token.c revision 103b2b152ab1f30e081cd8f98b88e71e6cd6d2fc
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2006 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
/*
* Token processing for auditreduce.
*/
#include <locale.h>
#include "auditr.h"
#include "toktable.h"
extern int re_exec2(char *);
static void anchor_path(char *path);
static char *collapse_path(char *s);
#if AUDIT_REC
void
{
char *suffix;
"token_processing: token %d not found\n", id);
return;
}
switch (id) {
case AUT_NEWGROUPS:
suffix = "_new";
break;
case AUT_ATTR32:
suffix = "32";
break;
case AUT_ARG64:
case AUT_RETURN64:
case AUT_ATTR64:
case AUT_HEADER64:
case AUT_SUBJECT64:
case AUT_PROCESS64:
case AUT_OTHER_FILE64:
suffix = "64";
break;
case AUT_SOCKET_EX:
case AUT_IN_ADDR_EX:
suffix = "_ex";
break;
case AUT_HEADER32_EX:
case AUT_SUBJECT32_EX:
case AUT_PROCESS32_EX:
suffix = "32_ex";
break;
case AUT_HEADER64_EX:
case AUT_SUBJECT64_EX:
case AUT_PROCESS64_EX:
suffix = "64_ex";
break;
default:
suffix = "";
break;
}
}
#endif /* AUDIT_REC */
/*
* Process a token in a record to determine whether the record is interesting.
*/
int
{
#if AUDIT_REC
#endif /* AUDIT_REC */
}
/* here if token id is not in table */
return (-2);
}
/* There should not be any file or header tokens in the middle of a record */
/* ARGSUSED */
int
{
return (-2);
}
/* ARGSUSED */
int
{
return (-2);
}
/* ARGSUSED */
int
{
return (-2);
}
/* ARGSUSED */
int
{
return (-2);
}
/* ARGSUSED */
int
{
return (-2);
}
/* ARGSUSED */
int
{
return (-2);
}
/*
* ======================================================
* The following token processing routines return
* -1: if the record is not interesting
* -2: if an error is found
* ======================================================
*/
int
{
short magic_number;
if (magic_number != AUT_TRAILER_MAGIC) {
gettext("auditreduce: Bad trailer token"));
return (-2);
}
return (-1);
}
/*
* Format of arbitrary data token:
* arbitrary data token id adr char
* how to print adr_char
* basic unit adr_char
* unit count adr_char, specifying number of units of
* data items depends on basic unit
*
*/
int
{
int i;
char c1;
short c2;
/* get how_to_print, basic_unit, and unit_count */
for (i = 0; i < unit_count; i++) {
switch (basic_unit) {
/* case AUR_BYTE: has same value as AUR_CHAR */
case AUR_CHAR:
break;
case AUR_SHORT:
break;
case AUR_INT32:
break;
case AUR_INT64:
break;
default:
return (-2);
break;
}
}
return (-1);
}
/*
* Format of opaque token:
* opaque token id adr_char
* size adr_short
* data adr_char, size times
*
*/
int
{
return (-1);
}
/*
* Format of return32 value token:
* return value token id adr_char
* error number adr_char
* return value adr_u_int32
*
*/
int
{
char errnum;
checkflags |= M_SORF;
}
return (-1);
}
/*
* Format of return64 value token:
* return value token id adr_char
* error number adr_char
* return value adr_u_int64
*
*/
int
{
char errnum;
checkflags |= M_SORF;
}
return (-1);
}
/*
* Format of sequence token:
* sequence token id adr_char
* audit_count int32_t
*
*/
int
{
return (-1);
}
/*
* Format of text token:
* text token id adr_char
* text adr_string
*
*/
int
{
return (-1);
}
/*
* Format of ip_addr token:
* ip token id adr_char
* address adr_int32
*
*/
int
{
return (-1);
}
/*
* Format of ip_addr_ex token:
* ip token id adr_char
* ip type adr_int32
* address 4*adr_int32
*
*/
int
{
return (-1);
}
/*
* Format of ip token:
* ip header token id adr_char
* version adr_char
* type of service adr_char
* length adr_short
* id adr_u_short
* offset adr_u_short
* ttl adr_char
* protocol adr_char
* checksum adr_u_short
* source address adr_int32
* destination address adr_int32
*
*/
int
{
char version;
char type;
short len;
return (-1);
}
/*
* Format of iport token:
* ip port address token id adr_char
* port address adr_short
*
*/
int
{
short address;
return (-1);
}
/*
* Format of groups token:
* group token id adr_char
* group list adr_int32, 16 times
*
*/
int
{
int gid[16];
int i;
int flag = 0;
for (i = 0; i < 16; i++) {
flag = 1;
}
}
if (flag)
checkflags |= M_GROUPR;
}
return (-1);
}
/*
* Format of newgroups token:
* group token id adr_char
* number of groups adr_short
* group list adr_int32, "number" times
*
*/
int
{
int i;
short int number;
for (i = 0; i < number; i++) {
checkflags |= M_GROUPR;
}
}
return (-1);
}
/*
* Format of argument32 token:
* argument token id adr_char
* argument number adr_char
* argument value adr_int32
* argument description adr_string
*
*/
int
{
char arg_num;
return (-1);
}
/*
* Format of argument64 token:
* argument token id adr_char
* argument number adr_char
* argument value adr_int64
* argument description adr_string
*
*/
int
{
char arg_num;
return (-1);
}
int
{
return (-1);
}
/*
* Format of attribute token: (old pre SunOS 5.7 format)
* attribute token id adr_char
* mode adr_int32 (printed in octal)
* uid adr_int32
* gid adr_int32
* file system id adr_int32
* node id adr_int32
* device adr_int32
*
*/
int
{
checkflags |= M_USERE;
}
checkflags |= M_GROUPE;
}
if ((obj_flag & OBJ_FGROUP) &&
checkflags |= M_OBJECT;
else if ((obj_flag & OBJ_FOWNER) &&
checkflags |= M_OBJECT;
}
return (-1);
}
/*
* Format of attribute32 token:
* attribute token id adr_char
* mode adr_int32 (printed in octal)
* uid adr_int32
* gid adr_int32
* file system id adr_int32
* node id adr_int64
* device adr_int32
*
*/
int
{
checkflags |= M_USERE;
}
checkflags |= M_GROUPE;
}
if ((obj_flag & OBJ_FGROUP) &&
checkflags |= M_OBJECT;
else if ((obj_flag & OBJ_FOWNER) &&
checkflags |= M_OBJECT;
}
return (-1);
}
/*
* Format of attribute64 token:
* attribute token id adr_char
* mode adr_int32 (printed in octal)
* uid adr_int32
* gid adr_int32
* file system id adr_int32
* node id adr_int64
* device adr_int64
*
*/
int
{
checkflags |= M_USERE;
}
checkflags |= M_GROUPE;
}
if ((obj_flag & OBJ_FGROUP) &&
checkflags |= M_OBJECT;
else if ((obj_flag & OBJ_FOWNER) &&
checkflags |= M_OBJECT;
}
return (-1);
}
/*
* Format of command token:
* attribute token id adr_char
* argc adr_short
* argv len adr_short variable amount of argv len
* argv text argv len and text
* .
* .
* .
* envp count adr_short variable amount of envp len
* envp len adr_short and text
* envp text envp len
* .
* .
* .
*
*/
int
{
short cnt;
short i;
for (i = 0; i < cnt; i++)
for (i = 0; i < cnt; i++)
return (-1);
}
/*
* Format of exit token:
* attribute token id adr_char
* return value adr_int32
* errno adr_int32
*
*/
int
{
return (-1);
}
/*
* Format of strings array token:
* token id adr_char
* count value adr_int32
* strings null terminated strings
*/
static int
{
int count, i;
char c;
for (i = 1; i <= count; i++) {
while (c != (char)0)
}
/* no dump option here, since we will have variable length fields */
return (-1);
}
int
{
return (strings_common_token(adr));
}
int
{
return (strings_common_token(adr));
}
int
{
return (strings_common_token(adr));
}
/*
* Format of liaison token:
*/
int
{
return (-1);
}
/*
* Format of path token:
* path adr_string
*/
int
{
char *path;
if (path[0] != '/')
/*
* anchor the path. user apps may not do it.
*/
/*
* match against the collapsed path. that is what user sees.
*/
checkflags |= M_OBJECT;
} else {
}
return (-1);
}
/*
* Format of System V IPC permission token:
* System V IPC permission token id adr_char
* uid adr_int32
* gid adr_int32
* cuid adr_int32
* cgid adr_int32
* mode adr_int32
* seq adr_int32
* key adr_int32
* label adr_opaque, sizeof (bslabel_t)
* bytes
*/
int
{
checkflags |= M_USERE;
}
checkflags |= M_USERE;
}
checkflags |= M_GROUPR;
}
checkflags |= M_GROUPR;
}
switch (obj_flag) {
case OBJ_MSGGROUP:
case OBJ_MSGOWNER:
checkflags |= M_OBJECT;
break;
case OBJ_SEMGROUP:
case OBJ_SEMOWNER:
checkflags |= M_OBJECT;
break;
case OBJ_SHMGROUP:
case OBJ_SHMOWNER:
checkflags |= M_OBJECT;
break;
}
}
return (-1);
}
/*
* Format of process32 token:
* process token id adr_char
* auid adr_int32
* euid adr_int32
* egid adr_int32
* ruid adr_int32
* rgid adr_int32
* pid adr_int32
* sid adr_int32
* termid adr_int32*2
*
*/
int
{
checkflags |= M_USERA;
}
checkflags |= M_USERE;
}
checkflags |= M_USERR;
}
checkflags |= M_GROUPR;
}
checkflags |= M_GROUPE;
}
checkflags |= M_OBJECT;
} else if ((obj_flag & OBJ_PGROUP) &&
checkflags |= M_OBJECT;
} else if ((obj_flag & OBJ_POWNER) &&
checkflags |= M_OBJECT;
}
}
return (-1);
}
/*
* Format of process32 token:
* process token id adr_char
* auid adr_int32
* euid adr_int32
* egid adr_int32
* ruid adr_int32
* rgid adr_int32
* pid adr_int32
* sid adr_int32
* termid adr_int32*6
*
*/
int
{
}
}
}
}
}
} else if ((obj_flag & OBJ_PGROUP) &&
} else if ((obj_flag & OBJ_POWNER) &&
}
}
return (-1);
}
/*
* Format of process64 token:
* process token id adr_char
* auid adr_int32
* euid adr_int32
* egid adr_int32
* ruid adr_int32
* rgid adr_int32
* pid adr_int32
* sid adr_int32
* termid adr_int64+adr_int32
*
*/
int
{
checkflags |= M_USERA;
}
checkflags |= M_USERE;
}
checkflags |= M_USERR;
}
checkflags |= M_GROUPR;
}
checkflags |= M_GROUPE;
}
checkflags |= M_OBJECT;
} else if ((obj_flag & OBJ_PGROUP) &&
checkflags |= M_OBJECT;
} else if ((obj_flag & OBJ_POWNER) &&
checkflags |= M_OBJECT;
}
}
return (-1);
}
/*
* Format of process64 token:
* process token id adr_char
* auid adr_int32
* euid adr_int32
* egid adr_int32
* ruid adr_int32
* rgid adr_int32
* pid adr_int32
* sid adr_int32
* termid adr_int64+5*adr_int32
*
*/
int
{
}
}
}
}
}
} else if ((obj_flag & OBJ_PGROUP) &&
} else if ((obj_flag & OBJ_POWNER) &&
}
}
return (-1);
}
/*
* Format of System V IPC token:
* System V IPC token id adr_char
* object id adr_int32
*
*/
int
{
checkflags |= M_OBJECT;
return (-1);
}
/*
* Format of socket token:
* socket_type adrm_short
* remote_port adrm_short
* remote_inaddr adrm_int32
*
*/
int
{
short socket_type;
short remote_port;
if (socket_flag == SOCKFLG_MACHINE) {
if (remote_inaddr == obj_id)
checkflags |= M_OBJECT;
} else if (socket_flag == SOCKFLG_PORT) {
if (remote_port == obj_id)
checkflags |= M_OBJECT;
}
}
return (-1);
}
/*
* Format of socket token:
* socket_type adrm_short
* remote_port adrm_short
* remote_inaddr adrm_int32
*
*/
int
{
short socket_domain;
short socket_type;
short ip_size;
short local_port;
short remote_port;
/* validate ip size */
return (0);
/* if IP type mis-match, then nothing to do */
return (-1);
if (socket_flag == SOCKFLG_MACHINE) {
if ((local_inaddr[0] == obj_id) ||
(remote_inaddr[0] == obj_id))
checkflags |= M_OBJECT;
} else {
if (((local_inaddr[0] == ip_ipv6[0]) &&
((remote_inaddr[0] == ip_ipv6[0]) &&
checkflags |= M_OBJECT;
}
} else if (socket_flag == SOCKFLG_PORT) {
checkflags |= M_OBJECT;
}
}
return (-1);
}
/*
* Format of subject32 token:
* subject token id adr_char
* auid adr_int32
* euid adr_int32
* egid adr_int32
* ruid adr_int32
* rgid adr_int32
* pid adr_int32
* sid adr_int32
* termid adr_int32*2
*
*/
int
{
checkflags |= M_SUBJECT;
}
checkflags |= M_USERA;
}
checkflags |= M_USERE;
}
checkflags |= M_USERR;
}
checkflags |= M_GROUPR;
}
checkflags |= M_GROUPE;
}
checkflags |= M_SID;
}
return (-1);
}
/*
* Format of subject32_ex token:
* subject token id adr_char
* auid adr_int32
* euid adr_int32
* egid adr_int32
* ruid adr_int32
* rgid adr_int32
* pid adr_int32
* sid adr_int32
* termid_addr adr_int32*6
*
*/
int
{
}
}
}
}
}
}
}
return (-1);
}
/*
* Format of subject64 token:
* subject token id adr_char
* auid adr_int32
* euid adr_int32
* egid adr_int32
* ruid adr_int32
* rgid adr_int32
* pid adr_int32
* sid adr_int32
* termid adr_int64+adr_int32
*
*/
int
{
checkflags |= M_SUBJECT;
}
checkflags |= M_USERA;
}
checkflags |= M_USERE;
}
checkflags |= M_USERR;
}
checkflags |= M_GROUPR;
}
checkflags |= M_GROUPE;
}
checkflags |= M_SID;
}
return (-1);
}
/*
* Format of subject64 token:
* subject token id adr_char
* auid adr_int32
* euid adr_int32
* egid adr_int32
* ruid adr_int32
* rgid adr_int32
* pid adr_int32
* sid adr_int32
* termid adr_int64+5*adr_int32
*
*/
int
{
}
}
}
}
}
}
}
return (-1);
}
/*
* -----------------------------------------------------------------------
* tid_token(): Process tid token and display contents
*
* Format of tid token:
* tid token id adr_char
* address type adr_char
* For address type of AU_IPADR...
* remote port adr_short
* local port adr_short
* IP type adr_int32
* IP addr adr_int32 if IPv4
* IP addr 4 x adr_int32 if IPv6
* address types other than AU_IPADR are not yet defined
* -----------------------------------------------------------------------
*/
int
{
char tid_type;
short rport;
short lport;
switch (tid_type) {
case AU_IPADR:
break;
default:
return (0);
}
return (-1);
}
/*
* -----------------------------------------------------------------------
* zonename_token(): Process zonename token and display contents
*
* Format of zonename token:
* zonename token id adr_char
* zone name adr_string
* -----------------------------------------------------------------------
*/
int
{
char *name;
if (flags & M_ZONENAME) {
checkflags |= M_ZONENAME;
} else {
}
return (-1);
}
/*
* fmri_token():
*
* Format of fmri token:
* fmri adr_string
*/
int
{
char *fmri_name;
/* match token against service instance */
checkflags |= M_OBJECT;
}
} else {
}
return (-1);
}
/*
* Format of xatom token:
*/
int
{
return (-1);
}
/*
* Format of xselect token:
*/
int
{
return (-1);
}
/*
* anchor a path name with a slash
* assume we have enough space
*/
void
anchor_path(char *path)
{
*path = '/';
}
/*
* copy path to collapsed path.
* collapsed path does not contain:
* successive slashes
* instances of dot-slash
* instances of dot-dot-slash
* passed path must be anchored with a '/'
*/
char *
collapse_path(char *s)
{
int id; /* index of where we are in destination string */
int is; /* index of where we are in source string */
int slashseen; /* have we seen a slash */
int ls; /* length of source string */
slashseen = 0;
/* thats all folks, we've reached the end of input */
if (s[is] == '\0') {
--id;
}
s[id++] = '\0';
break;
}
/* previous character was a / */
if (slashseen) {
if (s[is] == '/')
continue; /* another slash, ignore it */
} else if (s[is] == '/') {
/* we see a /, just copy it and try again */
slashseen = 1;
s[id++] = '/';
continue;
}
/* /./ seen */
is += 1;
continue;
}
/* XXX/. seen */
if (id > 1)
id--;
continue;
}
/* XXX/.. seen */
is += 1;
if (id > 0)
id--;
id++;
continue;
}
/* XXX/../ seen */
is += 2;
if (id > 0)
id--;
id++;
continue;
}
is--;
}
return (s);
}
int
{
return (1);
return (1);
return (1);
return (0);
}
void
{
ushort_t c;
}
void
{
ushort_t c;
}
/*
* Format of host token:
* host ard_uint32
*/
int
{
return (-1);
}
/*
* Format of useofauth token:
* uauth token id adr_char
* uauth adr_string
*
*/
int
{
return (-1);
}
int
{
}
int
{
}
int
{
}
int
{
}
int
{
}
int
{
}
/*
* Format of xgeneric token:
* XID adr_int32
* creator UID adr_int32
*
* Includes: xcolormap, xcursor, xfont, xgc, xpixmap, and xwindow
*/
int
{
}
return (-1);
}
/*
* Format of xproperty token:
* XID adr_int32
* creator UID adr_int32
* atom string adr_string
*/
int
{
}
return (-1);
}
/*
* Format of xclient token:
* xclient id adr_int32
*/
int
{
return (-1);
}
/*
* Format of privilege set token:
* priv_set type string
* priv_set string
*/
int
{
return (-1);
}
/*
* Format of slabel token:
* slabel adr_char*(sizeof (bslabel_t))
*/
int
{
}
return (-1);
}
/*
* Format of useofpriv token:
* TSOL:
* privilege adr_int32
* SOL:
* privilege(s) adr_string
*/
#ifndef TSOL
/* ARGSUSED */
#endif /* !TSOL */
int
{
char flag;
#ifdef TSOL
return (-1);
#else /* !TSOL */
return (-1);
#endif /* TSOL */
}