FreeBSD/sys/security/audit/bsm_token.c
/*
 * token ID                1 byte
 * socket family           2 bytes
 * local port              2 bytes
 * socket address          4 bytes
 */
token ID                1 byte
socket family           2 bytes
local port              2 bytes
socket address          4 bytes
token ID 1 byte socket family 2 bytes local port 2 bytes socket address 4 bytes
token_t *
au_to_sock_inet32(struct sockaddr_in *so)
{
	token_t *t;
	u_char *dptr = NULL;
	uint16_t family;
	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +
	    sizeof(uint32_t));
	ADD_U_CHAR(dptr, AUT_SOCKINET32);
	family = so->sin_family;
	ADD_U_INT16(dptr, family);
	ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));
	ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));
	return (t);
}
token_t * au_to_sock_inet32 ( struct sockaddr_in * so ) { token_t * t ; u_char * dptr = NULL ; uint16_t family ; GET_TOKEN_AREA ( t , dptr , sizeof ( u_char ) + 2 * sizeof ( uint16_t ) + sizeof ( uint32_t ) ) ; ADD_U_CHAR ( dptr , AUT_SOCKINET32 ) ; family = so -> sin_family ; ADD_U_INT16 ( dptr , family ) ; ADD_MEM ( dptr , & so -> sin_port , sizeof ( uint16_t ) ) ; ADD_MEM ( dptr , & so -> sin_addr . s_addr , sizeof ( uint32_t ) ) ; return ( t ) ; }
token ID                1 byte
 socket family           2 bytes
 local port              2 bytes
 socket address          4 bytes
token ID 1 byte socket family 2 bytes local port 2 bytes socket address 4 bytes
/*
	 * BSM defines the family field as 16 bits, but many operating
	 * systems have an 8-bit sin_family field.  Extend to 16 bits before
	 * writing into the token.  Assume that both the port and the address
	 * in the sockaddr_in are already in network byte order, but family
	 * is in local byte order.
	 *
	 * XXXRW: Should a name space conversion be taking place on the value
	 * of sin_family?
	 */