FreeBSD/contrib/openbsm/bin/auditreduce/auditreduce.c
/*
 * Read each record from the audit trail.  Check if it is selected after
 * passing through each of the options 
 */
Read each record from the audit trail.  Check if it is selected after
passing through each of the options
Read each record from the audit trail . Check if it is selected after passing through each of the options
static int
select_records(FILE *fp)
{
	tokenstr_t tok_hdr32_copy;
	u_char *buf;
	tokenstr_t tok;
	int reclen;
	int bytesread;
	int selected;
	uint32_t optchkd;
	int print;
	int err = 0;
	while ((reclen = au_read_rec(fp, &buf)) != -1) {
		optchkd = 0;
		bytesread = 0;
		selected = 1;
		while ((selected == 1) && (bytesread < reclen)) {
			if (-1 == au_fetch_tok(&tok, buf + bytesread,
			    reclen - bytesread)) {
				err = 1;
				break;
			}
			switch(tok.id) {
			case AUT_HEADER32:
					selected = select_hdr32(tok,
					    &optchkd);
					bcopy(&tok, &tok_hdr32_copy,
					    sizeof(tok));
					break;
			case AUT_PROCESS32:
					selected = select_proc32(tok,
					    &optchkd);
					break;
			case AUT_SUBJECT32:
					selected = select_subj32(tok,
					    &optchkd);
					break;
			case AUT_IPC:
					selected = select_ipcobj(
					    tok.tt.ipc.type, tok.tt.ipc.id,
					    &optchkd); 
					break;
			case AUT_PATH:
					selected = select_filepath(
					    tok.tt.path.path, &optchkd);
					break;	
			case AUT_RETURN32:
				selected = select_return32(tok,
				    tok_hdr32_copy, &optchkd);
				break;
			default:
				break;
			}
			bytesread += tok.len;
		}
		print = ((selected == 1) && (!err) && (!(opttochk & ~optchkd)));
		if (ISOPTSET(opttochk, OPT_v))
			print = !print;
		if (print)
			(void) fwrite(buf, 1, reclen, stdout);
		free(buf);
	}
	return (0);
}
static int select_records ( FILE * fp ) { tokenstr_t tok_hdr32_copy ; u_char * buf ; tokenstr_t tok ; int reclen ; int bytesread ; int selected ; uint32_t optchkd ; int print ; int err = 0 ; while ( ( reclen = au_read_rec ( fp , & buf ) ) != -1 ) { optchkd = 0 ; bytesread = 0 ; selected = 1 ; while ( ( selected == 1 ) && ( bytesread < reclen ) ) { if ( -1 == au_fetch_tok ( & tok , buf + bytesread , reclen - bytesread ) ) { err = 1 ; break ; } switch ( tok . id ) { case AUT_HEADER32 : selected = select_hdr32 ( tok , & optchkd ) ; bcopy ( & tok , & tok_hdr32_copy , sizeof ( tok ) ) ; break ; case AUT_PROCESS32 : selected = select_proc32 ( tok , & optchkd ) ; break ; case AUT_SUBJECT32 : selected = select_subj32 ( tok , & optchkd ) ; break ; case AUT_IPC : selected = select_ipcobj ( tok . tt . ipc . type , tok . tt . ipc . id , & optchkd ) ; break ; case AUT_PATH : selected = select_filepath ( tok . tt . path . path , & optchkd ) ; break ; case AUT_RETURN32 : selected = select_return32 ( tok , tok_hdr32_copy , & optchkd ) ; break ; default : break ; } bytesread += tok . len ; } print = ( ( selected == 1 ) && ( ! err ) && ( ! ( opttochk & ~ optchkd ) ) ) ; if ( ISOPTSET ( opttochk , OPT_v ) ) print = ! print ; if ( print ) ( void ) fwrite ( buf , 1 , reclen , stdout ) ; free ( buf ) ; } return ( 0 ) ; }
Read each record from the audit trail.
Read each record from the audit trail .
/* Is this an incomplete record? */ /*
			 * For each token type we have have different
			 * selection criteria.
			 */ /* Check if all the options were matched. */