1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170

use libc::pid_t;
use std::convert::TryFrom;
use std::ffi::CStr;
use std::os::raw::c_short;
use thiserror::Error;
use time::OffsetDateTime;
use utmp_raw::{timeval, utmp};

#[derive(Clone, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub enum UtmpEntry {
    /// Record does not contain valid info
    Empty,
    /// Change in system run-level (see `init(8)`)
    RunLevel {
        /// Kernel version
        kernel_version: String,
        /// Time entry was made
        time: OffsetDateTime,
    },
    /// Time of system boot
    BootTime {
        /// Kernel version
        kernel_version: String,
        /// Time entry was made
        time: OffsetDateTime,
    },
    /// Time of system shutdown
    ShutdownTime {
        /// Kernel version
        kernel_version: String,
        /// Time entry was made
        time: OffsetDateTime,
    },
    /// Time after system clock change
    NewTime(OffsetDateTime),
    /// Time before system clock change
    OldTime(OffsetDateTime),
    /// Process spawned by `init(8)`
    InitProcess {
        /// PID of the init process
        pid: pid_t,
        /// Time entry was made
        time: OffsetDateTime,
    },
    /// Session leader process for user login
    LoginProcess {
        /// PID of the login process
        pid: pid_t,
        /// Time entry was made
        time: OffsetDateTime,
    },
    /// Normal process
    UserProcess {
        /// PID of login process
        pid: pid_t,
        /// Device name of tty
        line: String,
        /// Username
        user: String,
        /// Hostname for remote login
        host: String,
        /// Session ID (`getsid(2)`)
        session: pid_t,
        /// Time entry was made
        time: OffsetDateTime,
        // TODO: Figure out the correct byte order to parse the address
        // address: IpAddr,
    },
    /// Terminated process
    DeadProcess {
        /// PID of the terminated process
        pid: pid_t,
        /// Time entry was made
        time: OffsetDateTime,
    },
    /// Not implemented
    #[non_exhaustive]
    Accounting,
}

impl<'a> TryFrom<&'a utmp> for UtmpEntry {
    type Error = UtmpError;

    fn try_from(from: &utmp) -> Result<Self, UtmpError> {
        Ok(match from.ut_type {
            utmp_raw::EMPTY => UtmpEntry::Empty,
            utmp_raw::RUN_LVL => {
                let kernel_version =
                    string_from_bytes(&from.ut_host).map_err(UtmpError::InvalidHost)?;
                let time = time_from_tv(from.ut_tv)?;
                if from.ut_line[0] == b'~' && from.ut_user.starts_with(b"shutdown\0") {
                    UtmpEntry::ShutdownTime {
                        kernel_version,
                        time,
                    }
                } else {
                    UtmpEntry::RunLevel {
                        kernel_version,
                        time,
                    }
                }
            }
            utmp_raw::BOOT_TIME => UtmpEntry::BootTime {
                kernel_version: string_from_bytes(&from.ut_host).map_err(UtmpError::InvalidHost)?,
                time: time_from_tv(from.ut_tv)?,
            },
            utmp_raw::NEW_TIME => UtmpEntry::NewTime(time_from_tv(from.ut_tv)?),
            utmp_raw::OLD_TIME => UtmpEntry::OldTime(time_from_tv(from.ut_tv)?),
            utmp_raw::INIT_PROCESS => UtmpEntry::InitProcess {
                pid: from.ut_pid,
                time: time_from_tv(from.ut_tv)?,
            },
            utmp_raw::LOGIN_PROCESS => UtmpEntry::LoginProcess {
                pid: from.ut_pid,
                time: time_from_tv(from.ut_tv)?,
            },
            utmp_raw::USER_PROCESS => UtmpEntry::UserProcess {
                pid: from.ut_pid,
                line: string_from_bytes(&from.ut_line).map_err(UtmpError::InvalidLine)?,
                user: string_from_bytes(&from.ut_user).map_err(UtmpError::InvalidUser)?,
                host: string_from_bytes(&from.ut_host).map_err(UtmpError::InvalidHost)?,
                session: from.ut_session,
                time: time_from_tv(from.ut_tv)?,
            },
            utmp_raw::DEAD_PROCESS => UtmpEntry::DeadProcess {
                pid: from.ut_pid,
                time: time_from_tv(from.ut_tv)?,
            },
            utmp_raw::ACCOUNTING => UtmpEntry::Accounting,
            _ => return Err(UtmpError::UnknownType(from.ut_type)),
        })
    }
}

#[derive(Debug, Error)]
#[non_exhaustive]
pub enum UtmpError {
    #[error("unknown type {0}")]
    UnknownType(c_short),
    #[error("invalid time value {0:?}")]
    InvalidTime(timeval),
    #[error("invalid line value `{0:?}`")]
    InvalidLine(Box<[u8]>),
    #[error("invalid user value `{0:?}`")]
    InvalidUser(Box<[u8]>),
    #[error("invalid host value `{0:?}`")]
    InvalidHost(Box<[u8]>),
}

fn time_from_tv(tv: timeval) -> Result<OffsetDateTime, UtmpError> {
    let timeval { tv_sec, tv_usec } = tv;
    if tv_usec < 0 {
        return Err(UtmpError::InvalidTime(tv));
    }
    let usec = i128::from(tv_sec) * 1_000_000 + i128::from(tv_usec);
    OffsetDateTime::from_unix_timestamp_nanos(usec * 1000).map_err(|_| UtmpError::InvalidTime(tv))
}

fn string_from_bytes(bytes: &[u8]) -> Result<String, Box<[u8]>> {
    bytes
        .iter()
        .position(|b| *b == 0)
        .and_then(|pos| {
            // This is safe because we manually located the first zero byte above.
            let cstr = unsafe { CStr::from_bytes_with_nul_unchecked(&bytes[..=pos]) };
            Some(cstr.to_str().ok()?.to_string())
        })
        .ok_or_else(|| bytes.to_owned().into_boxed_slice())
}