bsmconv #9
bsmconv #9
Commits on Jun 23, 2016
-
- Implement the reallocation of the buffer within which I will store an unparsed event. - Add some notes on how I am going to parse a Linux Audit event.
-
-
-
Commits on Jun 24, 2016
-
-
I can now extract seperate records from the input stream.
-
-
-
-
-
-
-
-
Commits on Jun 25, 2016
-
Some records are still missing from the eventbuf.
-
-
-
-
-
-
-
-
-
Add a pragma to pjdlog.h to ignore not-so-ANSI variadic macros.
Otherwise, `clang -ansi -Werror -Wall ...` refuses to complie due to `-Wvariadic-macros`.
-
Move makefiles to /usr.bin/bsmconv.
- Remove old Makefile. - Remove old scripts. - Remove pragma from pjdlog.h. - Remove README.
-
Merge pull request #12 from 0mp/makefile-to-usrbin
Move makefiles to /usr.bin/bsmconv.
-
-
-
-
-
Fix minor issues and improve tests.
Time to reimplement records and events using TAILQ.
-
-
-
-
Commits on Jun 26, 2016
-
-
Parse timestamp and id. Clean up before parsing fields.
Some tests are still failling.
-
-
Parse record fields. (In progress.)
- Perform s/pjdlog_notice/pjdlog_debug/g.
-
-
Remove commas from tests. Add a negative comma test.
There should be no commas between records' fields for the time being.
-
Improve debug logging. It is possible to control debug level now.
As you normally run `fu t` to run tests you can now run `fu tv -vvv` to run tests with the debug level of 3.
-
-
-
-
-
-
-
-
-
-
-
I've added a lot of minor changes apart from that.
-
Commits on Jun 27, 2016
-
- Incorporate the PJDLOG_VERIFY function. - Review the correctness of the usage of the PJDLOG_ASSERT function. Since asserts can be turned off so use PJDLOG_VERIFY instead of PJDLOG_ASSERT if you call any significant functions within the macro.
-
Use PJDLOG_VERIFY instead of PJDLOG_ASSERT.
Previously, I checked (bytesread != 1) using an assert which might result in an uncaught read(2) error.
Commits on Jun 28, 2016
-
-
Also: - Change some debug messages. - Reenable the negative test set.
-
Merge pull request #16 from 0mp/tailq
<strike>TAILQ kicks in.</strike> The idea for the implementation has changed.
Commits on Jun 29, 2016
-
* Implement a beta version of parsing. - You can print parsed Linux Audit logs. - There might be some bugs. - The code needs to be refactored.
-
-
Parse record's type, id and nsecs.
- I've got to implement the parsing of the record's fields.
Commits on Jun 30, 2016
-
-
-
- The program compiles and passes the tests. - Refactoring is badly needed.
-
-
-
-
Commits on Jul 1, 2016
-
Improve the linau_field interface.
Specifically: - Fix typedefs. - Remove some copy-paste code.
-
There is a bug in the 452 line of the linau_record when the linau_record_generate_key tries to get a key.
-
Fix a bug in linau_record_generate.
I am about to change the way the key is generated. At the moment the key is a timestamp contactenated with an id. This is a bad key obviously.
-
Commits on Jul 2, 2016
Commits on Jul 3, 2016
-
Mainly: - Update tests. - Improve interfaces. - Add more abstract functions to linau_impl.*.
-
Generally, the parsing works. There are still some minor issues.
-
Implement parser beta version.
Now its time to implement the comma parsing. Add README with some basic information about the testing script. Add a test based on read logs. Fix some minor bugs.
-
-
-
Commits on Jul 5, 2016
-
-
-
-
Begin to implement linau_event to token conversion.
- Update Makefile. - Create some basic data structures. - Add an outline of the linau_event_to_tokenlist function.
Commits on Jul 6, 2016
-
Add a not working version of conversion.
There are still some bugs and the programs doesn't print bytes which would be understandable to praudit.
-
-
-
-
I need a function like au_close_buffer which takes a timeval structure and creates header tokens with the time value I provide instead of using the system time.
-
-
-
-
Commits on Jul 7, 2016
-
-
- Move defintions to another file. - Create a function where conversion takes place. - Delete old functions from linau_record.c.
-
-
-
Update tests. Remove newlines from parsed records.
Additionally, move unhandled tests to .test/.
-
-
-
-
Modify libbsm/bsm_audit.c and fix bsmconv.c.
Now it is possible to give a custom date to the header token.
-
-
Commits on Jul 8, 2016
-
Merge pull request #35 from 0mp/expand-libbsm-interace
Expand the libbsm interface.
-
Merge pull request #33 from 0mp/linux-conversion
Linux Audit to BSM conversion (work in progress).
-
-
-
-
Commits on Jul 10, 2016
-
-
Additionally, I implemented a function which checks if a record has desired fields.
-
-
Add a macro to manage token creation.
Additionally: - Remove mpjdlog. (The problem was with the loglevel changing when you called a function inside a function.) - Add some functions related to conversion. - The program fails an assertion now. I'll fix it tomorrow.
Commits on Jul 11, 2016
Commits on Jul 15, 2016
-
-
Merge pull request #43 from 0mp/improve-linau-conv-api
Improve the Linux Audit to BSM conversion API/framework
Commits on Jul 18, 2016
Commits on Jul 19, 2016
Commits on Jul 20, 2016
-
-
- Fix a bug in functions generating text tokens. - Add defines to make defining linau_conv_tokens easier.
-
-
-
Commits on Jul 21, 2016
Commits on Jul 26, 2016
-
-
-
-
-
-
-
-
* Rename process_an_id_field to process_id_field. The further adjustments have to wait until a major adjustments of the static functions' names. * Improve the name of the linau_conv_write_text_from_field function.
Commits on Jul 28, 2016
-
* Add the help message. * Refactor the code a little bit. * Make the progress bar shirnk if you run fu tsv. * Add colors. * Extend fu with the ability to generate test cases.
-
Add support for every record type in the log files so far.
Additionally: - Update docs. - Add a todo. - Add an additional test for USER_AUTH.
Commits on Jul 30, 2016
Commits on Aug 1, 2016
-
-
-
Now the the fileds are printed in the desired manner. Lctokens can only write desired tokens - they do not care about invalid fields. It means that lctokens are not in charge of writing invalid and unprocessed tokens to the audit record descriptor.
-
Commits on Aug 2, 2016
Commits on Aug 3, 2016
Commits on Aug 8, 2016
Commits on Aug 12, 2016
-
Extend the linau_conv_field interface.
Now there is a union inside the linau_conv_field structure. It could be a lcf_validate function like before or a lcf_match function which returns an nvlist of matching fields. The point is that it allows us to detect and handle regex fields. A regex field is a field the name of which is not predefined as it is defined with a regex. A regex field is not "a0" while a regex field is "a4" for example.
-
-
Commits on Aug 13, 2016
-
-
Replace string_to_uint32() with an abstraction.
string_to_uint32 wasn't a good function to use on different systems. I introduced a new function instead.
-
-
-
-
I misunderstood the fact that a0, a1, a2 and a3 are SYSCALL only fields while a5[2]-like fields are for EXECVE.
Commits on Aug 15, 2016
-
-
-
-
-
Improve conversion, comment on event indentifiers.
- Add a few tokens to some types. - Comment on the indentifiers issue (the au_event_type_from_linux_event unimplemented function in linux_event.c.
-
-
-
-