path: root/usr/src/cmd/praudit/printaudit.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <dirent.h>
#include <locale.h>
#include <libintl.h>
#include <stdlib.h>
#include <strings.h>
#include <stdio.h>
#include <unistd.h>

#include <sys/types.h>
#include <sys/file.h>

#include <bsm/audit.h>
#include <bsm/audit_record.h>
#include <bsm/libbsm.h>

#include "praudit.h"
#include "toktable.h"

extern void	init_tokens(void);	/* shared with auditreduce */

static int	check_inputs(int flags, const char *separator);
static void	checkpoint_progress(pr_context_t *context);
static int	print_audit_common(pr_context_t *context, int flags,
    const char *separator);
static int	token_processing(pr_context_t *context);

static int	initdone = 0;

/*
 * This source is shared outside of praudit; the following lint directive
 * is needed to suppress praudit lint warnings about unused functions, for
 * functions which are only invoked outside praudit.
 */

/*LINTLIBRARY*/

/*
 * ----------------------------------------------------------------------
 * check_inputs() - check input flags and delimiter.
 *		Returns:
 *		    0 - successful
 *		   -1 - invalid inputs. errno is set to EINVAL
 * ----------------------------------------------------------------------
 */
static int
check_inputs(int flags, const char *separator)
{
	if ((flags & PRF_RAWM) && (flags & PRF_SHORTM)) {
		errno = EINVAL;
		return (-1);
	}

	/* Ignore the delimiter when XML is specified */
	if (!(flags & PRF_XMLM) && (strlen(separator) >= SEP_SIZE)) {
		errno = EINVAL;
		return (-1);
	}

	return (0);
}

/*
 * ----------------------------------------------------------------------
 * print_audit_xml_prolog_buf() - print the XML prolog.
 *		    0 - successful
 *		   -1 - output buffer too small. errno is set to ENOSPC
 * ----------------------------------------------------------------------
 */
int
print_audit_xml_prolog_buf(char *out_buf, const int out_buf_len)
{
	if (xml_prolog_len > out_buf_len) {
		errno = ENOSPC;
		return (-1);
	}

	(void) snprintf(out_buf, out_buf_len, "%s%s%s%s", prolog1, prolog_xsl,
	    prolog2, xml_start);

	return (0);
}

/*
 * ----------------------------------------------------------------------
 * print_audit_xml_ending_buf() - print the XML ending.
 *		    0 - successful
 *		   -1 - output buffer too small. errno is set to ENOSPC
 * ----------------------------------------------------------------------
 */
int
print_audit_xml_ending_buf(char *out_buf, const int out_buf_len)
{
	if (xml_end_len > out_buf_len) {
		errno = ENOSPC;
		return (-1);
	}

	(void) snprintf(out_buf, out_buf_len, "%s", xml_ending);
	return (0);
}

/*
 * ----------------------------------------------------------------------
 * print_prolog() - print the XML prolog.
 * ----------------------------------------------------------------------
 */
void
print_audit_xml_prolog(void)
{
	(void) printf("%s%s%s%s", prolog1, prolog_xsl, prolog2, xml_start);
}

/*
 * ----------------------------------------------------------------------
 * print_ending() - print the XML ending.
 * ----------------------------------------------------------------------
 */
void
print_audit_xml_ending(void)
{
	(void) printf("%s", xml_ending);
}

/*
 * ----------------------------------------------------------------------
 * checkpoint_progress() - If starting a new file or header token,
 *      checkpoint as needed to mark progress.
 * ----------------------------------------------------------------------
 */
static void
checkpoint_progress(pr_context_t *context)
{
	int	tokenid = context->tokenid;

	if (is_file_token(tokenid) || is_header_token(tokenid)) {
		if (context->data_mode == BUFMODE) {
			context->inbuf_last = context->audit_adr->adr_now - 1;
			context->outbuf_last = context->outbuf_p;
		}
		context->audit_rec_start = context->audit_adr->adr_now - 1;
		if (is_file_token(tokenid)) {
			context->audit_rec_len = 11;
		}
	}
}

/*
 * ----------------------------------------------------------------------
 * print_audit_buf() - display contents of audit trail file
 *
 *		   Parses the binary audit data from the specified input
 *		   buffer, and formats as requested to the specified output
 *		   buffer.
 *
 *	inputs:
 *		   in_buf, -	address and length of binary audit input.
 *		   in_buf_len
 *		   out_buf, -	address and length of output buffer to
 *		   out_buf_len	copy formatted audit data to.
 *		   flags -	formatting flags as defined in praudit.h
 *		   separator -	field delimiter (or NULL if the default
 *				delimiter of comma is to be used).
 *
 * return codes:    0 - success
 *		ENOSPC...
 * ----------------------------------------------------------------------
 */
int
print_audit_buf(char **in_buf, int *in_buf_len, char **out_buf,
    int *out_buf_len, const int flags, const char *separator)
{
	int	retstat = 0;
	pr_context_t	*context;

	if ((retstat = check_inputs(flags, separator)) != 0)
		return (retstat);

	if ((context = (pr_context_t *)malloc(sizeof (pr_context_t))) == NULL) {
		errno = EPERM;
		return (-1);
	}

	/* Init internal pointers and lengths... */
	context->data_mode = BUFMODE;
	context->inbuf_last = context->inbuf_start = *in_buf;
	context->inbuf_totalsize = *in_buf_len;

	context->pending_flag = 0;
	context->current_rec = 0;

	context->outbuf_last = context->outbuf_start =
	    context->outbuf_p = *out_buf;
	context->outbuf_remain_len = *out_buf_len;

	/*
	 * get an adr pointer to the audit input buf
	 */
	context->audit_adr = (adr_t *)malloc(sizeof (adr_t));
	(void) adrm_start(context->audit_adr, *in_buf);
	context->audit_rec_start = NULL;
	context->audit_rec_len = 0;

	retstat = print_audit_common(context, flags, separator);

	/* Check for and handle partial results as needed */
	if (retstat != 0) {
		*in_buf = context->inbuf_last;
		*in_buf_len = context->inbuf_totalsize -
		    (context->inbuf_last - context->inbuf_start);

		/* Return size of output */
		*out_buf_len = context->outbuf_last - context->outbuf_start;
		if (*out_buf_len > 0) {
			/* null-terminate the output */
			*(context->outbuf_last) = '\0';
			*out_buf_len = *out_buf_len + 1;
		}
	} else {
		/* Return size of output */
		*out_buf_len = context->outbuf_p - context->outbuf_start + 1;
		*(context->outbuf_p) = '\0';	/* null-terminate the output */
	}

	(void) free(context->audit_adr);
	(void) free(context);
	return (retstat);
}

/*
 * ----------------------------------------------------------------------
 * print_audit() - display contents of audit trail file
 *
 *		   Parses the binary audit data from the file mapped as stdin,
 *		   and formats as requested to file mapped as stdout.
 *	inputs:
 *		   flags -	formatting flags as defined in praudit.h
 *		   separator -	field delimiter (or NULL if the default
 *				delimiter of comma is to be used).
 *
 * return codes:   -1 - error
 *		    0 - successful
 * ----------------------------------------------------------------------
 */
int
print_audit(const int flags, const char *separator)
{
	int	retstat = 0;
	pr_context_t	*context;

	if ((retstat = check_inputs(flags, separator)) != 0)
		return (retstat);

	if ((context = (pr_context_t *)malloc(sizeof (pr_context_t))) == NULL) {
		errno = EPERM;
		return (-1);
	}

	/*
	 * get an adr pointer to the current audit file (stdin)
	 */
	context->audit_adr = malloc(sizeof (adr_t));
	context->audit_adrf = malloc(sizeof (adrf_t));

	adrf_start(context->audit_adrf, context->audit_adr, stdin);

	context->data_mode = FILEMODE;
	context->audit_rec_start = NULL;
	context->audit_rec_len = 0;

	context->pending_flag = 0;
	context->current_rec = 0;

	retstat = print_audit_common(context, flags, separator);

	(void) free(context->audit_adr);
	(void) free(context->audit_adrf);
	(void) free(context);
	return (retstat);
}

/*
 * ----------------------------------------------------------------------
 * print_audit_common() - common routine for print_audit* functions.
 *
 *		   Parses the binary audit data, and formats as requested.
 *		   The context parameter defines whether the source of the
 *		   audit data is a buffer, or a file mapped to stdin, and
 *		   whether the output is to a buffer or a file mapped to
 *		   stdout.
 *
 *	inputs:
 *		   context -	defines the context of the request, including
 *				info about the source and output.
 *		   flags -	formatting flags as defined in praudit.h
 *		   separator -	field delimiter (or NULL if the default
 *				delimiter of comma is to be used).
 *
 * return codes:   -1 - error
 *		    0 - successful
 * ----------------------------------------------------------------------
 */
static int
print_audit_common(pr_context_t *context, const int flags,
    const char *separator)
{
	int	retstat = 0;

	if (!initdone) {
		init_tokens();
		initdone++;
	}

	context->format = flags;

	/* start with default delimiter of comma */
	(void) strlcpy(context->SEPARATOR, ",", SEP_SIZE);
	if (separator != NULL) {
		if (strlen(separator) < SEP_SIZE) {
			(void) strlcpy(context->SEPARATOR, separator, SEP_SIZE);
		}
	}

	while ((retstat == 0) && pr_input_remaining(context, 1)) {
		if (pr_adr_char(context, (char *)&(context->tokenid), 1) == 0) {
			retstat = token_processing(context);
		} else
			break;
	}

	/*
	 * For buffer processing, if the entire input buffer was processed
	 * successfully, but the last record in the buffer was incomplete
	 * (according to the length from its header), then reflect an
	 * "incomplete input" error (which will cause partial results to be
	 * returned).
	 */
	if ((context->data_mode == BUFMODE) && (retstat == 0) &&
	    (context->audit_adr->adr_now < (context->audit_rec_start +
	    context->audit_rec_len))) {
		retstat = -1;
		errno = EIO;
	}

	/*
	 * If there was a last record that didn't get officially closed
	 * off, do it now.
	 */
	if ((retstat == 0) && (context->format & PRF_XMLM) &&
	    (context->current_rec)) {
		retstat = do_newline(context, 1);
		if (retstat == 0)
			retstat = close_tag(context, context->current_rec);
	}

	return (retstat);
}

/*
 * -----------------------------------------------------------------------
 * token_processing:
 *		  Calls the routine corresponding to the token id
 *		  passed in the parameter from the token table, tokentable
 * return codes : -1 - error
 *		:  0 - successful
 * -----------------------------------------------------------------------
 */
static int
token_processing(pr_context_t *context)
{
	uval_t	uval;
	int	retstat;
	int	tokenid = context->tokenid;

	if ((tokenid > 0) && (tokenid <= MAXTOKEN) &&
	    (tokentable[tokenid].func != NOFUNC)) {
		/*
		 * First check if there's a previous record that needs to be
		 * closed off now; then checkpoint our progress as needed.
		 */
		if ((retstat = check_close_rec(context, tokenid)) != 0)
			return (retstat);
		checkpoint_progress(context);

		/* print token name */
		if (context->format & PRF_XMLM) {
			retstat = open_tag(context, tokenid);
		} else {
			if (!(context->format & PRF_RAWM) &&
			    (tokentable[tokenid].t_name != (char *)0)) {
				uval.uvaltype = PRA_STRING;
				uval.string_val =
				    gettext(tokentable[tokenid].t_name);
			} else {
				uval.uvaltype = PRA_BYTE;
				uval.char_val = tokenid;
			}
			retstat = pa_print(context, &uval, 0);
		}
		if (retstat == 0)
			retstat = (*tokentable[tokenid].func)(context);

		/*
		 * For XML, close the token tag. Header tokens wrap the
		 * entire record, so they only get closed later implicitly;
		 * here, just make sure the header open tag gets finished.
		 */
		if ((retstat == 0) && (context->format & PRF_XMLM)) {
			if (!is_header_token(tokenid))
				retstat = close_tag(context, tokenid);
			else
				retstat = finish_open_tag(context);
		}
		return (retstat);
	}
	/* here if token id is not in table */
	(void) fprintf(stderr, gettext("praudit: No code associated with "
	    "token id %d\n"), tokenid);
	return (0);
}