auparse/test/auparse_test.c

   1 #include <stdio.h>
   2 #include <stdlib.h>
   3 #include <unistd.h>
   4 #include <string.h>
   5 #include <locale.h>
   6 #include <errno.h>
   7 #include <libaudit.h>
   8 #include <auparse.h>
   9
  10
  11 static const char *buf[] = {
  12                 "type=LOGIN msg=audit(1143146623.787:142): login pid=2027 uid=0 old auid=4294967295 new auid=848\n"
  13                 "type=SYSCALL msg=audit(1143146623.875:143): arch=c000003e syscall=188 success=yes exit=0 a0=7fffffa9a9f0 a1=3958d11333 a2=5131f0 a3=20 items=1 pid=2027 auid=848 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty3 comm=\"login\" exe=\"/bin/login\" subj=system_u:system_r:local_login_t:s0-s0:c0.c255\n",
  14
  15                 "type=USER_LOGIN msg=audit(1143146623.879:146): user pid=2027 uid=0 auid=848 msg=\'uid=848: exe=\"/bin/login\" (hostname=?, addr=?, terminal=tty3 res=success)\'\n",
  16
  17                 NULL
  18 };
  19
  20
  21 static void walk_test(auparse_state_t *au)
  22 {
  23         int event_cnt = 1, record_cnt;
  24
  25         do {
  26                 if (auparse_first_record(au) <= 0) {
  27                         printf("Error getting first record (%s)\n",
  28                                                 strerror(errno));
  29                         exit(1);
  30                 }
  31                 printf("event %d has %d records\n", event_cnt,
  32                                                 auparse_get_num_records(au));
  33                 record_cnt = 1;
  34                 do {
  35                         printf("    record %d of type %d(%s) has %d fields\n",
  36                                 record_cnt,
  37                                 auparse_get_type(au),
  38                                 audit_msg_type_to_name(auparse_get_type(au)),
  39                                 auparse_get_num_fields(au));
  40                         printf("    line=%d file=%s\n",
  41                                 auparse_get_line_number(au),
  42                                 auparse_get_filename(au) ?
  43                                         auparse_get_filename(au) : "None");
  44                         const au_event_t *e = auparse_get_timestamp(au);
  45                         if (e == NULL) {
  46                                 printf("Error getting timestamp - aborting\n");
  47                                 exit(1);
  48                         }
  49                         printf("    event time: %u.%u:%lu, host=%s\n",
  50                                 (unsigned)e->sec,
  51                                 e->milli, e->serial, e->host ? e->host : "?");
  52                         auparse_first_field(au);
  53                         do {
  54                                 printf("        %s=%s (%s)\n",
  55                                                 auparse_get_field_name(au),
  56                                                 auparse_get_field_str(au),
  57                                                 auparse_interpret_field(au));
  58                         } while (auparse_next_field(au) > 0);
  59                         printf("\n");
  60                         record_cnt++;
  61                 } while(auparse_next_record(au) > 0);
  62                 event_cnt++;
  63         } while (auparse_next_event(au) > 0);
  64 }
  65
  66 void light_test(auparse_state_t *au)
  67 {
  68         int record_cnt;
  69
  70         do {
  71                 if (auparse_first_record(au) <= 0) {
  72                         puts("Error getting first record");
  73                         exit(1);
  74                 }
  75                 printf("event has %d records\n", auparse_get_num_records(au));
  76                 record_cnt = 1;
  77                 do {
  78                         printf("    record %d of type %d(%s) has %d fields\n",
  79                                 record_cnt,
  80                                 auparse_get_type(au),
  81                                 audit_msg_type_to_name(auparse_get_type(au)),
  82                                 auparse_get_num_fields(au));
  83                         printf("    line=%d file=%s\n",
  84                                 auparse_get_line_number(au),
  85                                 auparse_get_filename(au) ?
  86                                         auparse_get_filename(au) : "None");
  87                         const au_event_t *e = auparse_get_timestamp(au);
  88                         if (e == NULL) {
  89                                 printf("Error getting timestamp - aborting\n");
  90                                 exit(1);
  91                         }
  92                         printf("    event time: %u.%u:%lu, host=%s\n",
  93                                         (unsigned)e->sec,
  94                                         e->milli, e->serial,
  95                                         e->host ? e->host : "?");
  96                         printf("\n");
  97                         record_cnt++;
  98                 } while(auparse_next_record(au) > 0);
  99
 100         } while (auparse_next_event(au) > 0);
 101 }
 102
 103 void simple_search(ausource_t source, austop_t where)
 104 {
 105         auparse_state_t *au;
 106         const char *val;
 107
 108         if (source == AUSOURCE_FILE) {
 109                 au = auparse_init(AUSOURCE_FILE, "./test.log");
 110                 val = "4294967295";
 111         } else {
 112                 au = auparse_init(AUSOURCE_BUFFER_ARRAY, buf);
 113                 val = "848";
 114         }
 115         if (au == NULL) {
 116                 printf("auparse_init error - %s\n", strerror(errno));
 117                 exit(1);
 118         }
 119         if (ausearch_add_item(au, "auid", "=", val, AUSEARCH_RULE_CLEAR)){
 120                 printf("ausearch_add_item error - %s\n", strerror(errno));
 121                 exit(1);
 122         }
 123         if (ausearch_set_stop(au, where)){
 124                 printf("ausearch_set_stop error - %s\n", strerror(errno));
 125                 exit(1);
 126         }
 127         if (ausearch_next_event(au) <= 0)
 128                 printf("Error searching for auid - %s\n", strerror(errno));
 129         else
 130                 printf("Found %s = %s\n", auparse_get_field_name(au),
 131                                         auparse_get_field_str(au));
 132         auparse_destroy(au);
 133 }
 134
 135 void compound_search(ausearch_rule_t how)
 136 {
 137         auparse_state_t *au;
 138
 139         au = auparse_init(AUSOURCE_FILE, "./test.log");
 140         if (au == NULL) {
 141                 printf("auparse_init error - %s\n", strerror(errno));
 142                 exit(1);
 143         }
 144         if (how == AUSEARCH_RULE_AND) {
 145                 if (ausearch_add_item(au, "uid", "=", "0",
 146                                                          AUSEARCH_RULE_CLEAR)){
 147                         printf("ausearch_add_item 1 error - %s\n",
 148                                                 strerror(errno));
 149                         exit(1);
 150                 }
 151                 if (ausearch_add_item(au, "pid", "=", "13015", how)){
 152                         printf("ausearch_add_item 2 error - %s\n",
 153                                                 strerror(errno));
 154                         exit(1);
 155                 }
 156                 if (ausearch_add_item(au, "type", "=", "USER_START", how)){
 157                         printf("ausearch_add_item 3 error - %s\n",
 158                                                 strerror(errno));
 159                         exit(1);
 160                 }
 161         } else {
 162                 if (ausearch_add_item(au, "auid", "=", "42",
 163                                                          AUSEARCH_RULE_CLEAR)){
 164                         printf("ausearch_add_item 4 error - %s\n",
 165                                                 strerror(errno));
 166                         exit(1);
 167                 }
 168                 // should stop on this one
 169                 if (ausearch_add_item(au, "auid", "=", "0", how)){
 170                         printf("ausearch_add_item 5 error - %s\n",
 171                                                 strerror(errno));
 172                         exit(1);
 173                 }
 174                 if (ausearch_add_item(au, "auid", "=", "500", how)){
 175                         printf("ausearch_add_item 6 error - %s\n",
 176                                                 strerror(errno));
 177                         exit(1);
 178                 }
 179         }
 180         if (ausearch_set_stop(au, AUSEARCH_STOP_FIELD)){
 181                 printf("ausearch_set_stop error - %s\n", strerror(errno));
 182                 exit(1);
 183         }
 184         if (ausearch_next_event(au) <= 0)
 185                 printf("Error searching for auid - %s\n", strerror(errno));
 186         else
 187                 printf("Found %s = %s\n", auparse_get_field_name(au),
 188                                         auparse_get_field_str(au));
 189         auparse_destroy(au);
 190 }
 191
 192 void regex_search(const char *expr)
 193 {
 194         auparse_state_t *au;
 195         int rc;
 196
 197         au = auparse_init(AUSOURCE_BUFFER_ARRAY, buf);
 198         if (au == NULL) {
 199                 printf("auparse_init error - %s\n", strerror(errno));
 200                 exit(1);
 201         }
 202         if (ausearch_add_regex(au, expr)){
 203                 printf("ausearch_add_regex error - %s\n", strerror(errno));
 204                 exit(1);
 205         }
 206         if (ausearch_set_stop(au, AUSEARCH_STOP_RECORD)){
 207                 printf("ausearch_set_stop error - %s\n", strerror(errno));
 208                 exit(1);
 209         }
 210         rc = ausearch_next_event(au);
 211         if (rc < 0)
 212                 printf("Error searching for %s - %s\n", expr, strerror(errno));
 213         else if (rc == 0)
 214                 printf("Not found\n");
 215         else
 216                 printf("Found %s = %s\n", auparse_get_field_name(au),
 217                                         auparse_get_field_str(au));
 218         auparse_destroy(au);
 219 }
 220
 221 static void auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type, void *user_data)
 222 {
 223         int *event_cnt = (int *)user_data;
 224         int record_cnt;
 225
 226         if (cb_event_type == AUPARSE_CB_EVENT_READY) {
 227                 if (auparse_first_record(au) <= 0) {
 228                         printf("can't get first record\n");
 229                         return;
 230                 }
 231                 printf("event %d has %d records\n", *event_cnt,
 232                                         auparse_get_num_records(au));
 233                 record_cnt = 1;
 234                 do {
 235                         printf("    record %d of type %d(%s) has %d fields\n",
 236                                 record_cnt,
 237                                 auparse_get_type(au),
 238                                 audit_msg_type_to_name(auparse_get_type(au)),
 239                                 auparse_get_num_fields(au));
 240                         printf("    line=%d file=%s\n",
 241                                 auparse_get_line_number(au),
 242                                 auparse_get_filename(au) ?
 243                                         auparse_get_filename(au) : "None");
 244                         const au_event_t *e = auparse_get_timestamp(au);
 245                         if (e == NULL) {
 246                                 return;
 247                         }
 248                         printf("    event time: %u.%u:%lu, host=%s\n",
 249                                         (unsigned)e->sec,
 250                                         e->milli, e->serial,
 251                                         e->host ? e->host : "?");
 252                         auparse_first_field(au);
 253                         do {
 254                                 printf("        %s=%s (%s)\n",
 255                                                 auparse_get_field_name(au),
 256                                                 auparse_get_field_str(au),
 257                                                 auparse_interpret_field(au));
 258                         } while (auparse_next_field(au) > 0);
 259                         printf("\n");
 260                         record_cnt++;
 261                 } while(auparse_next_record(au) > 0);
 262                 (*event_cnt)++;
 263         }
 264 }
 265
 266 int main(void)
 267 {
 268         //char *files[4] = { "test.log", "test2.log", "test3.log", NULL };
 269         char *files[3] = { "test.log", "test2.log", NULL };
 270         setlocale (LC_ALL, "");
 271         auparse_state_t *au;
 272
 273         au = auparse_init(AUSOURCE_BUFFER_ARRAY, buf);
 274         if (au == NULL) {
 275                 printf("Error - %s\n", strerror(errno));
 276                 return 1;
 277         }
 278
 279         printf("Starting Test 1, iterate...\n");
 280         while (auparse_next_event(au) > 0) {
 281                 if (auparse_find_field(au, "auid")) {
 282                         printf("%s=%s\n", auparse_get_field_name(au),
 283                                           auparse_get_field_str(au));
 284                         printf("interp auid=%s\n", auparse_interpret_field(au));
 285                 } else
 286                         printf("Error iterating to auid\n");
 287         }
 288         auparse_reset(au);
 289         while (auparse_next_event(au) > 0) {
 290                 if (auparse_find_field(au, "auid")) {
 291                         do {
 292                         printf("%s=%s\n", auparse_get_field_name(au),
 293                                           auparse_get_field_str(au));
 294                         printf("interp auid=%s\n", auparse_interpret_field(au));
 295                         } while (auparse_find_field_next(au));
 296                 } else
 297                         printf("Error iterating to auid\n");
 298         }
 299         printf("Test 1 Done\n\n");
 300
 301         /* Reset, now lets go to beginning and walk the list manually */
 302         printf("Starting Test 2, walk events, records, and fields...\n");
 303         auparse_reset(au);
 304         walk_test(au);
 305         auparse_destroy(au);
 306         printf("Test 2 Done\n\n");
 307
 308         /* Reset, now lets go to beginning and walk the list manually */
 309         printf("Starting Test 3, walk events, records of 1 buffer...\n");
 310         au = auparse_init(AUSOURCE_BUFFER, buf[1]);
 311         if (au == NULL) {
 312                 printf("Error - %s\n", strerror(errno));
 313                 return 1;
 314         }
 315         light_test(au);
 316         auparse_destroy(au);
 317         printf("Test 3 Done\n\n");
 318
 319         printf("Starting Test 4, walk events, records of 1 file...\n");
 320         au = auparse_init(AUSOURCE_FILE, "./test.log");
 321         if (au == NULL) {
 322                 printf("Error - %s\n", strerror(errno));
 323                 return 1;
 324         }
 325         walk_test(au);
 326         auparse_destroy(au);
 327         printf("Test 4 Done\n\n");
 328
 329         printf("Starting Test 5, walk events, records of 2 files...\n");
 330         au = auparse_init(AUSOURCE_FILE_ARRAY, files);
 331         if (au == NULL) {
 332                 printf("Error - %s\n", strerror(errno));
 333                 return 1;
 334         }
 335         walk_test(au);
 336         auparse_destroy(au);
 337         printf("Test 5 Done\n\n");
 338
 339         printf("Starting Test 6, search...\n");
 340         au = auparse_init(AUSOURCE_BUFFER_ARRAY, buf);
 341         if (au == NULL) {
 342                 printf("Error - %s\n", strerror(errno));
 343                 return 1;
 344         }
 345         if (ausearch_add_item(au, "auid", "=", "500", AUSEARCH_RULE_CLEAR)){
 346                 printf("Error - %s", strerror(errno));
 347                 return 1;
 348         }
 349         if (ausearch_set_stop(au, AUSEARCH_STOP_EVENT)){
 350                 printf("Error - %s", strerror(errno));
 351                 exit(1);
 352         }
 353         if (ausearch_next_event(au) != 0) {
 354                 printf("Error search found something it shouldn't have\n");
 355         }
 356         puts("auid = 500 not found...which is correct");
 357         ausearch_clear(au);
 358         auparse_destroy(au);
 359         au = auparse_init(AUSOURCE_BUFFER_ARRAY, buf);
 360         if (ausearch_add_item(au,"auid", "exists", NULL, AUSEARCH_RULE_CLEAR)){
 361                 printf("Error - %s", strerror(errno));
 362                 return 1;
 363         }
 364         if (ausearch_set_stop(au, AUSEARCH_STOP_EVENT)){
 365                 printf("Error - %s", strerror(errno));
 366                 exit(1);
 367         }
 368         if (ausearch_next_event(au) <= 0) {
 369                 printf("Error searching for existence of auid\n");
 370         }
 371         puts("auid exists...which is correct");
 372         puts("Testing BUFFER_ARRAY, stop on field");
 373         simple_search(AUSOURCE_BUFFER_ARRAY, AUSEARCH_STOP_FIELD);
 374         puts("Testing BUFFER_ARRAY, stop on record");
 375         simple_search(AUSOURCE_BUFFER_ARRAY, AUSEARCH_STOP_RECORD);
 376         puts("Testing BUFFER_ARRAY, stop on event");
 377         simple_search(AUSOURCE_BUFFER_ARRAY, AUSEARCH_STOP_EVENT);
 378         puts("Testing test.log, stop on field");
 379         simple_search(AUSOURCE_FILE, AUSEARCH_STOP_FIELD);
 380         puts("Testing test.log, stop on record");
 381         simple_search(AUSOURCE_FILE, AUSEARCH_STOP_RECORD);
 382         puts("Testing test.log, stop on event");
 383         simple_search(AUSOURCE_FILE, AUSEARCH_STOP_EVENT);
 384         auparse_destroy(au);
 385         printf("Test 6 Done\n\n");
 386
 387         printf("Starting Test 7, compound search...\n");
 388         au = auparse_init(AUSOURCE_BUFFER_ARRAY, buf);
 389         if (au == NULL) {
 390                 printf("Error - %s\n", strerror(errno));
 391                 return 1;
 392         }
 393         compound_search(AUSEARCH_RULE_AND);
 394         compound_search(AUSEARCH_RULE_OR);
 395         auparse_destroy(au);
 396         printf("Test 7 Done\n\n");
 397
 398         printf("Starting Test 8, regex search...\n");
 399         puts("Doing regex match...");
 400         regex_search("1143146623");
 401         puts("Doing regex wildcard search...");
 402         regex_search("11431466.*146");
 403         printf("Test 8 Done\n\n");
 404
 405         /* Note: this should match Test 2 exactly */
 406         printf("Starting Test 9, buffer feed...\n");
 407         {
 408                 int event_cnt = 1;
 409                 size_t len, chunk_len = 3;
 410                 const char **cur_buf, *p_beg, *p_end, *p_chunk_beg,
 411                         *p_chunk_end;
 412
 413                 au = auparse_init(AUSOURCE_FEED, 0);
 414                 auparse_add_callback(au, auparse_callback, &event_cnt, NULL);
 415                 for (cur_buf = buf, p_beg = *cur_buf; *cur_buf;
 416                                                  cur_buf++, p_beg = *cur_buf) {
 417                         len = strlen(p_beg);
 418                         p_end = p_beg + len;
 419                         p_chunk_beg = p_beg;
 420                         while (p_chunk_beg < p_end) {
 421                                 p_chunk_end = p_chunk_beg + chunk_len;
 422                                 if (p_chunk_end > p_end)
 423                                         p_chunk_end = p_end;
 424
 425                                 //fwrite(p_chunk_beg, 1,
 426                                 //       p_chunk_end-p_chunk_beg, stdout);
 427                                 auparse_feed(au, p_chunk_beg,
 428                                                 p_chunk_end-p_chunk_beg);
 429                                 p_chunk_beg = p_chunk_end;
 430                         }
 431                 }
 432
 433                 auparse_flush_feed(au);
 434                 auparse_destroy(au);
 435         }
 436                 printf("Test 9 Done\n\n");
 437
 438                 /* Note: this should match Test 4 exactly */
 439                 printf("Starting Test 10, file feed...\n");
 440         {
 441                 int *event_cnt = malloc(sizeof(int));
 442                 size_t len;
 443                 char filename[] = "./test.log";
 444                 char buf[4];
 445                 FILE *fp;
 446
 447                 *event_cnt = 1;
 448                 au = auparse_init(AUSOURCE_FEED, 0);
 449                 auparse_add_callback(au, auparse_callback, event_cnt, free);
 450                 if ((fp = fopen(filename, "r")) == NULL) {
 451                         fprintf(stderr, "could not open '%s', %s\n",
 452                                                 filename, strerror(errno));
 453                         return 1;
 454                 }
 455                 while ((len = fread(buf, 1, sizeof(buf), fp))) {
 456                         auparse_feed(au, buf, len);
 457                 }
 458
 459                 fclose(fp);
 460                 auparse_flush_feed(au);
 461                 auparse_destroy(au);
 462         }
 463         printf("Test 10 Done\n\n");
 464
 465         puts("Finished non-admin tests\n");
 466
 467         return 0;
 468 }
 469