kern_bsm_token.c   [plain text]

/*
 * Copyright (c) 2003-2004 Apple Computer, Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 * 
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 * 
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 * 
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

#include <sys/types.h>
#include <sys/un.h>      
#include <sys/event.h>      
#include <sys/ucred.h>

#include <sys/ipc.h>      
#include <bsm/audit.h>      
#include <bsm/audit_record.h>      
#include <bsm/audit_klib.h>      
#include <bsm/audit_kernel.h>      

#include <kern/clock.h>
#include <kern/kalloc.h>

#include <string.h>

#define GET_TOKEN_AREA(tok, dptr, length) \
        do {\
                tok = (token_t *)kalloc(sizeof(*tok) + length); \
                if(tok != NULL)\
                {\
                        tok->len = length;\
                        dptr = tok->t_data = (u_char *)&tok[1];\
                                memset(dptr, 0, length);\
                        }\
        }while(0)



/*
 * token ID                1 byte
 * argument #              1 byte
 * argument value          4 bytes/8 bytes (32-bit/64-bit value)
 * text length             2 bytes
 * text                    N bytes + 1 terminating NULL byte
 */
token_t *
au_to_arg32(char n, const char *text, u_int32_t v)
{
	token_t *t;
	u_char *dptr;
	u_int16_t textlen;
	
	if(text == NULL) {
		return NULL;	
	}
	
	textlen = strlen(text);
	
	GET_TOKEN_AREA(t, dptr, 9 + textlen);
	if(t == NULL) {
		return NULL;
	}

	textlen += 1;

	ADD_U_CHAR(dptr, AU_ARG32_TOKEN);
	ADD_U_CHAR(dptr, n);
	ADD_U_INT32(dptr, v);
	ADD_U_INT16(dptr, textlen);
	ADD_STRING(dptr, text, textlen);

	return t;

}

token_t *
au_to_arg64(char n, const char *text, u_int64_t v)
{
	token_t *t;
	u_char *dptr;
	u_int16_t textlen;
	
	if(text == NULL) {
		return NULL;	
	}
	
	textlen = strlen(text);
	
	GET_TOKEN_AREA(t, dptr, 13 + textlen);
	if(t == NULL) {
		return NULL;
	}

	textlen += 1;	

	ADD_U_CHAR(dptr, AU_ARG64_TOKEN);
	ADD_U_CHAR(dptr, n);
	ADD_U_INT64(dptr, v);
	ADD_U_INT16(dptr, textlen);
	ADD_STRING(dptr, text, textlen);
	
	return t;

}

token_t *
au_to_arg(char n, char *text, u_int32_t v)
{
	return au_to_arg32(n, text, v);
}

/*
 * token ID                1 byte
 * file access mode        4 bytes
 * owner user ID           4 bytes
 * owner group ID          4 bytes
 * file system ID          4 bytes
 * node ID                 8 bytes
 * device                  4 bytes/8 bytes (32-bit/64-bit)
 */
token_t *au_to_attr32(__unused struct vnode_attr *attr)
{
	return NULL;
}

/* Kernel-specific version of the above function */
token_t *kau_to_attr32(struct vnode_au_info *vni)
{
	token_t *t;
	u_char *dptr;
	u_int64_t fileid;
	u_int16_t pad0_16 = 0;
	u_int32_t pad0_32 = 0;

	if(vni == NULL) {
		return NULL;
	}
	
	GET_TOKEN_AREA(t, dptr, 29);
	if(t == NULL) {
		return NULL;
	}

	ADD_U_CHAR(dptr, AU_ATTR32_TOKEN);

	/* 
	 * Darwin defines the size for the file mode as 2 bytes; 
	 * BSM defines 4. So we copy in a 0 first.
	 */
	ADD_U_INT16(dptr, pad0_16);
	ADD_U_INT16(dptr, vni->vn_mode);

	ADD_U_INT32(dptr, vni->vn_uid);
	ADD_U_INT32(dptr, vni->vn_gid);
	ADD_U_INT32(dptr, vni->vn_fsid);

	/* 
	 * Darwin defines the size for fileid as 4 bytes; 
	 * BSM defines 8. So we copy in a 0 first.
	 */
	fileid = vni->vn_fileid;
	ADD_U_INT32(dptr, pad0_32);
	ADD_U_INT32(dptr, fileid);

	ADD_U_INT32(dptr, vni->vn_dev);
	
	return t;
}

token_t *au_to_attr64(__unused struct vnode_attr *attr)
{
	return NULL;
}
	
token_t *kau_to_attr64(__unused struct vnode_au_info *vni)
{
	return NULL;
}

token_t *au_to_attr(struct vnode_attr *attr)
{
	return au_to_attr32(attr);

}


/*
 * token ID                1 byte
 * how to print            1 byte
 * basic unit              1 byte
 * unit count              1 byte
 * data items              (depends on basic unit)
 */
token_t *au_to_data(char unit_print, char unit_type,
                    char unit_count, unsigned char *p)
{
	token_t *t;
	u_char *dptr;
	size_t datasize, totdata;
	
	if(p == NULL) {
		return NULL;
	}
	
	/* Determine the size of the basic unit */
	switch(unit_type) {
		case AUR_BYTE:	datasize = AUR_BYTE_SIZE;
						break;

		case AUR_SHORT:	datasize = AUR_SHORT_SIZE;
						break;
	
		case AUR_LONG:	datasize = AUR_LONG_SIZE;
						break;
				
		default: return NULL;
	}

	totdata = datasize * unit_count;
	
	GET_TOKEN_AREA(t, dptr, totdata + 4);
	if(t == NULL) {
		return NULL;
	}

	ADD_U_CHAR(dptr, AU_ARB_TOKEN);
	ADD_U_CHAR(dptr, unit_print);
	ADD_U_CHAR(dptr, unit_type);
	ADD_U_CHAR(dptr, unit_count);
	ADD_MEM(dptr, p, totdata);
	
	return t;
}

/*
 * token ID                1 byte
 * status		   4 bytes
 * return value            4 bytes  
 */
token_t *au_to_exit(int retval, int err)
{
	token_t *t;
	u_char *dptr;
		 
	GET_TOKEN_AREA(t, dptr, 9);
	if(t == NULL) {
		return NULL;
	}
	
	ADD_U_CHAR(dptr, AU_EXIT_TOKEN);
	ADD_U_INT32(dptr, err);
	ADD_U_INT32(dptr, retval);

	return t;	
}

/*
 */
token_t *
au_to_groups(gid_t *groups)
{
	return au_to_newgroups(MAX_GROUPS, groups);	
}

/*
 * token ID                1 byte
 * number groups           2 bytes
 * group list              count * 4 bytes
 */
token_t *au_to_newgroups(u_int16_t n, gid_t *groups)
{
	token_t *t;
	u_char *dptr;
	int i;
   	
	if(groups == NULL) {
		return NULL;
	}
	
	GET_TOKEN_AREA(t, dptr, n * 4 + 3);
	if(t == NULL) {
		return NULL;
	}
 
	ADD_U_CHAR(dptr, AU_NEWGROUPS_TOKEN);
	ADD_U_INT16(dptr, n);
	for(i = 0; i < n; i++) {
	    ADD_U_INT32(dptr, groups[i]);
	}
 
	return t;	
}




/*
 * token ID                1 byte
 * internet address        4 bytes
 */
token_t *au_to_in_addr(struct in_addr *internet_addr)
{
	token_t *t;
	u_char *dptr;
		 
	if(internet_addr == NULL) {
		return NULL;
	}

	GET_TOKEN_AREA(t, dptr, 5);
	if(t == NULL) {
		return NULL;
	}
	
	ADD_U_CHAR(dptr, AU_IN_ADDR_TOKEN);
	ADD_U_INT32(dptr, internet_addr->s_addr);

	return t;
}

/*
 * token ID                1 byte
 * address type/length     4 bytes
 * Address                16 bytes 
 */
token_t *au_to_in_addr_ex(struct in6_addr *internet_addr)
{
	token_t *t;
	u_char *dptr;
	u_int32_t type = AF_INET6;
	
	if(internet_addr == NULL) {
		return NULL;
	}
	
	GET_TOKEN_AREA(t, dptr, 21);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_IN_ADDR_EX_TOKEN);
	ADD_U_INT32(dptr, type);
	ADD_U_INT32(dptr, internet_addr->__u6_addr.__u6_addr32[0]);
	ADD_U_INT32(dptr, internet_addr->__u6_addr.__u6_addr32[1]);
	ADD_U_INT32(dptr, internet_addr->__u6_addr.__u6_addr32[2]);
	ADD_U_INT32(dptr, internet_addr->__u6_addr.__u6_addr32[3]);

	return t;
}

/*
 * token ID                1 byte
 * ip header		   20 bytes
 */
token_t *au_to_ip(struct ip *ip)
{
	token_t *t;
	u_char *dptr;

	if(ip == NULL) {
		return NULL;
	}

	GET_TOKEN_AREA(t, dptr, 21);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_IP_TOKEN);
	ADD_MEM(dptr, ip, sizeof(struct ip));
				
	return t;
}

/*
 * token ID                1 byte
 * object ID type          1 byte
 * object ID               4 bytes
 */
token_t *au_to_ipc(char type, int id)
{
	token_t *t;
	u_char *dptr;
		 
		 
	GET_TOKEN_AREA(t, dptr, 6);
	if(t == NULL) {
		return NULL;
	}
				 
	ADD_U_CHAR(dptr, AU_IPC_TOKEN);
	ADD_U_CHAR(dptr, type);
	ADD_U_INT32(dptr, id);

	return t;
}

/*
 * token ID                1 byte
 * owner user ID           4 bytes
 * owner group ID          4 bytes
 * creator user ID         4 bytes
 * creator group ID        4 bytes
 * access mode             4 bytes
 * slot sequence #         4 bytes
 * key                     4 bytes
 */
token_t *au_to_ipc_perm(struct ipc_perm *perm)
{
	token_t *t;
	u_char *dptr;
	u_int16_t pad0 = 0;

	if(perm == NULL) {
		return NULL;
	}
	
	GET_TOKEN_AREA(t, dptr, 29);
	if(t == NULL) {
		return NULL;
	}
				
	/* 
	 * Darwin defines the sizes for ipc_perm members
	 * as 2 bytes; BSM defines 4. So we copy in a 0 first.
	 */
	ADD_U_CHAR(dptr, AU_IPCPERM_TOKEN);

	ADD_U_INT32(dptr, perm->uid);
	ADD_U_INT32(dptr, perm->gid);
	ADD_U_INT32(dptr, perm->cuid);
	ADD_U_INT32(dptr, perm->cgid);

	ADD_U_INT16(dptr, pad0);
	ADD_U_INT16(dptr, perm->mode);

	ADD_U_INT16(dptr, pad0);
	ADD_U_INT16(dptr, perm->_seq);

	ADD_U_INT16(dptr, pad0);
	ADD_U_INT16(dptr, perm->_key);

	return t;
}


/*
 * token ID                1 byte
 * port IP address         2 bytes
 */
token_t *au_to_iport(u_int16_t iport)
{
	token_t *t;
	u_char *dptr;
		

	GET_TOKEN_AREA(t, dptr, 3);
	if(t == NULL) {
		return NULL;
	}

	ADD_U_CHAR(dptr, AU_IPORT_TOKEN);
	ADD_U_INT16(dptr, iport);
										 
	return t;
}


/*
 * token ID                1 byte
 * size 				   2 bytes
 * data                    size bytes
 */
token_t *au_to_opaque(char *data, u_int16_t bytes)
{
	token_t *t;
	u_char *dptr;
			 
	if((data == NULL) || (bytes <= 0)) {
		return NULL;
	}
 
	GET_TOKEN_AREA(t, dptr, bytes + 3);
	if(t == NULL) {
		return NULL;
	}
 
	ADD_U_CHAR(dptr, AU_OPAQUE_TOKEN);
	ADD_U_INT16(dptr, bytes);
	ADD_MEM(dptr, data, bytes);
 
	return t;
}

/*
 * Kernel version of the add file token function, where the time value 
 * is passed in as an additional parameter.
 * token ID                	1 byte
 * seconds of time		4 bytes
 * milliseconds of time		4 bytes
 * file name len		2 bytes
 * file pathname		N bytes + 1 terminating NULL byte   	
 */
token_t *kau_to_file(const char *file, const struct timeval *tv)
{
	token_t *t;
	u_char *dptr;
	u_int16_t filelen;
	u_int32_t timems = tv->tv_usec/1000; /* We need time in ms */

	if(file == NULL) {
		return NULL;
	}
	filelen = strlen(file);
 
	GET_TOKEN_AREA(t, dptr, filelen + 12);
	if(t == NULL) {
		return NULL;
	}
		
	filelen += 1;

	ADD_U_CHAR(dptr, AU_FILE_TOKEN);

	/* Add the timestamp */
	ADD_U_INT32(dptr, tv->tv_sec);
	ADD_U_INT32(dptr, timems); 

	ADD_U_INT16(dptr, filelen);
	ADD_STRING(dptr, file, filelen);
	 
	return t;

}

/*
 * token ID                1 byte
 * text length             2 bytes
 * text                    N bytes + 1 terminating NULL byte
 */
token_t *au_to_text(const char *text)
{
	token_t *t;
	u_char *dptr;
	u_int16_t textlen;
	
	if(text == NULL) {
		return NULL;
	}
	textlen = strlen(text);

	GET_TOKEN_AREA(t, dptr, textlen + 4);
	if(t == NULL) {
		return NULL;
	}

	textlen += 1;
						 
	ADD_U_CHAR(dptr, AU_TEXT_TOKEN);
	ADD_U_INT16(dptr, textlen);
	ADD_STRING(dptr, text, textlen);

	return t;
}

/*
 * token ID                1 byte
 * path length             2 bytes
 * path                    N bytes + 1 terminating NULL byte
 */
token_t *au_to_path(char *text)
{
	token_t *t;
	u_char *dptr;
	u_int16_t textlen;
	
	if(text == NULL) {
		return NULL;
	}
	textlen = strlen(text);

	GET_TOKEN_AREA(t, dptr, textlen + 4);
	if(t == NULL) {
		return NULL;
	}

	textlen += 1;
						 
	ADD_U_CHAR(dptr, AU_PATH_TOKEN);
	ADD_U_INT16(dptr, textlen);
	ADD_STRING(dptr, text, textlen);

	return t;
}

/*
 * token ID                1 byte
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
 *   machine address       4 bytes
 */
token_t *au_to_process32(au_id_t auid, uid_t euid, gid_t egid,
		               uid_t ruid, gid_t rgid, pid_t pid,
		               au_asid_t sid, au_tid_t *tid)
{
	token_t *t;
	u_char *dptr;
	
	if(tid == NULL) {
		return NULL;
	}

	GET_TOKEN_AREA(t, dptr, 37);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_PROCESS_32_TOKEN);
	ADD_U_INT32(dptr, auid);
	ADD_U_INT32(dptr, euid);
	ADD_U_INT32(dptr, egid);
	ADD_U_INT32(dptr, ruid);
	ADD_U_INT32(dptr, rgid);
	ADD_U_INT32(dptr, pid);
	ADD_U_INT32(dptr, sid);
	ADD_U_INT32(dptr, tid->port);
	ADD_U_INT32(dptr, tid->machine);
	 
	return t;
}

token_t *au_to_process64(__unused au_id_t auid, 
			 __unused uid_t euid,
			 __unused gid_t egid,
			 __unused uid_t ruid,
			 __unused gid_t rgid,
			 __unused pid_t pid,
			 __unused au_asid_t sid,
			 __unused au_tid_t *tid)
{
		return NULL;
	}

token_t *au_to_process(au_id_t auid, uid_t euid, gid_t egid,
		               uid_t ruid, gid_t rgid, pid_t pid,
		               au_asid_t sid, au_tid_t *tid)
{
	return au_to_process32(auid, euid, egid, ruid, rgid, pid,
			sid, tid);
}


/*
 * token ID                1 byte
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
 *   address type-len      4 bytes
 *   machine address      16 bytes
 */
token_t *au_to_process32_ex(au_id_t auid, uid_t euid, gid_t egid,
		               	   uid_t ruid, gid_t rgid, pid_t pid,
		                   au_asid_t sid, au_tid_addr_t *tid)
{
	token_t *t;
	u_char *dptr;
	
	if(tid == NULL) {
		return NULL;
	}

	GET_TOKEN_AREA(t, dptr, 53);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_PROCESS_32_EX_TOKEN);
	ADD_U_INT32(dptr, auid);
	ADD_U_INT32(dptr, euid);
	ADD_U_INT32(dptr, egid);
	ADD_U_INT32(dptr, ruid);
	ADD_U_INT32(dptr, rgid);
	ADD_U_INT32(dptr, pid);
	ADD_U_INT32(dptr, sid);
	ADD_U_INT32(dptr, tid->at_port);
	ADD_U_INT32(dptr, tid->at_type);
	ADD_U_INT32(dptr, tid->at_addr[0]);
	ADD_U_INT32(dptr, tid->at_addr[1]);
	ADD_U_INT32(dptr, tid->at_addr[2]);
	ADD_U_INT32(dptr, tid->at_addr[3]);
	 
	return t;
}

token_t *au_to_process64_ex(
	__unused au_id_t auid,
	__unused uid_t euid,
	__unused gid_t egid,
	__unused uid_t ruid,
	__unused gid_t rgid,
	__unused pid_t pid,
	__unused au_asid_t sid,
	__unused au_tid_addr_t *tid)
{
	return NULL;
}
						 
token_t *au_to_process_ex(au_id_t auid, uid_t euid, gid_t egid,
		               	   uid_t ruid, gid_t rgid, pid_t pid,
		                   au_asid_t sid, au_tid_addr_t *tid)
{
	return au_to_process32_ex(auid, euid, egid, ruid, rgid, 
			pid, sid, tid);
}

/*
 * token ID                1 byte
 * error status            1 byte
 * return value            4 bytes/8 bytes (32-bit/64-bit value)
 */
token_t *au_to_return32(char status, u_int32_t ret)
{
	token_t *t;
	u_char *dptr;
	

	GET_TOKEN_AREA(t, dptr, 6);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_RETURN_32_TOKEN);
	ADD_U_CHAR(dptr, status);
	ADD_U_INT32(dptr, ret);

	return t;
}

token_t *au_to_return64(char status, u_int64_t ret)
{
	token_t *t;
	u_char *dptr;
	

	GET_TOKEN_AREA(t, dptr, 10);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_RETURN_64_TOKEN);
	ADD_U_CHAR(dptr, status);
	ADD_U_INT64(dptr, ret);

	return t;
}

token_t *au_to_return(char status, u_int32_t ret)
{
	return au_to_return32(status, ret);
}

/*
 * token ID                1 byte
 * sequence number         4 bytes
 */
token_t *au_to_seq(u_int32_t audit_count)
{
	token_t *t;
	u_char *dptr;
	

	GET_TOKEN_AREA(t, dptr, 5);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_SEQ_TOKEN);
	ADD_U_INT32(dptr, audit_count);

	return t;
}

/*
 * token ID                1 byte
 * socket type             2 bytes
 * local port              2 bytes
 * local Internet address  4 bytes
 * remote port             2 bytes
 * remote Internet address 4 bytes
 */
token_t *au_to_socket(__unused struct socket *so)
{
	return NULL;
}

/*
 * Kernel-specific version of the above function.
 */
token_t *kau_to_socket(struct socket_au_info *soi)
{
	token_t *t;
	u_char *dptr;
	u_int16_t so_type;

	if(soi == NULL) {
		return NULL;
	}	

	GET_TOKEN_AREA(t, dptr, 15);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_SOCK_TOKEN);
	/* Coerce the socket type into a short value */
	so_type = soi->so_type;
	ADD_U_INT16(dptr, so_type);
	ADD_U_INT16(dptr, soi->so_lport);
	ADD_U_INT32(dptr, soi->so_laddr);
	ADD_U_INT16(dptr, soi->so_rport);
	ADD_U_INT32(dptr, soi->so_raddr);

	return t;
}

/*
 * token ID                1 byte
 * socket type             2 bytes
 * local port              2 bytes
 * address type/length     4 bytes
 * local Internet address  4 bytes/16 bytes (IPv4/IPv6 address)
 * remote port             4 bytes
 * address type/length     4 bytes
 * remote Internet address 4 bytes/16 bytes (IPv4/IPv6 address)
 */
token_t *au_to_socket_ex_32(
	__unused u_int16_t lp,
	__unused u_int16_t rp, 
	__unused struct sockaddr *la,
	__unused struct sockaddr *ra)
{
	return NULL;
}

token_t *au_to_socket_ex_128(
	__unused u_int16_t lp,
	__unused u_int16_t rp, 
	__unused struct sockaddr *la,
	__unused struct sockaddr *ra)
{
	return NULL;
}

/*
 * token ID                1 byte
 * socket family           2 bytes
 * local port              2 bytes
 * socket address          4 bytes
 */
token_t *au_to_sock_inet32(struct sockaddr_in *so)
{
	token_t *t;
	u_char *dptr;

	if(so == NULL) {
		return NULL;
	}	

	GET_TOKEN_AREA(t, dptr, 9);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_SOCK_INET_32_TOKEN);
	/* In Darwin, sin_family is one octet, but BSM defines the token
	 * to store two. So we copy in a 0 first.
	 */
	ADD_U_CHAR(dptr, 0);
	ADD_U_CHAR(dptr, so->sin_family);
	ADD_U_INT16(dptr, so->sin_port);
	ADD_U_INT32(dptr, so->sin_addr.s_addr);

	return t;

}

token_t *au_to_sock_inet128(struct sockaddr_in6 *so)
{
	token_t *t;
	u_char *dptr;

	if(so == NULL) {
		return NULL;
	}	

	GET_TOKEN_AREA(t, dptr, 21);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_SOCK_INET_128_TOKEN);
	/* In Darwin, sin_family is one octet, but BSM defines the token
	 * to store two. So we copy in a 0 first.
	 */
	ADD_U_CHAR(dptr, 0);
	ADD_U_CHAR(dptr, so->sin6_family);
	ADD_U_INT16(dptr, so->sin6_port);
	ADD_U_INT32(dptr, so->sin6_addr.__u6_addr.__u6_addr32[0]);
	ADD_U_INT32(dptr, so->sin6_addr.__u6_addr.__u6_addr32[1]);
	ADD_U_INT32(dptr, so->sin6_addr.__u6_addr.__u6_addr32[2]);
	ADD_U_INT32(dptr, so->sin6_addr.__u6_addr.__u6_addr32[3]);

	return t;
	

		
}

/*
 * token ID                1 byte
 * socket family           2 bytes
 * path                    104 bytes
 */
token_t *au_to_sock_unix(struct sockaddr_un *so)
{
	token_t *t;
	u_char *dptr;

	if(so == NULL) {
		return NULL;
	}	

	GET_TOKEN_AREA(t, dptr, 107);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_SOCK_UNIX_TOKEN);
	/* BSM token has two bytes for family */
	ADD_U_CHAR(dptr, 0);
	ADD_U_CHAR(dptr, so->sun_family);
	ADD_STRING(dptr, so->sun_path, strlen(so->sun_path));

	return t;

}

token_t *au_to_sock_inet(struct sockaddr_in *so)
{
	return au_to_sock_inet32(so);
}

/*
 * token ID                1 byte
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
 *   machine address       4 bytes
 */
token_t *au_to_subject32(au_id_t auid, uid_t euid, gid_t egid,
						uid_t ruid, gid_t rgid, pid_t pid,
						au_asid_t sid, au_tid_t *tid)
{
	token_t *t;
	u_char *dptr;
	
	if(tid == NULL) {
		return NULL;
	}

	GET_TOKEN_AREA(t, dptr, 37);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_SUBJECT_32_TOKEN);
	ADD_U_INT32(dptr, auid);
	ADD_U_INT32(dptr, euid);
	ADD_U_INT32(dptr, egid);
	ADD_U_INT32(dptr, ruid);
	ADD_U_INT32(dptr, rgid);
	ADD_U_INT32(dptr, pid);
	ADD_U_INT32(dptr, sid);
	ADD_U_INT32(dptr, tid->port);
	ADD_U_INT32(dptr, tid->machine);
	 
	return t;
}

token_t *au_to_subject64(
	__unused au_id_t auid,
	__unused uid_t euid,
	__unused gid_t egid,
	__unused uid_t ruid,
	__unused gid_t rgid,
	__unused pid_t pid,
	__unused au_asid_t sid,
	__unused au_tid_t *tid)
{
		return NULL;
	}
						 
token_t *au_to_subject(au_id_t auid, uid_t euid, gid_t egid,
						uid_t ruid, gid_t rgid, pid_t pid,
						au_asid_t sid, au_tid_t *tid)
{
	return au_to_subject32(auid, euid, egid, ruid, rgid,
			pid, sid, tid); 

}

/*
 * token ID                1 byte
 * audit ID                4 bytes
 * effective user ID       4 bytes
 * effective group ID      4 bytes
 * real user ID            4 bytes
 * real group ID           4 bytes
 * process ID              4 bytes
 * session ID              4 bytes
 * terminal ID
 *   port ID               4 bytes/8 bytes (32-bit/64-bit value)
 *   address type/length   4 bytes
 *   machine address      16 bytes
 */
token_t *au_to_subject32_ex(au_id_t auid, uid_t euid,
	                       gid_t egid, uid_t ruid, gid_t rgid, pid_t pid,
		                   au_asid_t sid, au_tid_addr_t *tid)
{
	token_t *t;
	u_char *dptr;
	
	if(tid == NULL) {
		return NULL;
	}

	GET_TOKEN_AREA(t, dptr, 53);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_SUBJECT_32_EX_TOKEN);
	ADD_U_INT32(dptr, auid);
	ADD_U_INT32(dptr, euid);
	ADD_U_INT32(dptr, egid);
	ADD_U_INT32(dptr, ruid);
	ADD_U_INT32(dptr, rgid);
	ADD_U_INT32(dptr, pid);
	ADD_U_INT32(dptr, sid);
	ADD_U_INT32(dptr, tid->at_port);
	ADD_U_INT32(dptr, tid->at_type);
	ADD_U_INT32(dptr, tid->at_addr[0]);
	ADD_U_INT32(dptr, tid->at_addr[1]);
	ADD_U_INT32(dptr, tid->at_addr[2]);
	ADD_U_INT32(dptr, tid->at_addr[3]);
	 
	return t;
}

token_t *au_to_subject64_ex(
	__unused au_id_t auid,
	__unused uid_t euid,
	__unused gid_t egid,
	__unused uid_t ruid,
	__unused gid_t rgid,
	__unused pid_t pid,
	__unused au_asid_t sid,
	__unused au_tid_addr_t *tid)
{
	return NULL;
}

token_t *au_to_subject_ex(au_id_t auid, uid_t euid,
	                       gid_t egid, uid_t ruid, gid_t rgid, pid_t pid,
		                   au_asid_t sid, au_tid_addr_t *tid)
{
	return au_to_subject32_ex(auid, euid, egid, ruid, rgid,
			pid, sid, tid); 

}

/*
 * token ID				1 byte
 * count				4 bytes
 * text					count null-terminated strings 
 */
token_t *au_to_exec_args(const char **args)
{
	token_t *t;
	u_char *dptr;
	const char *nextarg;
	int i, count = 0;
	size_t totlen = 0;
	
	if(args == NULL) {
		return NULL;
	}
	
	nextarg = *args;
	
	while(nextarg != NULL) {
		int nextlen;
		
		nextlen = strlen(nextarg);
		totlen += nextlen + 1;
		count++;
		nextarg = *(args + count);
	}
	
	
	GET_TOKEN_AREA(t, dptr, 5 + totlen);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_EXEC_ARG_TOKEN);
	ADD_U_INT32(dptr, count);

	for(i =0; i< count; i++) {
		nextarg = *(args + i);
		ADD_MEM(dptr, nextarg, strlen(nextarg) + 1);
	}
	 
	return t;
}


/*
 * token ID				1 byte
 * count				4 bytes
 * text					count null-terminated strings 
 */
token_t *au_to_exec_env(const char **env)
{
	token_t *t;
	u_char *dptr;
	int i, count = 0;
	size_t totlen = 0;
	const char *nextenv;
	
	if(env == NULL) {
		return NULL;
	}
	
	nextenv = *env;
	
	while(nextenv != NULL) {
		int nextlen;
		
		nextlen = strlen(nextenv);
		totlen += nextlen + 1;
		count++;
		nextenv = *(env + count);
	}
	
	
	GET_TOKEN_AREA(t, dptr, 5 + totlen);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_EXEC_ENV_TOKEN);
	ADD_U_INT32(dptr, count);

	for(i =0; i< count; i++) {
		nextenv = *(env + i);
		ADD_MEM(dptr, nextenv, strlen(nextenv) + 1);
	}
	 
	return t;
}


/*
 * Kernel version of the BSM header token functions. These versions take 
 * a timespec struct as an additional parameter in order to obtain the
 * create time value for the BSM audit record.
 * token ID                1 byte
 * record byte count       4 bytes
 * version #               1 byte    [2]
 * event type              2 bytes
 * event modifier          2 bytes
 * seconds of time         4 bytes/8 bytes (32-bit/64-bit value)
 * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value)
 */
token_t *kau_to_header32(const struct timespec *ctime, int rec_size, 
			  au_event_t e_type, au_emod_t e_mod)
{
	token_t *t;
	u_char *dptr;
	u_int32_t timems = ctime->tv_nsec/1000000; /* We need time in ms */
	
	GET_TOKEN_AREA(t, dptr, 18);
	if(t == NULL) {
		return NULL;
	}
	
	ADD_U_CHAR(dptr, AU_HEADER_32_TOKEN);
	ADD_U_INT32(dptr, rec_size);
	ADD_U_CHAR(dptr, HEADER_VERSION);
	ADD_U_INT16(dptr, e_type);
	ADD_U_INT16(dptr, e_mod);

	/* Add the timestamp */
	ADD_U_INT32(dptr, ctime->tv_sec);
	ADD_U_INT32(dptr, timems);

	return t;
}

token_t *kau_to_header64(
	__unused const struct timespec *ctime,
	__unused int rec_size, 
	__unused au_event_t e_type,
	__unused au_emod_t e_mod)
{
	return NULL;
}
						 
token_t *kau_to_header(const struct timespec *ctime, int rec_size, 
			  au_event_t e_type, au_emod_t e_mod)
{
	return kau_to_header32(ctime, rec_size, e_type, e_mod);
}

/*
 * token ID                1 byte
 * trailer magic number    2 bytes
 * record byte count       4 bytes
 */
token_t *au_to_trailer(int rec_size)
{
	token_t *t;
	u_char *dptr;
	u_int16_t magic = TRAILER_PAD_MAGIC;
	

	GET_TOKEN_AREA(t, dptr, 7);
	if(t == NULL) {
		return NULL;
	}
						 
	ADD_U_CHAR(dptr, AU_TRAILER_TOKEN);
	ADD_U_INT16(dptr, magic);
	ADD_U_INT32(dptr, rec_size);

	return t;
		
}