# Copyright 2026 SigmaSRC, Inc. All Rights Reserved.

"""Gather /etc/hosts.equiv contents.

Table columns:

- host      -- the hostname column from the .rhosts file; includes + markup
- ipaddr    -- lookup of host (after stripping + or -); may be empty
- user      -- the username column from the .rhosts file; may be empty

Example:

Suppose /etc/hosts.equiv contains the following:

    # never mind that this is insane :-)

    +
    + +
    foo
    +foo -bar         # this is a comment
    -foo

and assuming the IP address of host 'foo' is 1.2.3.4.  Then we
generate the following records:

    '+', '', ''
    '+', '', '+'
    'foo', '1.2.3.4', ''
    '+foo', '1.2.3.4', '-bar'
    '-foo', '1.2.3.4', ''
"""

import os
import sys
import socket

if __name__ == "__main__":
    try:
        import sigma
    except ImportError:
        sys.path.append(os.path.join(os.pardir, os.pardir))

def Gather(collector):
    # The third column used to be called "user", but that's an Oracle 
    # reserved word, so now it's "remoteuser".
    # The server takes advantage of the fact that this table has the
    # same trust consequences as the table from gather_rhosts, if you ignore
    # the "localuser" column from gather_rhosts.
    t = collector.table("hosts_equiv", ["host", "ipaddr", "remoteuser"])
    try:
        f = open("/etc/hosts.equiv")
    except IOError:
        return
    try:
        for line in f:
            words = line.split()
            if not words or words[0].startswith("#"):
                continue
            host = words[0]
            if len(words) >= 2 and not words[1].startswith("#"):
                user = words[1]
            else:
                user = ""
            ipaddr = ""
            realhost = host
            if realhost[0] in ("+", "-"):
                realhost = realhost[1:]
                if realhost.startswith("@"):
                    realhost = ""
            if realhost:
                try:
                    ipaddr = socket.gethostbyname(realhost)
                except socket.error:
                    pass
            t.add([host, ipaddr, user])
    finally:
        f.close()

def _test():
    from sigma.gather import gathering
    gathering.test(Gather)

if __name__ == "__main__":
    _test()
