/*
* token ID 1 byte
* record byte count 4 bytes
* version # 1 byte [2]
* event type 2 bytes
* event modifier 2 bytes
* address type/length 4 bytes
* machine address 4 bytes/16 bytes (IPv4/IPv6 address)
* seconds of time 4 bytes/8 bytes (32-bit/64-bit value)
* milliseconds of time 4 bytes/8 bytes (32-bit/64-bit value)
*/
token_t *
au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
struct timeval tm, struct auditinfo_addr *aia)
{
token_t *t;
u_char *dptr = NULL;
u_int32_t timems;
au_tid_addr_t *tid;
tid = &aia->ai_termid;
KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,
("au_to_header32_ex_tm: invalid address family"));
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 *
sizeof(u_int32_t) + tid->at_type);
ADD_U_CHAR(dptr, AUT_HEADER32_EX);
ADD_U_INT32(dptr, rec_size);
ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
ADD_U_INT16(dptr, e_type);
ADD_U_INT16(dptr, e_mod);
ADD_U_INT32(dptr, tid->at_type);
if (tid->at_type == AU_IPv6)
ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));
else
ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));
timems = tm.tv_usec/1000;
/* Add the timestamp */
ADD_U_INT32(dptr, tm.tv_sec);
ADD_U_INT32(dptr, timems); /* We need time in ms. */
return (t);
}
/*
* token ID 1 byte
* socket family 2 bytes
* local port 2 bytes
* socket address 4 bytes
*/
token_t *
au_to_sock_inet32(struct sockaddr_in *so)
{
token_t *t;
u_char *dptr = NULL;
uint16_t family;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +
sizeof(uint32_t));
ADD_U_CHAR(dptr, AUT_SOCKINET32);
/*
* BSM defines the family field as 16 bits, but many operating
* systems have an 8-bit sin_family field. Extend to 16 bits before
* writing into the token. Assume that both the port and the address
* in the sockaddr_in are already in network byte order, but family
* is in local byte order.
*
* XXXRW: Should a name space conversion be taking place on the value
* of sin_family?
*/
family = so->sin_family;
ADD_U_INT16(dptr, family);
ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
return (t);
}
token_t *
au_to_attr64(struct vnode_au_info *vni)
{
token_t *t;
u_char *dptr = NULL;
u_int16_t pad0_16 = 0;
u_int32_t pad0_32 = 0;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
3 * sizeof(u_int32_t) + sizeof(u_int64_t) * 2);
ADD_U_CHAR(dptr, AUT_ATTR64);
/*
* BSD defines the size for the file mode as 2 bytes; BSM defines 4
* so pad with 0.
*
* XXXRW: Possibly should be conditionally compiled.
*
* XXXRW: Should any conversions take place on the mode?
*/
ADD_U_INT16(dptr, pad0_16);
ADD_U_INT16(dptr, vni->vn_mode);
ADD_U_INT32(dptr, vni->vn_uid);
ADD_U_INT32(dptr, vni->vn_gid);
ADD_U_INT32(dptr, vni->vn_fsid);
/*
* Some systems use 32-bit file ID's, other's use 64-bit file IDs.
* Attempt to handle both, and let the compiler sort it out. If we
* could pick this out at compile-time, it would be better, so as to
* avoid the else case below.
*/
if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) {
ADD_U_INT32(dptr, pad0_32);
ADD_U_INT32(dptr, vni->vn_fileid);
} else if (sizeof(vni->vn_fileid) == sizeof(uint64_t))
ADD_U_INT64(dptr, vni->vn_fileid);
else
ADD_U_INT64(dptr, 0LL);
ADD_U_INT64(dptr, vni->vn_dev);
return (t);
}
/*
* token ID 1 byte
* privtstrlen 2 bytes
* privtstr N bytes + 1
* privstrlen 2 bytes
* privstr N bytes + 1
*/
token_t *
au_to_privset(char *privtypestr, char *privstr)
{
u_int16_t type_len, priv_len;
u_char *dptr;
token_t *t;
type_len = strlen(privtypestr) + 1;
priv_len = strlen(privstr) + 1;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
sizeof(u_int16_t) + type_len + priv_len);
ADD_U_CHAR(dptr, AUT_PRIV);
ADD_U_INT16(dptr, type_len);
ADD_STRING(dptr, privtypestr, type_len);
ADD_U_INT16(dptr, priv_len);
ADD_STRING(dptr, privstr, priv_len);
return (t);
}
/*
* token ID 1 byte
* socket domain 2 bytes
* socket type 2 bytes
* address type 2 byte
* local port 2 bytes
* local address 4 bytes/16 bytes (IPv4/IPv6 address)
* remote port 2 bytes
* remote address 4 bytes/16 bytes (IPv4/IPv6 address)
*
* Domain and type arguments to this routine are assumed to already have been
* converted to the BSM constant space, so we don't do that here.
*/
token_t *
au_to_socket_ex(u_short so_domain, u_short so_type,
struct sockaddr *sa_local, struct sockaddr *sa_remote)
{
token_t *t;
u_char *dptr = NULL;
struct sockaddr_in *sin;
struct sockaddr_in6 *sin6;
if (so_domain == AF_INET)
GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
5 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));
else if (so_domain == AF_INET6)
GET_TOKEN_AREA(t, dptr, sizeof(u_char) +
5 * sizeof(u_int16_t) + 8 * sizeof(u_int32_t));
else
return (NULL);
ADD_U_CHAR(dptr, AUT_SOCKET_EX);
ADD_U_INT16(dptr, au_domain_to_bsm(so_domain));
ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type));
if (so_domain == AF_INET) {
ADD_U_INT16(dptr, AU_IPv4);
sin = (struct sockaddr_in *)sa_local;
ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
sin = (struct sockaddr_in *)sa_remote;
ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));
ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));
} else {
ADD_U_INT16(dptr, AU_IPv6);
sin6 = (struct sockaddr_in6 *)sa_local;
ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
sin6 = (struct sockaddr_in6 *)sa_remote;
ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));
ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));
}
return (t);
}
token_t *
kau_to_socket(struct socket_au_info *soi)
{
token_t *t;
u_char *dptr;
u_int16_t so_type;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +
sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t));
ADD_U_CHAR(dptr, AUT_SOCKET);
/* Coerce the socket type into a short value */
so_type = soi->so_type;
ADD_U_INT16(dptr, so_type);
ADD_U_INT16(dptr, soi->so_lport);
ADD_U_INT32(dptr, soi->so_laddr);
ADD_U_INT16(dptr, soi->so_rport);
ADD_U_INT32(dptr, soi->so_raddr);
return (t);
}
/*
* token ID 1 byte
* port IP address 2 bytes
*/
token_t *
au_to_iport(u_int16_t iport)
{
token_t *t;
u_char *dptr = NULL;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));
ADD_U_CHAR(dptr, AUT_IPORT);
ADD_U_INT16(dptr, iport);
return (t);
}
/*
* token ID 1 byte
* size 2 bytes
* data size bytes
*/
token_t *
au_to_opaque(const char *data, u_int16_t bytes)
{
token_t *t;
u_char *dptr = NULL;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);
ADD_U_CHAR(dptr, AUT_OPAQUE);
ADD_U_INT16(dptr, bytes);
ADD_MEM(dptr, data, bytes);
return (t);
}
token_t *
au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,
struct timeval tm)
{
token_t *t;
u_char *dptr = NULL;
u_int32_t timems;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +
sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int64_t));
ADD_U_CHAR(dptr, AUT_HEADER64);
ADD_U_INT32(dptr, rec_size);
ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);
ADD_U_INT16(dptr, e_type);
ADD_U_INT16(dptr, e_mod);
timems = tm.tv_usec/1000;
/* Add the timestamp */
ADD_U_INT64(dptr, tm.tv_sec);
ADD_U_INT64(dptr, timems); /* We need time in ms. */
return (t);
}
/*
* token ID 1 byte
* zonename length 2 bytes
* zonename N bytes + 1 terminating NULL byte
*/
token_t *
au_to_zonename(const char *zonename)
{
u_char *dptr = NULL;
u_int16_t textlen;
token_t *t;
textlen = strlen(zonename) + 1;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
ADD_U_CHAR(dptr, AUT_ZONENAME);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, zonename, textlen);
return (t);
}
/*
* token ID 1 byte
* trailer magic number 2 bytes
* record byte count 4 bytes
*/
token_t *
au_to_trailer(int rec_size)
{
token_t *t;
u_char *dptr = NULL;
u_int16_t magic = AUT_TRAILER_MAGIC;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
sizeof(u_int32_t));
ADD_U_CHAR(dptr, AUT_TRAILER);
ADD_U_INT16(dptr, magic);
ADD_U_INT32(dptr, rec_size);
return (t);
}
/*
* token ID 1 byte
* number groups 2 bytes
* group list count * 4 bytes
*/
token_t *
au_to_newgroups(u_int16_t n, gid_t *groups)
{
token_t *t;
u_char *dptr = NULL;
int i;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +
n * sizeof(u_int32_t));
ADD_U_CHAR(dptr, AUT_NEWGROUPS);
ADD_U_INT16(dptr, n);
for (i = 0; i < n; i++)
ADD_U_INT32(dptr, groups[i]);
return (t);
}
/*
* token ID 1 byte
* success/failure 1 byte
* privstrlen 2 bytes
* privstr N bytes + 1 (\0 byte)
*/
token_t *
au_to_upriv(char sorf, char *priv)
{
u_int16_t textlen;
u_char *dptr;
token_t *t;
textlen = strlen(priv) + 1;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_char) +
sizeof(u_int16_t) + textlen);
ADD_U_CHAR(dptr, AUT_UPRIV);
ADD_U_CHAR(dptr, sorf);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, priv, textlen);
return (t);
}
/*
* token ID 1 byte
* path length 2 bytes
* path N bytes + 1 terminating NULL byte
*/
token_t *
au_to_path(const char *text)
{
token_t *t;
u_char *dptr = NULL;
u_int16_t textlen;
textlen = strlen(text);
textlen += 1;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
ADD_U_CHAR(dptr, AUT_PATH);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, text, textlen);
return (t);
}
/*
* token ID 1 byte
* text length 2 bytes
* text N bytes + 1 terminating NULL byte
*/
token_t *
au_to_text(const char *text)
{
token_t *t;
u_char *dptr = NULL;
u_int16_t textlen;
textlen = strlen(text);
textlen += 1;
/* XXXRW: Should validate length against token size limit. */
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);
ADD_U_CHAR(dptr, AUT_TEXT);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, text, textlen);
return (t);
}
token_t *
au_to_arg64(char n, const char *text, u_int64_t v)
{
token_t *t;
u_char *dptr = NULL;
u_int16_t textlen;
textlen = strlen(text);
textlen += 1;
GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) +
sizeof(u_int16_t) + textlen);
ADD_U_CHAR(dptr, AUT_ARG64);
ADD_U_CHAR(dptr, n);
ADD_U_INT64(dptr, v);
ADD_U_INT16(dptr, textlen);
ADD_STRING(dptr, text, textlen);
return (t);
}
token_t *
au_to_sock_inet128(struct sockaddr_in6 *so)
{
token_t *t;
u_char *dptr = NULL;
GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +
4 * sizeof(u_int32_t));
ADD_U_CHAR(dptr, AUT_SOCKINET128);
/*
* In BSD, sin6_family is one octet, but BSM defines the token to
* store two. So we copy in a 0 first. XXXRW: Possibly should be
* conditionally compiled.
*/
ADD_U_CHAR(dptr, 0);
ADD_U_CHAR(dptr, so->sin6_family);
ADD_U_INT16(dptr, so->sin6_port);
ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));
return (t);
}
/*
* token ID 1 byte
* seconds of time 4 bytes
* milliseconds of time 4 bytes
* file name len 2 bytes
* file pathname N bytes + 1 terminating NULL byte
*/
token_t *
au_to_file(const char *file, struct timeval tm)
{
token_t *t;
u_char *dptr = NULL;
u_int16_t filelen;
u_int32_t timems;
filelen = strlen(file);
filelen += 1;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +
sizeof(u_int16_t) + filelen);
timems = tm.tv_usec/1000;
ADD_U_CHAR(dptr, AUT_OTHER_FILE32);
ADD_U_INT32(dptr, tm.tv_sec);
ADD_U_INT32(dptr, timems); /* We need time in ms. */
ADD_U_INT16(dptr, filelen);
ADD_STRING(dptr, file, filelen);
return (t);
}
/*
* token ID 1 byte
* owner user ID 4 bytes
* owner group ID 4 bytes
* creator user ID 4 bytes
* creator group ID 4 bytes
* access mode 4 bytes
* slot sequence # 4 bytes
* key 4 bytes
*/
token_t *
au_to_ipc_perm(struct ipc_perm *perm)
{
token_t *t;
u_char *dptr = NULL;
u_int16_t pad0 = 0;
GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) +
sizeof(u_int32_t));
ADD_U_CHAR(dptr, AUT_IPC_PERM);
/*
* Systems vary significantly in what types they use in struct
* ipc_perm; at least a few still use 16-bit uid's and gid's, so
* allow for that, as BSM define 32-bit values here.
* Some systems define the sizes for ipc_perm members as 2 bytes;
* BSM defines 4 so pad with 0.
*
* XXXRW: Possibly shoulid be conditionally compiled, and more cases
* need to be handled.
*/
if (sizeof(perm->uid) != sizeof(u_int32_t)) {
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->uid);
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->gid);
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->cuid);
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->cgid);
} else {
ADD_U_INT32(dptr, perm->uid);
ADD_U_INT32(dptr, perm->gid);
ADD_U_INT32(dptr, perm->cuid);
ADD_U_INT32(dptr, perm->cgid);
}
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->mode);
ADD_U_INT16(dptr, pad0);
ADD_U_INT16(dptr, perm->seq);
ADD_U_INT32(dptr, perm->key);
return (t);
}
