1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
|
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright (c) 2019 Peter Tribble.
*/
/*
* Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/*
* File name: praudit.h
* praudit.c defines, globals
*/
#ifndef _PRAUDIT_H
#define _PRAUDIT_H
#ifdef __cplusplus
extern "C" {
#endif
/* DEFINES */
/*
* output value types
*/
#define PRA_INT32 0
#define PRA_UINT32 1
#define PRA_INT64 2
#define PRA_UINT64 3
#define PRA_SHORT 4
#define PRA_USHORT 5
#define PRA_CHAR 6
#define PRA_UCHAR 7
#define PRA_STRING 8
#define PRA_HEX32 9
#define PRA_HEX64 10
#define PRA_SHEX 11
#define PRA_OCT 12
#define PRA_BYTE 13
#define PRA_OUTREC 14
#define PRA_LOCT 15
/*
* Formatting flags
*/
#define PRF_DEFAULTM 0x0000 /* Default mode */
#define PRF_RAWM 0x0001 /* Raw mode */
#define PRF_SHORTM 0x0002 /* Short mode */
#define PRF_XMLM 0x0004 /* XML format */
#define PRF_ONELINE 0x0008 /* one-line output */
#define PRF_NOCACHE 0x0010 /* don't cache event names */
/*
* source of audit data (data_mode)
*/
#define FILEMODE 1
#define PIPEMODE 2
#define BUFMODE 3
/*
* max. number of audit file names entered on command line
*/
#define MAXFILENAMES 100
/*
* max. size of file name
*/
#define MAXFILELEN MAXPATHLEN+MAXNAMLEN+1
/*
* used to store value to be output
*/
typedef union u_tag {
int32_t int32_val;
uint32_t uint32_val;
int64_t int64_val;
uint64_t uint64_val;
short short_val;
ushort_t ushort_val;
char char_val;
char uchar_val;
char *string_val;
} u_tag_t;
typedef struct u_val {
int uvaltype;
u_tag_t tag;
} uval_t;
#define int32_val tag.int32_val
#define uint32_val tag.uint32_val
#define int64_val tag.int64_val
#define uint64_val tag.uint64_val
#define short_val tag.short_val
#define ushort_val tag.ushort_val
#define char_val tag.char_val
#define uchar_val tag.uchar_val
#define string_val tag.string_val
/*
* Strings and things for xml prolog & ending printing.
*/
#define prolog1 "<?xml version='1.0' encoding='UTF-8' ?>\n"
#define prolog2 "\n<!DOCTYPE audit PUBLIC " \
"'-//Sun Microsystems, Inc.//DTD Audit V1//EN' " \
"'file:///usr/share/lib/xml/dtd/adt_record.dtd.1'>\n\n"
#define prolog_xsl "<?xml-stylesheet type='text/xsl' " \
"href='file:///usr/share/lib/xml/style/adt_record.xsl.1' ?>\n"
/* Special main element: */
#define xml_start "<audit>"
#define xml_ending "\n</audit>\n"
#define xml_prolog_len (sizeof (prolog1) + sizeof (prolog2) + \
sizeof (prolog_xsl) + sizeof (xml_start) + 1)
#define xml_end_len (sizeof (xml_ending) + 1)
/*
* used to save context for print_audit and related functions.
*/
#define SEP_SIZE 4
struct pr_context {
int format;
int data_mode;
char SEPARATOR[SEP_SIZE]; /* field separator */
signed char tokenid; /* initial token ID */
adr_t *audit_adr; /* audit record */
adrf_t *audit_adrf; /* audit record, file mode */
int audit_rec_len;
char *audit_rec_start;
char *inbuf_start;
char *inbuf_last; /* ptr to byte after latest completed */
/* header or file token in the input */
int inbuf_totalsize;
char *outbuf_p;
char *outbuf_start;
char *outbuf_last; /* ptr to byte after latest completed */
/* header or file token in the output */
int outbuf_remain_len;
int pending_flag; /* open of extended tag not completed */
int current_rec; /* id of current record */
};
typedef struct pr_context pr_context_t;
extern void loadgroups(FILE *f);
extern void loadnames(FILE *f);
extern void init_tokens(void);
extern int open_tag(pr_context_t *context, int);
extern int finish_open_tag(pr_context_t *context);
extern int check_close_rec(pr_context_t *context, int);
extern int close_tag(pr_context_t *context, int);
extern int process_tag(pr_context_t *context, int, int, int);
extern int is_file_token(int);
extern int is_header_token(int);
extern int is_token(int);
extern int do_newline(pr_context_t *context, int);
extern char *bu2string(char basic_unit);
extern int convert_char_to_string(char printmode, char c, char *p);
extern int convert_int32_to_string(char printmode, int32_t c, char *p);
extern int convert_int64_to_string(char printmode, int64_t c, char *p);
extern int convert_short_to_string(char printmode, short c, char *p);
extern int findfieldwidth(char basicunit, char howtoprint);
extern void get_Hname(uint32_t addr, char *buf, size_t buflen);
extern void get_Hname_ex(uint32_t *addr, char *buf, size_t buflen);
extern char *hexconvert(char *c, int size, int chunk);
extern char *htp2string(char print_sugg);
extern int pa_print(pr_context_t *context, uval_t *uval, int flag);
extern int pa_reclen(pr_context_t *context, int status);
extern int pa_file_string(pr_context_t *context, int status, int flag);
extern int pa_adr_int32(pr_context_t *context, int status, int flag);
extern int pa_adr_int64(pr_context_t *context, int status, int flag);
extern int pa_utime32(pr_context_t *context, int status, int flag);
extern int pa_ntime32(pr_context_t *context, int status, int flag);
extern int pa_utime64(pr_context_t *context, int status, int flag);
extern int pa_ntime64(pr_context_t *context, int status, int flag);
extern int pa_adr_string(pr_context_t *context, int status, int flag);
extern int pa_adr_u_int32(pr_context_t *context, int status, int flag);
extern int pa_adr_u_int64(pr_context_t *context, int status, int flag);
extern int pa_adr_byte(pr_context_t *context, int status, int flag);
extern int pa_event_type(pr_context_t *context, int status, int flag);
extern int pa_event_modifier(pr_context_t *context, int status, int flag);
extern int pa_adr_int32hex(pr_context_t *context, int status, int flag);
extern int pa_adr_int64hex(pr_context_t *context, int status, int flag);
extern int pa_pw_uid(pr_context_t *context, int status, int flag);
extern int pa_gr_uid(pr_context_t *context, int status, int flag);
extern int pa_pw_uid_gr_gid(pr_context_t *context, int status, int flag);
extern int pa_ace(pr_context_t *context, int status, int flag);
extern int pa_hostname(pr_context_t *context, int status, int flag);
extern int pa_hostname_ex(pr_context_t *context, int status, int flag);
extern int pa_hostname_so(pr_context_t *context, int status, int flag);
extern int pa_adr_u_short(pr_context_t *context, int status, int flag);
extern int pa_tid32(pr_context_t *context, int status, int flag);
extern int pa_tid64(pr_context_t *context, int status, int flag);
extern int pa_tid32_ex(pr_context_t *context, int status, int flag);
extern int pa_tid64_ex(pr_context_t *context, int status, int flag);
extern int pa_adr_charhex(pr_context_t *context, int status, int flag);
extern int pa_adr_short(pr_context_t *context, int status, int flag);
extern int pa_adr_shorthex(pr_context_t *context, int status, int flag);
extern int pa_mode(pr_context_t *context, int status, int flag);
extern int pa_cmd(pr_context_t *context, int status, int flag);
extern int pa_string(pr_context_t *context, int status, int flag);
extern int pa_liaison(pr_context_t *context, int status, int flag);
extern int pa_xgeneric(pr_context_t *context);
extern int pa_xid(pr_context_t *context, int status, int flag);
extern void pa_error(const uchar_t err, char *buf, size_t buflen);
extern void pa_retval(const uchar_t, const int32_t, char *, size_t);
extern int pa_ip_addr(pr_context_t *context, int status, int flag);
extern int pr_adr_char(pr_context_t *context, char *cp, int count);
extern int pr_adr_short(pr_context_t *context, short *sp, int count);
extern int pr_adr_int32(pr_context_t *context, int32_t *lp, int count);
extern int pr_adr_int64(pr_context_t *context, int64_t *lp, int count);
extern int pr_adr_u_int32(pr_context_t *context, uint32_t *cp, int count);
extern int pr_adr_u_char(pr_context_t *context, uchar_t *cp, int count);
extern int pr_adr_u_int64(pr_context_t *context, uint64_t *lp, int count);
extern int pr_adr_u_short(pr_context_t *context, ushort_t *sp, int count);
extern int pr_putchar(pr_context_t *context, char);
extern int pr_printf(pr_context_t *context, const char *format, ...);
extern int pr_input_remaining(pr_context_t *context, size_t size);
/*
* Functions that format audit data
*/
extern int print_audit(const int, const char *);
extern int print_audit_buf(char **, int *, char **, int *, const int,
const char *);
extern void print_audit_xml_prolog(void);
extern void print_audit_xml_ending(void);
extern int print_audit_xml_prolog_buf(char *out_buf,
const int out_buf_len);
extern int print_audit_xml_ending_buf(char *out_buf,
const int out_buf_len);
#ifdef __cplusplus
}
#endif
#endif /* _PRAUDIT_H */
|
