Merge branch 'master' of ssh://git.nosd.in:2222/yo/libbsm

libbsm.go

@@ -225,8 +225,9 @@ type Tid32 struct {
 type Tid32Ex struct {
 	Port	uint32
 	Ttype	uint32
-	IpVers	uint32			// 0x10 = IPv6
+	IpVers	uint32			// 0x10 = IPv6, 0x04 = IPv4
-	Addr	[4]uint32		// 4 bytes long if IpVers == 0x10, 1 byte long if IpVers == 4
+	Addr4	uint32			// 4 bytes long if IpVers == 0x04
+	Addr6	[4]uint32		// 4x4 bytes long if IpVers == 0x10
 }
 
 type Subject64 struct {
@@ -264,8 +265,9 @@ type Tid64 struct {
 type Tid64Ex struct {
 	Port	uint64
 	Ttype	uint32
-	IpVers	uint32			// 0x10 = IPv6
+	IpVers	uint32			// 0x10 = IPv6, 0x04 = IPv4
-	Addr	[4]uint32
+	Addr4	uint32
+	Addr6	[4]uint32
 }
 
 type Exit struct {
@@ -273,6 +275,12 @@ type Exit struct {
 	Ret		uint32
 }
 
+type Text struct {
+	Length	uint16
+	Text	[]byte
+}
+
+
 /* Utilities */
 func PrintIpv6FromInt(ipv6int [4]uint32) string {
 	//return fmt.Sprintf("%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x", 
@@ -696,16 +704,36 @@ func (s *Subject32Ex) LoadFromBinary(file *os.File) error {
 	err = binary.Read(file, binary.BigEndian, &s.Sid)
 	if err != nil { return fmt.Errorf("Unable to read Subject32Ex.Sid from file: %v", err) }
 
-	err = binary.Read(file, binary.BigEndian, &s.Tid)
+	err = binary.Read(file, binary.BigEndian, &s.Tid.Port)
-	if err != nil { return fmt.Errorf("Unable to read Subject32Ex.Tid from file: %v", err) }
+	if err != nil { return fmt.Errorf("Unable to read Subject32Ex.Tid.Port from file: %v", err) }
+
+	err = binary.Read(file, binary.BigEndian, &s.Tid.Ttype)
+	if err != nil { return fmt.Errorf("Unable to read Subject32Ex.Tid.Ttype from file: %v", err) }
+
+	err = binary.Read(file, binary.BigEndian, &s.Tid.IpVers)
+	if err != nil { return fmt.Errorf("Unable to read Subject32Ex.Tid.IpVers from file: %v", err) }
+
+	if s.Tid.IpVers == 0x10 {
+		err = binary.Read(file, binary.BigEndian, &s.Tid.Addr6)
+		if err != nil { return fmt.Errorf("Unable to read Subject32Ex.Tid.Addr6 from file: %v", err) }
+	} else if s.Tid.IpVers == 0x04 {
+		err = binary.Read(file, binary.BigEndian, &s.Tid.Addr4)
+		if err != nil { return fmt.Errorf("Unable to read Subject32Ex.Tid.Addr4 from file: %v", err) }
+	}
 
 	return nil
 }
 
 func (s *Subject32Ex) Print(file *os.File, delimiter string, flags int) {
-	fmt.Fprintf(file, "subject_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, s.Auid, delimiter, s.Euid,
+	if s.Tid.IpVers == 0x04 {
+		fmt.Fprintf(file, "subject_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, s.Auid, delimiter, s.Euid,
 				delimiter, s.Egid, delimiter, s.Ruid, delimiter, s.Rgid, delimiter, s.Sid, delimiter, s.Tid.Port, delimiter,
-				s.Tid.Ttype, delimiter, PrintIpv6FromInt(s.Tid.Addr))
+				s.Tid.Ttype, delimiter, PrintIpv4FromInt(s.Tid.Addr4))
+	} else {
+		fmt.Fprintf(file, "subject_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, s.Auid, delimiter, s.Euid,
+				delimiter, s.Egid, delimiter, s.Ruid, delimiter, s.Rgid, delimiter, s.Sid, delimiter, s.Tid.Port, delimiter,
+				s.Tid.Ttype, delimiter, PrintIpv6FromInt(s.Tid.Addr6))
+	}
 	if 0 == (flags & PRT_ONELINE) {
 		fmt.Fprintf(file, "\n")
 	}
@@ -748,16 +776,36 @@ func (p *Process32Ex) LoadFromBinary(file *os.File) error {
 	err = binary.Read(file, binary.BigEndian, &p.Sid)
 	if err != nil { return fmt.Errorf("Unable to read Process32Ex.Sid from file: %v", err) }
 
-	err = binary.Read(file, binary.BigEndian, &p.Tid)
+	err = binary.Read(file, binary.BigEndian, &p.Tid.Port)
-	if err != nil { return fmt.Errorf("Unable to read Process32Ex.Tid from file: %v", err) }
+	if err != nil { return fmt.Errorf("Unable to read Process32Ex.Tid.Port from file: %v", err) }
+
+	err = binary.Read(file, binary.BigEndian, &p.Tid.Ttype)
+	if err != nil { return fmt.Errorf("Unable to read Process32Ex.Tid.Ttype from file: %v", err) }
+
+	err = binary.Read(file, binary.BigEndian, &p.Tid.IpVers)
+	if err != nil { return fmt.Errorf("Unable to read Process32Ex.Tid.IpVers from file: %v", err) }
+
+	if p.Tid.IpVers == 0x10 {
+		err = binary.Read(file, binary.BigEndian, &p.Tid.Addr6)
+		if err != nil { return fmt.Errorf("Unable to read Process32Ex.Tid.Addr6 from file: %v", err) }
+	} else if p.Tid.IpVers == 0x04 {
+		err = binary.Read(file, binary.BigEndian, &p.Tid.Addr4)
+		if err != nil { return fmt.Errorf("Unable to read Process32Ex.Tid.Addr4 from file: %v", err) }
+	}
 
 	return nil
 }
 
 func (p *Process32Ex) Print(file *os.File, delimiter string, flags int) {
-	fmt.Fprintf(file, "process_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, p.Auid, delimiter, p.Euid,
+	if p.Tid.IpVers == 0x04 {
+		fmt.Fprintf(file, "process_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, p.Auid, delimiter, p.Euid,
 				delimiter, p.Egid, delimiter, p.Ruid, delimiter, p.Rgid, delimiter, p.Sid, delimiter, p.Tid.Port, delimiter,
-				p.Tid.Ttype, delimiter, PrintIpv6FromInt(p.Tid.Addr))
+				p.Tid.Ttype, delimiter, PrintIpv4FromInt(p.Tid.Addr4))
+	} else {
+		fmt.Fprintf(file, "process_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, p.Auid, delimiter, p.Euid,
+				delimiter, p.Egid, delimiter, p.Ruid, delimiter, p.Rgid, delimiter, p.Sid, delimiter, p.Tid.Port, delimiter,
+				p.Tid.Ttype, delimiter, PrintIpv6FromInt(p.Tid.Addr6))
+	}
 	if 0 == (flags & PRT_ONELINE) {
 		fmt.Fprintf(file, "\n")
 	}
@@ -901,16 +949,36 @@ func (s *Subject64Ex) LoadFromBinary(file *os.File) error {
 	err = binary.Read(file, binary.BigEndian, &s.Sid)
 	if err != nil { return fmt.Errorf("Unable to read Subject64Ex.Sid from file: %v", err) }
 
-	err = binary.Read(file, binary.BigEndian, &s.Tid)
+	err = binary.Read(file, binary.BigEndian, &s.Tid.Port)
-	if err != nil { return fmt.Errorf("Unable to read Subject64Ex.Tid from file: %v", err) }
+	if err != nil { return fmt.Errorf("Unable to read Subject64Ex.Tid.Port from file: %v", err) }
+
+	err = binary.Read(file, binary.BigEndian, &s.Tid.Ttype)
+	if err != nil { return fmt.Errorf("Unable to read Subject64Ex.Tid.Ttype from file: %v", err) }
+
+	err = binary.Read(file, binary.BigEndian, &s.Tid.IpVers)
+	if err != nil { return fmt.Errorf("Unable to read Subject64Ex.Tid.IpVers from file: %v", err) }
+
+	if s.Tid.IpVers == 0x10 {
+		err = binary.Read(file, binary.BigEndian, &s.Tid.Addr6)
+		if err != nil { return fmt.Errorf("Unable to read Subject64Ex.Tid.Addr6 from file: %v", err) }
+	} else if s.Tid.IpVers == 0x04 {
+		err = binary.Read(file, binary.BigEndian, &s.Tid.Addr4)
+		if err != nil { return fmt.Errorf("Unable to read Subject64Ex.Tid.Addr4 from file: %v", err) }
+	}
 
 	return nil
 }
 
 func (s *Subject64Ex) Print(file *os.File, delimiter string, flags int) {
-	fmt.Fprintf(file, "subject_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, s.Auid, delimiter, s.Euid,
+	if s.Tid.IpVers == 0x04 {
+		fmt.Fprintf(file, "subject_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, s.Auid, delimiter, s.Euid,
 				delimiter, s.Egid, delimiter, s.Ruid, delimiter, s.Rgid, delimiter, s.Sid, delimiter, s.Tid.Port, delimiter,
-				s.Tid.Ttype, delimiter, PrintIpv6FromInt(s.Tid.Addr))
+				s.Tid.Ttype, delimiter, PrintIpv4FromInt(s.Tid.Addr4))
+	} else {
+		fmt.Fprintf(file, "subject_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, s.Auid, delimiter, s.Euid,
+				delimiter, s.Egid, delimiter, s.Ruid, delimiter, s.Rgid, delimiter, s.Sid, delimiter, s.Tid.Port, delimiter,
+				s.Tid.Ttype, delimiter, PrintIpv6FromInt(s.Tid.Addr6))
+	}
 	if 0 == (flags & PRT_ONELINE) {
 		fmt.Fprintf(file, "\n")
 	}
@@ -952,16 +1020,36 @@ func (p *Process64Ex) LoadFromBinary(file *os.File) error {
 	err = binary.Read(file, binary.BigEndian, &p.Sid)
 	if err != nil { return fmt.Errorf("Unable to read Process64Ex.Sid from file: %v", err) }
 
-	err = binary.Read(file, binary.BigEndian, &p.Tid)
+	err = binary.Read(file, binary.BigEndian, &p.Tid.Port)
-	if err != nil { return fmt.Errorf("Unable to read Process64Ex.Tid from file: %v", err) }
+	if err != nil { return fmt.Errorf("Unable to read Process64Ex.Tid.Port from file: %v", err) }
+
+	err = binary.Read(file, binary.BigEndian, &p.Tid.Ttype)
+	if err != nil { return fmt.Errorf("Unable to read Process64Ex.Tid.Ttype from file: %v", err) }
+
+	err = binary.Read(file, binary.BigEndian, &p.Tid.IpVers)
+	if err != nil { return fmt.Errorf("Unable to read Process64Ex.Tid.IpVers from file: %v", err) }
+
+	if p.Tid.IpVers == 0x10 {
+		err = binary.Read(file, binary.BigEndian, &p.Tid.Addr6)
+		if err != nil { return fmt.Errorf("Unable to read Process64Ex.Tid.Addr6 from file: %v", err) }
+	} else if p.Tid.IpVers == 0x04 {
+		err = binary.Read(file, binary.BigEndian, &p.Tid.Addr4)
+		if err != nil { return fmt.Errorf("Unable to read Process64Ex.Tid.Addr4 from file: %v", err) }
+	}
 
 	return nil
 }
 
 func (p *Process64Ex) Print(file *os.File, delimiter string, flags int) {
-	fmt.Fprintf(file, "process_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, p.Auid, delimiter, p.Euid,
+	if p.Tid.IpVers == 0x04 {
+		fmt.Fprintf(file, "process_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, p.Auid, delimiter, p.Euid,
 				delimiter, p.Egid, delimiter, p.Ruid, delimiter, p.Rgid, delimiter, p.Sid, delimiter, p.Tid.Port, delimiter,
-				p.Tid.Ttype, delimiter, PrintIpv6FromInt(p.Tid.Addr))
+				p.Tid.Ttype, delimiter, PrintIpv4FromInt(p.Tid.Addr4))
+	} else {
+		fmt.Fprintf(file, "process_ex%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%v%s%s", delimiter, p.Auid, delimiter, p.Euid,
+				delimiter, p.Egid, delimiter, p.Ruid, delimiter, p.Rgid, delimiter, p.Sid, delimiter, p.Tid.Port, delimiter,
+				p.Tid.Ttype, delimiter, PrintIpv6FromInt(p.Tid.Addr6))
+	}
 	if 0 == (flags & PRT_ONELINE) {
 		fmt.Fprintf(file, "\n")
 	}
@@ -1199,6 +1287,37 @@ func (e *Exit) Print(file *os.File, delimiter string, flags int) {
 	}
 }
 
+func NewText(t Text) *Text {
+	return &Text{
+		Length:	t.Length,
+		Text:	t.Text,
+	}
+}
+
+func (t *Text) GetType() uint8 {
+	return AUT_TEXT
+}
+
+func (t *Text) LoadFromBinary(file *os.File) error {
+	err := binary.Read(file, binary.BigEndian, &t.Length)
+	if err != nil { return fmt.Errorf("Unable to read Text.Length from file: %v", err) }
+
+
+	text := make([]byte, t.Length)
+	err = binary.Read(file, binary.BigEndian, &text)
+	if err != nil { return fmt.Errorf("Unable to read Text.Text from file: %v", err) }
+	t.Text = text
+
+	return nil
+}
+
+func (t *Text) Print(file *os.File, delimiter string, flags int) {
+	fmt.Fprintf(file, "text%s%s", delimiter, t.Text)
+	if 0 == (flags & PRT_ONELINE) {
+		fmt.Fprintf(file, "\n")
+	}
+}
+
 func readRecordToStruct(file *os.File) (Record, error) {
 	var rec Record
 
@@ -1294,6 +1413,11 @@ func readRecordToStruct(file *os.File) (Record, error) {
 			err := p.LoadFromBinary(file)
 			if err != nil { return rec, fmt.Errorf("Unable to read file: %v", err) }
 			return NewProcess64Ex(p), nil
+		case AUT_TEXT:
+			var t Text
+			err := t.LoadFromBinary(file)
+			if err != nil { return rec, fmt.Errorf("Unable to read file: %v", err) }
+			return NewText(t), nil
 	}
 
 	startOf, _ := file.Seek(0, io.SeekCurrent)