/* * dumputmp.c * * Usage: dumputmp [-w pafh] [-u path] [-p pid] * * by shj@netwiz.co.jp */ #include #include #include #include #include #include #include #include #include #include #include #include #include int dns_lookup(char *result, int size, int32_t *a) { struct sockaddr_in sin; struct sockaddr_in6 sin6; struct sockaddr *sa; int salen, flags; int mapped = 0; if (a[0] == 0 && a[1] == 0 && a[2] == (int32_t)htonl (0xffff)) mapped = 1; if (mapped || (a[1] == 0 && a[2] == 0 && a[3] == 0)) { /* IPv4 */ sin.sin_family = AF_INET; sin.sin_port = 0; sin.sin_addr.s_addr = mapped ? a[3] : a[0]; sa = (struct sockaddr *)&sin; salen = sizeof(sin); } else { /* IPv6 */ memset(&sin6, 0, sizeof(sin6)); sin6.sin6_family = AF_INET6; sin6.sin6_port = 0; memcpy(sin6.sin6_addr.s6_addr, a, 16); sa = (struct sockaddr *)&sin6; salen = sizeof(sin6); } return getnameinfo(sa, salen, result, size, NULL, 0, NI_NUMERICHOST); } int fetchtmp(char *file, pid_t pid, int use_pid) { struct utmp utmp; struct tm *tm; time_t t; int fd, count = 1; int year, month, day, hour, min, sec, usec; char domain[256]; char buf[128]; if ((fd = open(file, O_RDONLY)) >= 0) { while(read(fd, &utmp, sizeof(struct utmp))) { if (use_pid == 0 || (use_pid != 0 && pid == utmp.ut_pid)) { printf("FIELD NO.%d\n", count); printf(" TYPE : %u\n", utmp.ut_type); printf(" PID : %d\n", utmp.ut_pid); printf(" LINE : %s\n", utmp.ut_line); printf(" ID : %s\n", utmp.ut_id); printf(" USER : %s\n", utmp.ut_user); printf(" HOST : %s\n", utmp.ut_host); printf(" SESSION: %u\n", utmp.ut_session); dns_lookup(domain, sizeof(domain), (int32_t *)&utmp.ut_addr_v6); printf(" ADDR : %s\n", domain); t = utmp.ut_tv.tv_sec; tm = localtime((time_t *)&t); strftime(buf, sizeof(buf), "%Y/%m/%d %H:%M:%S", tm); printf(" TIME : %s\n", buf); } count++; } close(fd); return count; } } int main(int argc, char *argv[]) { char *wtmp = "/var/log/wtmp"; char *utmp = "/var/run/utmp"; pid_t pid = 0; int use_pid = 0; int opt; while ((opt = getopt(argc, argv, "u:w:p:")) != -1) { switch (opt) { case 'w': wtmp = optarg; break; case 'u': utmp = optarg; break; case 'p': use_pid = 1; pid = atoi(optarg); break; } } printf("======== WTMP: %s ========\n", wtmp); fetchtmp(wtmp, pid, use_pid); printf("======== UTMP: %s ========\n", utmp); fetchtmp(utmp, pid, use_pid); return 0; }