FreeBSD/contrib/openbsm/libbsm/bsm_audit.c
/*
 * Assemble an audit record out of its tokens, including allocating header and
 * trailer tokens.  Does not free the token chain, which must be done by the
 * caller if desirable.
 *
 * XXX: Assumes there is sufficient space for the header and trailer.
 */
Assemble an audit record out of its tokens, including allocating header and
trailer tokens.  Does not free the token chain, which must be done by the
caller if desirable.

Assumes there is sufficient space for the header and trailer.
Assemble an audit record out of its tokens including allocating header and trailer tokens . Does not free the token chain which must be done by the caller if desirable . Assumes there is sufficient space for the header and trailer .
static int
au_assemble(au_record_t *rec, short event)
{
#ifdef HAVE_AUDIT_SYSCALLS
	struct in6_addr *aptr;
	struct auditinfo_addr aia;
	struct timeval tm;
	size_t hdrsize;
#endif 
	token_t *header, *tok, *trailer;
	size_t tot_rec_size;
	u_char *dptr;
	int error;
#ifdef HAVE_AUDIT_SYSCALLS
	aia.ai_termid.at_type = AU_IPv4;
	aia.ai_termid.at_addr[0] = INADDR_ANY;
	if (audit_get_kaudit(&aia, sizeof(aia)) != 0) {
		if (errno != ENOSYS && errno != EPERM)
			return (-1);
#endif 
		tot_rec_size = rec->len + AUDIT_HEADER_SIZE +
		    AUDIT_TRAILER_SIZE;
		header = au_to_header(tot_rec_size, event, 0);
#ifdef HAVE_AUDIT_SYSCALLS
	} else {
		if (gettimeofday(&tm, NULL) < 0)
			return (-1);
		switch (aia.ai_termid.at_type) {
		case AU_IPv4:
			hdrsize = (aia.ai_termid.at_addr[0] == INADDR_ANY) ?
			    AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&aia);
			break;
		case AU_IPv6:
			aptr = (struct in6_addr *)&aia.ai_termid.at_addr[0];
			hdrsize =
			    (IN6_IS_ADDR_UNSPECIFIED(aptr)) ?
			    AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE(&aia);
			break;
		default:
			return (-1);
		}
		tot_rec_size = rec->len + hdrsize + AUDIT_TRAILER_SIZE;
		if (hdrsize > AUDIT_HEADER_SIZE)
			header = au_to_header32_ex_tm(tot_rec_size, event,
			    0, tm, &aia);
		else
			header = au_to_header(tot_rec_size, event, 0);
	}
#endif 
	if (header == NULL)
		return (-1);
	trailer = au_to_trailer(tot_rec_size);
	if (trailer == NULL) {
		error = errno;
		au_free_token(header);
		errno = error;
		return (-1);
	}
	TAILQ_INSERT_HEAD(&rec->token_q, header, tokens);
	TAILQ_INSERT_TAIL(&rec->token_q, trailer, tokens);
	rec->len = tot_rec_size;
	dptr = rec->data;
	TAILQ_FOREACH(tok, &rec->token_q, tokens) {
		memcpy(dptr, tok->t_data, tok->len);
		dptr += tok->len;
	}
	return (0);
}
static int au_assemble ( au_record_t * rec , short event ) { #ifdef HAVE_AUDIT_SYSCALLS struct in6_addr * aptr ; struct auditinfo_addr aia ; struct timeval tm ; size_t hdrsize ; #endif token_t * header , * tok , * trailer ; size_t tot_rec_size ; u_char * dptr ; int error ; #ifdef HAVE_AUDIT_SYSCALLS aia . ai_termid . at_type = AU_IPv4 ; aia . ai_termid . at_addr [ 0 ] = INADDR_ANY ; if ( audit_get_kaudit ( & aia , sizeof ( aia ) ) != 0 ) { if ( errno != ENOSYS && errno != EPERM ) return ( -1 ) ; #endif 
		tot_rec_size = rec->len + AUDIT_HEADER_SIZE + AUDIT_TRAILER_SIZE ; header = au_to_header ( tot_rec_size , event , 0 ) ; #ifdef HAVE_AUDIT_SYSCALLS } else { if ( gettimeofday ( & tm , NULL ) < 0 ) return ( -1 ) ; switch ( aia . ai_termid . at_type ) { case AU_IPv4 : hdrsize = ( aia . ai_termid . at_addr [ 0 ] == INADDR_ANY ) ? AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE ( & aia ) ; break ; case AU_IPv6 : aptr = ( struct in6_addr * ) & aia . ai_termid . at_addr [ 0 ] ; hdrsize = ( IN6_IS_ADDR_UNSPECIFIED ( aptr ) ) ? AUDIT_HEADER_SIZE : AUDIT_HEADER_EX_SIZE ( & aia ) ; break ; default : return ( -1 ) ; } tot_rec_size = rec -> len + hdrsize + AUDIT_TRAILER_SIZE ; if ( hdrsize > AUDIT_HEADER_SIZE ) header = au_to_header32_ex_tm ( tot_rec_size , event , 0 , tm , & aia ) ; else header = au_to_header ( tot_rec_size , event , 0 ) ; } #endif if ( header == NULL ) return ( -1 ) ; trailer = au_to_trailer ( tot_rec_size ) ; if ( trailer == NULL ) { error = errno ; au_free_token ( header ) ; errno = error ; return ( -1 ) ; } TAILQ_INSERT_HEAD ( & rec -> token_q , header , tokens ) ; TAILQ_INSERT_TAIL ( & rec -> token_q , trailer , tokens ) ; rec -> len = tot_rec_size ; dptr = rec -> data ; TAILQ_FOREACH ( tok , & rec -> token_q , tokens ) { memcpy ( dptr , tok -> t_data , tok -> len ) ; dptr += tok -> len ; } return ( 0 ) ; }
Assemble an audit record out of its tokens, including allocating header and
 trailer tokens.
Assemble an audit record out of its tokens including allocating header and trailer tokens .
/* HAVE_AUDIT_SYSCALLS */ /*
	 * Grab the size of the address family stored in the kernel's audit
	 * state.
	 */  /* HAVE_AUDIT_SYSCALLS */ /*
		 * A header size greater then AUDIT_HEADER_SIZE means
		 * that we are using an extended header.
		 */ /* HAVE_AUDIT_SYSCALLS */