pl\_PL    | Polish (Poland)
+pt\_PT    | Portuguese
+pt\_BR    | Portuguese (Brazil)
+ro\_RO    | Romanian
+ru\_RU    | Russian (русский язык)
+sk\_SK    | Slovak
+sl\_SI    | Slovenian
+es\_ES    | Spanish
+es\_ES\_T | Spanish (Traditional)
+es\_MX    | Spanish (Mexico)
+es\_ES\_M | Spanish (Modern)
+sv\_SE    | Swedish
+tr\_TR    | Turkish
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/Rakefile

@@ -28,7 +28,7 @@ task 'gem:native' do
   # See RUBY_CC_VERSION in https://github.com/rake-compiler/rake-compiler-dock/blob/master/Dockerfile.mri
   RakeCompilerDock.sh <<-EOS
     gem install bundler yard --no-doc && bundle
-    rake cross native gem RUBY_CC_VERSION=2.4.0:2.5.0:2.6.0
+    rake cross native gem RUBY_CC_VERSION=2.4.0:2.5.0:2.6.0:2.7.0
 EOS
 end
 

data/example/eventlog.rb

@@ -1,7 +1,13 @@
 require 'winevt'
 
-@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 3) and TimeCreated[timediff(@SystemTime) <= 86400000]]]")
+@session = Winevt::EventLog::Session.new("127.0.0.1") # Or remote box ip
+# @session.domain = "<EXAMPLEGROUP>"
+# @session.username = "<username>"
+# @session.password = "<password>"
+@query = Winevt::EventLog::Query.new("Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]", @session)
 
+@query.render_as_xml = true
+@query.preserve_qualifiers = true
 @query.each do |eventlog, message, string_inserts|
   puts ({eventlog: eventlog, data: message})
 end

data/example/locale.rb

@@ -0,0 +1,13 @@
+require 'winevt'
+
+@locale = Winevt::EventLog::Locale.new
+
+header = <<EOC
+locale    | language
+---------:|:--------
+EOC
+
+print header
+@locale.each do |code, desc|
+  print "#{code.gsub("_", "\\_")}#{" "*(8 - code.size)}| #{desc}\n"
+end

data/example/rate_limit.rb

@@ -1,7 +1,7 @@
 require 'winevt'
 
 @subscribe = Winevt::EventLog::Subscribe.new
-@subscribe.tail = true
+@subscribe.read_existing_events = true
 @subscribe.rate_limit = 80
 @subscribe.subscribe(
   "Application", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"

data/example/tailing.rb

@@ -1,9 +1,17 @@
 require 'winevt'
 
+@session = Winevt::EventLog::Session.new("127.0.0.1") # Or remote box ip
+# @session.domain = "<EXAMPLEGROUP>"
+# @session.username = "<username>"
+# @session.password = "<password>"
+@bookmark = Winevt::EventLog::Bookmark.new
 @subscribe = Winevt::EventLog::Subscribe.new
-@subscribe.tail = true
+@subscribe.read_existing_events = true
+@subscribe.preserve_qualifiers = true
+@subscribe.render_as_xml = true
 @subscribe.subscribe(
-  "Security", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]"
+  "Security", "*[System[(Level <= 4) and TimeCreated[timediff(@SystemTime) <= 86400000]]]",
+  @bookmark, @session
 )
 while true do
   @subscribe.each do |eventlog, message, string_inserts|

data/ext/winevt/winevt.c

@@ -1,7 +1,11 @@
 #include <winevt_c.h>
 
 VALUE rb_mWinevt;
+VALUE rb_cQuery;
 VALUE rb_cEventLog;
+VALUE rb_cSubscribe;
+VALUE rb_eWinevtQueryError;
+VALUE rb_eRemoteHandlerError;
 
 static ID id_call;
 
@@ -13,11 +17,14 @@ Init_winevt(void)
   rb_cQuery = rb_define_class_under(rb_cEventLog, "Query", rb_cObject);
   rb_cSubscribe = rb_define_class_under(rb_cEventLog, "Subscribe", rb_cObject);
   rb_eWinevtQueryError = rb_define_class_under(rb_cQuery, "Error", rb_eStandardError);
+  rb_eRemoteHandlerError = rb_define_class_under(rb_cSubscribe, "RemoteHandlerError", rb_eRuntimeError);
 
   Init_winevt_channel(rb_cEventLog);
   Init_winevt_bookmark(rb_cEventLog);
   Init_winevt_query(rb_cEventLog);
   Init_winevt_subscribe(rb_cEventLog);
+  Init_winevt_locale(rb_cEventLog);
+  Init_winevt_session(rb_cEventLog);
 
   id_call = rb_intern("call");
 }

data/ext/winevt/winevt_bookmark.c

@@ -19,6 +19,8 @@
  */
 /* clang-format pn */
 
+VALUE rb_cBookmark;
+
 static void bookmark_free(void* ptr);
 
 static const rb_data_type_t rb_winevt_bookmark_type = { "winevt/bookmark",

data/ext/winevt/winevt_c.h

@@ -21,28 +21,58 @@
 #define EventQuery(object) ((struct WinevtQuery*)DATA_PTR(object))
 #define EventBookMark(object) ((struct WinevtBookmark*)DATA_PTR(object))
 #define EventChannel(object) ((struct WinevtChannel*)DATA_PTR(object))
+#define EventSession(object) ((struct WinevtSession*)DATA_PTR(object))
+
+typedef struct {
+  LANGID langID;
+  CHAR* langCode;
+  CHAR* description;
+} LocaleInfo;
 
 #ifdef __cplusplus
 extern "C" {
 #endif /* __cplusplus */
 
 VALUE wstr_to_rb_str(UINT cp, const WCHAR* wstr, int clen);
+#if defined(__cplusplus)
+[[ noreturn ]]
+#endif /* __cplusplus */
 void  raise_system_error(VALUE error, DWORD errorCode);
 VALUE render_to_rb_str(EVT_HANDLE handle, DWORD flags);
-WCHAR* get_description(EVT_HANDLE handle);
+EVT_HANDLE connect_to_remote(LPWSTR computerName, LPWSTR domain,
+                             LPWSTR username, LPWSTR password,
+                             EVT_RPC_LOGIN_FLAGS flags);
+WCHAR* get_description(EVT_HANDLE handle, LANGID langID, EVT_HANDLE hRemote);
 VALUE get_values(EVT_HANDLE handle);
-VALUE render_system_event(EVT_HANDLE handle);
+VALUE render_system_event(EVT_HANDLE handle, BOOL preserve_qualifiers);
+LocaleInfo* get_locale_info_from_rb_str(VALUE rb_locale_str);
 
 #ifdef __cplusplus
 }
 #endif /* __cplusplus */
 
-VALUE rb_cQuery;
-VALUE rb_cFlag;
-VALUE rb_cChannel;
-VALUE rb_cBookmark;
-VALUE rb_cSubscribe;
-VALUE rb_eWinevtQueryError;
+extern VALUE rb_cQuery;
+extern VALUE rb_cFlag;
+extern VALUE rb_cChannel;
+extern VALUE rb_cBookmark;
+extern VALUE rb_cSubscribe;
+extern VALUE rb_eWinevtQueryError;
+extern VALUE rb_eRemoteHandlerError;
+extern VALUE rb_cLocale;
+extern VALUE rb_cSession;
+
+struct WinevtSession {
+  LPWSTR server;
+  LPWSTR domain;
+  LPWSTR username;
+  LPWSTR password;
+  EVT_RPC_LOGIN_FLAGS flags;
+};
+
+extern LocaleInfo localeInfoTable[];
+extern LocaleInfo default_locale;
+
+struct WinevtLocale {};
 
 struct WinevtChannel
 {
@@ -66,6 +96,9 @@ struct WinevtQuery
   LONG offset;
   LONG timeout;
   BOOL renderAsXML;
+  BOOL preserveQualifiers;
+  LocaleInfo *localeInfo;
+  EVT_HANDLE remoteHandle;
 };
 
 #define SUBSCRIBE_ARRAY_SIZE 10
@@ -84,11 +117,16 @@ struct WinevtSubscribe
   time_t lastTime;
   DWORD currentRate;
   BOOL renderAsXML;
+  BOOL preserveQualifiers;
+  LocaleInfo* localeInfo;
+  EVT_HANDLE remoteHandle;
 };
 
 void Init_winevt_query(VALUE rb_cEventLog);
 void Init_winevt_channel(VALUE rb_cEventLog);
 void Init_winevt_bookmark(VALUE rb_cEventLog);
 void Init_winevt_subscribe(VALUE rb_cEventLog);
+void Init_winevt_locale(VALUE rb_cEventLog);
+void Init_winevt_session(VALUE rb_cEventLog);
 
 #endif // _WINEVT_C_H

data/ext/winevt/winevt_channel.c

@@ -19,6 +19,8 @@
  *  print channels
  */
 
+VALUE rb_cChannel;
+
 DWORD is_subscribable_channel_p(EVT_HANDLE hChannel, BOOL force_enumerate);
 DWORD check_subscribable_with_channel_config_type(int Id, PEVT_VARIANT pProperty, BOOL force_enumerate);
 static void channel_free(void* ptr);

data/ext/winevt/winevt_locale.c

@@ -0,0 +1,92 @@
+#include <winevt_c.h>
+
+
+/* clang-format off */
+/*
+ * Document-class: Winevt::EventLog::Locale
+ *
+ * handle locales for Windows EventLog's description.
+ *
+ * @example
+ *  require 'winevt'
+ *
+ *  @locale = Winevt::EventLog::Locale.new
+ *  @locale.each {|code, desc|
+ *    print code, desc
+ *  }
+ * @since v0.8.1
+ */
+/* clang-format on */
+
+VALUE rb_cLocale;
+
+static void locale_free(void* ptr);
+
+static const rb_data_type_t rb_winevt_locale_type = { "winevt/locale",
+                                                       {
+                                                         0,
+                                                         locale_free,
+                                                         0,
+                                                       },
+                                                       NULL,
+                                                       NULL,
+                                                       RUBY_TYPED_FREE_IMMEDIATELY };
+
+static void
+locale_free(void* ptr)
+{
+  xfree(ptr);
+}
+
+static VALUE
+rb_winevt_locale_alloc(VALUE klass)
+{
+  VALUE obj;
+  struct WinevtLocale* winevtLocale;
+  obj = TypedData_Make_Struct(
+    klass, struct WinevtLocale, &rb_winevt_locale_type, winevtLocale);
+  return obj;
+}
+
+/*
+ * Initalize Locale class.
+ *
+ * @return [Locale]
+ *
+ */
+static VALUE
+rb_winevt_locale_initialize(VALUE self)
+{
+  return Qnil;
+}
+
+/*
+ * Enumerate supported locales and its descriptions
+ *
+ * @yield (String, String)
+ *
+ */
+static VALUE
+rb_winevt_locale_each(VALUE self)
+{
+  RETURN_ENUMERATOR(self, 0, 0);
+
+  for (int i = 0; localeInfoTable[i].langCode != NULL; i++) {
+    rb_yield_values(2,
+                    rb_utf8_str_new_cstr(localeInfoTable[i].langCode),
+                    rb_utf8_str_new_cstr(localeInfoTable[i].description));
+  }
+
+  return Qnil;
+}
+
+void
+Init_winevt_locale(VALUE rb_cEventLog)
+{
+  rb_cLocale = rb_define_class_under(rb_cEventLog, "Locale", rb_cObject);
+
+  rb_define_alloc_func(rb_cLocale, rb_winevt_locale_alloc);
+
+  rb_define_method(rb_cLocale, "initialize", rb_winevt_locale_initialize, 0);
+  rb_define_method(rb_cLocale, "each", rb_winevt_locale_each, 0);
+}

data/ext/winevt/winevt_locale_info.c

@@ -0,0 +1,68 @@
+#include <winevt_c.h>
+
+LocaleInfo localeInfoTable [] = {
+  { MAKELANGID(LANG_BULGARIAN,  SUBLANG_DEFAULT),              "bg_BG",   "Bulgarian"},
+  { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_SIMPLIFIED),   "zh_CN",   "Simplified Chinese "},
+  { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_TRADITIONAL),  "zh_TW",   "Traditional Chinese"},
+  { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_HONGKONG),     "zh_HK",   "Chinese (Hong Kong)"},
+  { MAKELANGID(LANG_CHINESE,    SUBLANG_CHINESE_SINGAPORE),    "zh_SG",   "Chinese (Singapore)"},
+  { MAKELANGID(LANG_CROATIAN,   SUBLANG_DEFAULT),              "hr_HR",   "Croatian"},
+  { MAKELANGID(LANG_CZECH,      SUBLANG_DEFAULT),              "cs_CZ",   "Czech"},
+  { MAKELANGID(LANG_DANISH,     SUBLANG_DEFAULT),              "da_DK",   "Dannish"},
+  { MAKELANGID(LANG_DUTCH,      SUBLANG_DUTCH),                "nl_NL",   "Dutch"},
+  { MAKELANGID(LANG_DUTCH,      SUBLANG_DUTCH_BELGIAN),        "nl_BE",   "Dutch (Belgium)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_DEFAULT),              "en_US",   "English (United States)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_UK),           "en_GB",   "English (UK)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_AUS),          "en_AU",   "English (Australia)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_CAN),          "en_CA",   "English (Canada)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_NZ),           "en_NZ",   "English (New Zealand)"},
+  { MAKELANGID(LANG_ENGLISH,    SUBLANG_ENGLISH_EIRE),         "en_IE",   "English (Ireland)"},
+  { MAKELANGID(LANG_FINNISH,    SUBLANG_DEFAULT),              "fi_FI",   "Finnish"},
+  { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH),               "fr_FR",   "French"},
+  { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_BELGIAN),       "fr_BE",   "French (Belgium)"},
+  { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_CANADIAN),      "fr_CA",   "French (Canada)"},
+  { MAKELANGID(LANG_FRENCH,     SUBLANG_FRENCH_SWISS),         "fr_CH",   "French (Swiss)"},
+  { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN),               "de_DE",   "German"},
+  { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN_SWISS),         "de_CH",   "German (Swiss)"},
+  { MAKELANGID(LANG_GERMAN,     SUBLANG_GERMAN_AUSTRIAN),      "de_AT",   "German (Austria))"},
+  { MAKELANGID(LANG_GREEK,      SUBLANG_DEFAULT),              "el_GR",   "Greek (Ελληνικά)"},
+  { MAKELANGID(LANG_HUNGARIAN,  SUBLANG_DEFAULT),              "hu_HU",   "Hungarian"},
+  { MAKELANGID(LANG_ICELANDIC,  SUBLANG_DEFAULT),              "is_IS",   "Icelandic"},
+  { MAKELANGID(LANG_ITALIAN,    SUBLANG_ITALIAN),              "it_IT",   "Italian (Italy)"},
+  { MAKELANGID(LANG_ITALIAN,    SUBLANG_ITALIAN_SWISS),        "it_CH",   "Italian (Swiss)"},
+  { MAKELANGID(LANG_JAPANESE,   SUBLANG_DEFAULT),              "ja_JP",   "Japanases"},
+  { MAKELANGID(LANG_KOREAN,     SUBLANG_DEFAULT),              "ko_KO",   "Korean"},
+  { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_BOKMAL),     "no_NO",   "Norwegian (Bokmål)"},
+  { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_BOKMAL),     "nb_NO",   "Norwegian (Bokmål)"},
+  { MAKELANGID(LANG_NORWEGIAN,  SUBLANG_NORWEGIAN_NYNORSK),    "nn_NO",   "Norwegian (Nynorsk)"},
+  { MAKELANGID(LANG_POLISH,     SUBLANG_DEFAULT),              "pl_PL",   "Polish"},
+  { MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE),           "pt_PT",   "Portuguese"},
+  { MAKELANGID(LANG_PORTUGUESE, SUBLANG_PORTUGUESE_BRAZILIAN), "pt_BR",   "Portuguese (Brazil)"},
+  { MAKELANGID(LANG_ROMANIAN,   SUBLANG_DEFAULT),              "ro_RO",   "Romanian"},
+  { MAKELANGID(LANG_RUSSIAN,    SUBLANG_DEFAULT),              "ru_RU",   "Russian  (русский язык)"},
+  { MAKELANGID(LANG_SLOVAK,     SUBLANG_DEFAULT),              "sk_SK",   "Slovak"},
+  { MAKELANGID(LANG_SLOVENIAN,  SUBLANG_DEFAULT),              "sl_SI",   "Slovenian"},
+  { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH),              "es_ES",   "Spanish"},
+  { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH),              "es_ES_T", "Spanish (Traditional)"},
+  { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH_MEXICAN),      "es_MX",   "Spanish (Mexico)"},
+  { MAKELANGID(LANG_SPANISH,    SUBLANG_SPANISH_MODERN),       "es_ES_M", "Spanish (Modern)"},
+  { MAKELANGID(LANG_SWEDISH,    SUBLANG_DEFAULT),              "sv_SE",   "Swedish"},
+  { MAKELANGID(LANG_TURKISH,    SUBLANG_DEFAULT),              "tr_TR",   "Turkish"},
+  { 0, NULL, NULL}
+};
+
+LocaleInfo default_locale = {MAKELANGID(LANG_NEUTRAL, SUBLANG_NEUTRAL), "neutral", "Default"};
+
+LocaleInfo*
+get_locale_info_from_rb_str(VALUE rb_locale_str)
+{
+  CHAR* locale_str = StringValuePtr(rb_locale_str);
+
+  for (int i = 0; localeInfoTable[i].langCode != NULL; i++) {
+    if (stricmp(localeInfoTable[i].langCode, locale_str) == 0) {
+      return &localeInfoTable[i];
+    }
+  }
+
+  rb_raise(rb_eArgError, "Unknown locale: %s", locale_str);
+}