Lines Matching refs:dptr
62 #define GET_TOKEN_AREA(t, dptr, length) do { \
66 dptr = t->t_data; \
79 u_char *dptr;
83 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_char) +
86 ADD_U_CHAR(dptr, AUT_UPRIV);
87 ADD_U_CHAR(dptr, sorf);
88 ADD_U_INT16(dptr, textlen);
89 ADD_STRING(dptr, priv, textlen);
104 u_char *dptr;
109 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
112 ADD_U_CHAR(dptr, AUT_PRIV);
113 ADD_U_INT16(dptr, type_len);
114 ADD_STRING(dptr, privtypestr, type_len);
115 ADD_U_INT16(dptr, priv_len);
116 ADD_STRING(dptr, privstr, priv_len);
131 u_char *dptr = NULL;
137 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t) +
140 ADD_U_CHAR(dptr, AUT_ARG32);
141 ADD_U_CHAR(dptr, n);
142 ADD_U_INT32(dptr, v);
143 ADD_U_INT16(dptr, textlen);
144 ADD_STRING(dptr, text, textlen);
153 u_char *dptr = NULL;
159 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) +
162 ADD_U_CHAR(dptr, AUT_ARG64);
163 ADD_U_CHAR(dptr, n);
164 ADD_U_INT64(dptr, v);
165 ADD_U_INT16(dptr, textlen);
166 ADD_STRING(dptr, text, textlen);
192 u_char *dptr = NULL;
196 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
199 ADD_U_CHAR(dptr, AUT_ATTR32);
209 ADD_U_INT16(dptr, pad0_16);
210 ADD_U_INT16(dptr, vni->vn_mode);
212 ADD_U_INT32(dptr, vni->vn_uid);
213 ADD_U_INT32(dptr, vni->vn_gid);
214 ADD_U_INT32(dptr, vni->vn_fsid);
223 ADD_U_INT32(dptr, pad0_32);
224 ADD_U_INT32(dptr, vni->vn_fileid);
226 ADD_U_INT64(dptr, vni->vn_fileid);
228 ADD_U_INT64(dptr, 0LL);
230 ADD_U_INT32(dptr, vni->vn_dev);
239 u_char *dptr = NULL;
243 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
246 ADD_U_CHAR(dptr, AUT_ATTR64);
256 ADD_U_INT16(dptr, pad0_16);
257 ADD_U_INT16(dptr, vni->vn_mode);
259 ADD_U_INT32(dptr, vni->vn_uid);
260 ADD_U_INT32(dptr, vni->vn_gid);
261 ADD_U_INT32(dptr, vni->vn_fsid);
270 ADD_U_INT32(dptr, pad0_32);
271 ADD_U_INT32(dptr, vni->vn_fileid);
273 ADD_U_INT64(dptr, vni->vn_fileid);
275 ADD_U_INT64(dptr, 0LL);
277 ADD_U_INT64(dptr, vni->vn_dev);
301 u_char *dptr = NULL;
330 GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata);
336 ADD_U_CHAR(dptr, AUT_DATA);
337 ADD_U_CHAR(dptr, unit_print);
338 ADD_U_CHAR(dptr, unit_type);
339 ADD_U_CHAR(dptr, unit_count);
340 ADD_MEM(dptr, p, totdata);
355 u_char *dptr = NULL;
357 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t));
359 ADD_U_CHAR(dptr, AUT_EXIT);
360 ADD_U_INT32(dptr, err);
361 ADD_U_INT32(dptr, retval);
384 u_char *dptr = NULL;
387 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
390 ADD_U_CHAR(dptr, AUT_NEWGROUPS);
391 ADD_U_INT16(dptr, n);
393 ADD_U_INT32(dptr, groups[i]);
406 u_char *dptr = NULL;
408 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(uint32_t));
410 ADD_U_CHAR(dptr, AUT_IN_ADDR);
411 ADD_MEM(dptr, &internet_addr->s_addr, sizeof(uint32_t));
425 u_char *dptr = NULL;
428 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 5 * sizeof(uint32_t));
430 ADD_U_CHAR(dptr, AUT_IN_ADDR_EX);
431 ADD_U_INT32(dptr, type);
432 ADD_MEM(dptr, internet_addr, 4 * sizeof(uint32_t));
447 u_char *dptr = NULL;
449 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(struct ip));
451 ADD_U_CHAR(dptr, AUT_IP);
452 ADD_MEM(dptr, ip, sizeof(struct ip));
466 u_char *dptr = NULL;
468 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
470 ADD_U_CHAR(dptr, AUT_IPC);
471 ADD_U_CHAR(dptr, type);
472 ADD_U_INT32(dptr, id);
491 u_char *dptr = NULL;
494 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) +
497 ADD_U_CHAR(dptr, AUT_IPC_PERM);
510 ADD_U_INT16(dptr, pad0);
511 ADD_U_INT16(dptr, perm->uid);
512 ADD_U_INT16(dptr, pad0);
513 ADD_U_INT16(dptr, perm->gid);
514 ADD_U_INT16(dptr, pad0);
515 ADD_U_INT16(dptr, perm->cuid);
516 ADD_U_INT16(dptr, pad0);
517 ADD_U_INT16(dptr, perm->cgid);
519 ADD_U_INT32(dptr, perm->uid);
520 ADD_U_INT32(dptr, perm->gid);
521 ADD_U_INT32(dptr, perm->cuid);
522 ADD_U_INT32(dptr, perm->cgid);
525 ADD_U_INT16(dptr, pad0);
526 ADD_U_INT16(dptr, perm->mode);
528 ADD_U_INT16(dptr, pad0);
530 ADD_U_INT16(dptr, perm->seq);
532 ADD_U_INT32(dptr, perm->key);
545 u_char *dptr = NULL;
547 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));
549 ADD_U_CHAR(dptr, AUT_IPORT);
550 ADD_U_INT16(dptr, iport);
564 u_char *dptr = NULL;
566 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);
568 ADD_U_CHAR(dptr, AUT_OPAQUE);
569 ADD_U_INT16(dptr, bytes);
570 ADD_MEM(dptr, data, bytes);
586 u_char *dptr = NULL;
593 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
598 ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
599 ADD_U_INT32(dptr, tm.tv_sec);
600 ADD_U_INT32(dptr, timems); /* We need time in ms. */
601 ADD_U_INT16(dptr, filelen);
602 ADD_STRING(dptr, file, filelen);
616 u_char *dptr = NULL;
624 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
626 ADD_U_CHAR(dptr, AUT_TEXT);
627 ADD_U_INT16(dptr, textlen);
628 ADD_STRING(dptr, text, textlen);
642 u_char *dptr = NULL;
648 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
650 ADD_U_CHAR(dptr, AUT_PATH);
651 ADD_U_INT16(dptr, textlen);
652 ADD_STRING(dptr, text, textlen);
675 u_char *dptr = NULL;
677 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
679 ADD_U_CHAR(dptr, AUT_PROCESS32);
680 ADD_U_INT32(dptr, auid);
681 ADD_U_INT32(dptr, euid);
682 ADD_U_INT32(dptr, egid);
683 ADD_U_INT32(dptr, ruid);
684 ADD_U_INT32(dptr, rgid);
685 ADD_U_INT32(dptr, pid);
686 ADD_U_INT32(dptr, sid);
687 ADD_U_INT32(dptr, tid->port);
695 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
705 u_char *dptr = NULL;
707 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 8 * sizeof(u_int32_t) +
710 ADD_U_CHAR(dptr, AUT_PROCESS64);
711 ADD_U_INT32(dptr, auid);
712 ADD_U_INT32(dptr, euid);
713 ADD_U_INT32(dptr, egid);
714 ADD_U_INT32(dptr, ruid);
715 ADD_U_INT32(dptr, rgid);
716 ADD_U_INT32(dptr, pid);
717 ADD_U_INT32(dptr, sid);
718 ADD_U_INT64(dptr, tid->port);
726 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
759 u_char *dptr = NULL;
764 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
767 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
770 ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
771 ADD_U_INT32(dptr, auid);
772 ADD_U_INT32(dptr, euid);
773 ADD_U_INT32(dptr, egid);
774 ADD_U_INT32(dptr, ruid);
775 ADD_U_INT32(dptr, rgid);
776 ADD_U_INT32(dptr, pid);
777 ADD_U_INT32(dptr, sid);
778 ADD_U_INT32(dptr, tid->at_port);
779 ADD_U_INT32(dptr, tid->at_type);
780 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
782 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
783 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
784 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
795 u_char *dptr = NULL;
798 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
802 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
809 ADD_U_CHAR(dptr, AUT_PROCESS64_EX);
810 ADD_U_INT32(dptr, auid);
811 ADD_U_INT32(dptr, euid);
812 ADD_U_INT32(dptr, egid);
813 ADD_U_INT32(dptr, ruid);
814 ADD_U_INT32(dptr, rgid);
815 ADD_U_INT32(dptr, pid);
816 ADD_U_INT32(dptr, sid);
817 ADD_U_INT64(dptr, tid->at_port);
818 ADD_U_INT32(dptr, tid->at_type);
819 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
821 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
822 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
823 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
842 u_char *dptr;
845 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(*rightsp));
847 ADD_U_CHAR(dptr, AUT_RIGHTS);
849 ADD_U_INT64(dptr, rightsp->cr_rights[i]);
863 u_char *dptr = NULL;
865 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
867 ADD_U_CHAR(dptr, AUT_RETURN32);
868 ADD_U_CHAR(dptr, status);
869 ADD_U_INT32(dptr, ret);
878 u_char *dptr = NULL;
880 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t));
882 ADD_U_CHAR(dptr, AUT_RETURN64);
883 ADD_U_CHAR(dptr, status);
884 ADD_U_INT64(dptr, ret);
904 u_char *dptr = NULL;
906 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t));
908 ADD_U_CHAR(dptr, AUT_SEQ);
909 ADD_U_INT32(dptr, audit_count);
932 u_char *dptr = NULL;
937 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
940 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
945 ADD_U_CHAR(dptr, AUT_SOCKET_EX);
946 ADD_U_INT16(dptr, au_domain_to_bsm(so_domain));
947 ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type));
949 ADD_U_INT16(dptr, AU_IPv4);
951 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
952 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
954 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
955 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
957 ADD_U_INT16(dptr, AU_IPv6);
959 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
960 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
962 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
963 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
979 u_char *dptr;
982 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
985 ADD_U_CHAR(dptr, AUT_SOCKET);
988 ADD_U_INT16(dptr, so_type);
989 ADD_U_INT16(dptr, soi->so_lport);
990 ADD_U_INT32(dptr, soi->so_laddr);
991 ADD_U_INT16(dptr, soi->so_rport);
992 ADD_U_INT32(dptr, soi->so_raddr);
1007 u_char *dptr;
1009 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
1011 ADD_U_CHAR(dptr, AUT_SOCKUNIX);
1013 ADD_U_CHAR(dptr, 0);
1014 ADD_U_CHAR(dptr, so->sun_family);
1015 ADD_STRING(dptr, so->sun_path, strlen(so->sun_path) + 1);
1030 u_char *dptr = NULL;
1033 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +
1036 ADD_U_CHAR(dptr, AUT_SOCKINET32);
1048 ADD_U_INT16(dptr, family);
1049 ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
1050 ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
1059 u_char *dptr = NULL;
1061 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +
1064 ADD_U_CHAR(dptr, AUT_SOCKINET128);
1070 ADD_U_CHAR(dptr, 0);
1071 ADD_U_CHAR(dptr, so->sin6_family);
1073 ADD_U_INT16(dptr, so->sin6_port);
1074 ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
1104 u_char *dptr = NULL;
1106 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
1108 ADD_U_CHAR(dptr, AUT_SUBJECT32);
1109 ADD_U_INT32(dptr, auid);
1110 ADD_U_INT32(dptr, euid);
1111 ADD_U_INT32(dptr, egid);
1112 ADD_U_INT32(dptr, ruid);
1113 ADD_U_INT32(dptr, rgid);
1114 ADD_U_INT32(dptr, pid);
1115 ADD_U_INT32(dptr, sid);
1116 ADD_U_INT32(dptr, tid->port);
1117 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1127 u_char *dptr = NULL;
1129 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 7 * sizeof(u_int32_t) +
1132 ADD_U_CHAR(dptr, AUT_SUBJECT64);
1133 ADD_U_INT32(dptr, auid);
1134 ADD_U_INT32(dptr, euid);
1135 ADD_U_INT32(dptr, egid);
1136 ADD_U_INT32(dptr, ruid);
1137 ADD_U_INT32(dptr, rgid);
1138 ADD_U_INT32(dptr, pid);
1139 ADD_U_INT32(dptr, sid);
1140 ADD_U_INT64(dptr, tid->port);
1141 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1174 u_char *dptr = NULL;
1180 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
1183 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
1186 ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
1187 ADD_U_INT32(dptr, auid);
1188 ADD_U_INT32(dptr, euid);
1189 ADD_U_INT32(dptr, egid);
1190 ADD_U_INT32(dptr, ruid);
1191 ADD_U_INT32(dptr, rgid);
1192 ADD_U_INT32(dptr, pid);
1193 ADD_U_INT32(dptr, sid);
1194 ADD_U_INT32(dptr, tid->at_port);
1195 ADD_U_INT32(dptr, tid->at_type);
1197 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1199 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1209 u_char *dptr = NULL;
1215 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1219 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1223 ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
1224 ADD_U_INT32(dptr, auid);
1225 ADD_U_INT32(dptr, euid);
1226 ADD_U_INT32(dptr, egid);
1227 ADD_U_INT32(dptr, ruid);
1228 ADD_U_INT32(dptr, rgid);
1229 ADD_U_INT32(dptr, pid);
1230 ADD_U_INT32(dptr, sid);
1231 ADD_U_INT64(dptr, tid->at_port);
1232 ADD_U_INT32(dptr, tid->at_type);
1234 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1236 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1288 u_char *dptr = NULL;
1300 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1301 ADD_U_CHAR(dptr, type);
1302 ADD_U_INT32(dptr, count);
1303 ADD_STRING(dptr, strs, totlen);
1341 u_char *dptr = NULL;
1357 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1359 ADD_U_CHAR(dptr, AUT_EXEC_ARGS);
1360 ADD_U_INT32(dptr, count);
1364 ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
1379 u_char *dptr = NULL;
1395 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1397 ADD_U_CHAR(dptr, AUT_EXEC_ENV);
1398 ADD_U_INT32(dptr, count);
1402 ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
1417 u_char *dptr = NULL;
1422 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
1424 ADD_U_CHAR(dptr, AUT_ZONENAME);
1425 ADD_U_INT16(dptr, textlen);
1426 ADD_STRING(dptr, zonename, textlen);
1444 u_char *dptr = NULL;
1447 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1450 ADD_U_CHAR(dptr, AUT_HEADER32);
1451 ADD_U_INT32(dptr, rec_size);
1452 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1453 ADD_U_INT16(dptr, e_type);
1454 ADD_U_INT16(dptr, e_mod);
1458 ADD_U_INT32(dptr, tm.tv_sec);
1459 ADD_U_INT32(dptr, timems); /* We need time in ms. */
1480 u_char *dptr = NULL;
1488 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1492 ADD_U_CHAR(dptr, AUT_HEADER32_EX);
1493 ADD_U_INT32(dptr, rec_size);
1494 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1495 ADD_U_INT16(dptr, e_type);
1496 ADD_U_INT16(dptr, e_mod);
1498 ADD_U_INT32(dptr, tid->at_type);
1500 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1502 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1505 ADD_U_INT32(dptr, tm.tv_sec);
1506 ADD_U_INT32(dptr, timems); /* We need time in ms. */
1516 u_char *dptr = NULL;
1519 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1522 ADD_U_CHAR(dptr, AUT_HEADER64);
1523 ADD_U_INT32(dptr, rec_size);
1524 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1525 ADD_U_INT16(dptr, e_type);
1526 ADD_U_INT16(dptr, e_mod);
1530 ADD_U_INT64(dptr, tm.tv_sec);
1531 ADD_U_INT64(dptr, timems); /* We need time in ms. */
1602 u_char *dptr = NULL;
1605 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
1608 ADD_U_CHAR(dptr, AUT_TRAILER);
1609 ADD_U_INT16(dptr, magic);
1610 ADD_U_INT32(dptr, rec_size);