1/*-
2 * Copyright (c) 2004-2009 Apple Inc.
3 * Copyright (c) 2006 Martin Voros
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1.  Redistributions of source code must retain the above copyright
10 *     notice, this list of conditions and the following disclaimer.
11 * 2.  Redistributions in binary form must reproduce the above copyright
12 *     notice, this list of conditions and the following disclaimer in the
13 *     documentation and/or other materials provided with the distribution.
14 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
15 *     its contributors may be used to endorse or promote products derived
16 *     from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
22 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
26 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
27 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
29 *
30 * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#16 $
31 */
32
33/*
34 * Tool used to parse audit records conforming to the BSM structure.
35 */
36
37/*
38 * praudit [-lnpx] [-r | -s] [-d del] [file ...]
39 */
40
41#include <bsm/libbsm.h>
42
43#include <stdio.h>
44#include <stdlib.h>
45#include <unistd.h>
46
47extern char	*optarg;
48extern int	 optind, optopt, opterr,optreset;
49
50static char	*del = ",";	/* Default delimiter. */
51static int	 oneline = 0;
52static int	 partial = 0;
53static int	 oflags = AU_OFLAG_NONE;
54
55static void
56usage(void)
57{
58
59	fprintf(stderr, "usage: praudit [-lnpx] [-r | -s] [-d del] "
60	    "[file ...]\n");
61	exit(1);
62}
63
64/*
65 * Token printing for each token type .
66 */
67static int
68print_tokens(FILE *fp)
69{
70	u_char *buf;
71	tokenstr_t tok;
72	int reclen;
73	int bytesread;
74
75	/* Allow tail -f | praudit to work. */
76	if (partial) {
77		u_char type = 0;
78		/* Record must begin with a header token. */
79		do {
80			type = fgetc(fp);
81		} while(type != AUT_HEADER32);
82		ungetc(type, fp);
83	}
84
85	while ((reclen = au_read_rec(fp, &buf)) != -1) {
86		bytesread = 0;
87		while (bytesread < reclen) {
88			/* Is this an incomplete record? */
89			if (-1 == au_fetch_tok(&tok, buf + bytesread,
90			    reclen - bytesread))
91				break;
92			au_print_flags_tok(stdout, &tok, del, oflags);
93			bytesread += tok.len;
94			if (oneline) {
95				if (!(oflags & AU_OFLAG_XML))
96					printf("%s", del);
97			} else
98				printf("\n");
99		}
100		free(buf);
101		if (oneline)
102			printf("\n");
103		fflush(stdout);
104	}
105	return (0);
106}
107
108int
109main(int argc, char **argv)
110{
111	int ch;
112	int i;
113	FILE *fp;
114
115	while ((ch = getopt(argc, argv, "d:lnprsx")) != -1) {
116		switch(ch) {
117		case 'd':
118			del = optarg;
119			break;
120
121		case 'l':
122			oneline = 1;
123			break;
124
125		case 'n':
126			oflags |= AU_OFLAG_NORESOLVE;
127			break;
128
129		case 'p':
130			partial = 1;
131			break;
132
133		case 'r':
134			if (oflags & AU_OFLAG_SHORT)
135				usage();	/* Exclusive from shortfrm. */
136			oflags |= AU_OFLAG_RAW;
137			break;
138
139		case 's':
140			if (oflags & AU_OFLAG_RAW)
141				usage();	/* Exclusive from raw. */
142			oflags |= AU_OFLAG_SHORT;
143			break;
144
145		case 'x':
146			oflags |= AU_OFLAG_XML;
147			break;
148
149		case '?':
150		default:
151			usage();
152		}
153	}
154
155	if (oflags & AU_OFLAG_XML)
156		au_print_xml_header(stdout);
157
158	/* For each of the files passed as arguments dump the contents. */
159	if (optind == argc) {
160		print_tokens(stdin);
161		return (1);
162	}
163	for (i = optind; i < argc; i++) {
164		fp = fopen(argv[i], "r");
165		if ((fp == NULL) || (print_tokens(fp) == -1))
166			perror(argv[i]);
167		if (fp != NULL)
168			fclose(fp);
169	}
170
171	if (oflags & AU_OFLAG_XML)
172		au_print_xml_footer(stdout);
173
174	return (1);
175}
176