Golang SIDType示例

示例#1

文件： wineventlog_windows.go 项目： MingchunZhao/beats

// readSID reads a pointer using the reader then parses the Windows SID
// data that the pointer addresses within the buffer.
func readSID(buffer []byte, reader io.Reader) (*eventlogging.SID, error) {
	offset, err := offset(buffer, reader)
	if err != nil {
		// Ignore NULL values.
		if err == ErrorEvtVarTypeNull {
			return nil, nil
		}
		return nil, err
	}
	sid := (*windows.SID)(unsafe.Pointer(&buffer[offset]))
	identifier, err := sid.String()
	if err != nil {
		return nil, err
	}

	account, domain, accountType, err := sid.LookupAccount("")
	if err != nil {
		// Ignore the error and return a partially populated SID.
		return &eventlogging.SID{Identifier: identifier}, nil
	}

	return &eventlogging.SID{
		Identifier: identifier,
		Name:       account,
		Domain:     domain,
		Type:       eventlogging.SIDType(accountType),
	}, nil
}

示例#2

文件： wineventlog_windows.go 项目： davidsoloman/beats

// readSID reads a pointer using the reader then parses the Windows SID
// data that the pointer addresses within the buffer.
func readSID(buffer []byte, reader io.Reader) (*eventlogging.SID, error) {
	offset, err := offset(buffer, reader)
	if err != nil {
		// Ignore NULL values.
		if err == ErrorEvtVarTypeNull {
			return nil, nil
		}
		return nil, err
	}
	sid := (*windows.SID)(unsafe.Pointer(&buffer[offset]))
	account, domain, accountType, err := sid.LookupAccount("")
	if err != nil {
		return nil, err
	}

	return &eventlogging.SID{
		Name:    account,
		Domain:  domain,
		SIDType: eventlogging.SIDType(accountType),
	}, nil
}