Question

For our assignment we are given a copy of a wtmp log, and are expected to parse it, and output it in a sorted format, similar to the output of last.

Now, I know that the file wtmp consists of a list of utmp structures. The file provided is guaranteed to contain at least one utmp structure and I’m supposed to assume all structures in the binary file are constructed correctly.

I’ve read through man utmp, and I have successfully written a program to read in the structs from the binary file provided. (My apologies for the lengthy print method)

#include <stdio.h>
#include <string.h>
#include <utmp.h>
#include <stdlib.h>

void utmpprint(struct utmp *log);

int main() {

    int logsize = 10;
    FILE *file;
    struct utmp log[logsize];
    int i = 0;

    file = fopen("wtmp", "rb");

    if (file) {
            fread(&log, sizeof(struct utmp), logsize, file);
            for(i = 0; i < logsize; i++) {
                    utmpprint(&log[i]);
            }
    } else {
            return(0);
    }
    return(0);
}


void utmpprint(struct utmp *log) {
    printf("{ ut_type: %i, ut_pid: %i, ut_line: %s, ut_id: %s,
        ut_user: %s, ut_host:   %s, ut_exit: { e_termination: %i,
        e_exit: %i }, ut_session: %i, timeval: { tv_sec: %i, tv_usec: %i },
        ut_addr_v6: %i }\n\n", log->ut_type, log->ut_pid, log->ut_line,
        log->ut_id, log->ut_user, log->ut_host, log->ut_exit.e_termination,
        log->ut_exit.e_exit, log->ut_session, log->ut_tv.tv_sec,
        log->ut_tv.tv_usec, log->ut_addr_v6);
}

Now, the problem I’m having is that when I run this, the output for ut_id is different than what I expect it to be.

From: man utmp

char ut_id[4];      /*Terminal name suffix, or inittab(5) ID */

My output:

... ut_line: pts/2, ut_id: ts/2jsmith, ut_user: jsmith, ...

I’m not quite sure what is going on here. What I think might be happening is that the ut_id field just might not exist in the struct that I am reading in. I think that might explain why the ut_id field is being displayed as the fields on either side of it squashed together.

I thought that I could possibly use fprintf formatting to get the field to display correctly, but it seems that you can only format text to one side of a char array or another, not grab specific parts from inside the string.

Otherwise, I’m pretty lost. Is this just a gap in my understanding of structs?

Not looking for answers, more so just some prodding in the right direction.

Also, what exactly is the terminal name suffix? Is that just the number that follows after pts/?

Answer 1

man utmp says “String fields are terminated by a null byte (‘\0’) if they are shorter than the size of the field.” So, in particular, if they are the same size as the field then they are not terminated by a null byte. Well formed C strings must be terminated by a null byte. The fact that it looks like the ut_id field is 4 characters long “ts/2” suggests that it does not have a terminating null byte.

You’re printing the char arrays using the %s formatting argument to printf. This keeps printing until it reaches a null byte. I suggest that you need to copy each field of the utmp to a temporary char array, which is one bigger than the size in the utmp structure. Make sure the last byte of that temporary array is a null byte, and it should print out OK.