Lines Matching refs:dptr
60 #define GET_TOKEN_AREA(t, dptr, length) do { \
64 dptr = t->t_data; \
77 u_char *dptr;
81 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_char) +
84 ADD_U_CHAR(dptr, AUT_UPRIV);
85 ADD_U_CHAR(dptr, sorf);
86 ADD_U_INT16(dptr, textlen);
87 ADD_STRING(dptr, priv, textlen);
102 u_char *dptr;
107 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
110 ADD_U_CHAR(dptr, AUT_PRIV);
111 ADD_U_INT16(dptr, type_len);
112 ADD_STRING(dptr, privtypestr, type_len);
113 ADD_U_INT16(dptr, priv_len);
114 ADD_STRING(dptr, privstr, priv_len);
129 u_char *dptr = NULL;
135 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t) +
138 ADD_U_CHAR(dptr, AUT_ARG32);
139 ADD_U_CHAR(dptr, n);
140 ADD_U_INT32(dptr, v);
141 ADD_U_INT16(dptr, textlen);
142 ADD_STRING(dptr, text, textlen);
151 u_char *dptr = NULL;
157 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) +
160 ADD_U_CHAR(dptr, AUT_ARG64);
161 ADD_U_CHAR(dptr, n);
162 ADD_U_INT64(dptr, v);
163 ADD_U_INT16(dptr, textlen);
164 ADD_STRING(dptr, text, textlen);
190 u_char *dptr = NULL;
194 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
197 ADD_U_CHAR(dptr, AUT_ATTR32);
207 ADD_U_INT16(dptr, pad0_16);
208 ADD_U_INT16(dptr, vni->vn_mode);
210 ADD_U_INT32(dptr, vni->vn_uid);
211 ADD_U_INT32(dptr, vni->vn_gid);
212 ADD_U_INT32(dptr, vni->vn_fsid);
221 ADD_U_INT32(dptr, pad0_32);
222 ADD_U_INT32(dptr, vni->vn_fileid);
224 ADD_U_INT64(dptr, vni->vn_fileid);
226 ADD_U_INT64(dptr, 0LL);
228 ADD_U_INT32(dptr, vni->vn_dev);
237 u_char *dptr = NULL;
241 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
244 ADD_U_CHAR(dptr, AUT_ATTR64);
254 ADD_U_INT16(dptr, pad0_16);
255 ADD_U_INT16(dptr, vni->vn_mode);
257 ADD_U_INT32(dptr, vni->vn_uid);
258 ADD_U_INT32(dptr, vni->vn_gid);
259 ADD_U_INT32(dptr, vni->vn_fsid);
268 ADD_U_INT32(dptr, pad0_32);
269 ADD_U_INT32(dptr, vni->vn_fileid);
271 ADD_U_INT64(dptr, vni->vn_fileid);
273 ADD_U_INT64(dptr, 0LL);
275 ADD_U_INT64(dptr, vni->vn_dev);
299 u_char *dptr = NULL;
328 GET_TOKEN_AREA(t, dptr, 4 * sizeof(u_char) + totdata);
334 ADD_U_CHAR(dptr, AUT_DATA);
335 ADD_U_CHAR(dptr, unit_print);
336 ADD_U_CHAR(dptr, unit_type);
337 ADD_U_CHAR(dptr, unit_count);
338 ADD_MEM(dptr, p, totdata);
353 u_char *dptr = NULL;
355 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t));
357 ADD_U_CHAR(dptr, AUT_EXIT);
358 ADD_U_INT32(dptr, err);
359 ADD_U_INT32(dptr, retval);
382 u_char *dptr = NULL;
385 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
388 ADD_U_CHAR(dptr, AUT_NEWGROUPS);
389 ADD_U_INT16(dptr, n);
391 ADD_U_INT32(dptr, groups[i]);
404 u_char *dptr = NULL;
406 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(uint32_t));
408 ADD_U_CHAR(dptr, AUT_IN_ADDR);
409 ADD_MEM(dptr, &internet_addr->s_addr, sizeof(uint32_t));
423 u_char *dptr = NULL;
426 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 5 * sizeof(uint32_t));
428 ADD_U_CHAR(dptr, AUT_IN_ADDR_EX);
429 ADD_U_INT32(dptr, type);
430 ADD_MEM(dptr, internet_addr, 4 * sizeof(uint32_t));
445 u_char *dptr = NULL;
447 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(struct ip));
449 ADD_U_CHAR(dptr, AUT_IP);
450 ADD_MEM(dptr, ip, sizeof(struct ip));
464 u_char *dptr = NULL;
466 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
468 ADD_U_CHAR(dptr, AUT_IPC);
469 ADD_U_CHAR(dptr, type);
470 ADD_U_INT32(dptr, id);
489 u_char *dptr = NULL;
492 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) +
495 ADD_U_CHAR(dptr, AUT_IPC_PERM);
508 ADD_U_INT16(dptr, pad0);
509 ADD_U_INT16(dptr, perm->uid);
510 ADD_U_INT16(dptr, pad0);
511 ADD_U_INT16(dptr, perm->gid);
512 ADD_U_INT16(dptr, pad0);
513 ADD_U_INT16(dptr, perm->cuid);
514 ADD_U_INT16(dptr, pad0);
515 ADD_U_INT16(dptr, perm->cgid);
517 ADD_U_INT32(dptr, perm->uid);
518 ADD_U_INT32(dptr, perm->gid);
519 ADD_U_INT32(dptr, perm->cuid);
520 ADD_U_INT32(dptr, perm->cgid);
523 ADD_U_INT16(dptr, pad0);
524 ADD_U_INT16(dptr, perm->mode);
526 ADD_U_INT16(dptr, pad0);
528 ADD_U_INT16(dptr, perm->seq);
530 ADD_U_INT32(dptr, perm->key);
543 u_char *dptr = NULL;
545 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));
547 ADD_U_CHAR(dptr, AUT_IPORT);
548 ADD_U_INT16(dptr, iport);
562 u_char *dptr = NULL;
564 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);
566 ADD_U_CHAR(dptr, AUT_OPAQUE);
567 ADD_U_INT16(dptr, bytes);
568 ADD_MEM(dptr, data, bytes);
584 u_char *dptr = NULL;
591 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
596 ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
597 ADD_U_INT32(dptr, tm.tv_sec);
598 ADD_U_INT32(dptr, timems); /* We need time in ms. */
599 ADD_U_INT16(dptr, filelen);
600 ADD_STRING(dptr, file, filelen);
614 u_char *dptr = NULL;
622 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
624 ADD_U_CHAR(dptr, AUT_TEXT);
625 ADD_U_INT16(dptr, textlen);
626 ADD_STRING(dptr, text, textlen);
640 u_char *dptr = NULL;
646 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
648 ADD_U_CHAR(dptr, AUT_PATH);
649 ADD_U_INT16(dptr, textlen);
650 ADD_STRING(dptr, text, textlen);
673 u_char *dptr = NULL;
675 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
677 ADD_U_CHAR(dptr, AUT_PROCESS32);
678 ADD_U_INT32(dptr, auid);
679 ADD_U_INT32(dptr, euid);
680 ADD_U_INT32(dptr, egid);
681 ADD_U_INT32(dptr, ruid);
682 ADD_U_INT32(dptr, rgid);
683 ADD_U_INT32(dptr, pid);
684 ADD_U_INT32(dptr, sid);
685 ADD_U_INT32(dptr, tid->port);
693 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
703 u_char *dptr = NULL;
705 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 8 * sizeof(u_int32_t) +
708 ADD_U_CHAR(dptr, AUT_PROCESS64);
709 ADD_U_INT32(dptr, auid);
710 ADD_U_INT32(dptr, euid);
711 ADD_U_INT32(dptr, egid);
712 ADD_U_INT32(dptr, ruid);
713 ADD_U_INT32(dptr, rgid);
714 ADD_U_INT32(dptr, pid);
715 ADD_U_INT32(dptr, sid);
716 ADD_U_INT64(dptr, tid->port);
724 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
757 u_char *dptr = NULL;
762 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
765 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
768 ADD_U_CHAR(dptr, AUT_PROCESS32_EX);
769 ADD_U_INT32(dptr, auid);
770 ADD_U_INT32(dptr, euid);
771 ADD_U_INT32(dptr, egid);
772 ADD_U_INT32(dptr, ruid);
773 ADD_U_INT32(dptr, rgid);
774 ADD_U_INT32(dptr, pid);
775 ADD_U_INT32(dptr, sid);
776 ADD_U_INT32(dptr, tid->at_port);
777 ADD_U_INT32(dptr, tid->at_type);
778 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
780 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
781 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
782 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
793 u_char *dptr = NULL;
796 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
800 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
807 ADD_U_CHAR(dptr, AUT_PROCESS64_EX);
808 ADD_U_INT32(dptr, auid);
809 ADD_U_INT32(dptr, euid);
810 ADD_U_INT32(dptr, egid);
811 ADD_U_INT32(dptr, ruid);
812 ADD_U_INT32(dptr, rgid);
813 ADD_U_INT32(dptr, pid);
814 ADD_U_INT32(dptr, sid);
815 ADD_U_INT64(dptr, tid->at_port);
816 ADD_U_INT32(dptr, tid->at_type);
817 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
819 ADD_MEM(dptr, &tid->at_addr[1], sizeof(u_int32_t));
820 ADD_MEM(dptr, &tid->at_addr[2], sizeof(u_int32_t));
821 ADD_MEM(dptr, &tid->at_addr[3], sizeof(u_int32_t));
840 u_char *dptr;
843 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(*rightsp));
845 ADD_U_CHAR(dptr, AUT_RIGHTS);
847 ADD_U_INT64(dptr, rightsp->cr_rights[i]);
861 u_char *dptr = NULL;
863 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int32_t));
865 ADD_U_CHAR(dptr, AUT_RETURN32);
866 ADD_U_CHAR(dptr, status);
867 ADD_U_INT32(dptr, ret);
876 u_char *dptr = NULL;
878 GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t));
880 ADD_U_CHAR(dptr, AUT_RETURN64);
881 ADD_U_CHAR(dptr, status);
882 ADD_U_INT64(dptr, ret);
902 u_char *dptr = NULL;
904 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t));
906 ADD_U_CHAR(dptr, AUT_SEQ);
907 ADD_U_INT32(dptr, audit_count);
930 u_char *dptr = NULL;
935 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
938 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
943 ADD_U_CHAR(dptr, AUT_SOCKET_EX);
944 ADD_U_INT16(dptr, au_domain_to_bsm(so_domain));
945 ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type));
947 ADD_U_INT16(dptr, AU_IPv4);
949 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
950 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
952 ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
953 ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
955 ADD_U_INT16(dptr, AU_IPv6);
957 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
958 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
960 ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
961 ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
977 u_char *dptr;
980 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
983 ADD_U_CHAR(dptr, AUT_SOCKET);
986 ADD_U_INT16(dptr, so_type);
987 ADD_U_INT16(dptr, soi->so_lport);
988 ADD_U_INT32(dptr, soi->so_laddr);
989 ADD_U_INT16(dptr, soi->so_rport);
990 ADD_U_INT32(dptr, soi->so_raddr);
1005 u_char *dptr;
1007 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + strlen(so->sun_path) + 1);
1009 ADD_U_CHAR(dptr, AUT_SOCKUNIX);
1011 ADD_U_CHAR(dptr, 0);
1012 ADD_U_CHAR(dptr, so->sun_family);
1013 ADD_STRING(dptr, so->sun_path, strlen(so->sun_path) + 1);
1028 u_char *dptr = NULL;
1031 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +
1034 ADD_U_CHAR(dptr, AUT_SOCKINET32);
1046 ADD_U_INT16(dptr, family);
1047 ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
1048 ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
1057 u_char *dptr = NULL;
1059 GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +
1062 ADD_U_CHAR(dptr, AUT_SOCKINET128);
1068 ADD_U_CHAR(dptr, 0);
1069 ADD_U_CHAR(dptr, so->sin6_family);
1071 ADD_U_INT16(dptr, so->sin6_port);
1072 ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
1102 u_char *dptr = NULL;
1104 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 9 * sizeof(u_int32_t));
1106 ADD_U_CHAR(dptr, AUT_SUBJECT32);
1107 ADD_U_INT32(dptr, auid);
1108 ADD_U_INT32(dptr, euid);
1109 ADD_U_INT32(dptr, egid);
1110 ADD_U_INT32(dptr, ruid);
1111 ADD_U_INT32(dptr, rgid);
1112 ADD_U_INT32(dptr, pid);
1113 ADD_U_INT32(dptr, sid);
1114 ADD_U_INT32(dptr, tid->port);
1115 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1125 u_char *dptr = NULL;
1127 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 7 * sizeof(u_int32_t) +
1130 ADD_U_CHAR(dptr, AUT_SUBJECT64);
1131 ADD_U_INT32(dptr, auid);
1132 ADD_U_INT32(dptr, euid);
1133 ADD_U_INT32(dptr, egid);
1134 ADD_U_INT32(dptr, ruid);
1135 ADD_U_INT32(dptr, rgid);
1136 ADD_U_INT32(dptr, pid);
1137 ADD_U_INT32(dptr, sid);
1138 ADD_U_INT64(dptr, tid->port);
1139 ADD_MEM(dptr, &tid->machine, sizeof(u_int32_t));
1172 u_char *dptr = NULL;
1178 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 10 *
1181 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 13 *
1184 ADD_U_CHAR(dptr, AUT_SUBJECT32_EX);
1185 ADD_U_INT32(dptr, auid);
1186 ADD_U_INT32(dptr, euid);
1187 ADD_U_INT32(dptr, egid);
1188 ADD_U_INT32(dptr, ruid);
1189 ADD_U_INT32(dptr, rgid);
1190 ADD_U_INT32(dptr, pid);
1191 ADD_U_INT32(dptr, sid);
1192 ADD_U_INT32(dptr, tid->at_port);
1193 ADD_U_INT32(dptr, tid->at_type);
1195 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1197 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1207 u_char *dptr = NULL;
1213 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1217 GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
1221 ADD_U_CHAR(dptr, AUT_SUBJECT64_EX);
1222 ADD_U_INT32(dptr, auid);
1223 ADD_U_INT32(dptr, euid);
1224 ADD_U_INT32(dptr, egid);
1225 ADD_U_INT32(dptr, ruid);
1226 ADD_U_INT32(dptr, rgid);
1227 ADD_U_INT32(dptr, pid);
1228 ADD_U_INT32(dptr, sid);
1229 ADD_U_INT64(dptr, tid->at_port);
1230 ADD_U_INT32(dptr, tid->at_type);
1232 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1234 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1286 u_char *dptr = NULL;
1298 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1299 ADD_U_CHAR(dptr, type);
1300 ADD_U_INT32(dptr, count);
1301 ADD_STRING(dptr, strs, totlen);
1339 u_char *dptr = NULL;
1355 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1357 ADD_U_CHAR(dptr, AUT_EXEC_ARGS);
1358 ADD_U_INT32(dptr, count);
1362 ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
1377 u_char *dptr = NULL;
1393 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) + totlen);
1395 ADD_U_CHAR(dptr, AUT_EXEC_ENV);
1396 ADD_U_INT32(dptr, count);
1400 ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
1415 u_char *dptr = NULL;
1420 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
1422 ADD_U_CHAR(dptr, AUT_ZONENAME);
1423 ADD_U_INT16(dptr, textlen);
1424 ADD_STRING(dptr, zonename, textlen);
1442 u_char *dptr = NULL;
1445 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1448 ADD_U_CHAR(dptr, AUT_HEADER32);
1449 ADD_U_INT32(dptr, rec_size);
1450 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1451 ADD_U_INT16(dptr, e_type);
1452 ADD_U_INT16(dptr, e_mod);
1456 ADD_U_INT32(dptr, tm.tv_sec);
1457 ADD_U_INT32(dptr, timems); /* We need time in ms. */
1478 u_char *dptr = NULL;
1486 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1490 ADD_U_CHAR(dptr, AUT_HEADER32_EX);
1491 ADD_U_INT32(dptr, rec_size);
1492 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1493 ADD_U_INT16(dptr, e_type);
1494 ADD_U_INT16(dptr, e_mod);
1496 ADD_U_INT32(dptr, tid->at_type);
1498 ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
1500 ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
1503 ADD_U_INT32(dptr, tm.tv_sec);
1504 ADD_U_INT32(dptr, timems); /* We need time in ms. */
1514 u_char *dptr = NULL;
1517 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
1520 ADD_U_CHAR(dptr, AUT_HEADER64);
1521 ADD_U_INT32(dptr, rec_size);
1522 ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
1523 ADD_U_INT16(dptr, e_type);
1524 ADD_U_INT16(dptr, e_mod);
1528 ADD_U_INT64(dptr, tm.tv_sec);
1529 ADD_U_INT64(dptr, timems); /* We need time in ms. */
1600 u_char *dptr = NULL;
1603 GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
1606 ADD_U_CHAR(dptr, AUT_TRAILER);
1607 ADD_U_INT16(dptr, magic);
1608 ADD_U_INT32(dptr, rec_size);