slist slist_insert(slist lista, int ind, int dato)
{
int lon = slist_length(lista);
int i;
slist nodoAux = slist_create();
slist nodoNuevo = slist_create();
slist listaAux = lista;
if( ind == 0)
{
lista = slist_preppend(lista, dato);
return lista;
}
if( ind == lon)
{
lista = slist_append(lista, dato);
return lista;
}
if( ind > 0 && ind < lon)
{
nodoNuevo = slist_append(nodoNuevo, dato);
for(i = 0; i < ind - 1; lista = slist_next(lista), i++)
;
nodoAux = slist_next(lista);
slist_next(lista) = nodoNuevo;
slist_next(nodoNuevo) = nodoAux;
}
return listaAux;
}
int main(int argc, char **argv)
{
int num_size = sizeof(int);
slnode_t node = NULL;
slist_t numbers = slist_create(free_mydata);
if (numbers == NULL)
return errno;
for (int i = 0; i < 10; ++i)
{
int *num = num = (int *) malloc(num_size);
if (num == NULL) {
errno = ENOMEM;
break;
}
*num = i;
node = slnode_create(num, num_size);
if (node == NULL) {
break;
}
slist_add(numbers, node);
}
if ((node = slist_find(numbers, my_compare, (void *) 8)) != NULL) {
printf("number %d was found.\n", *((int *)node->data));
}
slist_free(numbers);
return 0;
}
void test_slist_prepend_to_empty(void)
{
unsigned long *val = NULL;
assert_true(test_slist == NULL);
test_slist = slist_create();
assert_true(test_slist != NULL);
assert_true(slist_is_empty(test_slist));
val = make_ulong_ptr(9999);
assert_true(val != NULL);
assert_true(slist_prepend(test_slist, val) == 0);
/* Verify */
val = NULL;
val = slist_index(test_slist, 0);
assert_true(val != NULL);
assert_ulong_equal(9999, *val);
assert_true(slist_size(test_slist) == 1);
slist_free_all(test_slist, NULL);
test_slist = NULL;
}
/* This function inits the counters */
void reset_counters(void)
{
sd.changes = 0UL;
sd.crypto = 0UL;
sd.acct_changes = 0UL;
sd.good_logins = 0UL;
sd.bad_logins = 0UL;
sd.good_auth = 0UL;
sd.bad_auth = 0UL;
sd.events = 0UL;
sd.avcs = 0UL;
sd.mac = 0UL;
sd.failed_syscalls = 0UL;
sd.anomalies = 0UL;
sd.responses = 0UL;
slist_create(&sd.users);
slist_create(&sd.terms);
slist_create(&sd.files);
slist_create(&sd.hosts);
slist_create(&sd.exes);
slist_create(&sd.avc_objs);
slist_create(&sd.keys);
ilist_create(&sd.pids);
ilist_create(&sd.sys_list);
ilist_create(&sd.anom_list);
ilist_create(&sd.mac_list);
ilist_create(&sd.resp_list);
ilist_create(&sd.crypto_list);
}
void test_slist_create(void)
{
test_slist = slist_create();
assert_true(test_slist != NULL);
assert_true(slist_size(test_slist) == 0);
assert_true(slist_is_empty(test_slist));
slist_free(test_slist);
test_slist = NULL;
}
slist slist_concat(slist l1, slist l2)
{
slist listaNueva = slist_create();
for( ; l1 != slist_empty(); l1 = slist_next(l1))
listaNueva = slist_append(listaNueva, slist_data(l1));
for( ; l2 != slist_empty(); l2 = slist_next(l2))
listaNueva = slist_append(listaNueva, slist_data(l2));
return listaNueva;
}
void test_slist_remove_data_from_empty(void)
{
assert_true(test_slist == NULL);
test_slist = slist_create();
assert_true(test_slist != NULL);
assert_true(slist_is_empty(test_slist));
assert_true(slist_remove_data(test_slist, NULL) == -1);
slist_free_all(test_slist, NULL);
test_slist = NULL;
}
void test_slist_reverse_empty(void)
{
assert_true(test_slist == NULL);
test_slist = slist_create();
assert_true(test_slist != NULL);
assert_true(slist_is_empty(test_slist));
assert_true(slist_reverse(test_slist) == 0);
slist_free_all(test_slist, NULL);
test_slist = NULL;
}
slist slist_ssort(slist lista)
{
slist listaNueva = slist_create();
slist aux = slist_create();
int i,j, lonLista;
lonLista = slist_length(lista);
for(i = 0; i < lonLista; i++)
aux = slist_append(aux, slist_elem(lista, i));
slist aux2 = aux;
int posMenor = 0;
int menor = slist_data(aux);
for(j = 0; j < lonLista; j++)
{
posMenor = 0;
menor = slist_data(aux);
for(i = 0 ; aux != slist_empty(); aux = slist_next(aux), i++)
{
if(slist_data(aux) < menor)
{
posMenor = i;
menor = slist_data(aux);
}
}
aux = aux2;
listaNueva = slist_append(listaNueva, menor);
aux = slist_remove(aux, posMenor);
aux2 = aux;
}
return listaNueva;
}
void slist_setup_ints(void)
{
unsigned long i, *val;
test_slist = slist_create();
assert_true(test_slist != NULL);
assert_true(slist_is_empty(test_slist));
for(i = 0; i < 1000; i++) {
val = make_ulong_ptr(i);
if(val != NULL) {
slist_append(test_slist, val);
}
}
}
slist slist_intersec(slist l1, slist l2)
{
slist listaNueva = slist_create();
slist l2Aux = l2;
for( ; l1 != slist_empty(); l1 = slist_next(l1))
{
for( ; l2 != slist_empty(); l2 = slist_next(l2))
{
if( slist_data(l1) == slist_data(l2))
{
if(slist_contain(listaNueva, slist_data(l1)) == FALSE)
listaNueva = slist_append(listaNueva, slist_data(l1));
}
}
l2 = l2Aux;
}
return listaNueva;
}
SList slist_interect_custom(SList list1, SList list2, CompareFunc func, size_t size)
{
SList aux_list1 = list1;
SList aux_list2 = list2;
SList new_list = slist_create();
while (aux_list1 != slist_empty())
{
while(aux_list2 != slist_empty())
{
if(func(slist_data(aux_list1), slist_data(aux_list2)) && !slist_contain(new_list, slist_data(aux_list1), func))
new_list = slist_append(new_list, slist_data(aux_list1), size);
aux_list2 = slist_next(aux_list2);
}
aux_list2 = list2;
aux_list1 = slist_next(aux_list1);
}
return new_list;
}
SList slist_concat(SList list1, SList list2, size_t size)
{
SList new_list = slist_create();
SList aux_list1 = list1;
SList aux_list2 = list2;
while(aux_list1 != slist_empty())
{
new_list = slist_append(new_list, slist_data(aux_list1), size);
aux_list1 = slist_next(aux_list1);
}
while(aux_list2 != slist_empty())
{
new_list = slist_append(new_list, slist_data(aux_list2), size);
aux_list2 = slist_next(aux_list2);
}
return new_list;
}
int
test_base_slist(const char* param) {
struct slist_t* sl = slist_create();
if (!sl) {
fprintf(stderr, "slist create fail\n");
return -1;
}
rand_seed(time(NULL));
int loop = param ? atoi(param) : 32;
int data[loop];
for (int i = 0; i < loop; ++ i) {
data[i] = (int)(rand_gen()) % loop;
int res = slist_push_front(sl, &data[i]);
CHECK(sl, res == 0, "slist push front fail");
res = slist_push_back(sl, &data[i]);
CHECK(sl, res == 0, "slist push back fail");
}
CHECK(sl, slist_size(sl) == 2 * loop, "slist size fail");
for (int i = loop - 1; i >= 0; -- i) {
int res = slist_find(sl, &data[i]);
CHECK(sl, res == 0, "slist find fail");
void* p = slist_pop_front(sl);
CHECK(sl, p == &data[i], "slist pop front fail");
p = slist_pop_back(sl);
CHECK(sl, p == &data[i], "slist pop back fail");
res = slist_find(sl, &data[i]);
CHECK(sl, res < 0, "slist find fail");
}
CHECK(sl, slist_size(sl) == 0, "slist size fail");
slist_release(sl);
return 0;
}
SList slist_insert(SList list, void *data, size_t size, unsigned int pos)
{
if( pos == 0)
list = slist_preppend(list, data, size);
if( pos > 0 && pos <= slist_length(list))
{
int i;
SList aux_list = list;
SList new_node = slist_create();
new_node = slist_preppend(new_node, data, size);
for(i = 0; i <= pos; i++)
{
if( i == pos - 1)
{
slist_next(new_node) = slist_next(aux_list);
slist_next(aux_list) = new_node;
}
aux_list = slist_next(aux_list);
}
}
return list;
}
curlp_t*
curlp_create() {
curlc_t* cc = NULL;
curlp_t* cp = (curlp_t*)MALLOC(sizeof(*cp));
if (!cp) goto CURL_FAIL;
memset(cp, 0, sizeof(*cp));
cp->size = CURL_POOL_DEFAULT_SIZE;
cp->free_list = slist_create();
if (!cp->free_list) goto CURL_FAIL1;
cp->clients = hash_create(_curlp_hash, _curlp_cmp, cp->size * 13);
if (!cp->clients) goto CURL_FAIL2;
cp->mhandle = curl_multi_init();
if (!cp->mhandle) goto CURL_FAIL3;
// pre allocate client
for (int i = 0; i < cp->size; ++ i) {
cc = curlc_create();
if (cc) {
slist_push_front(cp->free_list, cc);
hash_insert(cp->clients, cc);
}
}
return cp;
CURL_FAIL3:
hash_release(cp->clients);
CURL_FAIL2:
slist_release(cp->free_list);
CURL_FAIL1:
FREE(cp);
CURL_FAIL:
return NULL;
}
int init(logT log_function)
{
char buffer[TEMP_BUF_SIZE];
s_log = log_function;
s_outputs = slist_create();
// now init the driver info array
// and the drivers that need it
#if defined(OS_WIN32)
if (!GDI_init(buffer, sizeof(buffer)))
{
char et[TEMP_BUF_SIZE];
snprintf(et, sizeof(et),
"Could not init GDI driver: '%s' - skipping",
buffer);
s_log(0, et);
}
else
insert_driver("GDI", GDI_get_driver);
#endif
#if defined(OS_DARWIN)
if (!Quartz_init(buffer, sizeof(buffer)))
{
char et[TEMP_BUF_SIZE];
snprintf(et, sizeof(et),
"Could not init quartz driver: '%s' - skipping",
buffer);
s_log(0, et);
}
else
{
insert_driver("quartz", Quartz_get_driver);
}
#endif
#if defined(HAVE_X11)
insert_driver("x11", X11_get_driver);
#endif
#if defined(WITH_SDL)
insert_driver("SDL", SDL_get_driver);
#endif
#if defined(WITH_GL)
insert_driver("GL", GL_get_driver);
#endif
#if defined(WITH_AALIB)
insert_driver("aalib", AA_get_driver);
#endif
#if defined(WITH_V4L)
insert_driver("vloopback", VLoopback_get_driver);
#endif
if (s_num_drivers == 0)
{
s_log(0, "No driver found - quitting");
return 0;
}
else
{
return 1;
}
}
/*
* This function examines the commandline parameters and sets various
* search options. It returns a 0 on success and < 0 on failure
*/
int check_params(int count, char *vars[])
{
int c = 1;
int retval = 0;
const char *optarg;
while (c < count && retval == 0) {
// Go ahead and point to the next argument
if (c+1 < count) {
if (vars[c+1][0] != '-')
optarg = vars[c+1];
else
optarg = NULL;
} else
optarg = NULL;
switch (audit_lookup_option(vars[c])) {
case R_INFILE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
user_file = strdup(optarg);
if (user_file == NULL)
retval = -1;
c++;
}
break;
case R_LOG_TIMES:
if (set_report(RPT_TIME))
retval = -1;
else
set_detail(D_DETAILED);
break;
case R_AVCS:
if (set_report(RPT_AVC))
retval = -1;
else {
set_detail(D_DETAILED);
event_comm = dummy;
event_subject = dummy;
event_object = dummy;
}
break;
case R_AUTH:
if (set_report(RPT_AUTH))
retval = -1;
else {
set_detail(D_DETAILED);
event_exe = dummy;
event_hostname = dummy;
event_terminal = dummy;
}
break;
case R_MAC:
if (set_report(RPT_MAC))
retval = -1;
else
set_detail(D_DETAILED);
break;
case R_CONFIGS:
if (set_report(RPT_CONFIG))
retval = -1;
else
set_detail(D_DETAILED);
break;
case R_CRYPTO:
if (set_report(RPT_CRYPTO))
retval = -1;
else
set_detail(D_DETAILED);
break;
case R_LOGINS:
if (set_report(RPT_LOGIN))
retval = -1;
else {
set_detail(D_DETAILED);
event_exe = dummy;
event_hostname = dummy;
event_terminal = dummy;
}
break;
case R_ACCT_MODS:
if (set_report(RPT_ACCT_MOD))
retval = -1;
else {
set_detail(D_DETAILED);
event_exe = dummy;
event_hostname = dummy;
event_terminal = dummy;
}
break;
case R_EVENTS:
if (set_report(RPT_EVENT))
retval = -1;
else {
// if (!optarg)
set_detail(D_DETAILED);
// else {
// UNIMPLEMENTED;
// set_detail(D_SPECIFIC);
// if (isdigit(optarg[0])) {
// errno = 0;
// event_id = strtoul(optarg,
// NULL, 10);
// if (errno) {
// fprintf(stderr,
// "Illegal value for audit event ID");
// retval = -1;
// }
// c++;
// } else {
// fprintf(stderr,
// "Audit event id must be a numeric value, was %s\n",
// optarg);
// retval = -1;
// }
// }
}
break;
case R_FILES:
if (set_report(RPT_FILE))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_filename = dummy;
event_exe = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_HOSTS:
if (set_report(RPT_HOST))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_hostname = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_INTERPRET:
report_format = RPT_INTERP;
if (optarg) {
fprintf(stderr,
"Argument is NOT required for %s\n",
vars[c]);
retval = -1;
}
break;
case R_PIDS:
if (set_report(RPT_PID))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_exe = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_SYSCALLS:
if (set_report(RPT_SYSCALL))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_comm = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_TERMINALS:
if (set_report(RPT_TERM))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_terminal = dummy;
event_hostname = dummy;
event_exe = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_USERS:
if (set_report(RPT_USER))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_terminal = dummy;
event_hostname = dummy;
event_exe = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_EXES:
if (set_report(RPT_EXE))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_terminal = dummy;
event_hostname = dummy;
event_exe = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_ANOMALY:
if (set_report(RPT_ANOMALY))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_terminal = dummy;
event_hostname = dummy;
event_exe = dummy;
event_comm = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_RESPONSE:
if (set_report(RPT_RESPONSE))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
} else {
UNIMPLEMENTED;
}
}
break;
case R_KEYS:
if (set_report(RPT_KEY))
retval = -1;
else {
if (!optarg) {
set_detail(D_DETAILED);
event_exe = dummy;
event_key = dummy;
} else {
UNIMPLEMENTED;
}
}
break;
case R_TTY:
if (set_report(RPT_TTY))
retval = -1;
else {
event_session_id = 1;
event_terminal = dummy;
event_comm = dummy;
set_detail(D_DETAILED);
}
break;
case R_TIME_END:
if (optarg) {
if ( (c+2 < count) && vars[c+2] &&
(vars[c+2][0] != '-') ) {
/* Have both date and time - check order*/
if (strchr(optarg, ':')) {
if (ausearch_time_end(vars[c+2],
optarg) != 0)
retval = -1;
} else {
if (ausearch_time_end(optarg,
vars[c+2]) != 0)
retval = -1;
}
c++;
} else {
// Check against recognized words
int t = lookup_time(optarg);
if (t >= 0) {
if (ausearch_time_end(optarg,
NULL) != 0)
retval = -1;
} else if ( (strchr(optarg, ':')) == NULL) {
/* Only have date */
if (ausearch_time_end(optarg,
NULL) != 0)
retval = -1;
} else {
/* Only have time */
if (ausearch_time_end(NULL,
optarg) != 0)
retval = -1;
}
}
c++;
break;
}
fprintf(stderr,
"%s requires either date and/or time\n",
vars[c]);
retval = -1;
break;
case R_TIME_START:
if (optarg) {
if ( (c+2 < count) && vars[c+2] &&
(vars[c+2][0] != '-') ) {
/* Have both date and time - check order */
if (strchr(optarg, ':')) {
if (ausearch_time_start(
vars[c+2], optarg) != 0)
retval = -1;
} else {
if (ausearch_time_start(optarg,
vars[c+2]) != 0)
retval = -1;
}
c++;
} else {
// Check against recognized words
int t = lookup_time(optarg);
if (t >= 0) {
if (ausearch_time_start(optarg,
"00:00:00") != 0)
retval = -1;
} else if ( strchr(optarg, ':') == NULL) {
/* Only have date */
if (ausearch_time_start(optarg,
"00:00:00") != 0)
retval = -1;
} else {
/* Only have time */
if (ausearch_time_start(NULL,
optarg) != 0)
retval = -1;
}
}
c++;
break;
}
fprintf(stderr,
"%s requires either date and/or time\n",
vars[c]);
retval = -1;
break;
case R_NODE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
snode sn;
c++;
if (!event_node_list) {
event_node_list = malloc(sizeof (slist));
if (!event_node_list) {
retval = -1;
break;
}
slist_create(event_node_list);
}
sn.str = strdup(optarg);
sn.key = NULL;
sn.hits=0;
slist_append(event_node_list, &sn);
}
break;
case R_SUMMARY_DET:
set_detail(D_SUM);
break;
case R_FAILED:
event_failed = F_FAILED;
break;
case R_SUCCESS:
event_failed = F_SUCCESS;
break;
case R_ADD:
event_conf_act = C_ADD;
break;
case R_DEL:
event_conf_act = C_DEL;
break;
case R_IN_LOGS:
force_logs = 1;
break;
case R_VERSION:
printf("aureport version %s\n", VERSION);
exit(0);
break;
case R_HELP:
usage();
exit(0);
break;
default:
fprintf(stderr, "%s is an unsupported option\n",
vars[c]);
retval = -1;
break;
}
c++;
}
if (retval >= 0) {
if (report_type == RPT_UNSET) {
if (set_report(RPT_SUMMARY))
retval = -1;
else {
set_detail(D_SUM);
event_filename = dummy;
event_hostname = dummy;
event_terminal = dummy;
event_exe = dummy;
event_key = dummy;
}
}
} else
usage();
return retval;
}
/*
* This function examines the commandline parameters and sets various
* search options. It returns a 0 on success and < 0 on failure
*/
int check_params(int count, char *vars[])
{
int c = 1;
int retval = 0;
const char *optarg;
if (count < 2) {
usage();
return -1;
}
while (c < count && retval == 0) {
// Go ahead and point to the next argument
if (c+1 < count) {
if (vars[c+1][0] != '-')
optarg = vars[c+1];
else
optarg = NULL;
} else
optarg = NULL;
switch (audit_lookup_option(vars[c])) {
case S_EVENT:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_id = strtoul(optarg, NULL, 10);
if (errno) {
fprintf(stderr,
"Illegal value for audit event ID");
retval = -1;
}
c++;
} else {
fprintf(stderr,
"Audit event id must be a numeric value, was %s\n",
optarg);
retval = -1;
}
break;
case S_COMM:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
} else {
event_comm = strdup(optarg);
if (event_comm == NULL)
retval = -1;
c++;
}
break;
case S_FILENAME:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_filename = strdup(optarg);
if (event_filename == NULL)
retval = -1;
c++;
}
break;
case S_KEY:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_key = strdup(optarg);
if (event_key == NULL)
retval = -1;
c++;
}
break;
case S_ALL_GID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_gid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric group ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct group *gr ;
gr = getgrnam(optarg) ;
if (gr == NULL) {
fprintf(stderr,
"Group ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_gid = gr->gr_gid;
}
event_egid = event_gid;
event_ga = 1;
c++;
break;
case S_EFF_GID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_egid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric group ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct group *gr ;
gr = getgrnam(optarg) ;
if (gr == NULL) {
fprintf(stderr,
"Effective group ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_egid = gr->gr_gid;
}
c++;
break;
case S_GID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_gid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric group ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct group *gr ;
gr = getgrnam(optarg) ;
if (gr == NULL) {
fprintf(stderr,
"Group ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_gid = gr->gr_gid;
}
c++;
break;
case S_HELP:
usage();
exit(0);
break;
case S_HOSTNAME:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_hostname = strdup(optarg);
if (event_hostname == NULL)
retval = -1;
c++;
}
break;
case S_INTERP:
if (report_format == RPT_DEFAULT)
report_format = RPT_INTERP;
else {
fprintf(stderr,
"Conflicting output format %s\n",
vars[c]);
retval = -1;
}
if (optarg) {
fprintf(stderr,
"Argument is NOT required for %s\n",
vars[c]);
retval = -1;
}
break;
case S_INFILE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
user_file = strdup(optarg);
if (user_file == NULL)
retval = -1;
c++;
}
break;
case S_MESSAGE_TYPE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
if (strcasecmp(optarg, "ALL") != 0) {
retval = parse_msg(optarg);
}
c++;
}
if (retval < 0) {
int i;
fprintf(stderr,
"Valid message types are: ALL ");
for (i=AUDIT_USER;i<=AUDIT_LAST_VIRT_MSG;i++){
const char *name;
if (i == AUDIT_WATCH_INS) // Skip a few
i = AUDIT_FIRST_USER_MSG;
name = audit_msg_type_to_name(i);
if (name)
fprintf(stderr, "%s ", name);
}
fprintf(stderr, "\n");
}
break;
case S_OBJECT:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
} else {
event_object = strdup(optarg);
if (event_object == NULL)
retval = -1;
c++;
}
break;
case S_PPID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_ppid = strtol(optarg,NULL,10);
if (errno)
retval = -1;
c++;
} else {
fprintf(stderr,
"Parent process id must be a numeric value, was %s\n",
optarg);
retval = -1;
}
break;
case S_PID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_pid = strtol(optarg,NULL,10);
if (errno)
retval = -1;
c++;
} else {
fprintf(stderr,
"Process id must be a numeric value, was %s\n",
optarg);
retval = -1;
}
break;
case S_RAW:
if (report_format == RPT_DEFAULT)
report_format = RPT_RAW;
else {
fprintf(stderr,
"Conflicting output format --raw\n");
retval = -1;
}
if (optarg) {
fprintf(stderr,
"Argument is NOT required for --raw\n");
retval = -1;
}
break;
case S_NODE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
snode sn;
c++;
if (!event_node_list) {
event_node_list = malloc(sizeof (slist));
if (!event_node_list) {
retval = -1;
break;
}
slist_create(event_node_list);
}
sn.str = strdup(optarg);
sn.key = NULL;
sn.hits=0;
slist_append(event_node_list, &sn);
}
break;
case S_SYSCALL:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_syscall = (int)strtoul(optarg, NULL, 10);
if (errno) {
fprintf(stderr,
"Syscall numeric conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
int machine;
machine = audit_detect_machine();
if (machine < 0) {
fprintf(stderr,
"Error detecting machine type");
retval = -1;
break;
}
event_syscall = audit_name_to_syscall(optarg,
machine);
if (event_syscall == -1) {
fprintf(stderr,
"Syscall %s not found\n",
optarg);
retval = -1;
}
}
c++;
break;
case S_CONTEXT:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
} else {
event_subject = strdup(optarg);
if (event_subject == NULL)
retval = -1;
event_object = strdup(optarg);
if (event_object == NULL)
retval = -1;
event_se = 1;
c++;
}
break;
case S_SUBJECT:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
} else {
event_subject = strdup(optarg);
if (event_subject == NULL)
retval = -1;
c++;
}
break;
case S_OSUCCESS:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if ( (strstr(optarg, "yes")!=NULL) ||
(strstr(optarg, "no")!=NULL) ) {
if (strcmp(optarg, "yes") == 0)
event_success = S_SUCCESS;
else
event_success = S_FAILED;
} else {
fprintf(stderr,
"Success must be 'yes' or 'no'.\n");
retval = -1;
}
c++;
break;
case S_SESSION:
if (!optarg) {
if ((c+1 < count) && vars[c+1])
optarg = vars[c+1];
else {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
}
{
size_t len = strlen(optarg);
if (isdigit(optarg[0])) {
errno = 0;
event_session_id = strtol(optarg,NULL,10);
if (errno)
retval = -1;
c++;
} else if (len >= 2 && *(optarg)=='-' &&
(isdigit(optarg[1]))) {
errno = 0;
event_session_id = strtol(optarg, NULL, 0);
if (errno) {
retval = -1;
fprintf(stderr, "Error converting %s\n",
optarg);
}
c++;
} else {
fprintf(stderr,
"Session id must be a numeric value, was %s\n",
optarg);
retval = -1;
}
}
break;
case S_EXIT:
if (!optarg) {
if ((c+1 < count) && vars[c+1])
optarg = vars[c+1];
else {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
}
{
size_t len = strlen(optarg);
if (isdigit(optarg[0])) {
errno = 0;
event_exit = strtol(optarg, NULL, 0);
if (errno) {
retval = -1;
fprintf(stderr, "Error converting %s\n",
optarg);
}
} else if (len >= 2 && *(optarg)=='-' &&
(isdigit(optarg[1]))) {
errno = 0;
event_exit = strtol(optarg, NULL, 0);
if (errno) {
retval = -1;
fprintf(stderr, "Error converting %s\n",
optarg);
}
} else {
event_exit = audit_name_to_errno(optarg);
if (event_exit == 0) {
retval = -1;
fprintf(stderr,
"Unknown errno, was %s\n",
optarg);
}
}
c++;
if (retval != -1)
event_exit_is_set = 1;
}
break;
case S_TIME_END:
if (optarg) {
if ( (c+2 < count) && vars[c+2] &&
(vars[c+2][0] != '-') ) {
/* Have both date and time - check order*/
if (strchr(optarg, ':')) {
if (ausearch_time_end(vars[c+2],
optarg) != 0)
retval = -1;
} else {
if (ausearch_time_end(optarg,
vars[c+2]) != 0)
retval = -1;
}
c++;
} else {
// Check against recognized words
int t = lookup_time(optarg);
if (t >= 0) {
if (ausearch_time_end(optarg,
NULL) != 0)
retval = -1;
} else if ( (strchr(optarg, ':')) == NULL) {
/* Only have date */
if (ausearch_time_end(optarg,
NULL) != 0)
retval = -1;
} else {
/* Only have time */
if (ausearch_time_end(NULL,
optarg) != 0)
retval = -1;
}
}
c++;
break;
}
fprintf(stderr,
"%s requires either date and/or time\n",
vars[c]);
retval = -1;
break;
case S_TIME_START:
if (optarg) {
if ( (c+2 < count) && vars[c+2] &&
(vars[c+2][0] != '-') ) {
/* Have both date and time - check order */
if (strchr(optarg, ':')) {
if (ausearch_time_start(
vars[c+2], optarg) != 0)
retval = -1;
} else {
if (ausearch_time_start(optarg,
vars[c+2]) != 0)
retval = -1;
}
c++;
} else {
// Check against recognized words
int t = lookup_time(optarg);
if (t >= 0) {
if (ausearch_time_start(optarg,
"00:00:00") != 0)
retval = -1;
}
else if ( strchr(optarg, ':') == NULL) {
/* Only have date */
if (ausearch_time_start(optarg,
"00:00:00") != 0)
retval = -1;
} else {
/* Only have time */
if (ausearch_time_start(NULL,
optarg) != 0)
retval = -1;
}
}
c++;
break;
}
fprintf(stderr,
"%s requires either date and/or time\n",
vars[c]);
retval = -1;
break;
case S_TERMINAL:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_terminal = strdup(optarg);
if (event_terminal == NULL)
retval = -1;
c++;
}
break;
case S_UID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_uid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric user ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct passwd *pw;
pw = getpwnam(optarg);
if (pw == NULL) {
fprintf(stderr,
"Effective user ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_uid = pw->pw_uid;
}
c++;
break;
case S_EFF_UID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_euid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric user ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct passwd *pw ;
pw = getpwnam(optarg) ;
if (pw == NULL) {
fprintf(stderr,
"User ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_euid = pw->pw_uid;
}
c++;
break;
case S_ALL_UID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
if (isdigit(optarg[0])) {
errno = 0;
event_uid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric user ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else {
struct passwd *pw ;
pw = getpwnam(optarg) ;
if (pw == NULL) {
fprintf(stderr,
"User ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_uid = pw->pw_uid;
}
event_ua = 1;
event_euid = event_uid;
event_loginuid = event_uid;
c++;
break;
case S_LOGINID:
if (!optarg) {
if ((c+1 < count) && vars[c+1])
optarg = vars[c+1];
else {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
break;
}
}
{
size_t len = strlen(optarg);
if (isdigit(optarg[0])) {
errno = 0;
event_loginuid = strtoul(optarg,NULL,10);
if (errno) {
fprintf(stderr,
"Numeric user ID conversion error (%s) for %s\n",
strerror(errno), optarg);
retval = -1;
}
} else if (len >= 2 && *(optarg)=='-' &&
(isdigit(optarg[1]))) {
errno = 0;
event_loginuid = strtol(optarg, NULL, 0);
if (errno) {
retval = -1;
fprintf(stderr, "Error converting %s\n",
optarg);
}
} else {
struct passwd *pw ;
pw = getpwnam(optarg) ;
if (pw == NULL) {
fprintf(stderr,
"Login user ID is non-numeric and unknown (%s)\n",
optarg);
retval = -1;
break;
}
event_loginuid = pw->pw_uid;
}
}
c++;
break;
case S_UUID:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_uuid = strdup(optarg);
if (event_uuid == NULL) {
retval = -1;
}
c++;
}
break;
case S_VMNAME:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_vmname= strdup(optarg);
if (event_vmname == NULL) {
retval = -1;
}
c++;
}
break;
case S_VERSION:
printf("ausearch version %s\n", VERSION);
exit(0);
break;
case S_EXACT_MATCH:
event_exact_match=1;
break;
case S_IN_LOGS:
force_logs = 1;
break;
case S_JUST_ONE:
just_one = 1;
break;
case S_EXECUTABLE:
if (!optarg) {
fprintf(stderr,
"Argument is required for %s\n",
vars[c]);
retval = -1;
} else {
event_exe = strdup(optarg);
if (event_exe == NULL)
retval = -1;
c++;
}
break;
case S_LINEBUFFERED:
line_buffered = 1;
break;
default:
fprintf(stderr, "%s is an unsupported option\n",
vars[c]);
retval = -1;
break;
}
c++;
}
return retval;
}
int main(void)
{
snode n, *node;
int rc, i = 0;
slist_create(&s);
// This first test checks to see if list is
// created in a numeric order
slist_add_if_uniq(&s, "test1");
slist_add_if_uniq(&s, "test2");
slist_first(&s);
slist_add_if_uniq(&s, "test3");
puts("should be 3");
rc = print_list();
if (s.cnt != 3 || rc !=3) {
puts("test count is wrong");
return 1;
}
n.str = strdup("test4");
n.key = NULL;
n.hits = 1;
slist_append(&s, &n);
puts("should add a #4");
rc = print_list();
if (s.cnt != 4 || rc != 4) {
puts("test count is wrong");
return 1;
}
slist_add_if_uniq(&s, "test2");
puts("should be same");
rc = print_list();
if (s.cnt != 4 || rc != 4) {
puts("test count is wrong");
return 1;
}
slist_clear(&s);
puts("should be empty");
rc = print_list();
if (s.cnt != 0 || rc != 0) {
puts("test count is wrong");
return 1;
}
puts("starting sort test");
// Now test to see if the sort function works
// Fill the list exactly backwards
slist_add_if_uniq(&s, "test3");
slist_add_if_uniq(&s, "test3");
slist_add_if_uniq(&s, "test4");
slist_add_if_uniq(&s, "test3");
slist_add_if_uniq(&s, "test4");
slist_add_if_uniq(&s, "test2");
slist_add_if_uniq(&s, "test4");
slist_add_if_uniq(&s, "test2");
slist_add_if_uniq(&s, "test4");
slist_add_if_uniq(&s, "test1");
slist_sort_by_hits(&s);
slist_first(&s);
do {
node = slist_get_cur(&s);
if (node->hits != (4-i)) {
printf("Sort test failed - i:%d != hits:%u\n", i, node->hits);
return 1;
}
i++;
} while ((node = slist_next(&s)));
puts("sort test passes");
slist_clear(&s);
return 0;
}
Queue* queue_create(void)
{
return (Queue *)slist_create();
}
