Lines Matching defs:dptr
81 #define GET_TOKEN_AREA(t, dptr, length) do { \
85 (dptr) = (t->t_data) = calloc((length), sizeof(u_char)); \
86 if ((dptr) == NULL) { \
91 (dptr) = NULL; \
92 assert((t) == NULL || (dptr) != NULL); \
105 u_char *dptr;
109 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_char) +
113 ADD_U_CHAR(dptr, AUT_UPRIV);
114 ADD_U_CHAR(dptr, sorf);
115 ADD_U_INT16(dptr, textlen);
116 ADD_STRING(dptr, priv, textlen);
131 u_char *dptr;
136 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
140 ADD_U_CHAR(dptr, AUT_PRIV);
141 ADD_U_INT16(dptr, type_len);
142 ADD_STRING(dptr, privtypestr, type_len);
143 ADD_U_INT16(dptr, priv_len);
144 ADD_STRING(dptr, privstr, priv_len);
159 u_char *dptr = NULL;
165 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t) +
170 ADD_U_CHAR(dptr, AUT_ARG32);
171 ADD_U_CHAR(dptr, n);
172 ADD_U_INT32(dptr, v);
173 ADD_U_INT16(dptr, textlen);
174 ADD_STRING(dptr, text, textlen);
183 u_char *dptr = NULL;
189 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) +
194 ADD_U_CHAR(dptr, AUT_ARG64);
195 ADD_U_CHAR(dptr, n);
196 ADD_U_INT64(dptr, v);
197 ADD_U_INT16(dptr, textlen);
198 ADD_STRING(dptr, text, textlen);
224 u_char *dptr = NULL;
228 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
233 ADD_U_CHAR(dptr, AUT_ATTR32);
243 ADD_U_INT16(dptr, pad0_16);
244 ADD_U_INT16(dptr, vni->vn_mode);
246 ADD_U_INT32(dptr, vni->vn_uid);
247 ADD_U_INT32(dptr, vni->vn_gid);
248 ADD_U_INT32(dptr, vni->vn_fsid);
257 ADD_U_INT32(dptr, pad0_32);
258 ADD_U_INT32(dptr, vni->vn_fileid);
260 ADD_U_INT64(dptr, vni->vn_fileid);
262 ADD_U_INT64(dptr, 0LL);
264 ADD_U_INT32(dptr, vni->vn_dev);
273 u_char *dptr = NULL;
277 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
282 ADD_U_CHAR(dptr, AUT_ATTR64);
292 ADD_U_INT16(dptr, pad0_16);
293 ADD_U_INT16(dptr, vni->vn_mode);
295 ADD_U_INT32(dptr, vni->vn_uid);
296 ADD_U_INT32(dptr, vni->vn_gid);
297 ADD_U_INT32(dptr, vni->vn_fsid);
306 ADD_U_INT32(dptr, pad0_32);
307 ADD_U_INT32(dptr, vni->vn_fileid);
309 ADD_U_INT64(dptr, vni->vn_fileid);
311 ADD_U_INT64(dptr, 0LL);
313 ADD_U_INT64(dptr, vni->vn_dev);
337 u_char *dptr = NULL;
367 GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata);
375 ADD_U_CHAR(dptr, AUT_DATA);
376 ADD_U_CHAR(dptr, unit_print);
377 ADD_U_CHAR(dptr, unit_type);
378 ADD_U_CHAR(dptr, unit_count);
379 ADD_MEM(dptr, p, totdata);
394 u_char *dptr = NULL;
396 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t));
400 ADD_U_CHAR(dptr, AUT_EXIT);
401 ADD_U_INT32(dptr, err);
402 ADD_U_INT32(dptr, retval);
425 u_char *dptr = NULL;
428 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
433 ADD_U_CHAR(dptr, AUT_NEWGROUPS);
434 ADD_U_INT16(dptr, n);
436 ADD_U_INT32(dptr, groups[i]);
449 u_char *dptr = NULL;
451 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(uint32_t));
455 ADD_U_CHAR(dptr, AUT_IN_ADDR);
456 ADD_MEM(dptr, &internet_addr->s_addr, sizeof(uint32_t));
470 u_char *dptr = NULL;
473 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 5 * sizeof(uint32_t));
477 ADD_U_CHAR(dptr, AUT_IN_ADDR_EX);
478 ADD_U_INT32(dptr, type);
479 ADD_MEM(dptr, internet_addr, 4 * sizeof(uint32_t));
494 u_char *dptr = NULL;
496 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(struct ip));
500 ADD_U_CHAR(dptr, AUT_IP);
501 ADD_MEM(dptr, ip, sizeof(struct ip));
515 u_char *dptr = NULL;
517 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
521 ADD_U_CHAR(dptr, AUT_IPC);
522 ADD_U_CHAR(dptr, type);
523 ADD_U_INT32(dptr, id);
542 u_char *dptr = NULL;
545 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) +
550 ADD_U_CHAR(dptr, AUT_IPC_PERM);
563 ADD_U_INT16(dptr, pad0);
564 ADD_U_INT16(dptr, perm->uid);
565 ADD_U_INT16(dptr, pad0);
566 ADD_U_INT16(dptr, perm->gid);
567 ADD_U_INT16(dptr, pad0);
568 ADD_U_INT16(dptr, perm->cuid);
569 ADD_U_INT16(dptr, pad0);
570 ADD_U_INT16(dptr, perm->cgid);
572 ADD_U_INT32(dptr, perm->uid);
573 ADD_U_INT32(dptr, perm->gid);
574 ADD_U_INT32(dptr, perm->cuid);
575 ADD_U_INT32(dptr, perm->cgid);
578 ADD_U_INT16(dptr, pad0);
579 ADD_U_INT16(dptr, perm->mode);
581 ADD_U_INT16(dptr, pad0);
584 ADD_U_INT16(dptr, perm->__seq);
587 ADD_U_INT16(dptr, perm->_seq);
589 ADD_U_INT16(dptr, perm->seq);
594 ADD_U_INT32(dptr, perm->__key);
597 ADD_U_INT32(dptr, perm->_key);
599 ADD_U_INT32(dptr, perm->key);
614 u_char *dptr = NULL;
616 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));
620 ADD_U_CHAR(dptr, AUT_IPORT);
621 ADD_U_INT16(dptr, iport);
635 u_char *dptr = NULL;
637 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);
641 ADD_U_CHAR(dptr, AUT_OPAQUE);
642 ADD_U_INT16(dptr, bytes);
643 ADD_MEM(dptr, data, bytes);
659 u_char *dptr = NULL;
666 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
673 ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
674 ADD_U_INT32(dptr, tm.tv_sec);
675 ADD_U_INT32(dptr, timems); /* We need time in ms. */
676 ADD_U_INT16(dptr, filelen);
677 ADD_STRING(dptr, file, filelen);
691 u_char *dptr = NULL;
699 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
703 ADD_U_CHAR(dptr, AUT_TEXT);
704 ADD_U_INT16(dptr, textlen);
705 ADD_STRING(dptr, text, textlen);
719 u_char *dptr = NULL;
725 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
729 ADD_U_CHAR(dptr, AUT_PATH);
730 ADD_U_INT16(dptr, textlen);
731 ADD_STRING(dptr, text, textlen);
754 u_char *dptr = NULL;
756 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
760 ADD_U_CHAR(dptr, AUT_PROCESS32);
761 ADD_U_INT32(dptr, auid);
762 ADD_U_INT32(dptr, euid);
763 ADD_U_INT32(dptr, egid);
764 ADD_U_INT32(dptr, ruid);
765 ADD_U_INT32(dptr, rgid);
766 ADD_U_INT32(dptr, pid);
767 ADD_U_INT32(dptr, sid);
768 ADD_U_INT32(dptr, tid->port);
776 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
786 u_char *dptr = NULL;
788 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 8 * sizeof(u_int32_t) +
793 ADD_U_CHAR(dptr, AUT_PROCESS64);
794 ADD_U_INT32(dptr, auid);
795 ADD_U_INT32(dptr, euid);
796 ADD_U_INT32(dptr, egid);
797 ADD_U_INT32(dptr, ruid);
798 ADD_U_INT32(dptr, rgid);
799 ADD_U_INT32(dptr, pid);
800 ADD_U_INT32(dptr, sid);
801 ADD_U_INT64(dptr, tid->port);
809 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
842 u_char *dptr = NULL;
845 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
848 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
857 ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
858 ADD_U_INT32(dptr, auid);
859 ADD_U_INT32(dptr, euid);
860 ADD_U_INT32(dptr, egid);
861 ADD_U_INT32(dptr, ruid);
862 ADD_U_INT32(dptr, rgid);
863 ADD_U_INT32(dptr, pid);
864 ADD_U_INT32(dptr, sid);
865 ADD_U_INT32(dptr, tid->at_port);
866 ADD_U_INT32(dptr, tid->at_type);
867 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
869 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
870 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
871 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
882 u_char *dptr = NULL;
885 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
889 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
899 ADD_U_CHAR(dptr, AUT_PROCESS64_EX);
900 ADD_U_INT32(dptr, auid);
901 ADD_U_INT32(dptr, euid);
902 ADD_U_INT32(dptr, egid);
903 ADD_U_INT32(dptr, ruid);
904 ADD_U_INT32(dptr, rgid);
905 ADD_U_INT32(dptr, pid);
906 ADD_U_INT32(dptr, sid);
907 ADD_U_INT64(dptr, tid->at_port);
908 ADD_U_INT32(dptr, tid->at_type);
909 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
911 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
912 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
913 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
937 u_char *dptr = NULL;
939 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
943 ADD_U_CHAR(dptr, AUT_RETURN32);
944 ADD_U_CHAR(dptr, status);
945 ADD_U_INT32(dptr, ret);
954 u_char *dptr = NULL;
956 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t));
960 ADD_U_CHAR(dptr, AUT_RETURN64);
961 ADD_U_CHAR(dptr, status);
962 ADD_U_INT64(dptr, ret);
982 u_char *dptr = NULL;
984 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t));
988 ADD_U_CHAR(dptr, AUT_SEQ);
989 ADD_U_INT32(dptr, audit_count);
1012 u_char *dptr = NULL;
1017 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1020 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1029 ADD_U_CHAR(dptr, AUT_SOCKET_EX);
1030 ADD_U_INT16(dptr, au_domain_to_bsm(so_domain));
1031 ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type));
1033 ADD_U_INT16(dptr, AU_IPv4);
1035 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
1036 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
1038 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
1039 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
1041 ADD_U_INT16(dptr, AU_IPv6);
1043 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
1044 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
1046 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
1047 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
1062 u_char *dptr;
1064 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
1068 ADD_U_CHAR(dptr, AUT_SOCKUNIX);
1070 ADD_U_CHAR(dptr, 0);
1071 ADD_U_CHAR(dptr, so->sun_family);
1072 ADD_STRING(dptr, so->sun_path, strlen(so->sun_path) + 1);
1087 u_char *dptr = NULL;
1090 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +
1095 ADD_U_CHAR(dptr, AUT_SOCKINET32);
1107 ADD_U_INT16(dptr, family);
1108 ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
1109 ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
1118 u_char *dptr = NULL;
1120 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +
1125 ADD_U_CHAR(dptr, AUT_SOCKINET128);
1131 ADD_U_CHAR(dptr, 0);
1132 ADD_U_CHAR(dptr, so->sin6_family);
1134 ADD_U_INT16(dptr, so->sin6_port);
1135 ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
1165 u_char *dptr = NULL;
1167 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
1171 ADD_U_CHAR(dptr, AUT_SUBJECT32);
1172 ADD_U_INT32(dptr, auid);
1173 ADD_U_INT32(dptr, euid);
1174 ADD_U_INT32(dptr, egid);
1175 ADD_U_INT32(dptr, ruid);
1176 ADD_U_INT32(dptr, rgid);
1177 ADD_U_INT32(dptr, pid);
1178 ADD_U_INT32(dptr, sid);
1179 ADD_U_INT32(dptr, tid->port);
1180 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1190 u_char *dptr = NULL;
1192 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 7 * sizeof(u_int32_t) +
1197 ADD_U_CHAR(dptr, AUT_SUBJECT64);
1198 ADD_U_INT32(dptr, auid);
1199 ADD_U_INT32(dptr, euid);
1200 ADD_U_INT32(dptr, egid);
1201 ADD_U_INT32(dptr, ruid);
1202 ADD_U_INT32(dptr, rgid);
1203 ADD_U_INT32(dptr, pid);
1204 ADD_U_INT32(dptr, sid);
1205 ADD_U_INT64(dptr, tid->port);
1206 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1239 u_char *dptr = NULL;
1242 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
1245 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
1254 ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
1255 ADD_U_INT32(dptr, auid);
1256 ADD_U_INT32(dptr, euid);
1257 ADD_U_INT32(dptr, egid);
1258 ADD_U_INT32(dptr, ruid);
1259 ADD_U_INT32(dptr, rgid);
1260 ADD_U_INT32(dptr, pid);
1261 ADD_U_INT32(dptr, sid);
1262 ADD_U_INT32(dptr, tid->at_port);
1263 ADD_U_INT32(dptr, tid->at_type);
1265 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1267 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1277 u_char *dptr = NULL;
1280 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1284 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1294 ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
1295 ADD_U_INT32(dptr, auid);
1296 ADD_U_INT32(dptr, euid);
1297 ADD_U_INT32(dptr, egid);
1298 ADD_U_INT32(dptr, ruid);
1299 ADD_U_INT32(dptr, rgid);
1300 ADD_U_INT32(dptr, pid);
1301 ADD_U_INT32(dptr, sid);
1302 ADD_U_INT64(dptr, tid->at_port);
1303 ADD_U_INT32(dptr, tid->at_type);
1305 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1307 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1363 u_char *dptr = NULL;
1379 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1383 ADD_U_CHAR(dptr, AUT_EXEC_ARGS);
1384 ADD_U_INT32(dptr, count);
1388 ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
1403 u_char *dptr = NULL;
1419 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1423 ADD_U_CHAR(dptr, AUT_EXEC_ENV);
1424 ADD_U_INT32(dptr, count);
1428 ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
1442 u_char *dptr = NULL;
1447 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
1451 ADD_U_CHAR(dptr, AUT_ZONENAME);
1452 ADD_U_INT16(dptr, textlen);
1453 ADD_STRING(dptr, zonename, textlen);
1471 u_char *dptr = NULL;
1474 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1479 ADD_U_CHAR(dptr, AUT_HEADER32);
1480 ADD_U_INT32(dptr, rec_size);
1481 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1482 ADD_U_INT16(dptr, e_type);
1483 ADD_U_INT16(dptr, e_mod);
1487 ADD_U_INT32(dptr, tm.tv_sec);
1488 ADD_U_INT32(dptr, timems); /* We need time in ms. */
1509 u_char *dptr = NULL;
1516 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1522 ADD_U_CHAR(dptr, AUT_HEADER32_EX);
1523 ADD_U_INT32(dptr, rec_size);
1524 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1525 ADD_U_INT16(dptr, e_type);
1526 ADD_U_INT16(dptr, e_mod);
1528 ADD_U_INT32(dptr, tid->at_type);
1530 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1532 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1535 ADD_U_INT32(dptr, tm.tv_sec);
1536 ADD_U_INT32(dptr, timems); /* We need time in ms. */
1546 u_char *dptr = NULL;
1549 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1554 ADD_U_CHAR(dptr, AUT_HEADER64);
1555 ADD_U_INT32(dptr, rec_size);
1556 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1557 ADD_U_INT16(dptr, e_type);
1558 ADD_U_INT16(dptr, e_mod);
1562 ADD_U_INT64(dptr, tm.tv_sec);
1563 ADD_U_INT64(dptr, timems); /* We need time in ms. */
1634 u_char *dptr = NULL;
1637 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
1642 ADD_U_CHAR(dptr, AUT_TRAILER);
1643 ADD_U_INT16(dptr, magic);
1644 ADD_U_INT32(dptr, rec_size);