1ca0716f5SRobert Watson /*-
2ca0716f5SRobert Watson * Copyright (c) 2004-2009 Apple Inc.
3ca0716f5SRobert Watson * Copyright (c) 2005 SPARTA, Inc.
4ca0716f5SRobert Watson * All rights reserved.
5ca0716f5SRobert Watson *
6ca0716f5SRobert Watson * This code was developed in part by Robert N. M. Watson, Senior Principal
7ca0716f5SRobert Watson * Scientist, SPARTA, Inc.
8ca0716f5SRobert Watson *
9ca0716f5SRobert Watson * Redistribution and use in source and binary forms, with or without
10ca0716f5SRobert Watson * modification, are permitted provided that the following conditions
11ca0716f5SRobert Watson * are met:
12ca0716f5SRobert Watson * 1. Redistributions of source code must retain the above copyright
13ca0716f5SRobert Watson * notice, this list of conditions and the following disclaimer.
14ca0716f5SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright
15ca0716f5SRobert Watson * notice, this list of conditions and the following disclaimer in the
16ca0716f5SRobert Watson * documentation and/or other materials provided with the distribution.
17ca0716f5SRobert Watson * 3. Neither the name of Apple Inc. ("Apple") nor the names of
18ca0716f5SRobert Watson * its contributors may be used to endorse or promote products derived
19ca0716f5SRobert Watson * from this software without specific prior written permission.
20ca0716f5SRobert Watson *
21ca0716f5SRobert Watson * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND
22ca0716f5SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23ca0716f5SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24ca0716f5SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR
25ca0716f5SRobert Watson * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26ca0716f5SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27ca0716f5SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28ca0716f5SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
29ca0716f5SRobert Watson * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
30ca0716f5SRobert Watson * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31ca0716f5SRobert Watson * POSSIBILITY OF SUCH DAMAGE.
32ca0716f5SRobert Watson */
330814440eSRobert Watson
34ca0716f5SRobert Watson #include <sys/types.h>
35ca0716f5SRobert Watson
36ca0716f5SRobert Watson #include <config/config.h>
373b97a967SRobert Watson
383b97a967SRobert Watson #ifdef USE_ENDIAN_H
393b97a967SRobert Watson #include <endian.h>
40ca0716f5SRobert Watson #endif
413b97a967SRobert Watson #ifdef USE_SYS_ENDIAN_H
423b97a967SRobert Watson #include <sys/endian.h>
433b97a967SRobert Watson #endif
443b97a967SRobert Watson #ifdef USE_MACHINE_ENDIAN_H
453b97a967SRobert Watson #include <machine/endian.h>
463b97a967SRobert Watson #endif
473b97a967SRobert Watson #ifdef USE_COMPAT_ENDIAN_H
483b97a967SRobert Watson #include <compat/endian.h>
493b97a967SRobert Watson #endif
503b97a967SRobert Watson #ifdef USE_COMPAT_ENDIAN_ENC_H
513b97a967SRobert Watson #include <compat/endian_enc.h>
523b97a967SRobert Watson #endif
533b97a967SRobert Watson
543b97a967SRobert Watson #ifdef HAVE_FULL_QUEUE_H
553b97a967SRobert Watson #include <sys/queue.h>
563b97a967SRobert Watson #else /* !HAVE_FULL_QUEUE_H */
573b97a967SRobert Watson #include <compat/queue.h>
583b97a967SRobert Watson #endif /* !HAVE_FULL_QUEUE_H */
59ca0716f5SRobert Watson
60ca0716f5SRobert Watson #include <sys/socket.h>
61ca0716f5SRobert Watson #include <sys/time.h>
62ca0716f5SRobert Watson #include <sys/un.h>
63ca0716f5SRobert Watson
64ca0716f5SRobert Watson #include <sys/ipc.h>
65ca0716f5SRobert Watson
66ca0716f5SRobert Watson #include <netinet/in.h>
67ca0716f5SRobert Watson #include <netinet/in_systm.h>
68ca0716f5SRobert Watson #include <netinet/ip.h>
69ca0716f5SRobert Watson
70ca0716f5SRobert Watson #include <assert.h>
71ca0716f5SRobert Watson #include <errno.h>
72ca0716f5SRobert Watson #include <string.h>
73ca0716f5SRobert Watson #include <stdlib.h>
74ca0716f5SRobert Watson #include <unistd.h>
75ca0716f5SRobert Watson
76ca0716f5SRobert Watson #include <bsm/audit_internal.h>
77ca0716f5SRobert Watson #include <bsm/libbsm.h>
78ca0716f5SRobert Watson
79ca0716f5SRobert Watson #define GET_TOKEN_AREA(t, dptr, length) do { \
80ca0716f5SRobert Watson (t) = malloc(sizeof(token_t)); \
81ca0716f5SRobert Watson if ((t) != NULL) { \
82ca0716f5SRobert Watson (t)->len = (length); \
83ca0716f5SRobert Watson (dptr) = (t->t_data) = calloc((length), sizeof(u_char)); \
84ca0716f5SRobert Watson if ((dptr) == NULL) { \
85ca0716f5SRobert Watson free(t); \
86ca0716f5SRobert Watson (t) = NULL; \
87ca0716f5SRobert Watson } \
88ca0716f5SRobert Watson } else \
89ca0716f5SRobert Watson (dptr) = NULL; \
90ca0716f5SRobert Watson assert((t) == NULL || (dptr) != NULL); \
91ca0716f5SRobert Watson } while (0)
92ca0716f5SRobert Watson
93ca0716f5SRobert Watson /*
94ca0716f5SRobert Watson * token ID 1 byte
95ca0716f5SRobert Watson * success/failure 1 byte
96ca0716f5SRobert Watson * privstrlen 2 bytes
97ca0716f5SRobert Watson * privstr N bytes + 1 (\0 byte)
98ca0716f5SRobert Watson */
99ca0716f5SRobert Watson token_t *
au_to_upriv(char sorf,char * priv)100ca0716f5SRobert Watson au_to_upriv(char sorf, char *priv)
101ca0716f5SRobert Watson {
102ca0716f5SRobert Watson u_int16_t textlen;
103ca0716f5SRobert Watson u_char *dptr;
104ca0716f5SRobert Watson token_t *t;
105ca0716f5SRobert Watson
106ca0716f5SRobert Watson textlen = strlen(priv) + 1;
107ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_char) +
108ca0716f5SRobert Watson sizeof(u_int16_t) + textlen);
109ca0716f5SRobert Watson if (t == NULL)
110ca0716f5SRobert Watson return (NULL);
111ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_UPRIV);
112ca0716f5SRobert Watson ADD_U_CHAR(dptr, sorf);
113ca0716f5SRobert Watson ADD_U_INT16(dptr, textlen);
114ca0716f5SRobert Watson ADD_STRING(dptr, priv, textlen);
115ca0716f5SRobert Watson return (t);
116ca0716f5SRobert Watson }
117ca0716f5SRobert Watson
118ca0716f5SRobert Watson /*
119ca0716f5SRobert Watson * token ID 1 byte
120ca0716f5SRobert Watson * privtstrlen 2 bytes
121ca0716f5SRobert Watson * privtstr N bytes + 1
122ca0716f5SRobert Watson * privstrlen 2 bytes
123ca0716f5SRobert Watson * privstr N bytes + 1
124ca0716f5SRobert Watson */
125ca0716f5SRobert Watson token_t *
au_to_privset(char * privtypestr,char * privstr)126ca0716f5SRobert Watson au_to_privset(char *privtypestr, char *privstr)
127ca0716f5SRobert Watson {
128ca0716f5SRobert Watson u_int16_t type_len, priv_len;
129ca0716f5SRobert Watson u_char *dptr;
130ca0716f5SRobert Watson token_t *t;
131ca0716f5SRobert Watson
132ca0716f5SRobert Watson type_len = strlen(privtypestr) + 1;
133ca0716f5SRobert Watson priv_len = strlen(privstr) + 1;
134ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
135ca0716f5SRobert Watson sizeof(u_int16_t) + type_len + priv_len);
136ca0716f5SRobert Watson if (t == NULL)
137ca0716f5SRobert Watson return (NULL);
138ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_PRIV);
139ca0716f5SRobert Watson ADD_U_INT16(dptr, type_len);
140ca0716f5SRobert Watson ADD_STRING(dptr, privtypestr, type_len);
141ca0716f5SRobert Watson ADD_U_INT16(dptr, priv_len);
142ca0716f5SRobert Watson ADD_STRING(dptr, privstr, priv_len);
143ca0716f5SRobert Watson return (t);
144ca0716f5SRobert Watson }
145ca0716f5SRobert Watson
146ca0716f5SRobert Watson /*
147ca0716f5SRobert Watson * token ID 1 byte
148ca0716f5SRobert Watson * argument # 1 byte
149ca0716f5SRobert Watson * argument value 4 bytes/8 bytes (32-bit/64-bit value)
150ca0716f5SRobert Watson * text length 2 bytes
151ca0716f5SRobert Watson * text N bytes + 1 terminating NULL byte
152ca0716f5SRobert Watson */
153ca0716f5SRobert Watson token_t *
au_to_arg32(char n,const char * text,u_int32_t v)154ca0716f5SRobert Watson au_to_arg32(char n, const char *text, u_int32_t v)
155ca0716f5SRobert Watson {
156ca0716f5SRobert Watson token_t *t;
157ca0716f5SRobert Watson u_char *dptr = NULL;
158ca0716f5SRobert Watson u_int16_t textlen;
159ca0716f5SRobert Watson
160ca0716f5SRobert Watson textlen = strlen(text);
161ca0716f5SRobert Watson textlen += 1;
162ca0716f5SRobert Watson
163ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t) +
164ca0716f5SRobert Watson sizeof(u_int16_t) + textlen);
165ca0716f5SRobert Watson if (t == NULL)
166ca0716f5SRobert Watson return (NULL);
167ca0716f5SRobert Watson
168ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_ARG32);
169ca0716f5SRobert Watson ADD_U_CHAR(dptr, n);
170ca0716f5SRobert Watson ADD_U_INT32(dptr, v);
171ca0716f5SRobert Watson ADD_U_INT16(dptr, textlen);
172ca0716f5SRobert Watson ADD_STRING(dptr, text, textlen);
173ca0716f5SRobert Watson
174ca0716f5SRobert Watson return (t);
175ca0716f5SRobert Watson }
176ca0716f5SRobert Watson
177ca0716f5SRobert Watson token_t *
au_to_arg64(char n,const char * text,u_int64_t v)178ca0716f5SRobert Watson au_to_arg64(char n, const char *text, u_int64_t v)
179ca0716f5SRobert Watson {
180ca0716f5SRobert Watson token_t *t;
181ca0716f5SRobert Watson u_char *dptr = NULL;
182ca0716f5SRobert Watson u_int16_t textlen;
183ca0716f5SRobert Watson
184ca0716f5SRobert Watson textlen = strlen(text);
185ca0716f5SRobert Watson textlen += 1;
186ca0716f5SRobert Watson
187ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) +
188ca0716f5SRobert Watson sizeof(u_int16_t) + textlen);
189ca0716f5SRobert Watson if (t == NULL)
190ca0716f5SRobert Watson return (NULL);
191ca0716f5SRobert Watson
192ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_ARG64);
193ca0716f5SRobert Watson ADD_U_CHAR(dptr, n);
194ca0716f5SRobert Watson ADD_U_INT64(dptr, v);
195ca0716f5SRobert Watson ADD_U_INT16(dptr, textlen);
196ca0716f5SRobert Watson ADD_STRING(dptr, text, textlen);
197ca0716f5SRobert Watson
198ca0716f5SRobert Watson return (t);
199ca0716f5SRobert Watson }
200ca0716f5SRobert Watson
201ca0716f5SRobert Watson token_t *
au_to_arg(char n,const char * text,u_int32_t v)202ca0716f5SRobert Watson au_to_arg(char n, const char *text, u_int32_t v)
203ca0716f5SRobert Watson {
204ca0716f5SRobert Watson
205ca0716f5SRobert Watson return (au_to_arg32(n, text, v));
206ca0716f5SRobert Watson }
207ca0716f5SRobert Watson
208ca0716f5SRobert Watson #if defined(_KERNEL) || defined(KERNEL)
209ca0716f5SRobert Watson /*
210ca0716f5SRobert Watson * token ID 1 byte
211ca0716f5SRobert Watson * file access mode 4 bytes
212ca0716f5SRobert Watson * owner user ID 4 bytes
213ca0716f5SRobert Watson * owner group ID 4 bytes
214ca0716f5SRobert Watson * file system ID 4 bytes
215bc168a6cSRobert Watson * node ID 8 bytes
216bc168a6cSRobert Watson * device 4 bytes/8 bytes (32-bit/64-bit)
217bc168a6cSRobert Watson */
218bc168a6cSRobert Watson token_t *
au_to_attr32(struct vnode_au_info * vni)219ca0716f5SRobert Watson au_to_attr32(struct vnode_au_info *vni)
220bc168a6cSRobert Watson {
221bc168a6cSRobert Watson token_t *t;
222bc168a6cSRobert Watson u_char *dptr = NULL;
223ca0716f5SRobert Watson u_int16_t pad0_16 = 0;
224bc168a6cSRobert Watson u_int32_t pad0_32 = 0;
225bc168a6cSRobert Watson
226bc168a6cSRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
227bc168a6cSRobert Watson 3 * sizeof(u_int32_t) + sizeof(u_int64_t) + sizeof(u_int32_t));
228bc168a6cSRobert Watson if (t == NULL)
229bc168a6cSRobert Watson return (NULL);
230bc168a6cSRobert Watson
231bc168a6cSRobert Watson ADD_U_CHAR(dptr, AUT_ATTR32);
232bc168a6cSRobert Watson
233bc168a6cSRobert Watson /*
234bc168a6cSRobert Watson * BSD defines the size for the file mode as 2 bytes; BSM defines 4
235bc168a6cSRobert Watson * so pad with 0.
236bc168a6cSRobert Watson *
237bc168a6cSRobert Watson * XXXRW: Possibly should be conditionally compiled.
238bc168a6cSRobert Watson *
239bc168a6cSRobert Watson * XXXRW: Should any conversions take place on the mode?
240bc168a6cSRobert Watson */
241bc168a6cSRobert Watson ADD_U_INT16(dptr, pad0_16);
242bc168a6cSRobert Watson ADD_U_INT16(dptr, vni->vn_mode);
243bc168a6cSRobert Watson
244bc168a6cSRobert Watson ADD_U_INT32(dptr, vni->vn_uid);
245bc168a6cSRobert Watson ADD_U_INT32(dptr, vni->vn_gid);
246bc168a6cSRobert Watson ADD_U_INT32(dptr, vni->vn_fsid);
247bc168a6cSRobert Watson
248bc168a6cSRobert Watson /*
249bc168a6cSRobert Watson * Some systems use 32-bit file ID's, others use 64-bit file IDs.
250bc168a6cSRobert Watson * Attempt to handle both, and let the compiler sort it out. If we
251bc168a6cSRobert Watson * could pick this out at compile-time, it would be better, so as to
252bc168a6cSRobert Watson * avoid the else case below.
253bc168a6cSRobert Watson */
254bc168a6cSRobert Watson if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) {
255ca0716f5SRobert Watson ADD_U_INT32(dptr, pad0_32);
256ca0716f5SRobert Watson ADD_U_INT32(dptr, vni->vn_fileid);
257ca0716f5SRobert Watson } else if (sizeof(vni->vn_fileid) == sizeof(uint64_t))
258ca0716f5SRobert Watson ADD_U_INT64(dptr, vni->vn_fileid);
259ca0716f5SRobert Watson else
260ca0716f5SRobert Watson ADD_U_INT64(dptr, 0LL);
261ca0716f5SRobert Watson
262ca0716f5SRobert Watson ADD_U_INT32(dptr, vni->vn_dev);
263ca0716f5SRobert Watson
264ca0716f5SRobert Watson return (t);
265ca0716f5SRobert Watson }
266ca0716f5SRobert Watson
267ca0716f5SRobert Watson token_t *
au_to_attr64(struct vnode_au_info * vni)268ca0716f5SRobert Watson au_to_attr64(struct vnode_au_info *vni)
269ca0716f5SRobert Watson {
270ca0716f5SRobert Watson token_t *t;
271ca0716f5SRobert Watson u_char *dptr = NULL;
272ca0716f5SRobert Watson u_int16_t pad0_16 = 0;
273ca0716f5SRobert Watson u_int32_t pad0_32 = 0;
274ca0716f5SRobert Watson
275ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
276ca0716f5SRobert Watson 3 * sizeof(u_int32_t) + sizeof(u_int64_t) * 2);
277ca0716f5SRobert Watson if (t == NULL)
278ca0716f5SRobert Watson return (NULL);
279ca0716f5SRobert Watson
280ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_ATTR64);
281ca0716f5SRobert Watson
282506764c6SRobert Watson /*
283ca0716f5SRobert Watson * BSD defines the size for the file mode as 2 bytes; BSM defines 4
284ca0716f5SRobert Watson * so pad with 0.
285ca0716f5SRobert Watson *
286ca0716f5SRobert Watson * XXXRW: Possibly should be conditionally compiled.
287ca0716f5SRobert Watson *
288ca0716f5SRobert Watson * XXXRW: Should any conversions take place on the mode?
289ca0716f5SRobert Watson */
290506764c6SRobert Watson ADD_U_INT16(dptr, pad0_16);
291506764c6SRobert Watson ADD_U_INT16(dptr, vni->vn_mode);
292506764c6SRobert Watson
293506764c6SRobert Watson ADD_U_INT32(dptr, vni->vn_uid);
294506764c6SRobert Watson ADD_U_INT32(dptr, vni->vn_gid);
295506764c6SRobert Watson ADD_U_INT32(dptr, vni->vn_fsid);
296506764c6SRobert Watson
297ca0716f5SRobert Watson /*
298ca0716f5SRobert Watson * Some systems use 32-bit file ID's, other's use 64-bit file IDs.
299ca0716f5SRobert Watson * Attempt to handle both, and let the compiler sort it out. If we
300ca0716f5SRobert Watson * could pick this out at compile-time, it would be better, so as to
301ca0716f5SRobert Watson * avoid the else case below.
302ca0716f5SRobert Watson */
303ca0716f5SRobert Watson if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) {
304ca0716f5SRobert Watson ADD_U_INT32(dptr, pad0_32);
305ca0716f5SRobert Watson ADD_U_INT32(dptr, vni->vn_fileid);
306506764c6SRobert Watson } else if (sizeof(vni->vn_fileid) == sizeof(uint64_t))
307ca0716f5SRobert Watson ADD_U_INT64(dptr, vni->vn_fileid);
308ca0716f5SRobert Watson else
309ca0716f5SRobert Watson ADD_U_INT64(dptr, 0LL);
310ca0716f5SRobert Watson
311ca0716f5SRobert Watson ADD_U_INT64(dptr, vni->vn_dev);
312ca0716f5SRobert Watson
313ca0716f5SRobert Watson return (t);
314ca0716f5SRobert Watson }
315ca0716f5SRobert Watson
316ca0716f5SRobert Watson token_t *
au_to_attr(struct vnode_au_info * vni)317ca0716f5SRobert Watson au_to_attr(struct vnode_au_info *vni)
318ca0716f5SRobert Watson {
319ca0716f5SRobert Watson
320ca0716f5SRobert Watson return (au_to_attr32(vni));
321ca0716f5SRobert Watson }
322ca0716f5SRobert Watson #endif /* !(defined(_KERNEL) || defined(KERNEL) */
323ca0716f5SRobert Watson
324ca0716f5SRobert Watson /*
325ca0716f5SRobert Watson * token ID 1 byte
326ca0716f5SRobert Watson * how to print 1 byte
327ca0716f5SRobert Watson * basic unit 1 byte
328ca0716f5SRobert Watson * unit count 1 byte
329ca0716f5SRobert Watson * data items (depends on basic unit)
330ca0716f5SRobert Watson */
331ca0716f5SRobert Watson token_t *
au_to_data(char unit_print,char unit_type,char unit_count,const char * p)332ca0716f5SRobert Watson au_to_data(char unit_print, char unit_type, char unit_count, const char *p)
333ca0716f5SRobert Watson {
334ca0716f5SRobert Watson token_t *t;
335ca0716f5SRobert Watson u_char *dptr = NULL;
336ca0716f5SRobert Watson size_t datasize, totdata;
337ca0716f5SRobert Watson
338ca0716f5SRobert Watson /* Determine the size of the basic unit. */
339ca0716f5SRobert Watson switch (unit_type) {
340ca0716f5SRobert Watson case AUR_BYTE:
341ca0716f5SRobert Watson /* case AUR_CHAR: */
342ca0716f5SRobert Watson datasize = AUR_BYTE_SIZE;
343ca0716f5SRobert Watson break;
344ca0716f5SRobert Watson
345ca0716f5SRobert Watson case AUR_SHORT:
346ca0716f5SRobert Watson datasize = AUR_SHORT_SIZE;
347ca0716f5SRobert Watson break;
348bc168a6cSRobert Watson
349ca0716f5SRobert Watson case AUR_INT32:
350ca0716f5SRobert Watson /* case AUR_INT: */
351ca0716f5SRobert Watson datasize = AUR_INT32_SIZE;
352ca0716f5SRobert Watson break;
353ca0716f5SRobert Watson
354ca0716f5SRobert Watson case AUR_INT64:
355ca0716f5SRobert Watson datasize = AUR_INT64_SIZE;
356ca0716f5SRobert Watson break;
357ca0716f5SRobert Watson
358ca0716f5SRobert Watson default:
359ca0716f5SRobert Watson errno = EINVAL;
360ca0716f5SRobert Watson return (NULL);
361ca0716f5SRobert Watson }
362ca0716f5SRobert Watson
363ca0716f5SRobert Watson totdata = datasize * unit_count;
364ca0716f5SRobert Watson
365ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata);
366ca0716f5SRobert Watson if (t == NULL)
367ca0716f5SRobert Watson return (NULL);
368ca0716f5SRobert Watson
369ca0716f5SRobert Watson /*
370ca0716f5SRobert Watson * XXXRW: We should be byte-swapping each data item for multi-byte
371ca0716f5SRobert Watson * types.
372ca0716f5SRobert Watson */
373ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_DATA);
374ca0716f5SRobert Watson ADD_U_CHAR(dptr, unit_print);
375ca0716f5SRobert Watson ADD_U_CHAR(dptr, unit_type);
376ca0716f5SRobert Watson ADD_U_CHAR(dptr, unit_count);
377ca0716f5SRobert Watson ADD_MEM(dptr, p, totdata);
378ca0716f5SRobert Watson
379ca0716f5SRobert Watson return (t);
380ca0716f5SRobert Watson }
381ca0716f5SRobert Watson
382ca0716f5SRobert Watson
383ca0716f5SRobert Watson /*
384ca0716f5SRobert Watson * token ID 1 byte
385ca0716f5SRobert Watson * status 4 bytes
386506764c6SRobert Watson * return value 4 bytes
387ca0716f5SRobert Watson */
388ca0716f5SRobert Watson token_t *
au_to_exit(int retval,int err)389ca0716f5SRobert Watson au_to_exit(int retval, int err)
390ca0716f5SRobert Watson {
391506764c6SRobert Watson token_t *t;
392ca0716f5SRobert Watson u_char *dptr = NULL;
393ca0716f5SRobert Watson
394ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t));
395ca0716f5SRobert Watson if (t == NULL)
396ca0716f5SRobert Watson return (NULL);
397ca0716f5SRobert Watson
398ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_EXIT);
399ca0716f5SRobert Watson ADD_U_INT32(dptr, err);
400ca0716f5SRobert Watson ADD_U_INT32(dptr, retval);
401ca0716f5SRobert Watson
402ca0716f5SRobert Watson return (t);
403ca0716f5SRobert Watson }
404ca0716f5SRobert Watson
405ca0716f5SRobert Watson /*
406ca0716f5SRobert Watson */
407ca0716f5SRobert Watson token_t *
au_to_groups(int * groups)408506764c6SRobert Watson au_to_groups(int *groups)
409ca0716f5SRobert Watson {
410ca0716f5SRobert Watson
411ca0716f5SRobert Watson return (au_to_newgroups(AUDIT_MAX_GROUPS, (gid_t *)groups));
412ca0716f5SRobert Watson }
413ca0716f5SRobert Watson
4140814440eSRobert Watson /*
415ca0716f5SRobert Watson * token ID 1 byte
416ca0716f5SRobert Watson * number groups 2 bytes
417ca0716f5SRobert Watson * group list count * 4 bytes
418ca0716f5SRobert Watson */
419ca0716f5SRobert Watson token_t *
au_to_newgroups(u_int16_t n,gid_t * groups)420ca0716f5SRobert Watson au_to_newgroups(u_int16_t n, gid_t *groups)
421ca0716f5SRobert Watson {
422bc168a6cSRobert Watson token_t *t;
423bc168a6cSRobert Watson u_char *dptr = NULL;
424ca0716f5SRobert Watson int i;
425ca0716f5SRobert Watson
426ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
427ca0716f5SRobert Watson n * sizeof(u_int32_t));
428ca0716f5SRobert Watson if (t == NULL)
429ca0716f5SRobert Watson return (NULL);
430ca0716f5SRobert Watson
431ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_NEWGROUPS);
432ca0716f5SRobert Watson ADD_U_INT16(dptr, n);
433ca0716f5SRobert Watson for (i = 0; i < n; i++)
434ca0716f5SRobert Watson ADD_U_INT32(dptr, groups[i]);
435ca0716f5SRobert Watson
436ca0716f5SRobert Watson return (t);
437ca0716f5SRobert Watson }
438ca0716f5SRobert Watson
439ca0716f5SRobert Watson /*
440ca0716f5SRobert Watson * token ID 1 byte
441ca0716f5SRobert Watson * internet address 4 bytes
442ca0716f5SRobert Watson */
443ca0716f5SRobert Watson token_t *
au_to_in_addr(struct in_addr * internet_addr)444ca0716f5SRobert Watson au_to_in_addr(struct in_addr *internet_addr)
445ca0716f5SRobert Watson {
446ca0716f5SRobert Watson token_t *t;
447ca0716f5SRobert Watson u_char *dptr = NULL;
448ca0716f5SRobert Watson
449ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(uint32_t));
450ca0716f5SRobert Watson if (t == NULL)
451ca0716f5SRobert Watson return (NULL);
452ca0716f5SRobert Watson
453ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_IN_ADDR);
454ca0716f5SRobert Watson ADD_MEM(dptr, &internet_addr->s_addr, sizeof(uint32_t));
455ca0716f5SRobert Watson
456ca0716f5SRobert Watson return (t);
457ca0716f5SRobert Watson }
458ca0716f5SRobert Watson
459ca0716f5SRobert Watson /*
460ca0716f5SRobert Watson * token ID 1 byte
461ca0716f5SRobert Watson * address type/length 4 bytes
462ca0716f5SRobert Watson * address 16 bytes
463ca0716f5SRobert Watson */
464ca0716f5SRobert Watson token_t *
au_to_in_addr_ex(struct in6_addr * internet_addr)465ca0716f5SRobert Watson au_to_in_addr_ex(struct in6_addr *internet_addr)
466ca0716f5SRobert Watson {
467ca0716f5SRobert Watson token_t *t;
468ca0716f5SRobert Watson u_char *dptr = NULL;
469ca0716f5SRobert Watson u_int32_t type = AU_IPv6;
470ca0716f5SRobert Watson
471ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 5 * sizeof(uint32_t));
472ca0716f5SRobert Watson if (t == NULL)
473ca0716f5SRobert Watson return (NULL);
474ca0716f5SRobert Watson
475ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_IN_ADDR_EX);
476ca0716f5SRobert Watson ADD_U_INT32(dptr, type);
477ca0716f5SRobert Watson ADD_MEM(dptr, internet_addr, 4 * sizeof(uint32_t));
478ca0716f5SRobert Watson
479ca0716f5SRobert Watson return (t);
480ca0716f5SRobert Watson }
481ca0716f5SRobert Watson
482ca0716f5SRobert Watson /*
483ca0716f5SRobert Watson * token ID 1 byte
484ca0716f5SRobert Watson * ip header 20 bytes
485ca0716f5SRobert Watson *
486ca0716f5SRobert Watson * The IP header should be submitted in network byte order.
487ca0716f5SRobert Watson */
488ca0716f5SRobert Watson token_t *
au_to_ip(struct ip * ip)489ca0716f5SRobert Watson au_to_ip(struct ip *ip)
490ca0716f5SRobert Watson {
491ca0716f5SRobert Watson token_t *t;
492ca0716f5SRobert Watson u_char *dptr = NULL;
493ca0716f5SRobert Watson
494ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(struct ip));
495ca0716f5SRobert Watson if (t == NULL)
496ca0716f5SRobert Watson return (NULL);
497ca0716f5SRobert Watson
498ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_IP);
499ca0716f5SRobert Watson ADD_MEM(dptr, ip, sizeof(struct ip));
500ca0716f5SRobert Watson
501ca0716f5SRobert Watson return (t);
502ca0716f5SRobert Watson }
503ca0716f5SRobert Watson
504ca0716f5SRobert Watson /*
505ca0716f5SRobert Watson * token ID 1 byte
506ca0716f5SRobert Watson * object ID type 1 byte
5073b97a967SRobert Watson * object ID 4 bytes
5083b97a967SRobert Watson */
5093b97a967SRobert Watson token_t *
au_to_ipc(char type,int id)5103b97a967SRobert Watson au_to_ipc(char type, int id)
5113b97a967SRobert Watson {
5123b97a967SRobert Watson token_t *t;
5133b97a967SRobert Watson u_char *dptr = NULL;
5143b97a967SRobert Watson
5153b97a967SRobert Watson GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
516ca0716f5SRobert Watson if (t == NULL)
5173b97a967SRobert Watson return (NULL);
518ca0716f5SRobert Watson
519ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_IPC);
520ca0716f5SRobert Watson ADD_U_CHAR(dptr, type);
521ca0716f5SRobert Watson ADD_U_INT32(dptr, id);
522ca0716f5SRobert Watson
523ca0716f5SRobert Watson return (t);
524ca0716f5SRobert Watson }
525ca0716f5SRobert Watson
526ca0716f5SRobert Watson /*
527ca0716f5SRobert Watson * token ID 1 byte
528ca0716f5SRobert Watson * owner user ID 4 bytes
529ca0716f5SRobert Watson * owner group ID 4 bytes
530ca0716f5SRobert Watson * creator user ID 4 bytes
531ca0716f5SRobert Watson * creator group ID 4 bytes
532ca0716f5SRobert Watson * access mode 4 bytes
533ca0716f5SRobert Watson * slot sequence # 4 bytes
534ca0716f5SRobert Watson * key 4 bytes
535ca0716f5SRobert Watson */
536ca0716f5SRobert Watson token_t *
au_to_ipc_perm(struct ipc_perm * perm)537ca0716f5SRobert Watson au_to_ipc_perm(struct ipc_perm *perm)
538ca0716f5SRobert Watson {
539ca0716f5SRobert Watson token_t *t;
540ca0716f5SRobert Watson u_char *dptr = NULL;
541ca0716f5SRobert Watson u_int16_t pad0 = 0;
542ca0716f5SRobert Watson
543ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) +
544ca0716f5SRobert Watson sizeof(u_int32_t));
545ca0716f5SRobert Watson if (t == NULL)
546ca0716f5SRobert Watson return (NULL);
547ca0716f5SRobert Watson
548ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_IPC_PERM);
549ca0716f5SRobert Watson
550ca0716f5SRobert Watson /*
551ca0716f5SRobert Watson * Systems vary significantly in what types they use in struct
552ca0716f5SRobert Watson * ipc_perm; at least a few still use 16-bit uid's and gid's, so
553ca0716f5SRobert Watson * allow for that, as BSM define 32-bit values here.
554ca0716f5SRobert Watson * Some systems define the sizes for ipc_perm members as 2 bytes;
555ca0716f5SRobert Watson * BSM defines 4 so pad with 0.
556ca0716f5SRobert Watson *
557ca0716f5SRobert Watson * XXXRW: Possibly shoulid be conditionally compiled, and more cases
558ca0716f5SRobert Watson * need to be handled.
559ca0716f5SRobert Watson */
560ca0716f5SRobert Watson if (sizeof(perm->uid) != sizeof(u_int32_t)) {
561ca0716f5SRobert Watson ADD_U_INT16(dptr, pad0);
562ca0716f5SRobert Watson ADD_U_INT16(dptr, perm->uid);
563ca0716f5SRobert Watson ADD_U_INT16(dptr, pad0);
564ca0716f5SRobert Watson ADD_U_INT16(dptr, perm->gid);
565ca0716f5SRobert Watson ADD_U_INT16(dptr, pad0);
566ca0716f5SRobert Watson ADD_U_INT16(dptr, perm->cuid);
567ca0716f5SRobert Watson ADD_U_INT16(dptr, pad0);
568ca0716f5SRobert Watson ADD_U_INT16(dptr, perm->cgid);
569ca0716f5SRobert Watson } else {
570ca0716f5SRobert Watson ADD_U_INT32(dptr, perm->uid);
571ca0716f5SRobert Watson ADD_U_INT32(dptr, perm->gid);
572ca0716f5SRobert Watson ADD_U_INT32(dptr, perm->cuid);
573ca0716f5SRobert Watson ADD_U_INT32(dptr, perm->cgid);
574ca0716f5SRobert Watson }
575ca0716f5SRobert Watson
576ca0716f5SRobert Watson ADD_U_INT16(dptr, pad0);
577ca0716f5SRobert Watson ADD_U_INT16(dptr, perm->mode);
578ca0716f5SRobert Watson
579ca0716f5SRobert Watson ADD_U_INT16(dptr, pad0);
580ca0716f5SRobert Watson
581ca0716f5SRobert Watson #ifdef HAVE_IPC_PERM___SEQ
582ca0716f5SRobert Watson ADD_U_INT16(dptr, perm->__seq);
583ca0716f5SRobert Watson #else /* HAVE_IPC_PERM___SEQ */
584ca0716f5SRobert Watson #ifdef HAVE_IPC_PERM__SEQ
585ca0716f5SRobert Watson ADD_U_INT16(dptr, perm->_seq);
586ca0716f5SRobert Watson #else /* HAVE_IPC_PERM__SEQ */
587ca0716f5SRobert Watson ADD_U_INT16(dptr, perm->seq);
588ca0716f5SRobert Watson #endif /* HAVE_IPC_PERM__SEQ */
589ca0716f5SRobert Watson #endif /* HAVE_IPC_PERM___SEQ */
590ca0716f5SRobert Watson
591ca0716f5SRobert Watson #ifdef HAVE_IPC_PERM___KEY
592ca0716f5SRobert Watson ADD_U_INT32(dptr, perm->__key);
593ca0716f5SRobert Watson #else /* HAVE_IPC_PERM___KEY */
594ca0716f5SRobert Watson #ifdef HAVE_IPC_PERM__KEY
595ca0716f5SRobert Watson ADD_U_INT32(dptr, perm->_key);
596ca0716f5SRobert Watson #else /* HAVE_IPC_PERM__KEY */
597ca0716f5SRobert Watson ADD_U_INT32(dptr, perm->key);
598ca0716f5SRobert Watson #endif /* HAVE_IPC_PERM__KEY */
599ca0716f5SRobert Watson #endif /* HAVE_IPC_PERM___KEY */
600ca0716f5SRobert Watson
601ca0716f5SRobert Watson return (t);
602ca0716f5SRobert Watson }
603ca0716f5SRobert Watson
604ca0716f5SRobert Watson /*
605ca0716f5SRobert Watson * token ID 1 byte
606ca0716f5SRobert Watson * port IP address 2 bytes
607ca0716f5SRobert Watson */
608ca0716f5SRobert Watson token_t *
au_to_iport(u_int16_t iport)609ca0716f5SRobert Watson au_to_iport(u_int16_t iport)
610ca0716f5SRobert Watson {
611ca0716f5SRobert Watson token_t *t;
612ca0716f5SRobert Watson u_char *dptr = NULL;
613ca0716f5SRobert Watson
614ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));
615ca0716f5SRobert Watson if (t == NULL)
616ca0716f5SRobert Watson return (NULL);
617ca0716f5SRobert Watson
618ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_IPORT);
619ca0716f5SRobert Watson ADD_U_INT16(dptr, iport);
620ca0716f5SRobert Watson
621ca0716f5SRobert Watson return (t);
622ca0716f5SRobert Watson }
623ca0716f5SRobert Watson
624ca0716f5SRobert Watson /*
625ca0716f5SRobert Watson * token ID 1 byte
626ca0716f5SRobert Watson * size 2 bytes
627ca0716f5SRobert Watson * data size bytes
628ca0716f5SRobert Watson */
629ca0716f5SRobert Watson token_t *
au_to_opaque(const char * data,u_int16_t bytes)630ca0716f5SRobert Watson au_to_opaque(const char *data, u_int16_t bytes)
631ca0716f5SRobert Watson {
632ca0716f5SRobert Watson token_t *t;
633ca0716f5SRobert Watson u_char *dptr = NULL;
634ca0716f5SRobert Watson
635ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);
636ca0716f5SRobert Watson if (t == NULL)
637ca0716f5SRobert Watson return (NULL);
638ca0716f5SRobert Watson
639ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_OPAQUE);
640ca0716f5SRobert Watson ADD_U_INT16(dptr, bytes);
641ca0716f5SRobert Watson ADD_MEM(dptr, data, bytes);
642ca0716f5SRobert Watson
643ca0716f5SRobert Watson return (t);
644ca0716f5SRobert Watson }
645ca0716f5SRobert Watson
646ca0716f5SRobert Watson /*
647ca0716f5SRobert Watson * token ID 1 byte
648ca0716f5SRobert Watson * seconds of time 4 bytes
649ca0716f5SRobert Watson * milliseconds of time 4 bytes
650ca0716f5SRobert Watson * file name len 2 bytes
651ca0716f5SRobert Watson * file pathname N bytes + 1 terminating NULL byte
652ca0716f5SRobert Watson */
653ca0716f5SRobert Watson token_t *
au_to_file(const char * file,struct timeval tm)654ca0716f5SRobert Watson au_to_file(const char *file, struct timeval tm)
655ca0716f5SRobert Watson {
656ca0716f5SRobert Watson token_t *t;
657ca0716f5SRobert Watson u_char *dptr = NULL;
658ca0716f5SRobert Watson u_int16_t filelen;
659ca0716f5SRobert Watson u_int32_t timems;
660ca0716f5SRobert Watson
661ca0716f5SRobert Watson filelen = strlen(file);
662ca0716f5SRobert Watson filelen += 1;
663ca0716f5SRobert Watson
664ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
665ca0716f5SRobert Watson sizeof(u_int16_t) + filelen);
666ca0716f5SRobert Watson if (t == NULL)
667ca0716f5SRobert Watson return (NULL);
668ca0716f5SRobert Watson
669ca0716f5SRobert Watson timems = tm.tv_usec/1000;
670ca0716f5SRobert Watson
671ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
672ca0716f5SRobert Watson ADD_U_INT32(dptr, tm.tv_sec);
673ca0716f5SRobert Watson ADD_U_INT32(dptr, timems); /* We need time in ms. */
674ca0716f5SRobert Watson ADD_U_INT16(dptr, filelen);
675ca0716f5SRobert Watson ADD_STRING(dptr, file, filelen);
676ca0716f5SRobert Watson
677ca0716f5SRobert Watson return (t);
678ca0716f5SRobert Watson }
679ca0716f5SRobert Watson
680ca0716f5SRobert Watson /*
681ca0716f5SRobert Watson * token ID 1 byte
682ca0716f5SRobert Watson * text length 2 bytes
683506764c6SRobert Watson * text N bytes + 1 terminating NULL byte
684ca0716f5SRobert Watson */
685ca0716f5SRobert Watson token_t *
au_to_text(const char * text)686ca0716f5SRobert Watson au_to_text(const char *text)
687ca0716f5SRobert Watson {
688ca0716f5SRobert Watson token_t *t;
689bc168a6cSRobert Watson u_char *dptr = NULL;
690bc168a6cSRobert Watson u_int16_t textlen;
691ca0716f5SRobert Watson
692bc168a6cSRobert Watson textlen = strlen(text);
693bc168a6cSRobert Watson textlen += 1;
694ca0716f5SRobert Watson
695bc168a6cSRobert Watson /* XXXRW: Should validate length against token size limit. */
696bc168a6cSRobert Watson
697bc168a6cSRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
698ca0716f5SRobert Watson if (t == NULL)
699bc168a6cSRobert Watson return (NULL);
700bc168a6cSRobert Watson
701bc168a6cSRobert Watson ADD_U_CHAR(dptr, AUT_TEXT);
702bc168a6cSRobert Watson ADD_U_INT16(dptr, textlen);
703bc168a6cSRobert Watson ADD_STRING(dptr, text, textlen);
704bc168a6cSRobert Watson
705bc168a6cSRobert Watson return (t);
706bc168a6cSRobert Watson }
707bc168a6cSRobert Watson
708bc168a6cSRobert Watson /*
709bc168a6cSRobert Watson * token ID 1 byte
710bc168a6cSRobert Watson * path length 2 bytes
711bc168a6cSRobert Watson * path N bytes + 1 terminating NULL byte
712ca0716f5SRobert Watson */
713ca0716f5SRobert Watson token_t *
au_to_path(const char * text)714ca0716f5SRobert Watson au_to_path(const char *text)
715bc168a6cSRobert Watson {
716bc168a6cSRobert Watson token_t *t;
717ca0716f5SRobert Watson u_char *dptr = NULL;
718ca0716f5SRobert Watson u_int16_t textlen;
719ca0716f5SRobert Watson
720ca0716f5SRobert Watson textlen = strlen(text);
721ca0716f5SRobert Watson textlen += 1;
722ca0716f5SRobert Watson
723ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
724ca0716f5SRobert Watson if (t == NULL)
725ca0716f5SRobert Watson return (NULL);
726ca0716f5SRobert Watson
727ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_PATH);
728ca0716f5SRobert Watson ADD_U_INT16(dptr, textlen);
729ca0716f5SRobert Watson ADD_STRING(dptr, text, textlen);
730ca0716f5SRobert Watson
731ca0716f5SRobert Watson return (t);
732ca0716f5SRobert Watson }
733ca0716f5SRobert Watson
734ca0716f5SRobert Watson /*
735ca0716f5SRobert Watson * token ID 1 byte
736ca0716f5SRobert Watson * audit ID 4 bytes
737ca0716f5SRobert Watson * effective user ID 4 bytes
738ca0716f5SRobert Watson * effective group ID 4 bytes
739ca0716f5SRobert Watson * real user ID 4 bytes
740ca0716f5SRobert Watson * real group ID 4 bytes
741ca0716f5SRobert Watson * process ID 4 bytes
742ca0716f5SRobert Watson * session ID 4 bytes
743ca0716f5SRobert Watson * terminal ID
744d9af45c4SRobert Watson * port ID 4 bytes/8 bytes (32-bit/64-bit value)
745d9af45c4SRobert Watson * machine address 4 bytes
746d9af45c4SRobert Watson */
747d9af45c4SRobert Watson token_t *
au_to_process32(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_t * tid)748d9af45c4SRobert Watson au_to_process32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
749d9af45c4SRobert Watson pid_t pid, au_asid_t sid, au_tid_t *tid)
750d9af45c4SRobert Watson {
751d9af45c4SRobert Watson token_t *t;
752d9af45c4SRobert Watson u_char *dptr = NULL;
753d9af45c4SRobert Watson
754ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
755ca0716f5SRobert Watson if (t == NULL)
756ca0716f5SRobert Watson return (NULL);
757ca0716f5SRobert Watson
758ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_PROCESS32);
759ca0716f5SRobert Watson ADD_U_INT32(dptr, auid);
760ca0716f5SRobert Watson ADD_U_INT32(dptr, euid);
761ca0716f5SRobert Watson ADD_U_INT32(dptr, egid);
762ca0716f5SRobert Watson ADD_U_INT32(dptr, ruid);
763ca0716f5SRobert Watson ADD_U_INT32(dptr, rgid);
764ca0716f5SRobert Watson ADD_U_INT32(dptr, pid);
765ca0716f5SRobert Watson ADD_U_INT32(dptr, sid);
766ca0716f5SRobert Watson ADD_U_INT32(dptr, tid->port);
767bc168a6cSRobert Watson
768d9af45c4SRobert Watson /*
769bc168a6cSRobert Watson * Note: Solaris will write out IPv6 addresses here as a 32-bit
770bc168a6cSRobert Watson * address type and 16 bytes of address, but for IPv4 addresses it
771bc168a6cSRobert Watson * simply writes the 4-byte address directly. We support only IPv4
772d9af45c4SRobert Watson * addresses for process32 tokens.
773ca0716f5SRobert Watson */
774ca0716f5SRobert Watson ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
775ca0716f5SRobert Watson
776ca0716f5SRobert Watson return (t);
777ca0716f5SRobert Watson }
778ca0716f5SRobert Watson
779ca0716f5SRobert Watson token_t *
au_to_process64(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_t * tid)780ca0716f5SRobert Watson au_to_process64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
781bc168a6cSRobert Watson pid_t pid, au_asid_t sid, au_tid_t *tid)
782bc168a6cSRobert Watson {
783ca0716f5SRobert Watson token_t *t;
784bc168a6cSRobert Watson u_char *dptr = NULL;
785bc168a6cSRobert Watson
786bc168a6cSRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 8 * sizeof(u_int32_t) +
787bc168a6cSRobert Watson sizeof(u_int64_t));
788bc168a6cSRobert Watson if (t == NULL)
789bc168a6cSRobert Watson return (NULL);
790bc168a6cSRobert Watson
791bc168a6cSRobert Watson ADD_U_CHAR(dptr, AUT_PROCESS64);
792bc168a6cSRobert Watson ADD_U_INT32(dptr, auid);
793bc168a6cSRobert Watson ADD_U_INT32(dptr, euid);
794ca0716f5SRobert Watson ADD_U_INT32(dptr, egid);
795ca0716f5SRobert Watson ADD_U_INT32(dptr, ruid);
796bc168a6cSRobert Watson ADD_U_INT32(dptr, rgid);
797bc168a6cSRobert Watson ADD_U_INT32(dptr, pid);
798bc168a6cSRobert Watson ADD_U_INT32(dptr, sid);
799bc168a6cSRobert Watson ADD_U_INT64(dptr, tid->port);
800bc168a6cSRobert Watson
801bc168a6cSRobert Watson /*
802bc168a6cSRobert Watson * Note: Solaris will write out IPv6 addresses here as a 32-bit
803bc168a6cSRobert Watson * address type and 16 bytes of address, but for IPv4 addresses it
804bc168a6cSRobert Watson * simply writes the 4-byte address directly. We support only IPv4
805bc168a6cSRobert Watson * addresses for process64 tokens.
806bc168a6cSRobert Watson */
807bc168a6cSRobert Watson ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
808bc168a6cSRobert Watson
809bc168a6cSRobert Watson return (t);
810bc168a6cSRobert Watson }
811bc168a6cSRobert Watson
812bc168a6cSRobert Watson token_t *
au_to_process(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_t * tid)813bc168a6cSRobert Watson au_to_process(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
814bc168a6cSRobert Watson pid_t pid, au_asid_t sid, au_tid_t *tid)
815bc168a6cSRobert Watson {
816bc168a6cSRobert Watson
817bc168a6cSRobert Watson return (au_to_process32(auid, euid, egid, ruid, rgid, pid, sid,
818ca0716f5SRobert Watson tid));
819ca0716f5SRobert Watson }
820ca0716f5SRobert Watson
821ca0716f5SRobert Watson /*
822ca0716f5SRobert Watson * token ID 1 byte
823ca0716f5SRobert Watson * audit ID 4 bytes
824ca0716f5SRobert Watson * effective user ID 4 bytes
825ca0716f5SRobert Watson * effective group ID 4 bytes
826ca0716f5SRobert Watson * real user ID 4 bytes
827ca0716f5SRobert Watson * real group ID 4 bytes
828ca0716f5SRobert Watson * process ID 4 bytes
829ca0716f5SRobert Watson * session ID 4 bytes
830ca0716f5SRobert Watson * terminal ID
831ca0716f5SRobert Watson * port ID 4 bytes/8 bytes (32-bit/64-bit value)
832ca0716f5SRobert Watson * address type-len 4 bytes
833ca0716f5SRobert Watson * machine address 16 bytes
834ca0716f5SRobert Watson */
835ca0716f5SRobert Watson token_t *
au_to_process32_ex(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_addr_t * tid)836ca0716f5SRobert Watson au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
837ca0716f5SRobert Watson gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
838ca0716f5SRobert Watson {
839ca0716f5SRobert Watson token_t *t;
840ca0716f5SRobert Watson u_char *dptr = NULL;
841ca0716f5SRobert Watson
842ca0716f5SRobert Watson if (tid->at_type == AU_IPv4)
843ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
844ca0716f5SRobert Watson 10 * sizeof(u_int32_t));
845ca0716f5SRobert Watson else if (tid->at_type == AU_IPv6)
846ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
847ca0716f5SRobert Watson 13 * sizeof(u_int32_t));
848ca0716f5SRobert Watson else {
849ca0716f5SRobert Watson errno = EINVAL;
850ca0716f5SRobert Watson return (NULL);
851ca0716f5SRobert Watson }
852ca0716f5SRobert Watson if (t == NULL)
853ca0716f5SRobert Watson return (NULL);
854ca0716f5SRobert Watson
855ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
856ca0716f5SRobert Watson ADD_U_INT32(dptr, auid);
857ca0716f5SRobert Watson ADD_U_INT32(dptr, euid);
858ca0716f5SRobert Watson ADD_U_INT32(dptr, egid);
859ca0716f5SRobert Watson ADD_U_INT32(dptr, ruid);
860ca0716f5SRobert Watson ADD_U_INT32(dptr, rgid);
861ca0716f5SRobert Watson ADD_U_INT32(dptr, pid);
862ca0716f5SRobert Watson ADD_U_INT32(dptr, sid);
863ca0716f5SRobert Watson ADD_U_INT32(dptr, tid->at_port);
864ca0716f5SRobert Watson ADD_U_INT32(dptr, tid->at_type);
865ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
866ca0716f5SRobert Watson if (tid->at_type == AU_IPv6) {
867ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
868ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
869ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
870ca0716f5SRobert Watson }
871ca0716f5SRobert Watson
872ca0716f5SRobert Watson return (t);
873ca0716f5SRobert Watson }
874ca0716f5SRobert Watson
875ca0716f5SRobert Watson token_t *
au_to_process64_ex(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_addr_t * tid)876ca0716f5SRobert Watson au_to_process64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
877ca0716f5SRobert Watson gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
878ca0716f5SRobert Watson {
879ca0716f5SRobert Watson token_t *t;
880ca0716f5SRobert Watson u_char *dptr = NULL;
881ca0716f5SRobert Watson
882ca0716f5SRobert Watson if (tid->at_type == AU_IPv4)
883ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
884ca0716f5SRobert Watson 7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
885ca0716f5SRobert Watson 2 * sizeof(u_int32_t));
886ca0716f5SRobert Watson else if (tid->at_type == AU_IPv6)
887ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
888ca0716f5SRobert Watson 7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
889ca0716f5SRobert Watson 5 * sizeof(u_int32_t));
890ca0716f5SRobert Watson else {
891ca0716f5SRobert Watson errno = EINVAL;
892ca0716f5SRobert Watson return (NULL);
893ca0716f5SRobert Watson }
894ca0716f5SRobert Watson if (t == NULL)
895ca0716f5SRobert Watson return (NULL);
896ca0716f5SRobert Watson
897ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_PROCESS64_EX);
898ca0716f5SRobert Watson ADD_U_INT32(dptr, auid);
899ca0716f5SRobert Watson ADD_U_INT32(dptr, euid);
900ca0716f5SRobert Watson ADD_U_INT32(dptr, egid);
901ca0716f5SRobert Watson ADD_U_INT32(dptr, ruid);
902ca0716f5SRobert Watson ADD_U_INT32(dptr, rgid);
903ca0716f5SRobert Watson ADD_U_INT32(dptr, pid);
904ca0716f5SRobert Watson ADD_U_INT32(dptr, sid);
905ca0716f5SRobert Watson ADD_U_INT64(dptr, tid->at_port);
906ca0716f5SRobert Watson ADD_U_INT32(dptr, tid->at_type);
907ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
908ca0716f5SRobert Watson if (tid->at_type == AU_IPv6) {
909ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
910ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
911ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
912ca0716f5SRobert Watson }
913ca0716f5SRobert Watson
914ca0716f5SRobert Watson return (t);
915ca0716f5SRobert Watson }
916ca0716f5SRobert Watson
917ca0716f5SRobert Watson token_t *
au_to_process_ex(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_addr_t * tid)918ca0716f5SRobert Watson au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
919ca0716f5SRobert Watson gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
920ca0716f5SRobert Watson {
921ca0716f5SRobert Watson
922ca0716f5SRobert Watson return (au_to_process32_ex(auid, euid, egid, ruid, rgid, pid, sid,
923ca0716f5SRobert Watson tid));
924ca0716f5SRobert Watson }
925ca0716f5SRobert Watson
926ca0716f5SRobert Watson /*
927ca0716f5SRobert Watson * token ID 1 byte
928ca0716f5SRobert Watson * error status 1 byte
929506764c6SRobert Watson * return value 4 bytes/8 bytes (32-bit/64-bit value)
930ca0716f5SRobert Watson */
931506764c6SRobert Watson token_t *
au_to_return32(char status,u_int32_t ret)932506764c6SRobert Watson au_to_return32(char status, u_int32_t ret)
933ca0716f5SRobert Watson {
934ca0716f5SRobert Watson token_t *t;
935ca0716f5SRobert Watson u_char *dptr = NULL;
936ca0716f5SRobert Watson
937ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
938506764c6SRobert Watson if (t == NULL)
939506764c6SRobert Watson return (NULL);
940506764c6SRobert Watson
941506764c6SRobert Watson ADD_U_CHAR(dptr, AUT_RETURN32);
942506764c6SRobert Watson ADD_U_CHAR(dptr, status);
943506764c6SRobert Watson ADD_U_INT32(dptr, ret);
944506764c6SRobert Watson
945506764c6SRobert Watson return (t);
946ca0716f5SRobert Watson }
947506764c6SRobert Watson
948506764c6SRobert Watson token_t *
au_to_return64(char status,u_int64_t ret)949506764c6SRobert Watson au_to_return64(char status, u_int64_t ret)
950506764c6SRobert Watson {
951ca0716f5SRobert Watson token_t *t;
952ca0716f5SRobert Watson u_char *dptr = NULL;
953ca0716f5SRobert Watson
954ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t));
955ca0716f5SRobert Watson if (t == NULL)
956ca0716f5SRobert Watson return (NULL);
957ca0716f5SRobert Watson
958ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_RETURN64);
959ca0716f5SRobert Watson ADD_U_CHAR(dptr, status);
960ca0716f5SRobert Watson ADD_U_INT64(dptr, ret);
961ca0716f5SRobert Watson
962ca0716f5SRobert Watson return (t);
963ca0716f5SRobert Watson }
964ca0716f5SRobert Watson
965ca0716f5SRobert Watson token_t *
au_to_return(char status,u_int32_t ret)966ca0716f5SRobert Watson au_to_return(char status, u_int32_t ret)
967ca0716f5SRobert Watson {
968ca0716f5SRobert Watson
969ca0716f5SRobert Watson return (au_to_return32(status, ret));
970ca0716f5SRobert Watson }
971ca0716f5SRobert Watson
972ca0716f5SRobert Watson /*
973ca0716f5SRobert Watson * token ID 1 byte
974ca0716f5SRobert Watson * sequence number 4 bytes
975ca0716f5SRobert Watson */
976506764c6SRobert Watson token_t *
au_to_seq(long audit_count)977ca0716f5SRobert Watson au_to_seq(long audit_count)
978ca0716f5SRobert Watson {
979ca0716f5SRobert Watson token_t *t;
980ca0716f5SRobert Watson u_char *dptr = NULL;
981ca0716f5SRobert Watson
982ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t));
983ca0716f5SRobert Watson if (t == NULL)
984ca0716f5SRobert Watson return (NULL);
985ca0716f5SRobert Watson
986ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_SEQ);
987ca0716f5SRobert Watson ADD_U_INT32(dptr, audit_count);
988ca0716f5SRobert Watson
989ca0716f5SRobert Watson return (t);
990ca0716f5SRobert Watson }
991ca0716f5SRobert Watson
992ca0716f5SRobert Watson /*
993ca0716f5SRobert Watson * token ID 1 byte
994ca0716f5SRobert Watson * socket domain 2 bytes
995ca0716f5SRobert Watson * socket type 2 bytes
996ca0716f5SRobert Watson * address type 2 byte
997ca0716f5SRobert Watson * local port 2 bytes
998ca0716f5SRobert Watson * local address 4 bytes/16 bytes (IPv4/IPv6 address)
999ca0716f5SRobert Watson * remote port 2 bytes
1000ca0716f5SRobert Watson * remote address 4 bytes/16 bytes (IPv4/IPv6 address)
1001ca0716f5SRobert Watson *
1002ca0716f5SRobert Watson * Domain and type arguments to this routine are assumed to already have been
1003ca0716f5SRobert Watson * converted to the BSM constant space, so we don't do that here.
1004ca0716f5SRobert Watson */
1005ca0716f5SRobert Watson token_t *
au_to_socket_ex(u_short so_domain,u_short so_type,struct sockaddr * sa_local,struct sockaddr * sa_remote)1006ca0716f5SRobert Watson au_to_socket_ex(u_short so_domain, u_short so_type,
1007ca0716f5SRobert Watson struct sockaddr *sa_local, struct sockaddr *sa_remote)
1008ca0716f5SRobert Watson {
1009ca0716f5SRobert Watson token_t *t;
1010ca0716f5SRobert Watson u_char *dptr = NULL;
1011ca0716f5SRobert Watson struct sockaddr_in *sin;
1012ca0716f5SRobert Watson struct sockaddr_in6 *sin6;
1013ca0716f5SRobert Watson
1014ca0716f5SRobert Watson if (so_domain == AF_INET)
1015ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1016ca0716f5SRobert Watson 5 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
1017ca0716f5SRobert Watson else if (so_domain == AF_INET6)
1018ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1019ca0716f5SRobert Watson 5 * sizeof(u_int16_t) + 8 * sizeof(u_int32_t));
1020ca0716f5SRobert Watson else {
1021ca0716f5SRobert Watson errno = EINVAL;
1022506764c6SRobert Watson return (NULL);
1023ca0716f5SRobert Watson }
1024ca0716f5SRobert Watson if (t == NULL)
1025ca0716f5SRobert Watson return (NULL);
1026ca0716f5SRobert Watson
1027ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_SOCKET_EX);
1028ca0716f5SRobert Watson ADD_U_INT16(dptr, au_domain_to_bsm(so_domain));
1029ca0716f5SRobert Watson ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type));
1030ca0716f5SRobert Watson if (so_domain == AF_INET) {
1031bc168a6cSRobert Watson ADD_U_INT16(dptr, AU_IPv4);
1032bc168a6cSRobert Watson sin = (struct sockaddr_in *)sa_local;
1033ca0716f5SRobert Watson ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
1034bc168a6cSRobert Watson ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
1035bc168a6cSRobert Watson sin = (struct sockaddr_in *)sa_remote;
1036bc168a6cSRobert Watson ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
1037ca0716f5SRobert Watson ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
1038bc168a6cSRobert Watson } else {
1039bc168a6cSRobert Watson ADD_U_INT16(dptr, AU_IPv6);
1040bc168a6cSRobert Watson sin6 = (struct sockaddr_in6 *)sa_local;
1041bc168a6cSRobert Watson ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
1042bc168a6cSRobert Watson ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
1043bc168a6cSRobert Watson sin6 = (struct sockaddr_in6 *)sa_remote;
1044bc168a6cSRobert Watson ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
1045bc168a6cSRobert Watson ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
1046bc168a6cSRobert Watson }
1047bc168a6cSRobert Watson
1048bc168a6cSRobert Watson return (t);
1049bc168a6cSRobert Watson }
1050bc168a6cSRobert Watson
1051ca0716f5SRobert Watson /*
1052ca0716f5SRobert Watson * token ID 1 byte
1053ca0716f5SRobert Watson * socket family 2 bytes
1054ca0716f5SRobert Watson * path (up to) 104 bytes + NULL (NULL terminated string)
1055ca0716f5SRobert Watson */
1056ca0716f5SRobert Watson token_t *
au_to_sock_unix(struct sockaddr_un * so)1057ca0716f5SRobert Watson au_to_sock_unix(struct sockaddr_un *so)
1058ca0716f5SRobert Watson {
1059ca0716f5SRobert Watson token_t *t;
1060ca0716f5SRobert Watson u_char *dptr;
1061ca0716f5SRobert Watson
1062ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
1063ca0716f5SRobert Watson if (t == NULL)
1064ca0716f5SRobert Watson return (NULL);
1065ca0716f5SRobert Watson
1066ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_SOCKUNIX);
1067ca0716f5SRobert Watson /* BSM token has two bytes for family */
1068ca0716f5SRobert Watson ADD_U_CHAR(dptr, 0);
1069ca0716f5SRobert Watson ADD_U_CHAR(dptr, so->sun_family);
1070ca0716f5SRobert Watson ADD_STRING(dptr, so->sun_path, strlen(so->sun_path) + 1);
1071ca0716f5SRobert Watson
1072ca0716f5SRobert Watson return (t);
1073ca0716f5SRobert Watson }
1074ca0716f5SRobert Watson
1075ca0716f5SRobert Watson /*
1076ca0716f5SRobert Watson * token ID 1 byte
1077ca0716f5SRobert Watson * socket family 2 bytes
1078ca0716f5SRobert Watson * local port 2 bytes
1079ca0716f5SRobert Watson * socket address 4 bytes
1080ca0716f5SRobert Watson */
1081ca0716f5SRobert Watson token_t *
au_to_sock_inet32(struct sockaddr_in * so)1082ca0716f5SRobert Watson au_to_sock_inet32(struct sockaddr_in *so)
1083d9af45c4SRobert Watson {
1084d9af45c4SRobert Watson token_t *t;
1085d9af45c4SRobert Watson u_char *dptr = NULL;
1086d9af45c4SRobert Watson uint16_t family;
1087d9af45c4SRobert Watson
1088d9af45c4SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +
1089d9af45c4SRobert Watson sizeof(uint32_t));
1090d9af45c4SRobert Watson if (t == NULL)
1091d9af45c4SRobert Watson return (NULL);
1092d9af45c4SRobert Watson
1093ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_SOCKINET32);
1094ca0716f5SRobert Watson /*
1095ca0716f5SRobert Watson * BSM defines the family field as 16 bits, but many operating
1096ca0716f5SRobert Watson * systems have an 8-bit sin_family field. Extend to 16 bits before
1097ca0716f5SRobert Watson * writing into the token. Assume that both the port and the address
1098ca0716f5SRobert Watson * in the sockaddr_in are already in network byte order, but family
1099ca0716f5SRobert Watson * is in local byte order.
1100ca0716f5SRobert Watson *
1101ca0716f5SRobert Watson * XXXRW: Should a name space conversion be taking place on the value
1102ca0716f5SRobert Watson * of sin_family?
1103ca0716f5SRobert Watson */
1104ca0716f5SRobert Watson family = so->sin_family;
1105ca0716f5SRobert Watson ADD_U_INT16(dptr, family);
1106bc168a6cSRobert Watson ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
1107bc168a6cSRobert Watson ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
1108bc168a6cSRobert Watson
1109bc168a6cSRobert Watson return (t);
1110ca0716f5SRobert Watson }
1111ca0716f5SRobert Watson
1112ca0716f5SRobert Watson token_t *
au_to_sock_inet128(struct sockaddr_in6 * so)1113ca0716f5SRobert Watson au_to_sock_inet128(struct sockaddr_in6 *so)
1114ca0716f5SRobert Watson {
1115ca0716f5SRobert Watson token_t *t;
1116ca0716f5SRobert Watson u_char *dptr = NULL;
1117ca0716f5SRobert Watson
1118bc168a6cSRobert Watson GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +
1119bc168a6cSRobert Watson 4 * sizeof(u_int32_t));
1120ca0716f5SRobert Watson if (t == NULL)
1121bc168a6cSRobert Watson return (NULL);
1122bc168a6cSRobert Watson
1123bc168a6cSRobert Watson ADD_U_CHAR(dptr, AUT_SOCKINET128);
1124bc168a6cSRobert Watson /*
1125bc168a6cSRobert Watson * In BSD, sin6_family is one octet, but BSM defines the token to
1126bc168a6cSRobert Watson * store two. So we copy in a 0 first. XXXRW: Possibly should be
1127bc168a6cSRobert Watson * conditionally compiled.
1128bc168a6cSRobert Watson */
1129bc168a6cSRobert Watson ADD_U_CHAR(dptr, 0);
1130bc168a6cSRobert Watson ADD_U_CHAR(dptr, so->sin6_family);
1131ca0716f5SRobert Watson
1132ca0716f5SRobert Watson ADD_U_INT16(dptr, so->sin6_port);
1133bc168a6cSRobert Watson ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
1134bc168a6cSRobert Watson
1135bc168a6cSRobert Watson return (t);
1136bc168a6cSRobert Watson }
1137bc168a6cSRobert Watson
1138bc168a6cSRobert Watson token_t *
au_to_sock_inet(struct sockaddr_in * so)1139bc168a6cSRobert Watson au_to_sock_inet(struct sockaddr_in *so)
1140bc168a6cSRobert Watson {
1141bc168a6cSRobert Watson
1142bc168a6cSRobert Watson return (au_to_sock_inet32(so));
1143bc168a6cSRobert Watson }
1144bc168a6cSRobert Watson
1145bc168a6cSRobert Watson /*
1146bc168a6cSRobert Watson * token ID 1 byte
1147bc168a6cSRobert Watson * audit ID 4 bytes
1148bc168a6cSRobert Watson * effective user ID 4 bytes
1149bc168a6cSRobert Watson * effective group ID 4 bytes
1150bc168a6cSRobert Watson * real user ID 4 bytes
1151bc168a6cSRobert Watson * real group ID 4 bytes
1152bc168a6cSRobert Watson * process ID 4 bytes
1153ca0716f5SRobert Watson * session ID 4 bytes
1154ca0716f5SRobert Watson * terminal ID
1155ca0716f5SRobert Watson * port ID 4 bytes/8 bytes (32-bit/64-bit value)
1156ca0716f5SRobert Watson * machine address 4 bytes
1157ca0716f5SRobert Watson */
1158ca0716f5SRobert Watson token_t *
au_to_subject32(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_t * tid)1159ca0716f5SRobert Watson au_to_subject32(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
1160ca0716f5SRobert Watson pid_t pid, au_asid_t sid, au_tid_t *tid)
1161ca0716f5SRobert Watson {
1162ca0716f5SRobert Watson token_t *t;
11633b97a967SRobert Watson u_char *dptr = NULL;
1164ca0716f5SRobert Watson
1165ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
1166ca0716f5SRobert Watson if (t == NULL)
1167ca0716f5SRobert Watson return (NULL);
1168ca0716f5SRobert Watson
1169ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_SUBJECT32);
1170ca0716f5SRobert Watson ADD_U_INT32(dptr, auid);
1171ca0716f5SRobert Watson ADD_U_INT32(dptr, euid);
1172ca0716f5SRobert Watson ADD_U_INT32(dptr, egid);
1173ca0716f5SRobert Watson ADD_U_INT32(dptr, ruid);
1174ca0716f5SRobert Watson ADD_U_INT32(dptr, rgid);
1175ca0716f5SRobert Watson ADD_U_INT32(dptr, pid);
1176ca0716f5SRobert Watson ADD_U_INT32(dptr, sid);
1177ca0716f5SRobert Watson ADD_U_INT32(dptr, tid->port);
1178ca0716f5SRobert Watson ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1179ca0716f5SRobert Watson
1180ca0716f5SRobert Watson return (t);
1181ca0716f5SRobert Watson }
1182ca0716f5SRobert Watson
1183ca0716f5SRobert Watson token_t *
au_to_subject64(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_t * tid)1184ca0716f5SRobert Watson au_to_subject64(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
1185ca0716f5SRobert Watson pid_t pid, au_asid_t sid, au_tid_t *tid)
1186ca0716f5SRobert Watson {
118785feadf6SRobert Watson token_t *t;
1188ca0716f5SRobert Watson u_char *dptr = NULL;
1189ca0716f5SRobert Watson
1190ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 7 * sizeof(u_int32_t) +
1191ca0716f5SRobert Watson sizeof(u_int64_t) + sizeof(u_int32_t));
1192ca0716f5SRobert Watson if (t == NULL)
1193ca0716f5SRobert Watson return (NULL);
1194ca0716f5SRobert Watson
119522ccb20dSRobert Watson ADD_U_CHAR(dptr, AUT_SUBJECT64);
1196ca0716f5SRobert Watson ADD_U_INT32(dptr, auid);
1197ca0716f5SRobert Watson ADD_U_INT32(dptr, euid);
1198ca0716f5SRobert Watson ADD_U_INT32(dptr, egid);
1199ca0716f5SRobert Watson ADD_U_INT32(dptr, ruid);
1200ca0716f5SRobert Watson ADD_U_INT32(dptr, rgid);
1201ca0716f5SRobert Watson ADD_U_INT32(dptr, pid);
1202ca0716f5SRobert Watson ADD_U_INT32(dptr, sid);
120322ccb20dSRobert Watson ADD_U_INT64(dptr, tid->port);
1204ca0716f5SRobert Watson ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1205ca0716f5SRobert Watson
1206ca0716f5SRobert Watson return (t);
1207ca0716f5SRobert Watson }
1208ca0716f5SRobert Watson
1209ca0716f5SRobert Watson token_t *
au_to_subject(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_t * tid)1210ca0716f5SRobert Watson au_to_subject(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid, gid_t rgid,
1211ca0716f5SRobert Watson pid_t pid, au_asid_t sid, au_tid_t *tid)
1212ca0716f5SRobert Watson {
1213ca0716f5SRobert Watson
1214ca0716f5SRobert Watson return (au_to_subject32(auid, euid, egid, ruid, rgid, pid, sid,
121522ccb20dSRobert Watson tid));
1216ca0716f5SRobert Watson }
1217ca0716f5SRobert Watson
1218ca0716f5SRobert Watson /*
1219ca0716f5SRobert Watson * token ID 1 byte
1220ca0716f5SRobert Watson * audit ID 4 bytes
1221ca0716f5SRobert Watson * effective user ID 4 bytes
1222ca0716f5SRobert Watson * effective group ID 4 bytes
1223ca0716f5SRobert Watson * real user ID 4 bytes
1224bc168a6cSRobert Watson * real group ID 4 bytes
1225bc168a6cSRobert Watson * process ID 4 bytes
1226bc168a6cSRobert Watson * session ID 4 bytes
1227bc168a6cSRobert Watson * terminal ID
1228bc168a6cSRobert Watson * port ID 4 bytes/8 bytes (32-bit/64-bit value)
1229bc168a6cSRobert Watson * address type/length 4 bytes
1230bc168a6cSRobert Watson * machine address 16 bytes
1231bc168a6cSRobert Watson */
1232bc168a6cSRobert Watson token_t *
au_to_subject32_ex(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_addr_t * tid)1233bc168a6cSRobert Watson au_to_subject32_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
1234bc168a6cSRobert Watson gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
1235bc168a6cSRobert Watson {
1236bc168a6cSRobert Watson token_t *t;
1237bc168a6cSRobert Watson u_char *dptr = NULL;
1238bc168a6cSRobert Watson
1239bc168a6cSRobert Watson if (tid->at_type == AU_IPv4)
1240bc168a6cSRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
1241bc168a6cSRobert Watson sizeof(u_int32_t));
1242bc168a6cSRobert Watson else if (tid->at_type == AU_IPv6)
1243bc168a6cSRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
1244bc168a6cSRobert Watson sizeof(u_int32_t));
1245ca0716f5SRobert Watson else {
1246ca0716f5SRobert Watson errno = EINVAL;
1247ca0716f5SRobert Watson return (NULL);
1248ca0716f5SRobert Watson }
124985feadf6SRobert Watson if (t == NULL)
1250ca0716f5SRobert Watson return (NULL);
1251ca0716f5SRobert Watson
1252ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
1253ca0716f5SRobert Watson ADD_U_INT32(dptr, auid);
1254ca0716f5SRobert Watson ADD_U_INT32(dptr, euid);
1255ca0716f5SRobert Watson ADD_U_INT32(dptr, egid);
1256ca0716f5SRobert Watson ADD_U_INT32(dptr, ruid);
125722ccb20dSRobert Watson ADD_U_INT32(dptr, rgid);
1258ca0716f5SRobert Watson ADD_U_INT32(dptr, pid);
1259ca0716f5SRobert Watson ADD_U_INT32(dptr, sid);
1260ca0716f5SRobert Watson ADD_U_INT32(dptr, tid->at_port);
1261ca0716f5SRobert Watson ADD_U_INT32(dptr, tid->at_type);
1262ca0716f5SRobert Watson if (tid->at_type == AU_IPv6)
1263ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1264ca0716f5SRobert Watson else
126522ccb20dSRobert Watson ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1266ca0716f5SRobert Watson
1267ca0716f5SRobert Watson return (t);
1268ca0716f5SRobert Watson }
1269ca0716f5SRobert Watson
1270ca0716f5SRobert Watson token_t *
au_to_subject64_ex(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_addr_t * tid)1271ca0716f5SRobert Watson au_to_subject64_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
1272ca0716f5SRobert Watson gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
1273ca0716f5SRobert Watson {
1274ca0716f5SRobert Watson token_t *t;
1275ca0716f5SRobert Watson u_char *dptr = NULL;
1276ca0716f5SRobert Watson
127722ccb20dSRobert Watson if (tid->at_type == AU_IPv4)
1278ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1279ca0716f5SRobert Watson 7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
1280ca0716f5SRobert Watson 2 * sizeof(u_int32_t));
1281ca0716f5SRobert Watson else if (tid->at_type == AU_IPv6)
1282ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1283ca0716f5SRobert Watson 7 * sizeof(u_int32_t) + sizeof(u_int64_t) +
1284ca0716f5SRobert Watson 5 * sizeof(u_int32_t));
1285ca0716f5SRobert Watson else {
1286ca0716f5SRobert Watson errno = EINVAL;
1287ca0716f5SRobert Watson return (NULL);
1288ca0716f5SRobert Watson }
1289ca0716f5SRobert Watson if (t == NULL)
1290ca0716f5SRobert Watson return (NULL);
1291ca0716f5SRobert Watson
1292ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
1293ca0716f5SRobert Watson ADD_U_INT32(dptr, auid);
1294506764c6SRobert Watson ADD_U_INT32(dptr, euid);
1295ca0716f5SRobert Watson ADD_U_INT32(dptr, egid);
1296ca0716f5SRobert Watson ADD_U_INT32(dptr, ruid);
1297ca0716f5SRobert Watson ADD_U_INT32(dptr, rgid);
1298ca0716f5SRobert Watson ADD_U_INT32(dptr, pid);
1299ca0716f5SRobert Watson ADD_U_INT32(dptr, sid);
1300ca0716f5SRobert Watson ADD_U_INT64(dptr, tid->at_port);
1301ca0716f5SRobert Watson ADD_U_INT32(dptr, tid->at_type);
1302ca0716f5SRobert Watson if (tid->at_type == AU_IPv6)
1303ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1304ca0716f5SRobert Watson else
1305ca0716f5SRobert Watson ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1306ca0716f5SRobert Watson
1307ca0716f5SRobert Watson return (t);
130822ccb20dSRobert Watson }
1309ca0716f5SRobert Watson
1310ca0716f5SRobert Watson token_t *
au_to_subject_ex(au_id_t auid,uid_t euid,gid_t egid,uid_t ruid,gid_t rgid,pid_t pid,au_asid_t sid,au_tid_addr_t * tid)1311ca0716f5SRobert Watson au_to_subject_ex(au_id_t auid, uid_t euid, gid_t egid, uid_t ruid,
1312ca0716f5SRobert Watson gid_t rgid, pid_t pid, au_asid_t sid, au_tid_addr_t *tid)
1313ca0716f5SRobert Watson {
1314ca0716f5SRobert Watson
1315ca0716f5SRobert Watson return (au_to_subject32_ex(auid, euid, egid, ruid, rgid, pid, sid,
1316ca0716f5SRobert Watson tid));
1317ca0716f5SRobert Watson }
1318ca0716f5SRobert Watson
1319ca0716f5SRobert Watson #if !defined(_KERNEL) && !defined(KERNEL) && defined(HAVE_AUDIT_SYSCALLS)
1320bc168a6cSRobert Watson /*
1321bc168a6cSRobert Watson * Collects audit information for the current process and creates a subject
1322bc168a6cSRobert Watson * token from it.
1323bc168a6cSRobert Watson */
1324bc168a6cSRobert Watson token_t *
au_to_me(void)1325bc168a6cSRobert Watson au_to_me(void)
1326bc168a6cSRobert Watson {
1327bc168a6cSRobert Watson auditinfo_t auinfo;
1328bc168a6cSRobert Watson auditinfo_addr_t aia;
1329bc168a6cSRobert Watson
1330bc168a6cSRobert Watson /*
1331bc168a6cSRobert Watson * Try to use getaudit_addr(2) first. If this kernel does not support
1332bc168a6cSRobert Watson * it, then fall back on to getaudit(2).
1333bc168a6cSRobert Watson */
1334bc168a6cSRobert Watson if (getaudit_addr(&aia, sizeof(aia)) != 0) {
1335bc168a6cSRobert Watson if (errno == ENOSYS) {
1336bc168a6cSRobert Watson if (getaudit(&auinfo) != 0)
1337bc168a6cSRobert Watson return (NULL);
1338bc168a6cSRobert Watson return (au_to_subject32(auinfo.ai_auid, geteuid(),
1339bc168a6cSRobert Watson getegid(), getuid(), getgid(), getpid(),
1340bc168a6cSRobert Watson auinfo.ai_asid, &auinfo.ai_termid));
1341bc168a6cSRobert Watson } else {
1342bc168a6cSRobert Watson /* getaudit_addr(2) failed for some other reason. */
1343bc168a6cSRobert Watson return (NULL);
1344bc168a6cSRobert Watson }
1345bc168a6cSRobert Watson }
1346bc168a6cSRobert Watson
1347506764c6SRobert Watson return (au_to_subject32_ex(aia.ai_auid, geteuid(), getegid(), getuid(),
1348506764c6SRobert Watson getgid(), getpid(), aia.ai_asid, &aia.ai_termid));
1349506764c6SRobert Watson }
1350506764c6SRobert Watson #endif
1351506764c6SRobert Watson
1352506764c6SRobert Watson /*
1353506764c6SRobert Watson * token ID 1 byte
1354506764c6SRobert Watson * count 4 bytes
1355506764c6SRobert Watson * text count null-terminated strings
1356506764c6SRobert Watson */
1357506764c6SRobert Watson token_t *
au_to_exec_args(char ** argv)1358ca0716f5SRobert Watson au_to_exec_args(char **argv)
1359ca0716f5SRobert Watson {
1360ca0716f5SRobert Watson token_t *t;
1361ca0716f5SRobert Watson u_char *dptr = NULL;
1362bc168a6cSRobert Watson const char *nextarg;
1363ca0716f5SRobert Watson int i, count = 0;
1364bc168a6cSRobert Watson size_t totlen = 0;
1365ca0716f5SRobert Watson
1366bc168a6cSRobert Watson nextarg = *argv;
1367ca0716f5SRobert Watson
1368ca0716f5SRobert Watson while (nextarg != NULL) {
1369ca0716f5SRobert Watson int nextlen;
1370ca0716f5SRobert Watson
1371ca0716f5SRobert Watson nextlen = strlen(nextarg);
1372ca0716f5SRobert Watson totlen += nextlen + 1;
1373ca0716f5SRobert Watson count++;
1374ca0716f5SRobert Watson nextarg = *(argv + count);
1375506764c6SRobert Watson }
1376ca0716f5SRobert Watson
1377ca0716f5SRobert Watson GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1378ca0716f5SRobert Watson if (t == NULL)
1379ca0716f5SRobert Watson return (NULL);
1380ca0716f5SRobert Watson
1381ca0716f5SRobert Watson ADD_U_CHAR(dptr, AUT_EXEC_ARGS);
1382ca0716f5SRobert Watson ADD_U_INT32(dptr, count);
1383ca0716f5SRobert Watson
1384ca0716f5SRobert Watson for (i = 0; i < count; i++) {
1385ca0716f5SRobert Watson nextarg = *(argv + i);
1386ca0716f5SRobert Watson ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
1387ca0716f5SRobert Watson }
1388ca0716f5SRobert Watson
1389ca0716f5SRobert Watson return (t);
1390ca0716f5SRobert Watson }
1391ca0716f5SRobert Watson
1392ca0716f5SRobert Watson /*
1393ca0716f5SRobert Watson * token ID 1 byte
1394ca0716f5SRobert Watson * count 4 bytes
1395ca0716f5SRobert Watson * text count null-terminated strings
1396ca0716f5SRobert Watson */
1397ca0716f5SRobert Watson token_t *
au_to_exec_env(char ** envp)1398ca0716f5SRobert Watson au_to_exec_env(char **envp)
1399ca0716f5SRobert Watson {
1400 token_t *t;
1401 u_char *dptr = NULL;
1402 int i, count = 0;
1403 size_t totlen = 0;
1404 const char *nextenv;
1405
1406 nextenv = *envp;
1407
1408 while (nextenv != NULL) {
1409 int nextlen;
1410
1411 nextlen = strlen(nextenv);
1412 totlen += nextlen + 1;
1413 count++;
1414 nextenv = *(envp + count);
1415 }
1416
1417 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1418 if (t == NULL)
1419 return (NULL);
1420
1421 ADD_U_CHAR(dptr, AUT_EXEC_ENV);
1422 ADD_U_INT32(dptr, count);
1423
1424 for (i = 0; i < count; i++) {
1425 nextenv = *(envp + i);
1426 ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
1427 }
1428
1429 return (t);
1430 }
1431
1432 /*
1433 * token ID 1 byte
1434 * zonename length 2 bytes
1435 * zonename N bytes + 1 terminating NULL byte
1436 */
1437 token_t *
au_to_zonename(const char * zonename)1438 au_to_zonename(const char *zonename)
1439 {
1440 u_char *dptr = NULL;
1441 u_int16_t textlen;
1442 token_t *t;
1443
1444 textlen = strlen(zonename) + 1;
1445 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
1446 if (t == NULL)
1447 return (NULL);
1448
1449 ADD_U_CHAR(dptr, AUT_ZONENAME);
1450 ADD_U_INT16(dptr, textlen);
1451 ADD_STRING(dptr, zonename, textlen);
1452 return (t);
1453 }
1454
1455 /*
1456 * token ID 1 byte
1457 * record byte count 4 bytes
1458 * version # 1 byte [2]
1459 * event type 2 bytes
1460 * event modifier 2 bytes
1461 * seconds of time 4 bytes/8 bytes (32-bit/64-bit value)
1462 * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value)
1463 */
1464 token_t *
au_to_header32_tm(int rec_size,au_event_t e_type,au_emod_t e_mod,struct timeval tm)1465 au_to_header32_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
1466 struct timeval tm)
1467 {
1468 token_t *t;
1469 u_char *dptr = NULL;
1470 u_int32_t timems;
1471
1472 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1473 sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
1474 if (t == NULL)
1475 return (NULL);
1476
1477 ADD_U_CHAR(dptr, AUT_HEADER32);
1478 ADD_U_INT32(dptr, rec_size);
1479 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1480 ADD_U_INT16(dptr, e_type);
1481 ADD_U_INT16(dptr, e_mod);
1482
1483 timems = tm.tv_usec/1000;
1484 /* Add the timestamp */
1485 ADD_U_INT32(dptr, tm.tv_sec);
1486 ADD_U_INT32(dptr, timems); /* We need time in ms. */
1487
1488 return (t);
1489 }
1490
1491 /*
1492 * token ID 1 byte
1493 * record byte count 4 bytes
1494 * version # 1 byte [2]
1495 * event type 2 bytes
1496 * event modifier 2 bytes
1497 * address type/length 4 bytes
1498 * machine address 4 bytes/16 bytes (IPv4/IPv6 address)
1499 * seconds of time 4 bytes/8 bytes (32-bit/64-bit value)
1500 * milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value)
1501 */
1502 token_t *
au_to_header32_ex_tm(int rec_size,au_event_t e_type,au_emod_t e_mod,struct timeval tm,struct auditinfo_addr * aia)1503 au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
1504 struct timeval tm, struct auditinfo_addr *aia)
1505 {
1506 token_t *t;
1507 u_char *dptr = NULL;
1508 u_int32_t timems;
1509 au_tid_addr_t *tid;
1510
1511 tid = &aia->ai_termid;
1512 if (tid->at_type != AU_IPv4 && tid->at_type != AU_IPv6)
1513 return (NULL);
1514 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1515 sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 *
1516 sizeof(u_int32_t) + tid->at_type);
1517 if (t == NULL)
1518 return (NULL);
1519
1520 ADD_U_CHAR(dptr, AUT_HEADER32_EX);
1521 ADD_U_INT32(dptr, rec_size);
1522 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1523 ADD_U_INT16(dptr, e_type);
1524 ADD_U_INT16(dptr, e_mod);
1525
1526 ADD_U_INT32(dptr, tid->at_type);
1527 if (tid->at_type == AU_IPv6)
1528 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1529 else
1530 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1531 timems = tm.tv_usec/1000;
1532 /* Add the timestamp */
1533 ADD_U_INT32(dptr, tm.tv_sec);
1534 ADD_U_INT32(dptr, timems); /* We need time in ms. */
1535
1536 return (t);
1537 }
1538
1539 token_t *
au_to_header64_tm(int rec_size,au_event_t e_type,au_emod_t e_mod,struct timeval tm)1540 au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
1541 struct timeval tm)
1542 {
1543 token_t *t;
1544 u_char *dptr = NULL;
1545 u_int32_t timems;
1546
1547 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1548 sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int64_t));
1549 if (t == NULL)
1550 return (NULL);
1551
1552 ADD_U_CHAR(dptr, AUT_HEADER64);
1553 ADD_U_INT32(dptr, rec_size);
1554 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1555 ADD_U_INT16(dptr, e_type);
1556 ADD_U_INT16(dptr, e_mod);
1557
1558 timems = tm.tv_usec/1000;
1559 /* Add the timestamp */
1560 ADD_U_INT64(dptr, tm.tv_sec);
1561 ADD_U_INT64(dptr, timems); /* We need time in ms. */
1562
1563 return (t);
1564 }
1565
1566 #if !defined(KERNEL) && !defined(_KERNEL)
1567 #ifdef HAVE_AUDIT_SYSCALLS
1568 token_t *
au_to_header32_ex(int rec_size,au_event_t e_type,au_emod_t e_mod)1569 au_to_header32_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
1570 {
1571 struct timeval tm;
1572 struct auditinfo_addr aia;
1573
1574 if (gettimeofday(&tm, NULL) == -1)
1575 return (NULL);
1576 if (audit_get_kaudit(&aia, sizeof(aia)) != 0) {
1577 if (errno != ENOSYS)
1578 return (NULL);
1579 return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
1580 }
1581 return (au_to_header32_ex_tm(rec_size, e_type, e_mod, tm, &aia));
1582 }
1583 #endif /* HAVE_AUDIT_SYSCALLS */
1584
1585 token_t *
au_to_header32(int rec_size,au_event_t e_type,au_emod_t e_mod)1586 au_to_header32(int rec_size, au_event_t e_type, au_emod_t e_mod)
1587 {
1588 struct timeval tm;
1589
1590 if (gettimeofday(&tm, NULL) == -1)
1591 return (NULL);
1592 return (au_to_header32_tm(rec_size, e_type, e_mod, tm));
1593 }
1594
1595 token_t *
au_to_header64(__unused int rec_size,__unused au_event_t e_type,__unused au_emod_t e_mod)1596 au_to_header64(__unused int rec_size, __unused au_event_t e_type,
1597 __unused au_emod_t e_mod)
1598 {
1599 struct timeval tm;
1600
1601 if (gettimeofday(&tm, NULL) == -1)
1602 return (NULL);
1603 return (au_to_header64_tm(rec_size, e_type, e_mod, tm));
1604 }
1605
1606 token_t *
au_to_header(int rec_size,au_event_t e_type,au_emod_t e_mod)1607 au_to_header(int rec_size, au_event_t e_type, au_emod_t e_mod)
1608 {
1609
1610 return (au_to_header32(rec_size, e_type, e_mod));
1611 }
1612
1613 #ifdef HAVE_AUDIT_SYSCALLS
1614 token_t *
au_to_header_ex(int rec_size,au_event_t e_type,au_emod_t e_mod)1615 au_to_header_ex(int rec_size, au_event_t e_type, au_emod_t e_mod)
1616 {
1617
1618 return (au_to_header32_ex(rec_size, e_type, e_mod));
1619 }
1620 #endif /* HAVE_AUDIT_SYSCALLS */
1621 #endif /* !defined(KERNEL) && !defined(_KERNEL) */
1622
1623 /*
1624 * token ID 1 byte
1625 * trailer magic number 2 bytes
1626 * record byte count 4 bytes
1627 */
1628 token_t *
au_to_trailer(int rec_size)1629 au_to_trailer(int rec_size)
1630 {
1631 token_t *t;
1632 u_char *dptr = NULL;
1633 u_int16_t magic = AUT_TRAILER_MAGIC;
1634
1635 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
1636 sizeof(u_int32_t));
1637 if (t == NULL)
1638 return (NULL);
1639
1640 ADD_U_CHAR(dptr, AUT_TRAILER);
1641 ADD_U_INT16(dptr, magic);
1642 ADD_U_INT32(dptr, rec_size);
1643
1644 return (t);
1645 }
1646