#!/bin/sh
#
#     tiger - A UN*X security checking system
#     Copyright (C) 1993 Douglas Lee Schales, David K. Hess, David R. Safford
#
#    This program is free software; you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation; either version 2, or (at your option)
#    any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#     Please see the file `COPYING' for the complete copyright notice.
#
# difflogs - 06/16/93
#
# 09/19/2003 - jfs - Fix from Nicholas Franois to work properly in Solaris.
# 05/12/2003 - jfs - Sort input before diffing. For some reason some
#                    checks might not always sort information properly
#                    and people might get spurious reports.
# 12/26/2001 jfs Modified intensively to work properly. Added
#  a new feature and associated variables in tigerrc so that cron jobs 
#  can be compared against a "template" (policy-compliant?) runs. 
#  This can reduce false positives even if they cannot be reduced 
#  in a given module.
#
#-----------------------------------------------------------------------------
# TODO:
# - Consider including always ERR messages regardless of wether they were not
#   present since otherwise scripts that do not run (due to ERRs) might be
#   only reported once in cron. Maybe this could be an option? 
#   (Always_Report_ERR?)
#-----------------------------------------------------------------------------
#
[ -z "$DIFF" ] && DIFF=`which diff`
[ -z "$CAT" ] && CAT=`which cat`
[ -z "$RM" ] && RM=`which rm`
[ -z "$SORT" ] && SORT=`which sort`
[ -z "$SORT" ] && SORT=$CAT
[ -z "$WORKDIR" ] && WORKDIR="/tmp"


oldfile="$1"
newfile="$2"

SPC="$DIFFD"

[ ! -n "$DIFF" ] && {
  $CAT $newfile
  exit 0
}

if [ -s "$oldfile" ]; then
  $SORT $oldfile >$WORKDIR/oldfile.sort.$$
  $SORT $newfile >$WORKDIR/newfile.sort.$$
  $DIFF -D${SPC}TIGERCHANGES $WORKDIR/oldfile.sort.$$ $WORKDIR/newfile.sort.$$ |
  {
    lastcontext=
    flag=0
    listing=0
    while read line
    do
      case "$line" in
	'#ifdef TIGERCHANGES') flag=1;;
	\#endif*) flag=0;;
	'#ifndef TIGERCHANGES') flag=2;;
	\#else*) {
	  [ $flag -eq 1 ] && flag=2
	  [ $flag -eq 2 ] && flag=1
	}
	;;
	\#*) {
	  listing=0
	  [ $flag -eq 2 -o $flag -eq 1 ] && echo "$line"
	  [ $flag -eq 0 ] && lastcontext=$line
	}
	;;
	--[A-Z]*) {
	  listing=1
	  [ -n "$lastcontext" ] && echo "$lastcontext"
	  [ $flag -eq 1 ] && echo "NEW: $line"
	  [ $flag -eq 2 ] && echo "OLD: $line"
	  lastcontext=
	}
	;;
	*) {
	  [ -n "$line" -a $listing -eq 1 ] &&  {
	  [ $flag -eq 1 ] && echo "NEW: $line"
	  [ $flag -eq 2 ] && echo "OLD: $line"
	  }
	 }
        ;;
      esac
    done
  } > $WORKDIR/tc.msg.$$
  $CAT $WORKDIR/tc.msg.$$
  $RM -f "$WORKDIR/tc.msg.$$"
  [ -f "$WORKDIR/newfile.sort.$$" ] && $RM -f "$WORKDIR/newfile.sort.$$"
  [ -f "$WORKDIR/oldfile.sort.$$" ] && $RM -f "$WORKDIR/oldfile.sort.$$"
else
  $CAT $newfile
fi
