Lines Matching refs:tok
915 fetch_header32_tok(tokenstr_t *tok, u_char *buf, int len)
919 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr32.size, tok->len, err);
923 READ_TOKEN_U_CHAR(buf, len, tok->tt.hdr32.version, tok->len, err);
927 READ_TOKEN_U_INT16(buf, len, tok->tt.hdr32.e_type, tok->len, err);
931 READ_TOKEN_U_INT16(buf, len, tok->tt.hdr32.e_mod, tok->len, err);
935 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr32.s, tok->len, err);
939 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr32.ms, tok->len, err);
947 print_header32_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
950 print_tok_type(fp, tok->id, "header", oflags);
953 print_1_byte(fp, tok->tt.hdr32.version, "%u");
956 print_event(fp, tok->tt.hdr32.e_type, oflags);
959 print_evmod(fp, tok->tt.hdr32.e_mod, oflags);
962 print_sec32(fp, tok->tt.hdr32.s, oflags);
965 print_msec32(fp, tok->tt.hdr32.ms, oflags);
967 close_tag(fp, tok->id);
970 print_4_bytes(fp, tok->tt.hdr32.size, "%u");
972 print_1_byte(fp, tok->tt.hdr32.version, "%u");
974 print_event(fp, tok->tt.hdr32.e_type, oflags);
976 print_evmod(fp, tok->tt.hdr32.e_mod, oflags);
978 print_sec32(fp, tok->tt.hdr32.s, oflags);
980 print_msec32(fp, tok->tt.hdr32.ms, oflags);
1003 fetch_header32_ex_tok(tokenstr_t *tok, u_char *buf, int len)
1007 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr32_ex.size, tok->len, err);
1011 READ_TOKEN_U_CHAR(buf, len, tok->tt.hdr32_ex.version, tok->len, err);
1015 READ_TOKEN_U_INT16(buf, len, tok->tt.hdr32_ex.e_type, tok->len, err);
1019 READ_TOKEN_U_INT16(buf, len, tok->tt.hdr32_ex.e_mod, tok->len, err);
1023 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr32_ex.ad_type, tok->len, err);
1027 bzero(tok->tt.hdr32_ex.addr, sizeof(tok->tt.hdr32_ex.addr));
1028 switch (tok->tt.hdr32_ex.ad_type) {
1030 READ_TOKEN_BYTES(buf, len, &tok->tt.hdr32_ex.addr[0],
1031 sizeof(tok->tt.hdr32_ex.addr[0]), tok->len, err);
1037 READ_TOKEN_BYTES(buf, len, tok->tt.hdr32_ex.addr,
1038 sizeof(tok->tt.hdr32_ex.addr), tok->len, err);
1042 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr32_ex.s, tok->len, err);
1046 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr32_ex.ms, tok->len, err);
1054 print_header32_ex_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1057 print_tok_type(fp, tok->id, "header_ex", oflags);
1060 print_1_byte(fp, tok->tt.hdr32_ex.version, "%u");
1063 print_event(fp, tok->tt.hdr32_ex.e_type, oflags);
1066 print_evmod(fp, tok->tt.hdr32_ex.e_mod, oflags);
1069 print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type,
1070 tok->tt.hdr32_ex.addr);
1073 print_sec32(fp, tok->tt.hdr32_ex.s, oflags);
1076 print_msec32(fp, tok->tt.hdr32_ex.ms, oflags);
1078 close_tag(fp, tok->id);
1081 print_4_bytes(fp, tok->tt.hdr32_ex.size, "%u");
1083 print_1_byte(fp, tok->tt.hdr32_ex.version, "%u");
1085 print_event(fp, tok->tt.hdr32_ex.e_type, oflags);
1087 print_evmod(fp, tok->tt.hdr32_ex.e_mod, oflags);
1089 print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type,
1090 tok->tt.hdr32_ex.addr);
1092 print_sec32(fp, tok->tt.hdr32_ex.s, oflags);
1094 print_msec32(fp, tok->tt.hdr32_ex.ms, oflags);
1107 fetch_header64_tok(tokenstr_t *tok, u_char *buf, int len)
1111 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr64.size, tok->len, err);
1115 READ_TOKEN_U_CHAR(buf, len, tok->tt.hdr64.version, tok->len, err);
1119 READ_TOKEN_U_INT16(buf, len, tok->tt.hdr64.e_type, tok->len, err);
1123 READ_TOKEN_U_INT16(buf, len, tok->tt.hdr64.e_mod, tok->len, err);
1127 READ_TOKEN_U_INT64(buf, len, tok->tt.hdr64.s, tok->len, err);
1131 READ_TOKEN_U_INT64(buf, len, tok->tt.hdr64.ms, tok->len, err);
1139 print_header64_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1142 print_tok_type(fp, tok->id, "header", oflags);
1145 print_1_byte(fp, tok->tt.hdr64.version, "%u");
1148 print_event(fp, tok->tt.hdr64.e_type, oflags);
1151 print_evmod(fp, tok->tt.hdr64.e_mod, oflags);
1154 print_sec64(fp, tok->tt.hdr64.s, oflags);
1157 print_msec64(fp, tok->tt.hdr64.ms, oflags);
1159 close_tag(fp, tok->id);
1162 print_4_bytes(fp, tok->tt.hdr64.size, "%u");
1164 print_1_byte(fp, tok->tt.hdr64.version, "%u");
1166 print_event(fp, tok->tt.hdr64.e_type, oflags);
1168 print_evmod(fp, tok->tt.hdr64.e_mod, oflags);
1170 print_sec64(fp, tok->tt.hdr64.s, oflags);
1172 print_msec64(fp, tok->tt.hdr64.ms, oflags);
1191 fetch_header64_ex_tok(tokenstr_t *tok, u_char *buf, int len)
1195 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr64_ex.size, tok->len, err);
1199 READ_TOKEN_U_CHAR(buf, len, tok->tt.hdr64_ex.version, tok->len, err);
1203 READ_TOKEN_U_INT16(buf, len, tok->tt.hdr64_ex.e_type, tok->len, err);
1207 READ_TOKEN_U_INT16(buf, len, tok->tt.hdr64_ex.e_mod, tok->len, err);
1211 READ_TOKEN_U_INT32(buf, len, tok->tt.hdr64_ex.ad_type, tok->len, err);
1215 bzero(tok->tt.hdr64_ex.addr, sizeof(tok->tt.hdr64_ex.addr));
1216 switch (tok->tt.hdr64_ex.ad_type) {
1218 READ_TOKEN_BYTES(buf, len, &tok->tt.hdr64_ex.addr[0],
1219 sizeof(tok->tt.hdr64_ex.addr[0]), tok->len, err);
1225 READ_TOKEN_BYTES(buf, len, tok->tt.hdr64_ex.addr,
1226 sizeof(tok->tt.hdr64_ex.addr), tok->len, err);
1230 READ_TOKEN_U_INT64(buf, len, tok->tt.hdr64_ex.s, tok->len, err);
1234 READ_TOKEN_U_INT64(buf, len, tok->tt.hdr64_ex.ms, tok->len, err);
1242 print_header64_ex_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1245 print_tok_type(fp, tok->id, "header_ex", oflags);
1248 print_1_byte(fp, tok->tt.hdr64_ex.version, "%u");
1251 print_event(fp, tok->tt.hdr64_ex.e_type, oflags);
1254 print_evmod(fp, tok->tt.hdr64_ex.e_mod, oflags);
1257 print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type,
1258 tok->tt.hdr64_ex.addr);
1261 print_sec64(fp, tok->tt.hdr64_ex.s, oflags);
1264 print_msec64(fp, tok->tt.hdr64_ex.ms, oflags);
1266 close_tag(fp, tok->id);
1269 print_4_bytes(fp, tok->tt.hdr64_ex.size, "%u");
1271 print_1_byte(fp, tok->tt.hdr64_ex.version, "%u");
1273 print_event(fp, tok->tt.hdr64_ex.e_type, oflags);
1275 print_evmod(fp, tok->tt.hdr64_ex.e_mod, oflags);
1277 print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type,
1278 tok->tt.hdr64_ex.addr);
1280 print_sec64(fp, tok->tt.hdr64_ex.s, oflags);
1282 print_msec64(fp, tok->tt.hdr64_ex.ms, oflags);
1291 fetch_trailer_tok(tokenstr_t *tok, u_char *buf, int len)
1295 READ_TOKEN_U_INT16(buf, len, tok->tt.trail.magic, tok->len, err);
1299 READ_TOKEN_U_INT32(buf, len, tok->tt.trail.count, tok->len, err);
1307 print_trailer_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1310 print_tok_type(fp, tok->id, "trailer", oflags);
1313 print_4_bytes(fp, tok->tt.trail.count, "%u");
1324 fetch_arg32_tok(tokenstr_t *tok, u_char *buf, int len)
1328 READ_TOKEN_U_CHAR(buf, len, tok->tt.arg32.no, tok->len, err);
1332 READ_TOKEN_U_INT32(buf, len, tok->tt.arg32.val, tok->len, err);
1336 READ_TOKEN_U_INT16(buf, len, tok->tt.arg32.len, tok->len, err);
1340 SET_PTR((char*)buf, len, tok->tt.arg32.text, tok->tt.arg32.len,
1341 tok->len, err);
1349 print_arg32_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1352 print_tok_type(fp, tok->id, "argument", oflags);
1355 print_1_byte(fp, tok->tt.arg32.no, "%u");
1358 print_4_bytes(fp, tok->tt.arg32.val, "0x%x");
1361 print_string(fp, tok->tt.arg32.text, tok->tt.arg32.len);
1363 close_tag(fp, tok->id);
1366 print_1_byte(fp, tok->tt.arg32.no, "%u");
1368 print_4_bytes(fp, tok->tt.arg32.val, "0x%x");
1370 print_string(fp, tok->tt.arg32.text, tok->tt.arg32.len);
1375 fetch_arg64_tok(tokenstr_t *tok, u_char *buf, int len)
1379 READ_TOKEN_U_CHAR(buf, len, tok->tt.arg64.no, tok->len, err);
1383 READ_TOKEN_U_INT64(buf, len, tok->tt.arg64.val, tok->len, err);
1387 READ_TOKEN_U_INT16(buf, len, tok->tt.arg64.len, tok->len, err);
1391 SET_PTR((char*)buf, len, tok->tt.arg64.text, tok->tt.arg64.len,
1392 tok->len, err);
1400 print_arg64_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1403 print_tok_type(fp, tok->id, "argument", oflags);
1406 print_1_byte(fp, tok->tt.arg64.no, "%u");
1409 print_8_bytes(fp, tok->tt.arg64.val, "0x%llx");
1412 print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len);
1414 close_tag(fp, tok->id);
1417 print_1_byte(fp, tok->tt.arg64.no, "%u");
1419 print_8_bytes(fp, tok->tt.arg64.val, "0x%llx");
1421 print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len);
1432 fetch_arb_tok(tokenstr_t *tok, u_char *buf, int len)
1437 READ_TOKEN_U_CHAR(buf, len, tok->tt.arb.howtopr, tok->len, err);
1441 READ_TOKEN_U_CHAR(buf, len, tok->tt.arb.bu, tok->len, err);
1445 READ_TOKEN_U_CHAR(buf, len, tok->tt.arb.uc, tok->len, err);
1452 switch(tok->tt.arb.bu) {
1475 SET_PTR(buf, len, tok->tt.arb.data, datasize * tok->tt.arb.uc,
1476 tok->len, err);
1484 print_arb_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1491 print_tok_type(fp, tok->id, "arbitrary", oflags);
1495 switch(tok->tt.arb.howtopr) {
1533 switch(tok->tt.arb.bu) {
1543 print_1_byte(fp, tok->tt.arb.uc, "%u");
1546 for (i = 0; i<tok->tt.arb.uc; i++)
1547 fprintf(fp, format, *(tok->tt.arb.data +
1549 close_tag(fp, tok->id);
1553 print_1_byte(fp, tok->tt.arb.uc, "%u");
1555 for (i = 0; i<tok->tt.arb.uc; i++)
1556 fprintf(fp, format, *(tok->tt.arb.data +
1569 print_1_byte(fp, tok->tt.arb.uc, "%u");
1572 for (i = 0; i < tok->tt.arb.uc; i++)
1574 *((u_int16_t *)(tok->tt.arb.data +
1576 close_tag(fp, tok->id);
1580 print_1_byte(fp, tok->tt.arb.uc, "%u");
1582 for (i = 0; i < tok->tt.arb.uc; i++)
1584 *((u_int16_t *)(tok->tt.arb.data +
1598 print_1_byte(fp, tok->tt.arb.uc, "%u");
1601 for (i = 0; i < tok->tt.arb.uc; i++)
1603 *((u_int32_t *)(tok->tt.arb.data +
1605 close_tag(fp, tok->id);
1609 print_1_byte(fp, tok->tt.arb.uc, "%u");
1611 for (i = 0; i < tok->tt.arb.uc; i++)
1613 *((u_int32_t *)(tok->tt.arb.data +
1626 print_1_byte(fp, tok->tt.arb.uc, "%u");
1629 for (i = 0; i < tok->tt.arb.uc; i++)
1631 *((u_int64_t *)(tok->tt.arb.data +
1633 close_tag(fp, tok->id);
1637 print_1_byte(fp, tok->tt.arb.uc, "%u");
1639 for (i = 0; i < tok->tt.arb.uc; i++)
1641 *((u_int64_t *)(tok->tt.arb.data +
1660 fetch_attr32_tok(tokenstr_t *tok, u_char *buf, int len)
1664 READ_TOKEN_U_INT32(buf, len, tok->tt.attr32.mode, tok->len, err);
1668 READ_TOKEN_U_INT32(buf, len, tok->tt.attr32.uid, tok->len, err);
1672 READ_TOKEN_U_INT32(buf, len, tok->tt.attr32.gid, tok->len, err);
1676 READ_TOKEN_U_INT32(buf, len, tok->tt.attr32.fsid, tok->len, err);
1680 READ_TOKEN_U_INT64(buf, len, tok->tt.attr32.nid, tok->len, err);
1684 READ_TOKEN_U_INT32(buf, len, tok->tt.attr32.dev, tok->len, err);
1692 print_attr32_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1695 print_tok_type(fp, tok->id, "attribute", oflags);
1698 print_4_bytes(fp, tok->tt.attr32.mode, "%o");
1701 print_user(fp, tok->tt.attr32.uid, oflags);
1704 print_group(fp, tok->tt.attr32.gid, oflags);
1707 print_4_bytes(fp, tok->tt.attr32.fsid, "%u");
1710 print_8_bytes(fp, tok->tt.attr32.nid, "%lld");
1713 print_4_bytes(fp, tok->tt.attr32.dev, "%u");
1715 close_tag(fp, tok->id);
1718 print_4_bytes(fp, tok->tt.attr32.mode, "%o");
1720 print_user(fp, tok->tt.attr32.uid, oflags);
1722 print_group(fp, tok->tt.attr32.gid, oflags);
1724 print_4_bytes(fp, tok->tt.attr32.fsid, "%u");
1726 print_8_bytes(fp, tok->tt.attr32.nid, "%lld");
1728 print_4_bytes(fp, tok->tt.attr32.dev, "%u");
1741 fetch_attr64_tok(tokenstr_t *tok, u_char *buf, int len)
1745 READ_TOKEN_U_INT32(buf, len, tok->tt.attr64.mode, tok->len, err);
1749 READ_TOKEN_U_INT32(buf, len, tok->tt.attr64.uid, tok->len, err);
1753 READ_TOKEN_U_INT32(buf, len, tok->tt.attr64.gid, tok->len, err);
1757 READ_TOKEN_U_INT32(buf, len, tok->tt.attr64.fsid, tok->len, err);
1761 READ_TOKEN_U_INT64(buf, len, tok->tt.attr64.nid, tok->len, err);
1765 READ_TOKEN_U_INT64(buf, len, tok->tt.attr64.dev, tok->len, err);
1773 print_attr64_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1776 print_tok_type(fp, tok->id, "attribute", oflags);
1779 print_4_bytes(fp, tok->tt.attr64.mode, "%o");
1782 print_user(fp, tok->tt.attr64.uid, oflags);
1785 print_group(fp, tok->tt.attr64.gid, oflags);
1788 print_4_bytes(fp, tok->tt.attr64.fsid, "%u");
1791 print_8_bytes(fp, tok->tt.attr64.nid, "%lld");
1794 print_8_bytes(fp, tok->tt.attr64.dev, "%llu");
1796 close_tag(fp, tok->id);
1799 print_4_bytes(fp, tok->tt.attr64.mode, "%o");
1801 print_user(fp, tok->tt.attr64.uid, oflags);
1803 print_group(fp, tok->tt.attr64.gid, oflags);
1805 print_4_bytes(fp, tok->tt.attr64.fsid, "%u");
1807 print_8_bytes(fp, tok->tt.attr64.nid, "%lld");
1809 print_8_bytes(fp, tok->tt.attr64.dev, "%llu");
1818 fetch_exit_tok(tokenstr_t *tok, u_char *buf, int len)
1822 READ_TOKEN_U_INT32(buf, len, tok->tt.exit.status, tok->len, err);
1826 READ_TOKEN_U_INT32(buf, len, tok->tt.exit.ret, tok->len, err);
1834 print_exit_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1837 print_tok_type(fp, tok->id, "exit", oflags);
1840 print_errval(fp, tok->tt.exit.status);
1843 print_4_bytes(fp, tok->tt.exit.ret, "%u");
1845 close_tag(fp, tok->id);
1848 print_errval(fp, tok->tt.exit.status);
1850 print_4_bytes(fp, tok->tt.exit.ret, "%u");
1859 fetch_execarg_tok(tokenstr_t *tok, u_char *buf, int len)
1865 READ_TOKEN_U_INT32(buf, len, tok->tt.execarg.count, tok->len, err);
1869 for (i = 0; i < tok->tt.execarg.count; i++) {
1870 bptr = buf + tok->len;
1872 tok->tt.execarg.text[i] = (char*)bptr;
1876 if (++tok->len >= (u_int32_t)len)
1878 bptr = buf + tok->len;
1882 tok->len++; /* \0 character */
1884 if (tok->tt.execarg.count > AUDIT_MAX_ARGS)
1885 tok->tt.execarg.count = AUDIT_MAX_ARGS;
1891 print_execarg_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1895 print_tok_type(fp, tok->id, "exec arg", oflags);
1896 for (i = 0; i < tok->tt.execarg.count; i++) {
1899 print_xml_string(fp, tok->tt.execarg.text[i],
1900 strlen(tok->tt.execarg.text[i]));
1904 print_string(fp, tok->tt.execarg.text[i],
1905 strlen(tok->tt.execarg.text[i]));
1909 close_tag(fp, tok->id);
1917 fetch_execenv_tok(tokenstr_t *tok, u_char *buf, int len)
1923 READ_TOKEN_U_INT32(buf, len, tok->tt.execenv.count, tok->len, err);
1927 for (i = 0; i < tok->tt.execenv.count; i++) {
1928 bptr = buf + tok->len;
1930 tok->tt.execenv.text[i] = (char*)bptr;
1934 if (++tok->len >= (u_int32_t)len)
1936 bptr = buf + tok->len;
1940 tok->len++; /* \0 character */
1942 if (tok->tt.execenv.count > AUDIT_MAX_ENV)
1943 tok->tt.execenv.count = AUDIT_MAX_ENV;
1949 print_execenv_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
1953 print_tok_type(fp, tok->id, "exec env", oflags);
1954 for (i = 0; i< tok->tt.execenv.count; i++) {
1957 print_xml_string(fp, tok->tt.execenv.text[i],
1958 strlen(tok->tt.execenv.text[i]));
1962 print_string(fp, tok->tt.execenv.text[i],
1963 strlen(tok->tt.execenv.text[i]));
1967 close_tag(fp, tok->id);
1977 fetch_file_tok(tokenstr_t *tok, u_char *buf, int len)
1981 READ_TOKEN_U_INT32(buf, len, tok->tt.file.s, tok->len, err);
1985 READ_TOKEN_U_INT32(buf, len, tok->tt.file.ms, tok->len, err);
1989 READ_TOKEN_U_INT16(buf, len, tok->tt.file.len, tok->len, err);
1993 SET_PTR((char*)buf, len, tok->tt.file.name, tok->tt.file.len, tok->len,
2002 print_file_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2005 print_tok_type(fp, tok->id, "file", oflags);
2008 print_sec32(fp, tok->tt.file.s, oflags);
2011 print_msec32(fp, tok->tt.file.ms, oflags);
2014 print_string(fp, tok->tt.file.name, tok->tt.file.len);
2015 close_tag(fp, tok->id);
2018 print_sec32(fp, tok->tt.file.s, oflags);
2020 print_msec32(fp, tok->tt.file.ms, oflags);
2022 print_string(fp, tok->tt.file.name, tok->tt.file.len);
2031 fetch_newgroups_tok(tokenstr_t *tok, u_char *buf, int len)
2036 READ_TOKEN_U_INT16(buf, len, tok->tt.grps.no, tok->len, err);
2040 for (i = 0; i<tok->tt.grps.no; i++) {
2041 READ_TOKEN_U_INT32(buf, len, tok->tt.grps.list[i], tok->len,
2051 print_newgroups_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2055 print_tok_type(fp, tok->id, "group", oflags);
2056 for (i = 0; i < tok->tt.grps.no; i++) {
2059 print_group(fp, tok->tt.grps.list[i], oflags);
2061 close_tag(fp, tok->id);
2064 print_group(fp, tok->tt.grps.list[i], oflags);
2073 fetch_inaddr_tok(tokenstr_t *tok, u_char *buf, int len)
2077 READ_TOKEN_BYTES(buf, len, &tok->tt.inaddr.addr, sizeof(uint32_t),
2078 tok->len, err);
2087 print_inaddr_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2090 print_tok_type(fp, tok->id, "ip addr", oflags);
2092 print_ip_address(fp, tok->tt.inaddr.addr);
2093 close_tag(fp, tok->id);
2096 print_ip_address(fp, tok->tt.inaddr.addr);
2105 fetch_inaddr_ex_tok(tokenstr_t *tok, u_char *buf, int len)
2109 READ_TOKEN_U_INT32(buf, len, tok->tt.inaddr_ex.type, tok->len, err);
2113 if (tok->tt.inaddr_ex.type == AU_IPv4) {
2114 READ_TOKEN_BYTES(buf, len, &tok->tt.inaddr_ex.addr[0],
2115 sizeof(tok->tt.inaddr_ex.addr[0]), tok->len, err);
2118 } else if (tok->tt.inaddr_ex.type == AU_IPv6) {
2119 READ_TOKEN_BYTES(buf, len, tok->tt.inaddr_ex.addr,
2120 sizeof(tok->tt.inaddr_ex.addr), tok->len, err);
2130 print_inaddr_ex_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2133 print_tok_type(fp, tok->id, "ip addr ex", oflags);
2135 print_ip_ex_address(fp, tok->tt.inaddr_ex.type,
2136 tok->tt.inaddr_ex.addr);
2137 close_tag(fp, tok->id);
2140 print_ip_ex_address(fp, tok->tt.inaddr_ex.type,
2141 tok->tt.inaddr_ex.addr);
2149 fetch_ip_tok(tokenstr_t *tok, u_char *buf, int len)
2153 READ_TOKEN_U_CHAR(buf, len, tok->tt.ip.version, tok->len, err);
2157 READ_TOKEN_U_CHAR(buf, len, tok->tt.ip.tos, tok->len, err);
2161 READ_TOKEN_BYTES(buf, len, &tok->tt.ip.len, sizeof(uint16_t),
2162 tok->len, err);
2166 READ_TOKEN_BYTES(buf, len, &tok->tt.ip.id, sizeof(uint16_t),
2167 tok->len, err);
2171 READ_TOKEN_BYTES(buf, len, &tok->tt.ip.offset, sizeof(uint16_t),
2172 tok->len, err);
2176 READ_TOKEN_U_CHAR(buf, len, tok->tt.ip.ttl, tok->len, err);
2180 READ_TOKEN_U_CHAR(buf, len, tok->tt.ip.prot, tok->len, err);
2184 READ_TOKEN_BYTES(buf, len, &tok->tt.ip.chksm, sizeof(uint16_t),
2185 tok->len, err);
2189 READ_TOKEN_BYTES(buf, len, &tok->tt.ip.src, sizeof(tok->tt.ip.src),
2190 tok->len, err);
2194 READ_TOKEN_BYTES(buf, len, &tok->tt.ip.dest, sizeof(tok->tt.ip.dest),
2195 tok->len, err);
2203 print_ip_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2206 print_tok_type(fp, tok->id, "ip", oflags);
2209 print_mem(fp, (u_char *)(&tok->tt.ip.version),
2213 print_mem(fp, (u_char *)(&tok->tt.ip.tos), sizeof(u_char));
2216 print_2_bytes(fp, ntohs(tok->tt.ip.len), "%u");
2219 print_2_bytes(fp, ntohs(tok->tt.ip.id), "%u");
2222 print_2_bytes(fp, ntohs(tok->tt.ip.offset), "%u");
2225 print_mem(fp, (u_char *)(&tok->tt.ip.ttl), sizeof(u_char));
2228 print_mem(fp, (u_char *)(&tok->tt.ip.prot), sizeof(u_char));
2231 print_2_bytes(fp, ntohs(tok->tt.ip.chksm), "%u");
2234 print_ip_address(fp, tok->tt.ip.src);
2237 print_ip_address(fp, tok->tt.ip.dest);
2239 close_tag(fp, tok->id);
2242 print_mem(fp, (u_char *)(&tok->tt.ip.version),
2245 print_mem(fp, (u_char *)(&tok->tt.ip.tos), sizeof(u_char));
2247 print_2_bytes(fp, ntohs(tok->tt.ip.len), "%u");
2249 print_2_bytes(fp, ntohs(tok->tt.ip.id), "%u");
2251 print_2_bytes(fp, ntohs(tok->tt.ip.offset), "%u");
2253 print_mem(fp, (u_char *)(&tok->tt.ip.ttl), sizeof(u_char));
2255 print_mem(fp, (u_char *)(&tok->tt.ip.prot), sizeof(u_char));
2257 print_2_bytes(fp, ntohs(tok->tt.ip.chksm), "%u");
2259 print_ip_address(fp, tok->tt.ip.src);
2261 print_ip_address(fp, tok->tt.ip.dest);
2270 fetch_ipc_tok(tokenstr_t *tok, u_char *buf, int len)
2274 READ_TOKEN_U_CHAR(buf, len, tok->tt.ipc.type, tok->len, err);
2278 READ_TOKEN_U_INT32(buf, len, tok->tt.ipc.id, tok->len, err);
2286 print_ipc_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2289 print_tok_type(fp, tok->id, "IPC", oflags);
2292 print_ipctype(fp, tok->tt.ipc.type, oflags);
2295 print_4_bytes(fp, tok->tt.ipc.id, "%u");
2297 close_tag(fp, tok->id);
2300 print_ipctype(fp, tok->tt.ipc.type, oflags);
2302 print_4_bytes(fp, tok->tt.ipc.id, "%u");
2316 fetch_ipcperm_tok(tokenstr_t *tok, u_char *buf, int len)
2320 READ_TOKEN_U_INT32(buf, len, tok->tt.ipcperm.uid, tok->len, err);
2324 READ_TOKEN_U_INT32(buf, len, tok->tt.ipcperm.gid, tok->len, err);
2328 READ_TOKEN_U_INT32(buf, len, tok->tt.ipcperm.puid, tok->len, err);
2332 READ_TOKEN_U_INT32(buf, len, tok->tt.ipcperm.pgid, tok->len, err);
2336 READ_TOKEN_U_INT32(buf, len, tok->tt.ipcperm.mode, tok->len, err);
2340 READ_TOKEN_U_INT32(buf, len, tok->tt.ipcperm.seq, tok->len, err);
2344 READ_TOKEN_U_INT32(buf, len, tok->tt.ipcperm.key, tok->len, err);
2352 print_ipcperm_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2355 print_tok_type(fp, tok->id, "IPC perm", oflags);
2358 print_user(fp, tok->tt.ipcperm.uid, oflags);
2361 print_group(fp, tok->tt.ipcperm.gid, oflags);
2364 print_user(fp, tok->tt.ipcperm.puid, oflags);
2367 print_group(fp, tok->tt.ipcperm.pgid, oflags);
2370 print_4_bytes(fp, tok->tt.ipcperm.mode, "%o");
2373 print_4_bytes(fp, tok->tt.ipcperm.seq, "%u");
2376 print_4_bytes(fp, tok->tt.ipcperm.key, "%u");
2378 close_tag(fp, tok->id);
2381 print_user(fp, tok->tt.ipcperm.uid, oflags);
2383 print_group(fp, tok->tt.ipcperm.gid, oflags);
2385 print_user(fp, tok->tt.ipcperm.puid, oflags);
2387 print_group(fp, tok->tt.ipcperm.pgid, oflags);
2389 print_4_bytes(fp, tok->tt.ipcperm.mode, "%o");
2391 print_4_bytes(fp, tok->tt.ipcperm.seq, "%u");
2393 print_4_bytes(fp, tok->tt.ipcperm.key, "%u");
2401 fetch_iport_tok(tokenstr_t *tok, u_char *buf, int len)
2405 READ_TOKEN_BYTES(buf, len, &tok->tt.iport.port, sizeof(uint16_t),
2406 tok->len, err);
2414 print_iport_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2417 print_tok_type(fp, tok->id, "ip port", oflags);
2419 print_2_bytes(fp, ntohs(tok->tt.iport.port), "%#x");
2420 close_tag(fp, tok->id);
2423 print_2_bytes(fp, ntohs(tok->tt.iport.port), "%#x");
2432 fetch_opaque_tok(tokenstr_t *tok, u_char *buf, int len)
2436 READ_TOKEN_U_INT16(buf, len, tok->tt.opaque.size, tok->len, err);
2440 SET_PTR((char*)buf, len, tok->tt.opaque.data, tok->tt.opaque.size,
2441 tok->len, err);
2449 print_opaque_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2452 print_tok_type(fp, tok->id, "opaque", oflags);
2454 print_mem(fp, (u_char*)tok->tt.opaque.data,
2455 tok->tt.opaque.size);
2456 close_tag(fp, tok->id);
2459 print_2_bytes(fp, tok->tt.opaque.size, "%u");
2461 print_mem(fp, (u_char*)tok->tt.opaque.data,
2462 tok->tt.opaque.size);
2471 fetch_path_tok(tokenstr_t *tok, u_char *buf, int len)
2475 READ_TOKEN_U_INT16(buf, len, tok->tt.path.len, tok->len, err);
2479 SET_PTR((char*)buf, len, tok->tt.path.path, tok->tt.path.len, tok->len,
2488 print_path_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2491 print_tok_type(fp, tok->id, "path", oflags);
2493 print_string(fp, tok->tt.path.path, tok->tt.path.len);
2494 close_tag(fp, tok->id);
2497 print_string(fp, tok->tt.path.path, tok->tt.path.len);
2515 fetch_process32_tok(tokenstr_t *tok, u_char *buf, int len)
2519 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32.auid, tok->len, err);
2523 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32.euid, tok->len, err);
2527 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32.egid, tok->len, err);
2531 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32.ruid, tok->len, err);
2535 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32.rgid, tok->len, err);
2539 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32.pid, tok->len, err);
2543 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32.sid, tok->len, err);
2547 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32.tid.port, tok->len, err);
2551 READ_TOKEN_BYTES(buf, len, &tok->tt.proc32.tid.addr,
2552 sizeof(tok->tt.proc32.tid.addr), tok->len, err);
2560 print_process32_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2563 print_tok_type(fp, tok->id, "process", oflags);
2566 print_user(fp, tok->tt.proc32.auid, oflags);
2569 print_user(fp, tok->tt.proc32.euid, oflags);
2572 print_group(fp, tok->tt.proc32.egid, oflags);
2575 print_user(fp, tok->tt.proc32.ruid, oflags);
2578 print_group(fp, tok->tt.proc32.rgid, oflags);
2581 print_4_bytes(fp, tok->tt.proc32.pid, "%u");
2584 print_4_bytes(fp, tok->tt.proc32.sid, "%u");
2587 print_4_bytes(fp, tok->tt.proc32.tid.port, "%u");
2588 print_ip_address(fp, tok->tt.proc32.tid.addr);
2590 close_tag(fp, tok->id);
2593 print_user(fp, tok->tt.proc32.auid, oflags);
2595 print_user(fp, tok->tt.proc32.euid, oflags);
2597 print_group(fp, tok->tt.proc32.egid, oflags);
2599 print_user(fp, tok->tt.proc32.ruid, oflags);
2601 print_group(fp, tok->tt.proc32.rgid, oflags);
2603 print_4_bytes(fp, tok->tt.proc32.pid, "%u");
2605 print_4_bytes(fp, tok->tt.proc32.sid, "%u");
2607 print_4_bytes(fp, tok->tt.proc32.tid.port, "%u");
2609 print_ip_address(fp, tok->tt.proc32.tid.addr);
2627 fetch_process64_tok(tokenstr_t *tok, u_char *buf, int len)
2631 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64.auid, tok->len, err);
2635 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64.euid, tok->len, err);
2639 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64.egid, tok->len, err);
2643 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64.ruid, tok->len, err);
2647 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64.rgid, tok->len, err);
2651 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64.pid, tok->len, err);
2655 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64.sid, tok->len, err);
2659 READ_TOKEN_U_INT64(buf, len, tok->tt.proc64.tid.port, tok->len, err);
2663 READ_TOKEN_BYTES(buf, len, &tok->tt.proc64.tid.addr,
2664 sizeof(tok->tt.proc64.tid.addr), tok->len, err);
2672 print_process64_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2674 print_tok_type(fp, tok->id, "process", oflags);
2677 print_user(fp, tok->tt.proc64.auid, oflags);
2680 print_user(fp, tok->tt.proc64.euid, oflags);
2683 print_group(fp, tok->tt.proc64.egid, oflags);
2686 print_user(fp, tok->tt.proc64.ruid, oflags);
2689 print_group(fp, tok->tt.proc64.rgid, oflags);
2692 print_4_bytes(fp, tok->tt.proc64.pid, "%u");
2695 print_4_bytes(fp, tok->tt.proc64.sid, "%u");
2698 print_8_bytes(fp, tok->tt.proc64.tid.port, "%llu");
2699 print_ip_address(fp, tok->tt.proc64.tid.addr);
2701 close_tag(fp, tok->id);
2704 print_user(fp, tok->tt.proc64.auid, oflags);
2706 print_user(fp, tok->tt.proc64.euid, oflags);
2708 print_group(fp, tok->tt.proc64.egid, oflags);
2710 print_user(fp, tok->tt.proc64.ruid, oflags);
2712 print_group(fp, tok->tt.proc64.rgid, oflags);
2714 print_4_bytes(fp, tok->tt.proc64.pid, "%u");
2716 print_4_bytes(fp, tok->tt.proc64.sid, "%u");
2718 print_8_bytes(fp, tok->tt.proc64.tid.port, "%llu");
2720 print_ip_address(fp, tok->tt.proc64.tid.addr);
2739 fetch_process32ex_tok(tokenstr_t *tok, u_char *buf, int len)
2743 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.auid, tok->len, err);
2747 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.euid, tok->len, err);
2751 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.egid, tok->len, err);
2755 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.ruid, tok->len, err);
2759 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.rgid, tok->len, err);
2763 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.pid, tok->len, err);
2767 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.sid, tok->len, err);
2771 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.tid.port, tok->len,
2776 READ_TOKEN_U_INT32(buf, len, tok->tt.proc32_ex.tid.type, tok->len,
2781 if (tok->tt.proc32_ex.tid.type == AU_IPv4) {
2782 READ_TOKEN_BYTES(buf, len, &tok->tt.proc32_ex.tid.addr[0],
2783 sizeof(tok->tt.proc32_ex.tid.addr[0]), tok->len, err);
2786 } else if (tok->tt.proc32_ex.tid.type == AU_IPv6) {
2787 READ_TOKEN_BYTES(buf, len, tok->tt.proc32_ex.tid.addr,
2788 sizeof(tok->tt.proc32_ex.tid.addr), tok->len, err);
2798 print_process32ex_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2801 print_tok_type(fp, tok->id, "process_ex", oflags);
2804 print_user(fp, tok->tt.proc32_ex.auid, oflags);
2807 print_user(fp, tok->tt.proc32_ex.euid, oflags);
2810 print_group(fp, tok->tt.proc32_ex.egid, oflags);
2813 print_user(fp, tok->tt.proc32_ex.ruid, oflags);
2816 print_group(fp, tok->tt.proc32_ex.rgid, oflags);
2819 print_4_bytes(fp, tok->tt.proc32_ex.pid, "%u");
2822 print_4_bytes(fp, tok->tt.proc32_ex.sid, "%u");
2825 print_4_bytes(fp, tok->tt.proc32_ex.tid.port, "%u");
2826 print_ip_ex_address(fp, tok->tt.proc32_ex.tid.type,
2827 tok->tt.proc32_ex.tid.addr);
2829 close_tag(fp, tok->id);
2832 print_user(fp, tok->tt.proc32_ex.auid, oflags);
2834 print_user(fp, tok->tt.proc32_ex.euid, oflags);
2836 print_group(fp, tok->tt.proc32_ex.egid, oflags);
2838 print_user(fp, tok->tt.proc32_ex.ruid, oflags);
2840 print_group(fp, tok->tt.proc32_ex.rgid, oflags);
2842 print_4_bytes(fp, tok->tt.proc32_ex.pid, "%u");
2844 print_4_bytes(fp, tok->tt.proc32_ex.sid, "%u");
2846 print_4_bytes(fp, tok->tt.proc32_ex.tid.port, "%u");
2848 print_ip_ex_address(fp, tok->tt.proc32_ex.tid.type,
2849 tok->tt.proc32_ex.tid.addr);
2868 fetch_process64ex_tok(tokenstr_t *tok, u_char *buf, int len)
2872 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64_ex.auid, tok->len, err);
2876 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64_ex.euid, tok->len, err);
2880 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64_ex.egid, tok->len, err);
2884 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64_ex.ruid, tok->len, err);
2888 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64_ex.rgid, tok->len, err);
2892 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64_ex.pid, tok->len, err);
2896 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64_ex.sid, tok->len, err);
2900 READ_TOKEN_U_INT64(buf, len, tok->tt.proc64_ex.tid.port, tok->len,
2905 READ_TOKEN_U_INT32(buf, len, tok->tt.proc64_ex.tid.type, tok->len,
2910 if (tok->tt.proc64_ex.tid.type == AU_IPv4) {
2911 READ_TOKEN_BYTES(buf, len, &tok->tt.proc64_ex.tid.addr[0],
2912 sizeof(tok->tt.proc64_ex.tid.addr[0]), tok->len, err);
2915 } else if (tok->tt.proc64_ex.tid.type == AU_IPv6) {
2916 READ_TOKEN_BYTES(buf, len, tok->tt.proc64_ex.tid.addr,
2917 sizeof(tok->tt.proc64_ex.tid.addr), tok->len, err);
2927 print_process64ex_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
2929 print_tok_type(fp, tok->id, "process_ex", oflags);
2932 print_user(fp, tok->tt.proc64_ex.auid, oflags);
2935 print_user(fp, tok->tt.proc64_ex.euid, oflags);
2938 print_group(fp, tok->tt.proc64_ex.egid, oflags);
2941 print_user(fp, tok->tt.proc64_ex.ruid, oflags);
2944 print_group(fp, tok->tt.proc64_ex.rgid, oflags);
2947 print_4_bytes(fp, tok->tt.proc64_ex.pid, "%u");
2950 print_4_bytes(fp, tok->tt.proc64_ex.sid, "%u");
2953 print_8_bytes(fp, tok->tt.proc64_ex.tid.port, "%llu");
2954 print_ip_ex_address(fp, tok->tt.proc64_ex.tid.type,
2955 tok->tt.proc64_ex.tid.addr);
2957 close_tag(fp, tok->id);
2960 print_user(fp, tok->tt.proc64_ex.auid, oflags);
2962 print_user(fp, tok->tt.proc64_ex.euid, oflags);
2964 print_group(fp, tok->tt.proc64_ex.egid, oflags);
2966 print_user(fp, tok->tt.proc64_ex.ruid, oflags);
2968 print_group(fp, tok->tt.proc64_ex.rgid, oflags);
2970 print_4_bytes(fp, tok->tt.proc64_ex.pid, "%u");
2972 print_4_bytes(fp, tok->tt.proc64_ex.sid, "%u");
2974 print_8_bytes(fp, tok->tt.proc64_ex.tid.port, "%llu");
2976 print_ip_ex_address(fp, tok->tt.proc64_ex.tid.type,
2977 tok->tt.proc64_ex.tid.addr);
2986 fetch_return32_tok(tokenstr_t *tok, u_char *buf, int len)
2990 READ_TOKEN_U_CHAR(buf, len, tok->tt.ret32.status, tok->len, err);
2994 READ_TOKEN_U_INT32(buf, len, tok->tt.ret32.ret, tok->len, err);
3002 print_return32_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3005 print_tok_type(fp, tok->id, "return", oflags);
3008 print_retval(fp, tok->tt.ret32.status, oflags);
3011 print_4_bytes(fp, tok->tt.ret32.ret, "%u");
3013 close_tag(fp, tok->id);
3016 print_retval(fp, tok->tt.ret32.status, oflags);
3018 print_4_bytes(fp, tok->tt.ret32.ret, "%u");
3023 fetch_return64_tok(tokenstr_t *tok, u_char *buf, int len)
3027 READ_TOKEN_U_CHAR(buf, len, tok->tt.ret64.err, tok->len, err);
3031 READ_TOKEN_U_INT64(buf, len, tok->tt.ret64.val, tok->len, err);
3039 print_return64_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3042 print_tok_type(fp, tok->id, "return", oflags);
3045 print_retval(fp, tok->tt.ret64.err, oflags);
3048 print_8_bytes(fp, tok->tt.ret64.val, "%lld");
3050 close_tag(fp, tok->id);
3053 print_retval(fp, tok->tt.ret64.err, oflags);
3055 print_8_bytes(fp, tok->tt.ret64.val, "%lld");
3063 fetch_seq_tok(tokenstr_t *tok, u_char *buf, int len)
3067 READ_TOKEN_U_INT32(buf, len, tok->tt.seq.seqno, tok->len, err);
3075 print_seq_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3078 print_tok_type(fp, tok->id, "sequence", oflags);
3081 print_4_bytes(fp, tok->tt.seq.seqno, "%u");
3083 close_tag(fp, tok->id);
3086 print_4_bytes(fp, tok->tt.seq.seqno, "%u");
3096 fetch_sock_inet32_tok(tokenstr_t *tok, u_char *buf, int len)
3100 READ_TOKEN_U_INT16(buf, len, tok->tt.sockinet_ex32.family, tok->len,
3105 READ_TOKEN_BYTES(buf, len, &tok->tt.sockinet_ex32.port,
3106 sizeof(uint16_t), tok->len, err);
3110 READ_TOKEN_BYTES(buf, len, &tok->tt.sockinet_ex32.addr,
3111 sizeof(tok->tt.sockinet_ex32.addr[0]), tok->len, err);
3119 print_sock_inet32_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3122 print_tok_type(fp, tok->id, "socket-inet", oflags);
3125 print_2_bytes(fp, tok->tt.sockinet_ex32.family, "%u");
3128 print_2_bytes(fp, ntohs(tok->tt.sockinet_ex32.port), "%u");
3131 print_ip_address(fp, tok->tt.sockinet_ex32.addr[0]);
3133 close_tag(fp, tok->id);
3136 print_2_bytes(fp, tok->tt.sockinet_ex32.family, "%u");
3138 print_2_bytes(fp, ntohs(tok->tt.sockinet_ex32.port), "%u");
3140 print_ip_address(fp, tok->tt.sockinet_ex32.addr[0]);
3150 fetch_sock_inet128_tok(tokenstr_t *tok, u_char *buf, int len)
3154 READ_TOKEN_U_INT16(buf, len, tok->tt.sockinet_ex32.family, tok->len,
3159 READ_TOKEN_BYTES(buf, len, &tok->tt.sockinet_ex32.port,
3160 sizeof(uint16_t), tok->len, err);
3164 READ_TOKEN_BYTES(buf, len, &tok->tt.sockinet_ex32.addr,
3165 sizeof(tok->tt.sockinet_ex32.addr), tok->len, err);
3173 print_sock_inet128_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3176 print_tok_type(fp, tok->id, "socket-inet6", oflags);
3179 print_2_bytes(fp, tok->tt.sockinet_ex32.family, "%u");
3182 print_2_bytes(fp, ntohs(tok->tt.sockinet_ex32.port), "%u");
3185 print_ip_ex_address(fp, AU_IPv6, tok->tt.sockinet_ex32.addr);
3187 close_tag(fp, tok->id);
3190 print_2_bytes(fp, tok->tt.sockinet_ex32.family, "%u");
3192 print_2_bytes(fp, ntohs(tok->tt.sockinet_ex32.port), "%u");
3194 print_ip_ex_address(fp, AU_IPv6, tok->tt.sockinet_ex32.addr);
3203 fetch_sock_unix_tok(tokenstr_t *tok, u_char *buf, int len)
3210 READ_TOKEN_U_INT16(buf, len, tok->tt.sockunix.family, tok->len, err);
3214 /* slen = strnlen((buf + tok->len), 104) + 1; */
3215 p = (u_char *)memchr((const void *)(buf + tok->len), '\0', 104);
3216 slen = (p ? (int)(p - (buf + tok->len)) : 104) + 1;
3218 READ_TOKEN_BYTES(buf, len, tok->tt.sockunix.path, slen, tok->len, err);
3226 print_sock_unix_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3229 print_tok_type(fp, tok->id, "socket-unix", oflags);
3232 print_2_bytes(fp, tok->tt.sockunix.family, "%u");
3237 print_string(fp, tok->tt.sockunix.path,
3238 strlen(tok->tt.sockunix.path));
3240 close_tag(fp, tok->id);
3243 print_2_bytes(fp, tok->tt.sockunix.family, "%u");
3245 print_string(fp, tok->tt.sockunix.path,
3246 strlen(tok->tt.sockunix.path));
3258 fetch_socket_tok(tokenstr_t *tok, u_char *buf, int len)
3262 READ_TOKEN_U_INT16(buf, len, tok->tt.socket.type, tok->len, err);
3266 READ_TOKEN_BYTES(buf, len, &tok->tt.socket.l_port, sizeof(uint16_t),
3267 tok->len, err);
3271 READ_TOKEN_BYTES(buf, len, &tok->tt.socket.l_addr,
3272 sizeof(tok->tt.socket.l_addr), tok->len, err);
3276 READ_TOKEN_BYTES(buf, len, &tok->tt.socket.r_port, sizeof(uint16_t),
3277 tok->len, err);
3281 READ_TOKEN_BYTES(buf, len, &tok->tt.socket.l_addr,
3282 sizeof(tok->tt.socket.r_addr), tok->len, err);
3290 print_socket_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3293 print_tok_type(fp, tok->id, "socket", oflags);
3296 print_2_bytes(fp, tok->tt.socket.type, "%u");
3299 print_2_bytes(fp, ntohs(tok->tt.socket.l_port), "%u");
3302 print_ip_address(fp, tok->tt.socket.l_addr);
3305 print_2_bytes(fp, ntohs(tok->tt.socket.r_port), "%u");
3308 print_ip_address(fp, tok->tt.socket.r_addr);
3310 close_tag(fp, tok->id);
3313 print_2_bytes(fp, tok->tt.socket.type, "%u");
3315 print_2_bytes(fp, ntohs(tok->tt.socket.l_port), "%u");
3317 print_ip_address(fp, tok->tt.socket.l_addr);
3319 print_2_bytes(fp, ntohs(tok->tt.socket.r_port), "%u");
3321 print_ip_address(fp, tok->tt.socket.r_addr);
3338 fetch_subject32_tok(tokenstr_t *tok, u_char *buf, int len)
3342 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32.auid, tok->len, err);
3346 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32.euid, tok->len, err);
3350 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32.egid, tok->len, err);
3354 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32.ruid, tok->len, err);
3358 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32.rgid, tok->len, err);
3362 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32.pid, tok->len, err);
3366 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32.sid, tok->len, err);
3370 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32.tid.port, tok->len, err);
3374 READ_TOKEN_BYTES(buf, len, &tok->tt.subj32.tid.addr,
3375 sizeof(tok->tt.subj32.tid.addr), tok->len, err);
3383 print_subject32_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3386 print_tok_type(fp, tok->id, "subject", oflags);
3389 print_user(fp, tok->tt.subj32.auid, oflags);
3392 print_user(fp, tok->tt.subj32.euid, oflags);
3395 print_group(fp, tok->tt.subj32.egid, oflags);
3398 print_user(fp, tok->tt.subj32.ruid, oflags);
3401 print_group(fp, tok->tt.subj32.rgid, oflags);
3404 print_4_bytes(fp, tok->tt.subj32.pid, "%u");
3407 print_4_bytes(fp, tok->tt.subj32.sid, "%u");
3410 print_4_bytes(fp, tok->tt.subj32.tid.port, "%u ");
3411 print_ip_address(fp, tok->tt.subj32.tid.addr);
3413 close_tag(fp, tok->id);
3416 print_user(fp, tok->tt.subj32.auid, oflags);
3418 print_user(fp, tok->tt.subj32.euid, oflags);
3420 print_group(fp, tok->tt.subj32.egid, oflags);
3422 print_user(fp, tok->tt.subj32.ruid, oflags);
3424 print_group(fp, tok->tt.subj32.rgid, oflags);
3426 print_4_bytes(fp, tok->tt.subj32.pid, "%u");
3428 print_4_bytes(fp, tok->tt.subj32.sid, "%u");
3430 print_4_bytes(fp, tok->tt.subj32.tid.port, "%u");
3432 print_ip_address(fp, tok->tt.subj32.tid.addr);
3437 print_upriv_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3440 print_tok_type(fp, tok->id, "use of privilege", oflags);
3443 if (tok->tt.priv.sorf)
3449 print_string(fp, tok->tt.priv.priv, tok->tt.priv.privstrlen);
3451 close_tag(fp, tok->id);
3454 if (tok->tt.priv.sorf)
3459 print_string(fp, tok->tt.priv.priv, tok->tt.priv.privstrlen);
3469 fetch_priv_tok(tokenstr_t *tok, u_char *buf, int len)
3473 READ_TOKEN_U_CHAR(buf, len, tok->tt.priv.sorf, tok->len, err);
3476 READ_TOKEN_U_INT16(buf, len, tok->tt.priv.privstrlen, tok->len, err);
3479 SET_PTR((char *)buf, len, tok->tt.priv.priv, tok->tt.priv.privstrlen,
3480 tok->len, err);
3493 fetch_privset_tok(tokenstr_t *tok, u_char *buf, int len)
3497 READ_TOKEN_U_INT16(buf, len, tok->tt.privset.privtstrlen,
3498 tok->len, err);
3501 SET_PTR((char *)buf, len, tok->tt.privset.privtstr,
3502 tok->tt.privset.privtstrlen, tok->len, err);
3505 READ_TOKEN_U_INT16(buf, len, tok->tt.privset.privstrlen,
3506 tok->len, err);
3509 SET_PTR((char *)buf, len, tok->tt.privset.privstr,
3510 tok->tt.privset.privstrlen, tok->len, err);
3517 print_privset_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3520 print_tok_type(fp, tok->id, "privilege", oflags);
3523 print_string(fp, tok->tt.privset.privtstr,
3524 tok->tt.privset.privtstrlen);
3527 print_string(fp, tok->tt.privset.privstr,
3528 tok->tt.privset.privstrlen);
3532 print_string(fp, tok->tt.privset.privtstr,
3533 tok->tt.privset.privtstrlen);
3535 print_string(fp, tok->tt.privset.privstr,
3536 tok->tt.privset.privstrlen);
3553 fetch_subject64_tok(tokenstr_t *tok, u_char *buf, int len)
3557 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64.auid, tok->len, err);
3561 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64.euid, tok->len, err);
3565 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64.egid, tok->len, err);
3569 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64.ruid, tok->len, err);
3573 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64.rgid, tok->len, err);
3577 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64.pid, tok->len, err);
3581 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64.sid, tok->len, err);
3585 READ_TOKEN_U_INT64(buf, len, tok->tt.subj64.tid.port, tok->len, err);
3589 READ_TOKEN_BYTES(buf, len, &tok->tt.subj64.tid.addr,
3590 sizeof(tok->tt.subj64.tid.addr), tok->len, err);
3598 print_subject64_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3601 print_tok_type(fp, tok->id, "subject", oflags);
3604 print_user(fp, tok->tt.subj64.auid, oflags);
3607 print_user(fp, tok->tt.subj64.euid, oflags);
3610 print_group(fp, tok->tt.subj64.egid, oflags);
3613 print_user(fp, tok->tt.subj64.ruid, oflags);
3616 print_group(fp, tok->tt.subj64.rgid, oflags);
3619 print_4_bytes(fp, tok->tt.subj64.pid, "%u");
3622 print_4_bytes(fp, tok->tt.subj64.sid, "%u");
3625 print_8_bytes(fp, tok->tt.subj64.tid.port, "%llu");
3626 print_ip_address(fp, tok->tt.subj64.tid.addr);
3628 close_tag(fp, tok->id);
3631 print_user(fp, tok->tt.subj64.auid, oflags);
3633 print_user(fp, tok->tt.subj64.euid, oflags);
3635 print_group(fp, tok->tt.subj64.egid, oflags);
3637 print_user(fp, tok->tt.subj64.ruid, oflags);
3639 print_group(fp, tok->tt.subj64.rgid, oflags);
3641 print_4_bytes(fp, tok->tt.subj64.pid, "%u");
3643 print_4_bytes(fp, tok->tt.subj64.sid, "%u");
3645 print_8_bytes(fp, tok->tt.subj64.tid.port, "%llu");
3647 print_ip_address(fp, tok->tt.subj64.tid.addr);
3665 fetch_subject32ex_tok(tokenstr_t *tok, u_char *buf, int len)
3669 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.auid, tok->len, err);
3673 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.euid, tok->len, err);
3677 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.egid, tok->len, err);
3681 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.ruid, tok->len, err);
3685 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.rgid, tok->len, err);
3689 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.pid, tok->len, err);
3693 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.sid, tok->len, err);
3697 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.tid.port, tok->len,
3702 READ_TOKEN_U_INT32(buf, len, tok->tt.subj32_ex.tid.type, tok->len,
3707 if (tok->tt.subj32_ex.tid.type == AU_IPv4) {
3708 READ_TOKEN_BYTES(buf, len, &tok->tt.subj32_ex.tid.addr[0],
3709 sizeof(tok->tt.subj32_ex.tid.addr[0]), tok->len, err);
3712 } else if (tok->tt.subj32_ex.tid.type == AU_IPv6) {
3713 READ_TOKEN_BYTES(buf, len, tok->tt.subj32_ex.tid.addr,
3714 sizeof(tok->tt.subj32_ex.tid.addr), tok->len, err);
3724 print_subject32ex_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3727 print_tok_type(fp, tok->id, "subject_ex", oflags);
3730 print_user(fp, tok->tt.subj32_ex.auid, oflags);
3733 print_user(fp, tok->tt.subj32_ex.euid, oflags);
3736 print_group(fp, tok->tt.subj32_ex.egid, oflags);
3739 print_user(fp, tok->tt.subj32_ex.ruid, oflags);
3742 print_group(fp, tok->tt.subj32_ex.rgid, oflags);
3745 print_4_bytes(fp, tok->tt.subj32_ex.pid, "%u");
3748 print_4_bytes(fp, tok->tt.subj32_ex.sid, "%u");
3751 print_4_bytes(fp, tok->tt.subj32_ex.tid.port, "%u");
3752 print_ip_ex_address(fp, tok->tt.subj32_ex.tid.type,
3753 tok->tt.subj32_ex.tid.addr);
3755 close_tag(fp, tok->id);
3758 print_user(fp, tok->tt.subj32_ex.auid, oflags);
3760 print_user(fp, tok->tt.subj32_ex.euid, oflags);
3762 print_group(fp, tok->tt.subj32_ex.egid, oflags);
3764 print_user(fp, tok->tt.subj32_ex.ruid, oflags);
3766 print_group(fp, tok->tt.subj32_ex.rgid, oflags);
3768 print_4_bytes(fp, tok->tt.subj32_ex.pid, "%u");
3770 print_4_bytes(fp, tok->tt.subj32_ex.sid, "%u");
3772 print_4_bytes(fp, tok->tt.subj32_ex.tid.port, "%u");
3774 print_ip_ex_address(fp, tok->tt.subj32_ex.tid.type,
3775 tok->tt.subj32_ex.tid.addr);
3793 fetch_subject64ex_tok(tokenstr_t *tok, u_char *buf, int len)
3797 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64_ex.auid, tok->len, err);
3801 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64_ex.euid, tok->len, err);
3805 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64_ex.egid, tok->len, err);
3809 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64_ex.ruid, tok->len, err);
3813 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64_ex.rgid, tok->len, err);
3817 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64_ex.pid, tok->len, err);
3821 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64_ex.sid, tok->len, err);
3825 READ_TOKEN_U_INT64(buf, len, tok->tt.subj64_ex.tid.port, tok->len,
3830 READ_TOKEN_U_INT32(buf, len, tok->tt.subj64_ex.tid.type, tok->len,
3835 if (tok->tt.subj64_ex.tid.type == AU_IPv4) {
3836 READ_TOKEN_BYTES(buf, len, &tok->tt.subj64_ex.tid.addr[0],
3837 sizeof(tok->tt.subj64_ex.tid.addr[0]), tok->len, err);
3840 } else if (tok->tt.subj64_ex.tid.type == AU_IPv6) {
3841 READ_TOKEN_BYTES(buf, len, tok->tt.subj64_ex.tid.addr,
3842 sizeof(tok->tt.subj64_ex.tid.addr), tok->len, err);
3852 print_subject64ex_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3854 print_tok_type(fp, tok->id, "subject_ex", oflags);
3857 print_user(fp, tok->tt.subj64_ex.auid, oflags);
3860 print_user(fp, tok->tt.subj64_ex.euid, oflags);
3863 print_group(fp, tok->tt.subj64_ex.egid, oflags);
3866 print_user(fp, tok->tt.subj64_ex.ruid, oflags);
3869 print_group(fp, tok->tt.subj64_ex.rgid, oflags);
3872 print_4_bytes(fp, tok->tt.subj64_ex.pid, "%u");
3875 print_4_bytes(fp, tok->tt.subj64_ex.sid, "%u");
3878 print_8_bytes(fp, tok->tt.subj64_ex.tid.port, "%llu");
3879 print_ip_ex_address(fp, tok->tt.subj64_ex.tid.type,
3880 tok->tt.subj64_ex.tid.addr);
3882 close_tag(fp, tok->id);
3885 print_user(fp, tok->tt.subj64_ex.auid, oflags);
3887 print_user(fp, tok->tt.subj64_ex.euid, oflags);
3889 print_group(fp, tok->tt.subj64_ex.egid, oflags);
3891 print_user(fp, tok->tt.subj64_ex.ruid, oflags);
3893 print_group(fp, tok->tt.subj64_ex.rgid, oflags);
3895 print_4_bytes(fp, tok->tt.subj64_ex.pid, "%u");
3897 print_4_bytes(fp, tok->tt.subj64_ex.sid, "%u");
3899 print_8_bytes(fp, tok->tt.subj64_ex.tid.port, "%llu");
3901 print_ip_ex_address(fp, tok->tt.subj64_ex.tid.type,
3902 tok->tt.subj64_ex.tid.addr);
3911 fetch_text_tok(tokenstr_t *tok, u_char *buf, int len)
3915 READ_TOKEN_U_INT16(buf, len, tok->tt.text.len, tok->len, err);
3919 SET_PTR((char*)buf, len, tok->tt.text.text, tok->tt.text.len, tok->len,
3928 print_text_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
3931 print_tok_type(fp, tok->id, "text", oflags);
3933 print_string(fp, tok->tt.text.text, tok->tt.text.len);
3934 close_tag(fp, tok->id);
3937 print_string(fp, tok->tt.text.text, tok->tt.text.len);
3951 fetch_socketex32_tok(tokenstr_t *tok, u_char *buf, int len)
3955 READ_TOKEN_U_INT16(buf, len, tok->tt.socket_ex32.domain, tok->len,
3960 READ_TOKEN_U_INT16(buf, len, tok->tt.socket_ex32.type, tok->len,
3965 READ_TOKEN_U_INT16(buf, len, tok->tt.socket_ex32.atype, tok->len,
3970 if (tok->tt.socket_ex32.atype != AU_IPv4 &&
3971 tok->tt.socket_ex32.atype != AU_IPv6)
3974 READ_TOKEN_BYTES(buf, len, &tok->tt.socket_ex32.l_port,
3975 sizeof(uint16_t), tok->len, err);
3979 if (tok->tt.socket_ex32.atype == AU_IPv4) {
3980 READ_TOKEN_BYTES(buf, len, &tok->tt.socket_ex32.l_addr,
3981 sizeof(tok->tt.socket_ex32.l_addr[0]), tok->len, err);
3985 READ_TOKEN_BYTES(buf, len, &tok->tt.socket_ex32.l_addr,
3986 sizeof(tok->tt.socket_ex32.l_addr), tok->len, err);
3991 READ_TOKEN_BYTES(buf, len, &tok->tt.socket_ex32.r_port,
3992 sizeof(uint16_t), tok->len, err);
3996 if (tok->tt.socket_ex32.atype == AU_IPv4) {
3997 READ_TOKEN_BYTES(buf, len, &tok->tt.socket_ex32.r_addr,
3998 sizeof(tok->tt.socket_ex32.r_addr[0]), tok->len, err);
4002 READ_TOKEN_BYTES(buf, len, &tok->tt.socket_ex32.r_addr,
4003 sizeof(tok->tt.socket_ex32.r_addr), tok->len, err);
4012 print_socketex32_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
4021 print_tok_type(fp, tok->id, "socket", oflags);
4024 print_2_bytes(fp, tok->tt.socket_ex32.domain, "%#x");
4027 print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x");
4030 print_2_bytes(fp, ntohs(tok->tt.socket_ex32.l_port), "%#x");
4033 print_ip_ex_address(fp, tok->tt.socket_ex32.atype,
4034 tok->tt.socket_ex32.l_addr);
4037 print_ip_ex_address(fp, tok->tt.socket_ex32.atype,
4038 tok->tt.socket_ex32.r_addr);
4041 print_2_bytes(fp, ntohs(tok->tt.socket_ex32.r_port), "%#x");
4043 close_tag(fp, tok->id);
4046 print_2_bytes(fp, tok->tt.socket_ex32.domain, "%#x");
4048 print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x");
4050 print_2_bytes(fp, ntohs(tok->tt.socket_ex32.l_port), "%#x");
4052 print_ip_ex_address(fp, tok->tt.socket_ex32.atype,
4053 tok->tt.socket_ex32.l_addr);
4055 print_4_bytes(fp, ntohs(tok->tt.socket_ex32.r_port), "%#x");
4057 print_ip_ex_address(fp, tok->tt.socket_ex32.atype,
4058 tok->tt.socket_ex32.r_addr);
4063 fetch_invalid_tok(tokenstr_t *tok, u_char *buf, int len)
4068 recoversize = len - (tok->len + AUDIT_TRAILER_SIZE);
4072 tok->tt.invalid.length = recoversize;
4074 SET_PTR((char*)buf, len, tok->tt.invalid.data, recoversize, tok->len,
4083 print_invalid_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
4087 print_tok_type(fp, tok->id, "unknown", oflags);
4089 print_mem(fp, (u_char*)tok->tt.invalid.data,
4090 tok->tt.invalid.length);
4100 fetch_zonename_tok(tokenstr_t *tok, u_char *buf, int len)
4104 READ_TOKEN_U_INT16(buf, len, tok->tt.zonename.len, tok->len, err);
4107 SET_PTR((char *)buf, len, tok->tt.zonename.zonename, tok->tt.zonename.len,
4108 tok->len, err);
4115 print_zonename_tok(FILE *fp, tokenstr_t *tok, char *del, int oflags)
4118 print_tok_type(fp, tok->id, "zone", oflags);
4121 print_string(fp, tok->tt.zonename.zonename,
4122 tok->tt.zonename.len);
4124 close_tag(fp, tok->id);
4127 print_string(fp, tok->tt.zonename.zonename,
4128 tok->tt.zonename.len);
4133 * Reads the token beginning at buf into tok.
4136 au_fetch_tok(tokenstr_t *tok, u_char *buf, int len)
4142 tok->len = 1;
4143 tok->data = buf;
4144 tok->id = *buf;
4146 switch(tok->id) {
4148 return (fetch_header32_tok(tok, buf, len));
4151 return (fetch_header32_ex_tok(tok, buf, len));
4154 return (fetch_header64_tok(tok, buf, len));
4157 return (fetch_header64_ex_tok(tok, buf, len));
4160 return (fetch_trailer_tok(tok, buf, len));
4163 return (fetch_arg32_tok(tok, buf, len));
4166 return (fetch_arg64_tok(tok, buf, len));
4169 return (fetch_attr32_tok(tok, buf, len));
4172 return (fetch_attr64_tok(tok, buf, len));
4175 return (fetch_exit_tok(tok, buf, len));
4178 return (fetch_execarg_tok(tok, buf, len));
4181 return (fetch_execenv_tok(tok, buf, len));
4184 return (fetch_file_tok(tok, buf, len));
4187 return (fetch_newgroups_tok(tok, buf, len));
4190 return (fetch_inaddr_tok(tok, buf, len));
4193 return (fetch_inaddr_ex_tok(tok, buf, len));
4196 return (fetch_ip_tok(tok, buf, len));
4199 return (fetch_ipc_tok(tok, buf, len));
4202 return (fetch_ipcperm_tok(tok, buf, len));
4205 return (fetch_iport_tok(tok, buf, len));
4208 return (fetch_opaque_tok(tok, buf, len));
4211 return (fetch_path_tok(tok, buf, len));
4214 return (fetch_process32_tok(tok, buf, len));
4217 return (fetch_process32ex_tok(tok, buf, len));
4220 return (fetch_process64_tok(tok, buf, len));
4223 return (fetch_process64ex_tok(tok, buf, len));
4226 return (fetch_return32_tok(tok, buf, len));
4229 return (fetch_return64_tok(tok, buf, len));
4232 return (fetch_seq_tok(tok, buf, len));
4235 return (fetch_socket_tok(tok, buf, len));
4238 return (fetch_sock_inet32_tok(tok, buf, len));
4241 return (fetch_sock_unix_tok(tok, buf, len));
4244 return (fetch_sock_inet128_tok(tok, buf, len));
4247 return (fetch_subject32_tok(tok, buf, len));
4250 return (fetch_subject32ex_tok(tok, buf, len));
4253 return (fetch_subject64_tok(tok, buf, len));
4256 return (fetch_subject64ex_tok(tok, buf, len));
4259 return (fetch_text_tok(tok, buf, len));
4262 return (fetch_socketex32_tok(tok, buf, len));
4265 return (fetch_arb_tok(tok, buf, len));
4268 return (fetch_zonename_tok(tok, buf, len));
4271 return (fetch_priv_tok(tok, buf, len));
4274 return (fetch_privset_tok(tok, buf, len));
4277 return (fetch_invalid_tok(tok, buf, len));
4282 au_print_flags_tok(FILE *outfp, tokenstr_t *tok, char *del, int oflags)
4285 switch(tok->id) {
4287 print_header32_tok(outfp, tok, del, oflags);
4291 print_header32_ex_tok(outfp, tok, del, oflags);
4295 print_header64_tok(outfp, tok, del, oflags);
4299 print_header64_ex_tok(outfp, tok, del, oflags);
4303 print_trailer_tok(outfp, tok, del, oflags);
4307 print_arg32_tok(outfp, tok, del, oflags);
4311 print_arg64_tok(outfp, tok, del, oflags);
4315 print_arb_tok(outfp, tok, del, oflags);
4319 print_attr32_tok(outfp, tok, del, oflags);
4323 print_attr64_tok(outfp, tok, del, oflags);
4327 print_exit_tok(outfp, tok, del, oflags);
4331 print_execarg_tok(outfp, tok, del, oflags);
4335 print_execenv_tok(outfp, tok, del, oflags);
4339 print_file_tok(outfp, tok, del, oflags);
4343 print_newgroups_tok(outfp, tok, del, oflags);
4347 print_inaddr_tok(outfp, tok, del, oflags);
4351 print_inaddr_ex_tok(outfp, tok, del, oflags);
4355 print_ip_tok(outfp, tok, del, oflags);
4359 print_ipc_tok(outfp, tok, del, oflags);
4363 print_ipcperm_tok(outfp, tok, del, oflags);
4367 print_iport_tok(outfp, tok, del, oflags);
4371 print_opaque_tok(outfp, tok, del, oflags);
4375 print_path_tok(outfp, tok, del, oflags);
4379 print_process32_tok(outfp, tok, del, oflags);
4383 print_process32ex_tok(outfp, tok, del, oflags);
4387 print_process64_tok(outfp, tok, del, oflags);
4391 print_process64ex_tok(outfp, tok, del, oflags);
4395 print_return32_tok(outfp, tok, del, oflags);
4399 print_return64_tok(outfp, tok, del, oflags);
4403 print_seq_tok(outfp, tok, del, oflags);
4407 print_socket_tok(outfp, tok, del, oflags);
4411 print_sock_inet32_tok(outfp, tok, del, oflags);
4415 print_sock_unix_tok(outfp, tok, del, oflags);
4419 print_sock_inet128_tok(outfp, tok, del, oflags);
4423 print_subject32_tok(outfp, tok, del, oflags);
4427 print_subject64_tok(outfp, tok, del, oflags);
4431 print_subject32ex_tok(outfp, tok, del, oflags);
4435 print_subject64ex_tok(outfp, tok, del, oflags);
4439 print_text_tok(outfp, tok, del, oflags);
4443 print_socketex32_tok(outfp, tok, del, oflags);
4447 print_zonename_tok(outfp, tok, del, oflags);
4451 print_upriv_tok(outfp, tok, del, oflags);
4455 print_privset_tok(outfp, tok, del, oflags);
4459 print_invalid_tok(outfp, tok, del, oflags);
4467 au_print_tok(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm)
4476 au_print_flags_tok(outfp, tok, del, oflags);
4483 au_print_tok_xml(FILE *outfp, tokenstr_t *tok, char *del, char raw,
4493 au_print_flags_tok(outfp, tok, del, oflags);