299 lines
6.6 KiB
C
299 lines
6.6 KiB
C
/*
|
|
* utmpdump Simple program to dump UTMP and WTMP files in
|
|
* raw format, so they can be examined.
|
|
*
|
|
* Author: Miquel van Smoorenburg, <miquels@cistron.nl>
|
|
* Danek Duvall <duvall@alumni.princeton.edu>
|
|
*
|
|
* Version: @(#)utmpdump 2.79 12-Sep-2000
|
|
*
|
|
* This file is part of the sysvinit suite,
|
|
* Copyright (C) 1991-2000 Miquel van Smoorenburg.
|
|
*
|
|
* Additional Copyright on this file 1998 Danek Duvall.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <utmp.h>
|
|
#include <time.h>
|
|
#include <ctype.h>
|
|
#include <unistd.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
#include "oldutmp.h"
|
|
|
|
struct utmp
|
|
oldtonew(struct oldutmp src)
|
|
{
|
|
struct utmp dest;
|
|
|
|
memset(&dest, 0, sizeof dest);
|
|
dest.ut_type = src.ut_type;
|
|
dest.ut_pid = src.ut_pid;
|
|
dest.ut_time = src.ut_oldtime;
|
|
dest.ut_addr = src.ut_oldaddr;
|
|
strncpy(dest.ut_id, src.ut_id, 4);
|
|
strncpy(dest.ut_line, src.ut_line, OLD_LINESIZE);
|
|
strncpy(dest.ut_user, src.ut_user, OLD_NAMESIZE);
|
|
strncpy(dest.ut_host, src.ut_host, OLD_HOSTSIZE);
|
|
|
|
return dest;
|
|
}
|
|
|
|
struct oldutmp
|
|
newtoold(struct utmp src)
|
|
{
|
|
struct oldutmp dest;
|
|
|
|
memset(&dest, 0, sizeof dest);
|
|
dest.ut_type = src.ut_type;
|
|
dest.ut_pid = src.ut_pid;
|
|
dest.ut_oldtime = src.ut_time;
|
|
dest.ut_oldaddr = src.ut_addr;
|
|
strncpy(dest.ut_id, src.ut_id, 4);
|
|
strncpy(dest.ut_line, src.ut_line, OLD_LINESIZE);
|
|
strncpy(dest.ut_user, src.ut_user, OLD_NAMESIZE);
|
|
strncpy(dest.ut_host, src.ut_host, OLD_HOSTSIZE);
|
|
|
|
return dest;
|
|
}
|
|
|
|
char *
|
|
timetostr(const time_t time)
|
|
{
|
|
static char s[29]; /* [Sun Sep 01 00:00:00 1998 PST] */
|
|
|
|
if (time != 0)
|
|
strftime(s, 29, "%a %b %d %T %Y %Z", localtime(&time));
|
|
else
|
|
s[0] = '\0';
|
|
|
|
return s;
|
|
}
|
|
|
|
time_t
|
|
strtotime(const char *s_time)
|
|
{
|
|
struct tm tm;
|
|
|
|
memset(&tm, '\0', sizeof(struct tm));
|
|
|
|
if (s_time[0] == ' ' || s_time[0] == '\0')
|
|
return (time_t)0;
|
|
|
|
strptime(s_time, "%a %b %d %T %Y", &tm);
|
|
|
|
/* Cheesy way of checking for DST */
|
|
if (s_time[26] == 'D')
|
|
tm.tm_isdst = 1;
|
|
|
|
return mktime(&tm);
|
|
}
|
|
|
|
#define cleanse(x) xcleanse(x, sizeof(x))
|
|
void
|
|
xcleanse(char *s, int len)
|
|
{
|
|
for ( ; *s && len-- > 0; s++)
|
|
if (!isprint(*s) || *s == '[' || *s == ']')
|
|
*s = '?';
|
|
}
|
|
|
|
void
|
|
unspace(char *s, int len)
|
|
{
|
|
while (*s && *s != ' ' && len--)
|
|
++s;
|
|
|
|
if (len > 0)
|
|
*s = '\0';
|
|
}
|
|
|
|
void
|
|
print_utline(struct utmp ut)
|
|
{
|
|
char *addr_string, *time_string;
|
|
struct in_addr in;
|
|
|
|
in.s_addr = ut.ut_addr;
|
|
addr_string = inet_ntoa(in);
|
|
time_string = timetostr(ut.ut_time);
|
|
cleanse(ut.ut_id);
|
|
cleanse(ut.ut_user);
|
|
cleanse(ut.ut_line);
|
|
cleanse(ut.ut_host);
|
|
|
|
/* pid id user line host addr time */
|
|
printf("[%d] [%05d] [%-4.4s] [%-*.*s] [%-*.*s] [%-*.*s] [%-15.15s] [%-28.28s]\n",
|
|
ut.ut_type, ut.ut_pid, ut.ut_id, 8, UT_NAMESIZE, ut.ut_user,
|
|
12, UT_LINESIZE, ut.ut_line, 20, UT_HOSTSIZE, ut.ut_host,
|
|
addr_string, time_string);
|
|
}
|
|
|
|
void
|
|
dump(FILE *fp, int forever, int oldfmt)
|
|
{
|
|
struct utmp ut;
|
|
struct oldutmp uto;
|
|
|
|
if (forever)
|
|
fseek(fp, -10 * (oldfmt ? sizeof uto : sizeof ut), SEEK_END);
|
|
|
|
do {
|
|
if (oldfmt)
|
|
while (fread(&uto, sizeof uto, 1, fp) == 1)
|
|
print_utline(oldtonew(uto));
|
|
else
|
|
while (fread(&ut, sizeof ut, 1, fp) == 1)
|
|
print_utline(ut);
|
|
if (forever) sleep(1);
|
|
} while (forever);
|
|
}
|
|
|
|
/* This function won't work properly if there's a ']' or a ' ' in the real
|
|
* token. Thankfully, this should never happen. */
|
|
int
|
|
gettok(char *line, char *dest, int size, int eatspace)
|
|
{
|
|
int bpos, epos, eaten;
|
|
char *t;
|
|
|
|
bpos = strchr(line, '[') - line;
|
|
if (bpos < 0) {
|
|
fprintf(stderr, "Extraneous newline in file. Exiting.");
|
|
exit(1);
|
|
}
|
|
line += 1 + bpos;
|
|
|
|
epos = strchr(line, ']') - line;
|
|
if (epos < 0) {
|
|
fprintf(stderr, "Extraneous newline in file. Exiting.");
|
|
exit(1);
|
|
}
|
|
line[epos] = '\0';
|
|
|
|
eaten = bpos + epos + 1;
|
|
|
|
if (eatspace)
|
|
if ((t = strchr(line, ' ')))
|
|
*t = 0;
|
|
|
|
strncpy(dest, line, size);
|
|
|
|
return eaten + 1;
|
|
}
|
|
|
|
void
|
|
undump(FILE *fp, int forever, int oldfmt)
|
|
{
|
|
struct utmp ut;
|
|
struct oldutmp uto;
|
|
char s_addr[16], s_time[29], *linestart, *line;
|
|
int count = 0;
|
|
|
|
line = linestart = malloc(1024 * sizeof *linestart);
|
|
s_addr[15] = 0;
|
|
s_time[28] = 0;
|
|
|
|
while(fgets(linestart, 1023, fp))
|
|
{
|
|
line = linestart;
|
|
memset(&ut, '\0', sizeof(ut));
|
|
sscanf(line, "[%hd] [%d] [%4c] ", &ut.ut_type, &ut.ut_pid, ut.ut_id);
|
|
|
|
line += 19;
|
|
line += gettok(line, ut.ut_user, sizeof(ut.ut_user), 1);
|
|
line += gettok(line, ut.ut_line, sizeof(ut.ut_line), 1);
|
|
line += gettok(line, ut.ut_host, sizeof(ut.ut_host), 1);
|
|
line += gettok(line, s_addr, sizeof(s_addr)-1, 1);
|
|
line += gettok(line, s_time, sizeof(s_time)-1, 0);
|
|
|
|
ut.ut_addr = inet_addr(s_addr);
|
|
ut.ut_time = strtotime(s_time);
|
|
|
|
if (oldfmt) {
|
|
uto = newtoold(ut);
|
|
fwrite(&uto, sizeof(uto), 1, stdout);
|
|
} else
|
|
fwrite(&ut, sizeof(ut), 1, stdout);
|
|
|
|
++count;
|
|
}
|
|
|
|
free(linestart);
|
|
}
|
|
|
|
void
|
|
usage(int result)
|
|
{
|
|
printf("Usage: utmpdump [ -froh ] [ filename ]\n");
|
|
exit(result);
|
|
}
|
|
|
|
int main(int argc, char **argv)
|
|
{
|
|
int c;
|
|
FILE *fp;
|
|
int reverse = 0, forever = 0, oldfmt = 0;
|
|
|
|
while ((c = getopt(argc, argv, "froh")) != EOF) {
|
|
switch (c) {
|
|
case 'r':
|
|
reverse = 1;
|
|
break;
|
|
|
|
case 'f':
|
|
forever = 1;
|
|
break;
|
|
|
|
case 'o':
|
|
oldfmt = 1;
|
|
break;
|
|
|
|
case 'h':
|
|
usage(0);
|
|
break;
|
|
|
|
default:
|
|
usage(1);
|
|
}
|
|
}
|
|
|
|
if (optind < argc) {
|
|
fprintf(stderr, "Utmp %sdump of %s\n", reverse ? "un" : "", argv[optind]);
|
|
if ((fp = fopen(argv[optind], "r")) == NULL) {
|
|
perror("Unable to open file");
|
|
exit(1);
|
|
}
|
|
}
|
|
else {
|
|
fprintf(stderr, "Utmp %sdump of stdin\n", reverse ? "un" : "");
|
|
fp = stdin;
|
|
}
|
|
|
|
if (reverse)
|
|
undump(fp, forever, oldfmt);
|
|
else
|
|
dump(fp, forever, oldfmt);
|
|
|
|
fclose(fp);
|
|
|
|
return 0;
|
|
}
|