Change 109311 by rwatson@rwatson_fledge on 2006/11/05 23:30:33 Support for printing BSM records as XML in praudit. Reviewed by: Martin Voros Affected files ... ... //depot/projects/trustedbsd/openbsm/HISTORY#43 edit ... //depot/projects/trustedbsd/openbsm/README#21 edit ... //depot/projects/trustedbsd/openbsm/TODO#9 edit ... //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#12 edit ... //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#11 edit ... //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#31 edit ... //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#42 edit Differences ... ==== //depot/projects/trustedbsd/openbsm/HISTORY#43 (text+ko) ==== @@ -3,6 +3,7 @@ - compat/clock_gettime.h now provides a compatibility implementation of clock_gettime(), which fixes building on Mac OS X. - Countless man page fixes. +- praudit XML support via "praudit -x". OpenBSM 1.0 alpha 12 @@ -270,4 +271,4 @@ to support reloading of kernel event table. - Allow comments in /etc/security configuration files. -$P4: //depot/projects/trustedbsd/openbsm/HISTORY#42 $ +$P4: //depot/projects/trustedbsd/openbsm/HISTORY#43 $ ==== //depot/projects/trustedbsd/openbsm/README#21 (text+ko) ==== @@ -77,6 +77,7 @@ Pawel Worach Martin Englund Ruslan Ermilov + Martin Voros In addition, Coverity, Inc.'s Prevent(tm) static analysis tool and Gimpel Software's FlexeLint tool were used to identify a number of bugs in the @@ -98,4 +99,4 @@ http://www.TrustedBSD.org/ -$P4: //depot/projects/trustedbsd/openbsm/README#20 $ +$P4: //depot/projects/trustedbsd/openbsm/README#21 $ ==== //depot/projects/trustedbsd/openbsm/TODO#9 (text+ko) ==== @@ -1,4 +1,3 @@ -- Teach praudit how to general XML format BSM streams. - Teach libbsm about any additional 64-bit token types that are present in more recent Solaris versions. - Build a regression test suite for libbsm that generates each token @@ -20,4 +19,4 @@ - Put hostname in trail file name. - Document audit_warn event arguments. -$P4: //depot/projects/trustedbsd/openbsm/TODO#8 $ +$P4: //depot/projects/trustedbsd/openbsm/TODO#9 $ ==== //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#12 (text+ko) ==== @@ -25,9 +25,9 @@ .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.\" $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#11 $ +.\" $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#12 $ .\" -.Dd October 3, 2006 +.Dd November 5, 2006 .Dt PRAUDIT 1 .Os .Sh NAME @@ -35,7 +35,7 @@ .Nd "print the contents of audit trail files" .Sh SYNOPSIS .Nm -.Op Fl lp +.Op Fl lpx .Op Fl r | s .Op Fl d Ar del .Op Ar @@ -77,6 +77,8 @@ record and event type are displayed. This option is exclusive from .Fl r . +.It Fl x +Print audit records in the XML output format. .El .Pp If the raw or short forms are not specified, the default is to print the tokens ==== //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#11 (text+ko) ==== @@ -1,5 +1,6 @@ /* * Copyright (c) 2004 Apple Computer, Inc. + * Copyright (c) 2006 Martin Voros * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -26,7 +27,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#10 $ + * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#11 $ */ /* @@ -34,7 +35,7 @@ */ /* - * praudit [-lp] [-r | -s] [-d del] [file ...] + * praudit [-lpx] [-r | -s] [-d del] [file ...] */ #include @@ -51,12 +52,14 @@ static int raw = 0; static int shortfrm = 0; static int partial = 0; +static int xml = 0; static void usage(void) { - fprintf(stderr, "usage: praudit [-lp] [-r | -s] [-d del] [file ...]\n"); + fprintf(stderr, "usage: praudit [-lpx] [-r | -s] [-d del] " + "[file ...]\n"); exit(1); } @@ -88,11 +91,17 @@ if (-1 == au_fetch_tok(&tok, buf + bytesread, reclen - bytesread)) break; - au_print_tok(stdout, &tok, del, raw, shortfrm); + if (xml) + au_print_tok_xml(stdout, &tok, del, raw, + shortfrm); + else + au_print_tok(stdout, &tok, del, raw, + shortfrm); bytesread += tok.len; - if (oneline) - printf("%s", del); - else + if (oneline) { + if (!xml) + printf("%s", del); + } else printf("\n"); } free(buf); @@ -109,7 +118,7 @@ int i; FILE *fp; - while ((ch = getopt(argc, argv, "d:lprs")) != -1) { + while ((ch = getopt(argc, argv, "d:lprsx")) != -1) { switch(ch) { case 'd': del = optarg; @@ -135,12 +144,19 @@ shortfrm = 1; break; + case 'x': + xml = 1; + break; + case '?': default: usage(); } } + if (xml) + au_print_xml_header(stdout); + /* For each of the files passed as arguments dump the contents. */ if (optind == argc) { print_tokens(stdin); @@ -153,5 +169,9 @@ if (fp != NULL) fclose(fp); } + + if (xml) + au_print_xml_footer(stdout); + return (1); } ==== //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#31 (text+ko) ==== @@ -26,7 +26,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#30 $ + * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#31 $ */ #ifndef _LIBBSM_H_ @@ -771,6 +771,14 @@ //XXX The following interface has different prototype from BSM void au_print_tok(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm); +void au_print_tok_xml(FILE *outfp, tokenstr_t *tok, + char *del, char raw, char sfrm); + +/* + * Functions relating to XML output. + */ +void au_print_xml_header(FILE *outfp); +void au_print_xml_footer(FILE *outfp); __END_DECLS /* ==== //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#42 (text+ko) ==== @@ -2,6 +2,7 @@ * Copyright (c) 2004 Apple Computer, Inc. * Copyright (c) 2005 SPARTA, Inc. * Copyright (c) 2006 Robert N. M. Watson + * Copyright (c) 2006 Martin Voros * All rights reserved. * * This code was developed in part by Robert N. M. Watson, Senior Principal @@ -31,7 +32,7 @@ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. * - * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#41 $ + * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#42 $ */ #include @@ -126,6 +127,12 @@ } while (0) /* + * XML option. + */ +#define AU_PLAIN 0 +#define AU_XML 1 + +/* * Prints the delimiter string. */ static void @@ -207,16 +214,334 @@ } /* + * Prints the beggining of attribute. + */ +static void +open_attr(FILE *fp, u_char *str) +{ + + fprintf(fp,"%s=\"", str); +} + +/* + * Prints the end of attribute. + */ +static void +close_attr(FILE *fp) +{ + + fprintf(fp,"\" "); +} + +/* + * Prints the end of tag. + */ +static void +close_tag(FILE *fp, u_char type) +{ + + switch(type) { + case AUT_HEADER32: + fprintf(fp, ">"); + break; + + case AUT_HEADER32_EX: + fprintf(fp, ">"); + break; + + case AUT_HEADER64: + fprintf(fp, ">"); + break; + + case AUT_HEADER64_EX: + fprintf(fp, ">"); + break; + + case AUT_ARG32: + fprintf(fp, "/>"); + break; + + case AUT_ARG64: + fprintf(fp, "/>"); + break; + + case AUT_ATTR32: + fprintf(fp, "/>"); + break; + + case AUT_ATTR64: + fprintf(fp, "/>"); + break; + + case AUT_EXIT: + fprintf(fp, "/>"); + break; + + case AUT_EXEC_ARGS: + fprintf(fp, ""); + break; + + case AUT_EXEC_ENV: + fprintf(fp, ""); + break; + + case AUT_OTHER_FILE32: + fprintf(fp, ""); + break; + + case AUT_NEWGROUPS: + fprintf(fp, ""); + break; + + case AUT_IN_ADDR: + fprintf(fp, ""); + break; + + case AUT_IN_ADDR_EX: + fprintf(fp, ""); + break; + + case AUT_IP: + fprintf(fp, "/>"); + break; + + case AUT_IPC: + fprintf(fp, "/>"); + break; + + case AUT_IPC_PERM: + fprintf(fp, "/>"); + break; + + case AUT_IPORT: + fprintf(fp, ""); + break; + + case AUT_OPAQUE: + fprintf(fp, ""); + break; + + case AUT_PATH: + fprintf(fp, ""); + break; + + case AUT_PROCESS32: + fprintf(fp, "/>"); + break; + + case AUT_PROCESS32_EX: + fprintf(fp, "/>"); + break; + + case AUT_RETURN32: + fprintf(fp, "/>"); + break; + + case AUT_RETURN64: + fprintf(fp, "/>"); + break; + + case AUT_SEQ: + fprintf(fp, "/>"); + break; + + case AUT_SOCKET: + fprintf(fp, "/>"); + break; + + case AUT_SOCKINET32: + fprintf(fp, "/>"); + break; + + case AUT_SOCKUNIX: + fprintf(fp, "/>"); + break; + + case AUT_SUBJECT32: + fprintf(fp, "/>"); + break; + + case AUT_SUBJECT64: + fprintf(fp, "/>"); + break; + + case AUT_SUBJECT32_EX: + fprintf(fp, "/>"); + break; + + case AUT_TEXT: + fprintf(fp, ""); + break; + + case AUT_SOCKET_EX: + fprintf(fp, "/>"); + break; + + case AUT_DATA: + fprintf(fp, ""); + break; + } +} + +/* * Prints the token type in either the raw or the default form. */ static void -print_tok_type(FILE *fp, u_char type, const char *tokname, char raw) +print_tok_type(FILE *fp, u_char type, const char *tokname, char raw, int xml) { - if (raw) - fprintf(fp, "%u", type); - else - fprintf(fp, "%s", tokname); + if (xml) { + switch(type) { + case AUT_HEADER32: + fprintf(fp, ""); + break; + + case AUT_ARG32: + fprintf(fp, ""); + break; + + case AUT_EXEC_ENV: + fprintf(fp, ""); + break; + + case AUT_OTHER_FILE32: + fprintf(fp, ""); + break; + + case AUT_IN_ADDR: + fprintf(fp, ""); + break; + + case AUT_IN_ADDR_EX: + fprintf(fp, ""); + break; + + case AUT_IP: + fprintf(fp, ""); + break; + + case AUT_OPAQUE: + fprintf(fp, ""); + break; + + case AUT_PATH: + fprintf(fp, ""); + break; + + case AUT_PROCESS32: + fprintf(fp, ""); + break; + + case AUT_SOCKET_EX: + fprintf(fp, "\n"); + fprintf(outfp, "\n"); +} + +/* + * Print XML footer. + */ +void +au_print_xml_footer(FILE *outfp) +{ + + fprintf(outfp, "\n"); +} + +/* * record byte count 4 bytes * version # 1 byte [2] * event type 2 bytes @@ -495,22 +841,42 @@ } static void -print_header32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm) +print_header32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm, + int xml) { - print_tok_type(fp, tok->id, "header", raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.hdr32.size, "%u"); - print_delim(fp, del); - print_1_byte(fp, tok->tt.hdr32.version, "%u"); - print_delim(fp, del); - print_event(fp, tok->tt.hdr32.e_type, raw, sfrm); - print_delim(fp, del); - print_evmod(fp, tok->tt.hdr32.e_mod, raw); - print_delim(fp, del); - print_sec32(fp, tok->tt.hdr32.s, raw); - print_delim(fp, del); - print_msec32(fp, tok->tt.hdr32.ms, raw); + print_tok_type(fp, tok->id, "header", raw, xml); + if (xml) { + open_attr(fp, "version"); + print_1_byte(fp, tok->tt.hdr32.version, "%u"); + close_attr(fp); + open_attr(fp, "event"); + print_event(fp, tok->tt.hdr32.e_type, raw, sfrm); + close_attr(fp); + open_attr(fp, "modifier"); + print_evmod(fp, tok->tt.hdr32.e_mod, raw); + close_attr(fp); + open_attr(fp, "time"); + print_sec32(fp, tok->tt.hdr32.s, raw); + close_attr(fp); + open_attr(fp, "msec"); + print_msec32(fp, tok->tt.hdr32.ms, 1); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_4_bytes(fp, tok->tt.hdr32.size, "%u"); + print_delim(fp, del); + print_1_byte(fp, tok->tt.hdr32.version, "%u"); + print_delim(fp, del); + print_event(fp, tok->tt.hdr32.e_type, raw, sfrm); + print_delim(fp, del); + print_evmod(fp, tok->tt.hdr32.e_mod, raw); + print_delim(fp, del); + print_sec32(fp, tok->tt.hdr32.s, raw); + print_delim(fp, del); + print_msec32(fp, tok->tt.hdr32.ms, raw); + } } /* @@ -584,25 +950,50 @@ static void print_header32_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - char sfrm) + char sfrm, int xml) { - print_tok_type(fp, tok->id, "header_ex", raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.hdr32_ex.size, "%u"); - print_delim(fp, del); - print_1_byte(fp, tok->tt.hdr32_ex.version, "%u"); - print_delim(fp, del); - print_event(fp, tok->tt.hdr32_ex.e_type, raw, sfrm); - print_delim(fp, del); - print_evmod(fp, tok->tt.hdr32_ex.e_mod, raw); - print_delim(fp, del); - print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type, - tok->tt.hdr32_ex.addr); - print_delim(fp, del); - print_sec32(fp, tok->tt.hdr32_ex.s, raw); - print_delim(fp, del); - print_msec32(fp, tok->tt.hdr32_ex.ms, raw); + print_tok_type(fp, tok->id, "header_ex", raw, xml); + if (xml) { + open_attr(fp, "version"); + print_1_byte(fp, tok->tt.hdr32_ex.version, "%u"); + close_attr(fp); + open_attr(fp, "event"); + print_event(fp, tok->tt.hdr32_ex.e_type, raw, sfrm); + close_attr(fp); + open_attr(fp, "modifier"); + print_evmod(fp, tok->tt.hdr32_ex.e_mod, raw); + close_attr(fp); + /* + * No attribute for additional types. + * + print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type, + tok->tt.hdr32_ex.addr); + */ + open_attr(fp, "time"); + print_sec32(fp, tok->tt.hdr32_ex.s, raw); + close_attr(fp); + open_attr(fp, "msec"); + print_msec32(fp, tok->tt.hdr32_ex.ms, raw); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_4_bytes(fp, tok->tt.hdr32_ex.size, "%u"); + print_delim(fp, del); + print_1_byte(fp, tok->tt.hdr32_ex.version, "%u"); + print_delim(fp, del); + print_event(fp, tok->tt.hdr32_ex.e_type, raw, sfrm); + print_delim(fp, del); + print_evmod(fp, tok->tt.hdr32_ex.e_mod, raw); + print_delim(fp, del); + print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type, + tok->tt.hdr32_ex.addr); + print_delim(fp, del); + print_sec32(fp, tok->tt.hdr32_ex.s, raw); + print_delim(fp, del); + print_msec32(fp, tok->tt.hdr32_ex.ms, raw); + } } /* @@ -646,23 +1037,44 @@ } static void -print_header64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm) +print_header64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm, + int xml) { + + print_tok_type(fp, tok->id, "header", raw, xml); + if (xml) { + open_attr(fp, "version"); + print_1_byte(fp, tok->tt.hdr64.version, "%u"); + close_attr(fp); + open_attr(fp, "event"); + print_event(fp, tok->tt.hdr64.e_type, raw, sfrm); + close_attr(fp); + open_attr(fp, "modifier"); + print_evmod(fp, tok->tt.hdr64.e_mod, raw); + close_attr(fp); + open_attr(fp, "time"); + print_sec64(fp, tok->tt.hdr64.s, raw); + close_attr(fp); + open_attr(fp, "msec"); + print_msec64(fp, tok->tt.hdr64.ms, raw); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_4_bytes(fp, tok->tt.hdr64.size, "%u"); + print_delim(fp, del); + print_1_byte(fp, tok->tt.hdr64.version, "%u"); + print_delim(fp, del); + print_event(fp, tok->tt.hdr64.e_type, raw, sfrm); + print_delim(fp, del); + print_evmod(fp, tok->tt.hdr64.e_mod, raw); + print_delim(fp, del); + print_sec64(fp, tok->tt.hdr64.s, raw); + print_delim(fp, del); + print_msec64(fp, tok->tt.hdr64.ms, raw); + } +} - print_tok_type(fp, tok->id, "header", raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.hdr64.size, "%u"); - print_delim(fp, del); - print_1_byte(fp, tok->tt.hdr64.version, "%u"); - print_delim(fp, del); - print_event(fp, tok->tt.hdr64.e_type, raw, sfrm); - print_delim(fp, del); - print_evmod(fp, tok->tt.hdr64.e_mod, raw); - print_delim(fp, del); - print_sec64(fp, tok->tt.hdr64.s, raw); - print_delim(fp, del); - print_msec64(fp, tok->tt.hdr64.ms, raw); -} /* * record byte count 4 bytes * version # 1 byte [2] @@ -729,25 +1141,51 @@ } static void -print_header64_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm) +print_header64_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, + char sfrm, int xml) { - print_tok_type(fp, tok->id, "header_ex", raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.hdr64_ex.size, "%u"); - print_delim(fp, del); - print_1_byte(fp, tok->tt.hdr64_ex.version, "%u"); - print_delim(fp, del); - print_event(fp, tok->tt.hdr64_ex.e_type, raw, sfrm); - print_delim(fp, del); - print_evmod(fp, tok->tt.hdr64_ex.e_mod, raw); - print_delim(fp, del); - print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type, - tok->tt.hdr64_ex.addr); - print_delim(fp, del); - print_sec64(fp, tok->tt.hdr64_ex.s, raw); - print_delim(fp, del); - print_msec64(fp, tok->tt.hdr64_ex.ms, raw); + print_tok_type(fp, tok->id, "header_ex", raw, xml); + if (xml) { + open_attr(fp, "version"); + print_1_byte(fp, tok->tt.hdr64_ex.version, "%u"); + close_attr(fp); + open_attr(fp, "event"); + print_event(fp, tok->tt.hdr64_ex.e_type, raw, sfrm); + close_attr(fp); + open_attr(fp, "modifier"); + print_evmod(fp, tok->tt.hdr64_ex.e_mod, raw); + close_attr(fp); + /* + * No attribute for additional types. + * + print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type, + tok->tt.hdr64_ex.addr); + */ + open_attr(fp, "time"); + print_sec64(fp, tok->tt.hdr64_ex.s, raw); + close_attr(fp); + open_attr(fp, "msec"); + print_msec64(fp, tok->tt.hdr64_ex.ms, raw); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_4_bytes(fp, tok->tt.hdr64_ex.size, "%u"); + print_delim(fp, del); + print_1_byte(fp, tok->tt.hdr64_ex.version, "%u"); + print_delim(fp, del); + print_event(fp, tok->tt.hdr64_ex.e_type, raw, sfrm); + print_delim(fp, del); + print_evmod(fp, tok->tt.hdr64_ex.e_mod, raw); + print_delim(fp, del); + print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type, + tok->tt.hdr64_ex.addr); + print_delim(fp, del); + print_sec64(fp, tok->tt.hdr64_ex.s, raw); + print_delim(fp, del); + print_msec64(fp, tok->tt.hdr64_ex.ms, raw); + } } /* @@ -772,12 +1210,14 @@ static void print_trailer_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "trailer", raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.trail.count, "%u"); + print_tok_type(fp, tok->id, "trailer", raw, xml); + if (!xml) { + print_delim(fp, del); + print_4_bytes(fp, tok->tt.trail.count, "%u"); + } } /* @@ -813,16 +1253,28 @@ static void print_arg32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "argument", raw); - print_delim(fp, del); - print_1_byte(fp, tok->tt.arg32.no, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.arg32.val, "0x%x"); - print_delim(fp, del); - print_string(fp, tok->tt.arg32.text, tok->tt.arg32.len); + print_tok_type(fp, tok->id, "argument", raw, xml); + if (xml) { + open_attr(fp, "arg-num"); + print_1_byte(fp, tok->tt.arg32.no, "%u"); + close_attr(fp); + open_attr(fp, "value"); + print_4_bytes(fp, tok->tt.arg32.val, "0x%x"); + close_attr(fp); + open_attr(fp, "desc"); + print_string(fp, tok->tt.arg32.text, tok->tt.arg32.len); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_1_byte(fp, tok->tt.arg32.no, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.arg32.val, "0x%x"); + print_delim(fp, del); + } } static int @@ -852,16 +1304,29 @@ static void print_arg64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "argument", raw); - print_delim(fp, del); - print_1_byte(fp, tok->tt.arg64.no, "%u"); - print_delim(fp, del); - print_8_bytes(fp, tok->tt.arg64.val, "0x%llx"); - print_delim(fp, del); - print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len); + print_tok_type(fp, tok->id, "argument", raw, xml); + if (xml) { + open_attr(fp, "arg-num"); + print_1_byte(fp, tok->tt.arg64.no, "%u"); + close_attr(fp); + open_attr(fp, "value"); + print_8_bytes(fp, tok->tt.arg64.val, "0x%llx"); + close_attr(fp); + open_attr(fp, "desc"); + print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_1_byte(fp, tok->tt.arg64.no, "%u"); + print_delim(fp, del); + print_8_bytes(fp, tok->tt.arg64.val, "0x%llx"); + print_delim(fp, del); + print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len); + } } /* @@ -924,15 +1389,16 @@ static void print_arb_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { char *str; char *format; size_t size; int i; - print_tok_type(fp, tok->id, "arbitrary", raw); - print_delim(fp, del); + print_tok_type(fp, tok->id, "arbitrary", raw, xml); + if (!xml) + print_delim(fp, del); switch(tok->tt.arb.howtopr) { case AUP_BINARY: @@ -964,56 +1430,125 @@ return; } - print_string(fp, str, strlen(str)); - print_delim(fp, del); + if (xml) { + open_attr(fp, "print"); + fprintf(fp, "%s",str); + close_attr(fp); + } else { + print_string(fp, str, strlen(str)); + print_delim(fp, del); + } switch(tok->tt.arb.bu) { case AUR_BYTE: /* case AUR_CHAR: */ str = "byte"; size = AUR_BYTE_SIZE; - print_string(fp, str, strlen(str)); - print_delim(fp, del); - print_1_byte(fp, tok->tt.arb.uc, "%u"); - print_delim(fp, del); - for (i = 0; itt.arb.uc; i++) - fprintf(fp, format, *(tok->tt.arb.data + (size * i))); + if (xml) { + open_attr(fp, "type"); + fprintf(fp, "%u", size); + close_attr(fp); + open_attr(fp, "count"); + print_1_byte(fp, tok->tt.arb.uc, "%u"); + close_attr(fp); + fprintf(fp, ">"); + for (i = 0; itt.arb.uc; i++) + fprintf(fp, format, *(tok->tt.arb.data + + (size * i))); + close_tag(fp, tok->id); + } else { + print_string(fp, str, strlen(str)); + print_delim(fp, del); + print_1_byte(fp, tok->tt.arb.uc, "%u"); + print_delim(fp, del); + for (i = 0; itt.arb.uc; i++) + fprintf(fp, format, *(tok->tt.arb.data + + (size * i))); + } break; case AUR_SHORT: str = "short"; size = AUR_SHORT_SIZE; - print_string(fp, str, strlen(str)); - print_delim(fp, del); - print_1_byte(fp, tok->tt.arb.uc, "%u"); - print_delim(fp, del); - for (i = 0; i < tok->tt.arb.uc; i++) - fprintf(fp, format, *((u_int16_t *)(tok->tt.arb.data + - (size * i)))); + if (xml) { + open_attr(fp, "type"); + fprintf(fp, "%u", size); + close_attr(fp); + open_attr(fp, "count"); + print_1_byte(fp, tok->tt.arb.uc, "%u"); + close_attr(fp); + fprintf(fp, ">"); + for (i = 0; i < tok->tt.arb.uc; i++) + fprintf(fp, format, + *((u_int16_t *)(tok->tt.arb.data + + (size * i)))); + close_tag(fp, tok->id); + } else { + print_string(fp, str, strlen(str)); + print_delim(fp, del); + print_1_byte(fp, tok->tt.arb.uc, "%u"); + print_delim(fp, del); + for (i = 0; i < tok->tt.arb.uc; i++) + fprintf(fp, format, + *((u_int16_t *)(tok->tt.arb.data + + (size * i)))); + } break; case AUR_INT32: /* case AUR_INT: */ str = "int"; size = AUR_INT32_SIZE; - print_string(fp, str, strlen(str)); - print_delim(fp, del); - print_1_byte(fp, tok->tt.arb.uc, "%u"); - print_delim(fp, del); - for (i = 0; i < tok->tt.arb.uc; i++) - fprintf(fp, format, *((u_int32_t *)(tok->tt.arb.data + - (size * i)))); + if (xml) { + open_attr(fp, "type"); + fprintf(fp, "%u", size); + close_attr(fp); + open_attr(fp, "count"); + print_1_byte(fp, tok->tt.arb.uc, "%u"); + close_attr(fp); + fprintf(fp, ">"); + for (i = 0; i < tok->tt.arb.uc; i++) + fprintf(fp, format, + *((u_int32_t *)(tok->tt.arb.data + + (size * i)))); + close_tag(fp, tok->id); + } else { + print_string(fp, str, strlen(str)); + print_delim(fp, del); + print_1_byte(fp, tok->tt.arb.uc, "%u"); + print_delim(fp, del); + for (i = 0; i < tok->tt.arb.uc; i++) + fprintf(fp, format, + *((u_int32_t *)(tok->tt.arb.data + + (size * i)))); + } break; case AUR_INT64: str = "int64"; size = AUR_INT64_SIZE; - print_string(fp, str, strlen(str)); - print_delim(fp, del); - print_1_byte(fp, tok->tt.arb.uc, "%u"); - print_delim(fp, del); - for (i = 0; i < tok->tt.arb.uc; i++) - fprintf(fp, format, *((u_int64_t *)(tok->tt.arb.data + - (size * i)))); + if (xml) { + open_attr(fp, "type"); + fprintf(fp, "%u", size); + close_attr(fp); + open_attr(fp, "count"); + print_1_byte(fp, tok->tt.arb.uc, "%u"); + close_attr(fp); + fprintf(fp, ">"); + for (i = 0; i < tok->tt.arb.uc; i++) + fprintf(fp, format, + *((u_int64_t *)(tok->tt.arb.data + + (size * i)))); + close_tag(fp, tok->id); + } else { + print_string(fp, str, strlen(str)); + print_delim(fp, del); + print_1_byte(fp, tok->tt.arb.uc, "%u"); + print_delim(fp, del); + for (i = 0; i < tok->tt.arb.uc; i++) + fprintf(fp, format, + *((u_int64_t *)(tok->tt.arb.data + + (size * i)))); + } break; default: @@ -1063,22 +1598,44 @@ static void print_attr32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "attribute", raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.attr32.mode, "%o"); - print_delim(fp, del); - print_user(fp, tok->tt.attr32.uid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.attr32.gid, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.attr32.fsid, "%u"); - print_delim(fp, del); - print_8_bytes(fp, tok->tt.attr32.nid, "%lld"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.attr32.dev, "%u"); + print_tok_type(fp, tok->id, "attribute", raw, xml); + if (xml) { + open_attr(fp, "mode"); + print_4_bytes(fp, tok->tt.attr32.mode, "%o"); + close_attr(fp); + open_attr(fp, "uid"); + print_user(fp, tok->tt.attr32.uid, raw); + close_attr(fp); + open_attr(fp, "gid"); + print_group(fp, tok->tt.attr32.gid, raw); + close_attr(fp); + open_attr(fp, "fsid"); + print_4_bytes(fp, tok->tt.attr32.fsid, "%u"); + close_attr(fp); + open_attr(fp, "nodeid"); + print_8_bytes(fp, tok->tt.attr32.nid, "%lld"); + close_attr(fp); + open_attr(fp, "device"); + print_4_bytes(fp, tok->tt.attr32.dev, "%u"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_4_bytes(fp, tok->tt.attr32.mode, "%o"); + print_delim(fp, del); + print_user(fp, tok->tt.attr32.uid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.attr32.gid, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.attr32.fsid, "%u"); + print_delim(fp, del); + print_8_bytes(fp, tok->tt.attr32.nid, "%lld"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.attr32.dev, "%u"); + } } /* @@ -1123,22 +1680,44 @@ static void print_attr64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "attribute", raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.attr64.mode, "%o"); - print_delim(fp, del); - print_user(fp, tok->tt.attr64.uid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.attr64.gid, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.attr64.fsid, "%u"); - print_delim(fp, del); - print_8_bytes(fp, tok->tt.attr64.nid, "%lld"); - print_delim(fp, del); - print_8_bytes(fp, tok->tt.attr64.dev, "%llu"); + print_tok_type(fp, tok->id, "attribute", raw, xml); + if (xml) { + open_attr(fp, "mode"); + print_4_bytes(fp, tok->tt.attr64.mode, "%o"); + close_attr(fp); + open_attr(fp, "uid"); + print_user(fp, tok->tt.attr64.uid, raw); + close_attr(fp); + open_attr(fp, "gid"); + print_group(fp, tok->tt.attr64.gid, raw); + close_attr(fp); + open_attr(fp, "fsid"); + print_4_bytes(fp, tok->tt.attr64.fsid, "%u"); + close_attr(fp); + open_attr(fp, "nodeid"); + print_8_bytes(fp, tok->tt.attr64.nid, "%lld"); + close_attr(fp); + open_attr(fp, "device"); + print_8_bytes(fp, tok->tt.attr64.dev, "%llu"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_4_bytes(fp, tok->tt.attr64.mode, "%o"); + print_delim(fp, del); + print_user(fp, tok->tt.attr64.uid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.attr64.gid, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.attr64.fsid, "%u"); + print_delim(fp, del); + print_8_bytes(fp, tok->tt.attr64.nid, "%lld"); + print_delim(fp, del); + print_8_bytes(fp, tok->tt.attr64.dev, "%llu"); + } } /* @@ -1163,14 +1742,24 @@ static void print_exit_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "exit", raw); - print_delim(fp, del); - print_errval(fp, tok->tt.exit.status); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.exit.ret, "%u"); + print_tok_type(fp, tok->id, "exit", raw, xml); + if (xml) { + open_attr(fp, "errval"); + print_errval(fp, tok->tt.exit.status); + close_attr(fp); + open_attr(fp, "retval"); + print_4_bytes(fp, tok->tt.exit.ret, "%u"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_errval(fp, tok->tt.exit.status); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.exit.ret, "%u"); + } } /* @@ -1211,16 +1800,25 @@ static void print_execarg_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { int i; - print_tok_type(fp, tok->id, "exec arg", raw); + print_tok_type(fp, tok->id, "exec arg", raw, xml); for (i = 0; i < tok->tt.execarg.count; i++) { - print_delim(fp, del); - print_string(fp, tok->tt.execarg.text[i], - strlen(tok->tt.execarg.text[i])); + if (xml) { + fprintf(fp, ""); + print_string(fp, tok->tt.execarg.text[i], + strlen(tok->tt.execarg.text[i])); + fprintf(fp, ""); + } else { + print_delim(fp, del); + print_string(fp, tok->tt.execarg.text[i], + strlen(tok->tt.execarg.text[i])); + } } + if (xml) + close_tag(fp, tok->id); } /* @@ -1261,16 +1859,25 @@ static void print_execenv_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { int i; - print_tok_type(fp, tok->id, "exec env", raw); + print_tok_type(fp, tok->id, "exec env", raw, xml); for (i = 0; i< tok->tt.execenv.count; i++) { - print_delim(fp, del); - print_string(fp, tok->tt.execenv.text[i], - strlen(tok->tt.execenv.text[i])); + if (xml) { + fprintf(fp, ""); + print_string(fp, tok->tt.execenv.text[i], + strlen(tok->tt.execenv.text[i])); + fprintf(fp, ""); + } else { + print_delim(fp, del); + print_string(fp, tok->tt.execenv.text[i], + strlen(tok->tt.execenv.text[i])); + } } + if (xml) + close_tag(fp, tok->id); } /* @@ -1305,16 +1912,28 @@ static void print_file_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "file", raw); - print_delim(fp, del); - print_sec32(fp, tok->tt.file.s, raw); - print_delim(fp, del); - print_msec32(fp, tok->tt.file.ms, raw); - print_delim(fp, del); - print_string(fp, tok->tt.file.name, tok->tt.file.len); + print_tok_type(fp, tok->id, "file", raw, xml); + if (xml) { + open_attr(fp, "time"); + print_sec32(fp, tok->tt.file.s, raw); + close_attr(fp); + open_attr(fp, "msec"); + print_msec32(fp, tok->tt.file.ms, raw); + close_attr(fp); + fprintf(fp, ">"); + print_string(fp, tok->tt.file.name, tok->tt.file.len); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_sec32(fp, tok->tt.file.s, raw); + print_delim(fp, del); + print_msec32(fp, tok->tt.file.ms, raw); + print_delim(fp, del); + print_string(fp, tok->tt.file.name, tok->tt.file.len); + } } /* @@ -1343,14 +1962,21 @@ static void print_newgroups_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { int i; - print_tok_type(fp, tok->id, "group", raw); + print_tok_type(fp, tok->id, "group", raw, xml); for (i = 0; i < tok->tt.grps.no; i++) { - print_delim(fp, del); - print_group(fp, tok->tt.grps.list[i], raw); + if (xml) { + fprintf(fp, ""); + print_group(fp, tok->tt.grps.list[i], raw); + fprintf(fp, ""); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_group(fp, tok->tt.grps.list[i], raw); + } } } @@ -1373,12 +1999,17 @@ static void print_inaddr_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "ip addr", raw); - print_delim(fp, del); - print_ip_address(fp, tok->tt.inaddr.addr); + print_tok_type(fp, tok->id, "ip addr", raw, xml); + if (xml) { + print_ip_address(fp, tok->tt.inaddr.addr); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_ip_address(fp, tok->tt.inaddr.addr); + } } /* @@ -1412,13 +2043,19 @@ static void print_inaddr_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "ip addr ex", raw); - print_delim(fp, del); - print_ip_ex_address(fp, tok->tt.inaddr_ex.type, - tok->tt.inaddr_ex.addr); + print_tok_type(fp, tok->id, "ip addr ex", raw, xml); + if (xml) { + print_ip_ex_address(fp, tok->tt.inaddr_ex.type, + tok->tt.inaddr_ex.addr); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_ip_ex_address(fp, tok->tt.inaddr_ex.type, + tok->tt.inaddr_ex.addr); + } } /* @@ -1480,30 +2117,66 @@ static void print_ip_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "ip", raw); - print_delim(fp, del); - print_mem(fp, (u_char *)(&tok->tt.ip.version), sizeof(u_char)); - print_delim(fp, del); - print_mem(fp, (u_char *)(&tok->tt.ip.tos), sizeof(u_char)); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.ip.len), "%u"); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.ip.id), "%u"); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.ip.offset), "%u"); - print_delim(fp, del); - print_mem(fp, (u_char *)(&tok->tt.ip.ttl), sizeof(u_char)); - print_delim(fp, del); - print_mem(fp, (u_char *)(&tok->tt.ip.prot), sizeof(u_char)); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.ip.chksm), "%u"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.ip.src); - print_delim(fp, del); - print_ip_address(fp, tok->tt.ip.dest); + print_tok_type(fp, tok->id, "ip", raw, xml); + if (xml) { + open_attr(fp, "version"); + print_mem(fp, (u_char *)(&tok->tt.ip.version), + sizeof(u_char)); + close_attr(fp); + open_attr(fp, "service_type"); + print_mem(fp, (u_char *)(&tok->tt.ip.tos), sizeof(u_char)); + close_attr(fp); + open_attr(fp, "len"); + print_2_bytes(fp, ntohs(tok->tt.ip.len), "%u"); + close_attr(fp); + open_attr(fp, "id"); + print_2_bytes(fp, ntohs(tok->tt.ip.id), "%u"); + close_attr(fp); + open_attr(fp, "offset"); + print_2_bytes(fp, ntohs(tok->tt.ip.offset), "%u"); + close_attr(fp); + open_attr(fp, "time_to_live"); + print_mem(fp, (u_char *)(&tok->tt.ip.ttl), sizeof(u_char)); + close_attr(fp); + open_attr(fp, "protocol"); + print_mem(fp, (u_char *)(&tok->tt.ip.prot), sizeof(u_char)); + close_attr(fp); + open_attr(fp, "cksum"); + print_2_bytes(fp, ntohs(tok->tt.ip.chksm), "%u"); + close_attr(fp); + open_attr(fp, "src_addr"); + print_ip_address(fp, tok->tt.ip.src); + close_attr(fp); + open_attr(fp, "dest_addr"); + print_ip_address(fp, tok->tt.ip.dest); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_mem(fp, (u_char *)(&tok->tt.ip.version), + sizeof(u_char)); + print_delim(fp, del); + print_mem(fp, (u_char *)(&tok->tt.ip.tos), sizeof(u_char)); + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.ip.len), "%u"); + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.ip.id), "%u"); + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.ip.offset), "%u"); + print_delim(fp, del); + print_mem(fp, (u_char *)(&tok->tt.ip.ttl), sizeof(u_char)); + print_delim(fp, del); + print_mem(fp, (u_char *)(&tok->tt.ip.prot), sizeof(u_char)); + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.ip.chksm), "%u"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.ip.src); + print_delim(fp, del); + print_ip_address(fp, tok->tt.ip.dest); + } } /* @@ -1528,14 +2201,24 @@ static void print_ipc_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "IPC", raw); - print_delim(fp, del); - print_ipctype(fp, tok->tt.ipc.type, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.ipc.id, "%u"); + print_tok_type(fp, tok->id, "IPC", raw, xml); + if (xml) { + open_attr(fp, "ipc-type"); + print_ipctype(fp, tok->tt.ipc.type, raw); + close_attr(fp); + open_attr(fp, "ipc-id"); + print_4_bytes(fp, tok->tt.ipc.id, "%u"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_ipctype(fp, tok->tt.ipc.type, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.ipc.id, "%u"); + } } /* @@ -1585,24 +2268,49 @@ static void print_ipcperm_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "IPC perm", raw); - print_delim(fp, del); - print_user(fp, tok->tt.ipcperm.uid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.ipcperm.gid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.ipcperm.puid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.ipcperm.pgid, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.ipcperm.mode, "%o"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.ipcperm.seq, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.ipcperm.key, "%u"); + print_tok_type(fp, tok->id, "IPC perm", raw, xml); + if (xml) { + open_attr(fp, "uid"); + print_user(fp, tok->tt.ipcperm.uid, raw); + close_attr(fp); + open_attr(fp, "gid"); + print_group(fp, tok->tt.ipcperm.gid, raw); + close_attr(fp); + open_attr(fp, "creator-uid"); + print_user(fp, tok->tt.ipcperm.puid, raw); + close_attr(fp); + open_attr(fp, "creator-gid"); + print_group(fp, tok->tt.ipcperm.pgid, raw); + close_attr(fp); + open_attr(fp, "mode"); + print_4_bytes(fp, tok->tt.ipcperm.mode, "%o"); + close_attr(fp); + open_attr(fp, "seq"); + print_4_bytes(fp, tok->tt.ipcperm.seq, "%u"); + close_attr(fp); + open_attr(fp, "key"); + print_4_bytes(fp, tok->tt.ipcperm.key, "%u"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_user(fp, tok->tt.ipcperm.uid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.ipcperm.gid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.ipcperm.puid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.ipcperm.pgid, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.ipcperm.mode, "%o"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.ipcperm.seq, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.ipcperm.key, "%u"); + } } /* @@ -1623,12 +2331,17 @@ static void print_iport_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "ip port", raw); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.iport.port), "%#x"); + print_tok_type(fp, tok->id, "ip port", raw, xml); + if (xml) { + print_2_bytes(fp, ntohs(tok->tt.iport.port), "%#x"); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.iport.port), "%#x"); + } } /* @@ -1654,14 +2367,19 @@ static void print_opaque_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "opaque", raw); - print_delim(fp, del); - print_2_bytes(fp, tok->tt.opaque.size, "%u"); - print_delim(fp, del); - print_mem(fp, tok->tt.opaque.data, tok->tt.opaque.size); + print_tok_type(fp, tok->id, "opaque", raw, xml); + if (xml) { + print_mem(fp, tok->tt.opaque.data, tok->tt.opaque.size); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_2_bytes(fp, tok->tt.opaque.size, "%u"); + print_delim(fp, del); + print_mem(fp, tok->tt.opaque.data, tok->tt.opaque.size); + } } /* @@ -1686,12 +2404,17 @@ static void print_path_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "path", raw); - print_delim(fp, del); - print_string(fp, tok->tt.path.path, tok->tt.path.len); + print_tok_type(fp, tok->id, "path", raw, xml); + if (xml) { + print_string(fp, tok->tt.path.path, tok->tt.path.len); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_string(fp, tok->tt.path.path, tok->tt.path.len); + } } /* @@ -1754,28 +2477,57 @@ static void print_process32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "process", raw); - print_delim(fp, del); - print_user(fp, tok->tt.proc32.auid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.proc32.euid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.proc32.egid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.proc32.ruid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.proc32.rgid, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.proc32.pid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.proc32.sid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.proc32.tid.port, "%u"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.proc32.tid.addr); + print_tok_type(fp, tok->id, "process", raw, xml); + if (xml) { + open_attr(fp, "audit-uid"); + print_user(fp, tok->tt.proc32.auid, raw); + close_attr(fp); + open_attr(fp, "uid"); + print_user(fp, tok->tt.proc32.euid, raw); + close_attr(fp); + open_attr(fp, "gid"); + print_group(fp, tok->tt.proc32.egid, raw); + close_attr(fp); + open_attr(fp, "ruid"); + print_user(fp, tok->tt.proc32.ruid, raw); + close_attr(fp); + open_attr(fp, "rgid"); + print_group(fp, tok->tt.proc32.rgid, raw); + close_attr(fp); + open_attr(fp, "pid"); + print_4_bytes(fp, tok->tt.proc32.pid, "%u"); + close_attr(fp); + open_attr(fp, "sid"); + print_4_bytes(fp, tok->tt.proc32.sid, "%u"); + close_attr(fp); + open_attr(fp, "tid"); + print_4_bytes(fp, tok->tt.proc32.tid.port, "%u"); + print_ip_address(fp, tok->tt.proc32.tid.addr); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_user(fp, tok->tt.proc32.auid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.proc32.euid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.proc32.egid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.proc32.ruid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.proc32.rgid, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.proc32.pid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.proc32.sid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.proc32.tid.port, "%u"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.proc32.tid.addr); + } } static int @@ -1839,29 +2591,59 @@ static void print_process32ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "process_ex", raw); - print_delim(fp, del); - print_user(fp, tok->tt.proc32_ex.auid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.proc32_ex.euid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.proc32_ex.egid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.proc32_ex.ruid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.proc32_ex.rgid, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.proc32_ex.pid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.proc32_ex.sid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.proc32_ex.tid.port, "%u"); - print_delim(fp, del); - print_ip_ex_address(fp, tok->tt.proc32_ex.tid.type, - tok->tt.proc32_ex.tid.addr); + print_tok_type(fp, tok->id, "process_ex", raw, xml); + if (xml) { + open_attr(fp, "audit-uid"); + print_user(fp, tok->tt.proc32_ex.auid, raw); + close_attr(fp); + open_attr(fp, "uid"); + print_user(fp, tok->tt.proc32_ex.euid, raw); + close_attr(fp); + open_attr(fp, "gid"); + print_group(fp, tok->tt.proc32_ex.egid, raw); + close_attr(fp); + open_attr(fp, "ruid"); + print_user(fp, tok->tt.proc32_ex.ruid, raw); + close_attr(fp); + open_attr(fp, "rgid"); + print_group(fp, tok->tt.proc32_ex.rgid, raw); + close_attr(fp); + open_attr(fp, "pid"); + print_4_bytes(fp, tok->tt.proc32_ex.pid, "%u"); + close_attr(fp); + open_attr(fp, "sid"); + print_4_bytes(fp, tok->tt.proc32_ex.sid, "%u"); + close_attr(fp); + open_attr(fp, "tid"); + print_4_bytes(fp, tok->tt.proc32_ex.tid.port, "%u"); + print_ip_ex_address(fp, tok->tt.proc32_ex.tid.type, + tok->tt.proc32_ex.tid.addr); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_user(fp, tok->tt.proc32_ex.auid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.proc32_ex.euid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.proc32_ex.egid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.proc32_ex.ruid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.proc32_ex.rgid, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.proc32_ex.pid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.proc32_ex.sid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.proc32_ex.tid.port, "%u"); + print_delim(fp, del); + print_ip_ex_address(fp, tok->tt.proc32_ex.tid.type, + tok->tt.proc32_ex.tid.addr); + } } /* @@ -1886,14 +2668,24 @@ static void print_return32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "return", raw); - print_delim(fp, del); - print_retval(fp, tok->tt.ret32.status, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.ret32.ret, "%u"); + print_tok_type(fp, tok->id, "return", raw, xml); + if (xml) { + open_attr(fp ,"errval"); + print_retval(fp, tok->tt.ret32.status, raw); + close_attr(fp); + open_attr(fp, "retval"); + print_4_bytes(fp, tok->tt.ret32.ret, "%u"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_retval(fp, tok->tt.ret32.status, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.ret32.ret, "%u"); + } } static int @@ -1914,14 +2706,24 @@ static void print_return64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "return", raw); - print_delim(fp, del); - print_retval(fp, tok->tt.ret64.err, raw); - print_delim(fp, del); - print_8_bytes(fp, tok->tt.ret64.val, "%lld"); + print_tok_type(fp, tok->id, "return", raw, xml); + if (xml) { + open_attr(fp, "errval"); + print_retval(fp, tok->tt.ret64.err, raw); + close_attr(fp); + open_attr(fp, "retval"); + print_8_bytes(fp, tok->tt.ret64.val, "%lld"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_retval(fp, tok->tt.ret64.err, raw); + print_delim(fp, del); + print_8_bytes(fp, tok->tt.ret64.val, "%lld"); + } } /* @@ -1941,12 +2743,19 @@ static void print_seq_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "sequence", raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.seq.seqno, "%u"); + print_tok_type(fp, tok->id, "sequence", raw, xml); + if (xml) { + open_attr(fp, "seq-num"); + print_4_bytes(fp, tok->tt.seq.seqno, "%u"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_4_bytes(fp, tok->tt.seq.seqno, "%u"); + } } /* @@ -1979,16 +2788,29 @@ static void print_sock_inet32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "socket-inet", raw); - print_delim(fp, del); - print_2_bytes(fp, tok->tt.sockinet32.family, "%u"); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.sockinet32.port), "%u"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.sockinet32.addr); + print_tok_type(fp, tok->id, "socket-inet", raw, xml); + if (xml) { + open_attr(fp, "type"); + print_2_bytes(fp, tok->tt.sockinet32.family, "%u"); + close_attr(fp); + open_attr(fp, "port"); + print_2_bytes(fp, ntohs(tok->tt.sockinet32.port), "%u"); + close_attr(fp); + open_attr(fp, "addr"); + print_ip_address(fp, tok->tt.sockinet32.addr); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_2_bytes(fp, tok->tt.sockinet32.family, "%u"); + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.sockinet32.port), "%u"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.sockinet32.addr); + } } /* @@ -2014,15 +2836,28 @@ static void print_sock_unix_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "socket-unix", raw); - print_delim(fp, del); - print_2_bytes(fp, tok->tt.sockunix.family, "%u"); - print_delim(fp, del); - print_string(fp, tok->tt.sockunix.path, - strlen(tok->tt.sockunix.path)); + print_tok_type(fp, tok->id, "socket-unix", raw, xml); + if (xml) { + open_attr(fp, "type"); + print_2_bytes(fp, tok->tt.sockunix.family, "%u"); + close_attr(fp); + open_attr(fp, "port"); + close_attr(fp); + open_attr(fp, "addr"); + print_string(fp, tok->tt.sockunix.path, + strlen(tok->tt.sockunix.path)); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_2_bytes(fp, tok->tt.sockunix.family, "%u"); + print_delim(fp, del); + print_string(fp, tok->tt.sockunix.path, + strlen(tok->tt.sockunix.path)); + } } /* @@ -2066,20 +2901,39 @@ static void print_socket_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "socket", raw); - print_delim(fp, del); - print_2_bytes(fp, tok->tt.socket.type, "%u"); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.socket.l_port), "%u"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.socket.l_addr); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.socket.r_port), "%u"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.socket.r_addr); + print_tok_type(fp, tok->id, "socket", raw, xml); + if (xml) { + open_attr(fp, "sock_type"); + print_2_bytes(fp, tok->tt.socket.type, "%u"); + close_attr(fp); + open_attr(fp, "lport"); + print_2_bytes(fp, ntohs(tok->tt.socket.l_port), "%u"); + close_attr(fp); + open_attr(fp, "laddr"); + print_ip_address(fp, tok->tt.socket.l_addr); + close_attr(fp); + open_attr(fp, "fport"); + print_2_bytes(fp, ntohs(tok->tt.socket.r_port), "%u"); + close_attr(fp); + open_attr(fp, "faddr"); + print_ip_address(fp, tok->tt.socket.r_addr); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_2_bytes(fp, tok->tt.socket.type, "%u"); + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.socket.l_port), "%u"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.socket.l_addr); + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.socket.r_port), "%u"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.socket.r_addr); + } } /* @@ -2141,28 +2995,57 @@ static void print_subject32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "subject", raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj32.auid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj32.euid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.subj32.egid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj32.ruid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.subj32.rgid, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.subj32.pid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.subj32.sid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.subj32.tid.port, "%u"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.subj32.tid.addr); + print_tok_type(fp, tok->id, "subject", raw, xml); + if (xml) { + open_attr(fp, "audit-uid"); + print_user(fp, tok->tt.subj32.auid, raw); + close_attr(fp); + open_attr(fp, "uid"); + print_user(fp, tok->tt.subj32.euid, raw); + close_attr(fp); + open_attr(fp, "gid"); + print_group(fp, tok->tt.subj32.egid, raw); + close_attr(fp); + open_attr(fp, "ruid"); + print_user(fp, tok->tt.subj32.ruid, raw); + close_attr(fp); + open_attr(fp, "rgid"); + print_group(fp, tok->tt.subj32.rgid, raw); + close_attr(fp); + open_attr(fp,"pid"); + print_4_bytes(fp, tok->tt.subj32.pid, "%u"); + close_attr(fp); + open_attr(fp,"sid"); + print_4_bytes(fp, tok->tt.subj32.sid, "%u"); + close_attr(fp); + open_attr(fp,"tid"); + print_4_bytes(fp, tok->tt.subj32.tid.port, "%u "); + print_ip_address(fp, tok->tt.subj32.tid.addr); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_user(fp, tok->tt.subj32.auid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.subj32.euid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.subj32.egid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.subj32.ruid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.subj32.rgid, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.subj32.pid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.subj32.sid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.subj32.tid.port, "%u"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.subj32.tid.addr); + } } /* @@ -2224,28 +3107,57 @@ static void print_subject64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "subject", raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj64.auid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj64.euid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.subj64.egid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj64.ruid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.subj64.rgid, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.subj64.pid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.subj64.sid, "%u"); - print_delim(fp, del); - print_8_bytes(fp, tok->tt.subj64.tid.port, "%llu"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.subj64.tid.addr); + print_tok_type(fp, tok->id, "subject", raw, xml); + if (xml) { + open_attr(fp, "audit-uid"); + print_user(fp, tok->tt.subj64.auid, raw); + close_attr(fp); + open_attr(fp, "uid"); + print_user(fp, tok->tt.subj64.euid, raw); + close_attr(fp); + open_attr(fp, "gid"); + print_group(fp, tok->tt.subj64.egid, raw); + close_attr(fp); + open_attr(fp, "ruid"); + print_user(fp, tok->tt.subj64.ruid, raw); + close_attr(fp); + open_attr(fp, "rgid"); + print_group(fp, tok->tt.subj64.rgid, raw); + close_attr(fp); + open_attr(fp, "pid"); + print_4_bytes(fp, tok->tt.subj64.pid, "%u"); + close_attr(fp); + open_attr(fp, "sid"); + print_4_bytes(fp, tok->tt.subj64.sid, "%u"); + close_attr(fp); + open_attr(fp, "tid"); + print_8_bytes(fp, tok->tt.subj64.tid.port, "%llu"); + print_ip_address(fp, tok->tt.subj64.tid.addr); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_user(fp, tok->tt.subj64.auid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.subj64.euid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.subj64.egid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.subj64.ruid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.subj64.rgid, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.subj64.pid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.subj64.sid, "%u"); + print_delim(fp, del); + print_8_bytes(fp, tok->tt.subj64.tid.port, "%llu"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.subj64.tid.addr); + } } /* @@ -2322,29 +3234,59 @@ static void print_subject32ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "subject_ex", raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj32_ex.auid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj32_ex.euid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.subj32_ex.egid, raw); - print_delim(fp, del); - print_user(fp, tok->tt.subj32_ex.ruid, raw); - print_delim(fp, del); - print_group(fp, tok->tt.subj32_ex.rgid, raw); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.subj32_ex.pid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.subj32_ex.sid, "%u"); - print_delim(fp, del); - print_4_bytes(fp, tok->tt.subj32_ex.tid.port, "%u"); - print_delim(fp, del); - print_ip_ex_address(fp, tok->tt.subj32_ex.tid.type, - tok->tt.subj32_ex.tid.addr); + print_tok_type(fp, tok->id, "subject_ex", raw, xml); + if (xml) { + open_attr(fp, "audit-uid"); + print_user(fp, tok->tt.subj32_ex.auid, raw); + close_attr(fp); + open_attr(fp, "uid"); + print_user(fp, tok->tt.subj32_ex.euid, raw); + close_attr(fp); + open_attr(fp, "gid"); + print_group(fp, tok->tt.subj32_ex.egid, raw); + close_attr(fp); + open_attr(fp, "ruid"); + print_user(fp, tok->tt.subj32_ex.ruid, raw); + close_attr(fp); + open_attr(fp, "rgid"); + print_group(fp, tok->tt.subj32_ex.rgid, raw); + close_attr(fp); + open_attr(fp, "pid"); + print_4_bytes(fp, tok->tt.subj32_ex.pid, "%u"); + close_attr(fp); + open_attr(fp, "sid"); + print_4_bytes(fp, tok->tt.subj32_ex.sid, "%u"); + close_attr(fp); + open_attr(fp, "tid"); + print_4_bytes(fp, tok->tt.subj32_ex.tid.port, "%u"); + print_ip_ex_address(fp, tok->tt.subj32_ex.tid.type, + tok->tt.subj32_ex.tid.addr); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_user(fp, tok->tt.subj32_ex.auid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.subj32_ex.euid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.subj32_ex.egid, raw); + print_delim(fp, del); + print_user(fp, tok->tt.subj32_ex.ruid, raw); + print_delim(fp, del); + print_group(fp, tok->tt.subj32_ex.rgid, raw); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.subj32_ex.pid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.subj32_ex.sid, "%u"); + print_delim(fp, del); + print_4_bytes(fp, tok->tt.subj32_ex.tid.port, "%u"); + print_delim(fp, del); + print_ip_ex_address(fp, tok->tt.subj32_ex.tid.type, + tok->tt.subj32_ex.tid.addr); + } } /* @@ -2370,12 +3312,17 @@ static void print_text_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "text", raw); - print_delim(fp, del); - print_string(fp, tok->tt.text.text, tok->tt.text.len); + print_tok_type(fp, tok->id, "text", raw, xml); + if (xml) { + print_string(fp, tok->tt.text.text, tok->tt.text.len); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_string(fp, tok->tt.text.text, tok->tt.text.len); + } } /* @@ -2432,20 +3379,39 @@ static void print_socketex32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "socket", raw); - print_delim(fp, del); - print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x"); - print_delim(fp, del); - print_2_bytes(fp, ntohs(tok->tt.socket_ex32.l_port), "%#x"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.socket_ex32.l_addr); - print_delim(fp, del); - print_4_bytes(fp, ntohs(tok->tt.socket_ex32.r_port), "%#x"); - print_delim(fp, del); - print_ip_address(fp, tok->tt.socket_ex32.r_addr); + print_tok_type(fp, tok->id, "socket", raw, xml); + if (xml) { + open_attr(fp, "sock_type"); + print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x"); + close_attr(fp); + open_attr(fp, "lport"); + print_2_bytes(fp, ntohs(tok->tt.socket_ex32.l_port), "%#x"); + close_attr(fp); + open_attr(fp, "laddr"); + print_ip_address(fp, tok->tt.socket_ex32.l_addr); + close_attr(fp); + open_attr(fp, "faddr"); + print_ip_address(fp, tok->tt.socket_ex32.r_addr); + close_attr(fp); + open_attr(fp, "fport"); + print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x"); + close_attr(fp); + close_tag(fp, tok->id); + } else { + print_delim(fp, del); + print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x"); + print_delim(fp, del); + print_2_bytes(fp, ntohs(tok->tt.socket_ex32.l_port), "%#x"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.socket_ex32.l_addr); + print_delim(fp, del); + print_4_bytes(fp, ntohs(tok->tt.socket_ex32.r_port), "%#x"); + print_delim(fp, del); + print_ip_address(fp, tok->tt.socket_ex32.r_addr); + } } static int @@ -2469,12 +3435,14 @@ static void print_invalid_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, - __unused char sfrm) + __unused char sfrm, int xml) { - print_tok_type(fp, tok->id, "unknown", raw); - print_delim(fp, del); - print_mem(fp, tok->tt.invalid.data, tok->tt.invalid.length); + if (!xml) { + print_tok_type(fp, tok->id, "unknown", raw, 0); + print_delim(fp, del); + print_mem(fp, tok->tt.invalid.data, tok->tt.invalid.length); + } } @@ -2607,7 +3575,7 @@ } /* - * 'prints' the token out to outfp + * 'prints' the token out to outfp. */ void au_print_tok(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm) @@ -2615,151 +3583,309 @@ switch(tok->id) { case AUT_HEADER32: - print_header32_tok(outfp, tok, del, raw, sfrm); + print_header32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_HEADER32_EX: + print_header32_ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_HEADER64: + print_header64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_HEADER64_EX: + print_header64_ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_TRAILER: + print_trailer_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_ARG32: + print_arg32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_ARG64: + print_arg64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_DATA: + print_arb_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_ATTR32: + print_attr32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_ATTR64: + print_attr64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_EXIT: + print_exit_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_EXEC_ARGS: + print_execarg_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_EXEC_ENV: + print_execenv_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_OTHER_FILE32: + print_file_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_NEWGROUPS: + print_newgroups_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_IN_ADDR: + print_inaddr_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_IN_ADDR_EX: + print_inaddr_ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_IP: + print_ip_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_IPC: + print_ipc_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_IPC_PERM: + print_ipcperm_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_IPORT: + print_iport_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_OPAQUE: + print_opaque_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_PATH: + print_path_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_PROCESS32: + print_process32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_PROCESS32_EX: + print_process32ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_RETURN32: + print_return32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_RETURN64: + print_return64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_SEQ: + print_seq_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_SOCKET: + print_socket_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_SOCKINET32: + print_sock_inet32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_SOCKUNIX: + print_sock_unix_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_SUBJECT32: + print_subject32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_SUBJECT64: + print_subject64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_SUBJECT32_EX: + print_subject32ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_TEXT: + print_text_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + case AUT_SOCKET_EX: + print_socketex32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + return; + + default: + print_invalid_tok(outfp, tok, del, raw, sfrm, AU_PLAIN); + } +} + +/* + * 'prints' the token out to outfp in XML format. + */ +void +au_print_tok_xml(FILE *outfp, tokenstr_t *tok, char *del, char raw, + char sfrm) +{ + + switch(tok->id) { + case AUT_HEADER32: + print_header32_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_HEADER32_EX: - print_header32_ex_tok(outfp, tok, del, raw, sfrm); + print_header32_ex_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_HEADER64: - print_header64_tok(outfp, tok, del, raw, sfrm); + print_header64_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_HEADER64_EX: - print_header64_ex_tok(outfp, tok, del, raw, sfrm); + print_header64_ex_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_TRAILER: - print_trailer_tok(outfp, tok, del, raw, sfrm); + print_trailer_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_ARG32: - print_arg32_tok(outfp, tok, del, raw, sfrm); + print_arg32_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_ARG64: - print_arg64_tok(outfp, tok, del, raw, sfrm); + print_arg64_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_DATA: - print_arb_tok(outfp, tok, del, raw, sfrm); + print_arb_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_ATTR32: - print_attr32_tok(outfp, tok, del, raw, sfrm); + print_attr32_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_ATTR64: - print_attr64_tok(outfp, tok, del, raw, sfrm); + print_attr64_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_EXIT: - print_exit_tok(outfp, tok, del, raw, sfrm); + print_exit_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_EXEC_ARGS: - print_execarg_tok(outfp, tok, del, raw, sfrm); + print_execarg_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_EXEC_ENV: - print_execenv_tok(outfp, tok, del, raw, sfrm); + print_execenv_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_OTHER_FILE32: - print_file_tok(outfp, tok, del, raw, sfrm); + print_file_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_NEWGROUPS: - print_newgroups_tok(outfp, tok, del, raw, sfrm); + print_newgroups_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_IN_ADDR: - print_inaddr_tok(outfp, tok, del, raw, sfrm); + print_inaddr_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_IN_ADDR_EX: - print_inaddr_ex_tok(outfp, tok, del, raw, sfrm); + print_inaddr_ex_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_IP: - print_ip_tok(outfp, tok, del, raw, sfrm); + print_ip_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_IPC: - print_ipc_tok(outfp, tok, del, raw, sfrm); + print_ipc_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_IPC_PERM: - print_ipcperm_tok(outfp, tok, del, raw, sfrm); + print_ipcperm_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_IPORT: - print_iport_tok(outfp, tok, del, raw, sfrm); + print_iport_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_OPAQUE: - print_opaque_tok(outfp, tok, del, raw, sfrm); + print_opaque_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_PATH: - print_path_tok(outfp, tok, del, raw, sfrm); + print_path_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_PROCESS32: - print_process32_tok(outfp, tok, del, raw, sfrm); + print_process32_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_PROCESS32_EX: - print_process32ex_tok(outfp, tok, del, raw, sfrm); + print_process32ex_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_RETURN32: - print_return32_tok(outfp, tok, del, raw, sfrm); + print_return32_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_RETURN64: - print_return64_tok(outfp, tok, del, raw, sfrm); + print_return64_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_SEQ: - print_seq_tok(outfp, tok, del, raw, sfrm); + print_seq_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_SOCKET: - print_socket_tok(outfp, tok, del, raw, sfrm); + print_socket_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_SOCKINET32: - print_sock_inet32_tok(outfp, tok, del, raw, sfrm); + print_sock_inet32_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_SOCKUNIX: - print_sock_unix_tok(outfp, tok, del, raw, sfrm); + print_sock_unix_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_SUBJECT32: - print_subject32_tok(outfp, tok, del, raw, sfrm); + print_subject32_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_SUBJECT64: - print_subject64_tok(outfp, tok, del, raw, sfrm); + print_subject64_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_SUBJECT32_EX: - print_subject32ex_tok(outfp, tok, del, raw, sfrm); + print_subject32ex_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_TEXT: - print_text_tok(outfp, tok, del, raw, sfrm); + print_text_tok(outfp, tok, del, raw, sfrm, AU_XML); return; case AUT_SOCKET_EX: - print_socketex32_tok(outfp, tok, del, raw, sfrm); + print_socketex32_tok(outfp, tok, del, raw, sfrm, AU_XML); return; default: - print_invalid_tok(outfp, tok, del, raw, sfrm); + print_invalid_tok(outfp, tok, del, raw, sfrm, AU_XML); } }