auditd_plugins/syslog/systoken.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright 2012 Milan Jurik. All rights reserved.
 */


/*
 * Token processing for sysupd; each token function does one
 * or more operations.  All of them bump the buffer pointer
 * to the next token; some of them extract one or more data
 * from the token.
 */

#define DEBUG   0
#if DEBUG
#define DPRINT(x) { (void) fprintf x; }
#else
#define DPRINT(x)
#endif

#include <locale.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <bsm/libbsm.h>
#include <sys/tsol/label.h>
#include "toktable.h"   /* ../praudit */
#include "sysplugin.h"
#include "systoken.h"
#include <audit_plugin.h>

#if DEBUG
static FILE *dbfp;          /* debug file */
#endif

static void anchor_path(char *);
static size_t   collapse_path(char *, size_t);
static void get_bytes_to_string(parse_context_t *, size_t *, char **,
            size_t);
static void skip_bytes(parse_context_t *);
static void skip_string(parse_context_t *);
static int  xgeneric(parse_context_t *);

/*
 * Process a token in a record to (1) extract data of interest if any
 * and (2) point to the next token.
 *
 * returns 0 if ok.  + or - values are of debug value:
 *
 *  returns -1 if the parsing of the token failed.
 *
 *  returns +<previous id> if the token is not found.  This value
 *  is used to help determine where in the record the problem
 *  occurred.  The common failure case is that the parsing of
 *  token M is incorrect and the buffer pointer ends up pointing
 *  to garbage.  The positive error value of M *may* be the id of
 *  the incorrectly parsed token.
 */

int
parse_token(parse_context_t *ctx)
{
    char        tokenid;
    static char prev_tokenid = -1;
    int     rc;

#if DEBUG
    static boolean_t    first = 1;

    if (first) {
        dbfp = __auditd_debug_file_open();
        first = 0;
    }
#endif

    adrm_char(&(ctx->adr), &tokenid, 1);

    if ((tokenid > 0) && (tokentable[tokenid].func != NOFUNC)) {
        rc = (*tokentable[tokenid].func)(ctx);
        prev_tokenid = tokenid;
        return (rc);
    }
    /* here if token id is not in table */
    return (prev_tokenid);
}

/* There should not be any file tokens in the middle of a record */

/* ARGSUSED */
int
file_token(parse_context_t *ctx)
{

    return (-1);
}

/* ARGSUSED */
int
file64_token(parse_context_t *ctx)
{
    return (-1);
}

static void
common_header(parse_context_t *ctx)
{
    adrm_u_int32(&(ctx->adr), &(ctx->out.sf_reclen), 1);
    ctx->adr.adr_now += sizeof (char);      /* version number */
    adrm_u_short(&(ctx->adr), &(ctx->out.sf_eventid), 1);
    ctx->adr.adr_now += sizeof (short);     /* modifier */
}

/*
 * 32bit header
 */
int
header_token(parse_context_t *ctx)
{
    common_header(ctx);
    ctx->adr.adr_now += 2 * sizeof (int32_t);   /* time */

    return (0);
}


int
header32_ex_token(parse_context_t *ctx)
{
    int32_t type;

    common_header(ctx);

    adrm_int32(&(ctx->adr), &type, 1);      /* tid type */
    ctx->adr.adr_now += type * sizeof (char);   /* ip address */

    ctx->adr.adr_now += 2 * sizeof (int32_t);   /* time */

    return (0);
}


int
header64_ex_token(parse_context_t *ctx)
{
    int32_t type;

    common_header(ctx);

    adrm_int32(&(ctx->adr), &type, 1);      /* tid type */
    ctx->adr.adr_now += type * sizeof (char);   /* ip address */

    ctx->adr.adr_now += 2 * sizeof (int64_t);   /* time */

    return (0);
}


int
header64_token(parse_context_t *ctx)
{
    common_header(ctx);

    ctx->adr.adr_now += 2 * sizeof (int64_t);   /* time */

    return (0);
}


/*
 * ======================================================
 *  The following token processing routines return
 *  0: if parsed ok
 * -1: can't parse and can't determine location of next token
 * ======================================================
 */

int
trailer_token(parse_context_t *ctx)
{
    short   magic_number;
    uint32_t bytes;

    adrm_u_short(&(ctx->adr), (ushort_t *)&magic_number, 1);
    if (magic_number != AUT_TRAILER_MAGIC)
        return (-1);

    adrm_u_int32(&(ctx->adr), &bytes, 1);

    return (0);
}


/*
 * Format of arbitrary data token:
 *  arbitrary data token id &(ctx->adr) char
 *  how to print        adr_char
 *  basic unit      adr_char
 *  unit count      adr_char, specifying number of units of
 *  data items      depends on basic unit
 *
 */
int
arbitrary_data_token(parse_context_t *ctx)
{
    char    basic_unit, unit_count;

    ctx->adr.adr_now += sizeof (char); /* how to print */

    adrm_char(&(ctx->adr), &basic_unit, 1);
    adrm_char(&(ctx->adr), &unit_count, 1);

    switch (basic_unit) {
    case AUR_CHAR: /* same as AUR_BYTE */
        ctx->adr.adr_now += unit_count * sizeof (char);
        break;
    case AUR_SHORT:
        ctx->adr.adr_now += unit_count * sizeof (short);
        break;
    case AUR_INT32: /* same as AUR_INT */
        ctx->adr.adr_now += unit_count * sizeof (int32_t);
        break;
    case AUR_INT64:
        ctx->adr.adr_now += unit_count * sizeof (int64_t);
        break;
    default:
        return (-1);
    }
    return (0);
}


/*
 * Format of opaque token:
 *  opaque token id     adr_char
 *  size            adr_short
 *  data            adr_char, size times
 *
 */
int
opaque_token(parse_context_t *ctx)
{
    skip_bytes(ctx);
    return (0);
}


/*
 * Format of return32 value token:
 *  return value token id   adr_char
 *  error number        adr_char
 *  return value        adr_u_int32
 *
 */
int
return_value32_token(parse_context_t *ctx)
{
    char        errnum;

    adrm_char(&(ctx->adr), &errnum, 1); /* pass / fail */
    ctx->adr.adr_now += sizeof (int32_t);   /* error code */

    ctx->out.sf_pass = (errnum == 0) ? 1 : -1;

    return (0);
}

/*
 * Format of return64 value token:
 *  return value token id   adr_char
 *  error number        adr_char
 *  return value        adr_u_int64
 *
 */
int
return_value64_token(parse_context_t *ctx)
{
    char        errnum;

    adrm_char(&(ctx->adr), &errnum, 1); /* pass / fail */
    ctx->adr.adr_now += sizeof (int64_t);   /* error code */

    ctx->out.sf_pass = (errnum == 0) ? 1 : -1;

    return (0);
}


/*
 * Format of sequence token:
 *  sequence token id   adr_char
 *  audit_count     int32_t
 *
 */
int
sequence_token(parse_context_t *ctx)
{
    adrm_int32(&(ctx->adr), &(ctx->out.sf_sequence), 1);
    return (0);
}


/*
 * Format of text token:
 *  text token id       adr_char
 *  text            adr_string
 */
int
text_token(parse_context_t *ctx)
{
    ushort_t    len;
    size_t      separator_sz = 0;
    char        *bp;    /* pointer to output string */

    adrm_u_short(&(ctx->adr), &len, 1);

    if (ctx->out.sf_textlen > 0)
        separator_sz = sizeof (AU_TEXT_NAME) - 1;

    DPRINT((dbfp, "text_token: start length=%d, add length=%d+%d\n",
        ctx->out.sf_textlen, (size_t)len, separator_sz));

    ctx->out.sf_text = realloc(ctx->out.sf_text,
        ctx->out.sf_textlen + (size_t)len + separator_sz);

    if (ctx->out.sf_text == NULL)
        return (-1);

    bp = ctx->out.sf_text;

    if (ctx->out.sf_textlen != 0) { /* concatenation? */
        bp += ctx->out.sf_textlen;
        bp += strlcpy(bp, AU_TEXT_NAME, separator_sz + 1);
        ctx->out.sf_textlen += separator_sz;
        DPRINT((dbfp, "text_token: l is %d\n%s\n", ctx->out.sf_textlen,
            ctx->out.sf_text));
    }
    adrm_char(&(ctx->adr), bp, len);
    len--;      /* includes EOS */
    *(bp + len) = '\0';

    ctx->out.sf_textlen += len;
    DPRINT((dbfp, "text_token: l=%d\n%s\n", ctx->out.sf_textlen,
        ctx->out.sf_text));

    return (0);
}

/*
 * Format of tid token:
 *  ip token id adr_char
 *  terminal type   adr_char
 *  terminal type = AU_IPADR:
 *  remote port:    ushort
 *  local port: ushort
 *  IP type:    int32 -- AU_IPv4 or AU_IPv6
 *  address:    int32 if IPv4, else 4 * int32
 */
int
tid_token(parse_context_t *ctx)
{
    uchar_t     type;
    int32_t     ip_length;

    adrm_char(&(ctx->adr), (char *)&type, 1);

    switch (type) {
    default:
        return (-1);    /* other than IP type is not implemented */
    case AU_IPADR:
        ctx->adr.adr_now += 2 * sizeof (ushort_t);
        adrm_int32(&(ctx->adr), &ip_length, 1);
        ctx->adr.adr_now += ip_length;
        break;
    }
    return (0);
}

/*
 * Format of ip_addr token:
 *  ip token id adr_char
 *  address     adr_int32
 *
 */
int
ip_addr_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (int32_t);

    return (0);
}

/*
 * Format of ip_addr_ex token:
 *  ip token id adr_char
 *  ip type     adr_int32
 *  ip address  adr_u_char*type
 *
 */
int
ip_addr_ex_token(parse_context_t *ctx)
{
    int32_t type;

    adrm_int32(&(ctx->adr), &type, 1);      /* ip type */
    ctx->adr.adr_now += type * sizeof (uchar_t);    /* ip address */

    return (0);
}

/*
 * Format of ip token:
 *  ip header token id  adr_char
 *  version         adr_char
 *  type of service     adr_char
 *  length          adr_short
 *  id          adr_u_short
 *  offset          adr_u_short
 *  ttl         adr_char
 *  protocol        adr_char
 *  checksum        adr_u_short
 *  source address      adr_int32
 *  destination address adr_int32
 *
 */
int
ip_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += (2 * sizeof (char)) + (3 * sizeof (short)) +
        (2 * sizeof (char)) + sizeof (short) + (2 * sizeof (int32_t));
    return (0);
}


/*
 * Format of iport token:
 *  ip port address token id    adr_char
 *  port address            adr_short
 *
 */
int
iport_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (short);

    return (0);
}


/*
 * Format of groups token:
 *  group token id      adr_char
 *  group list      adr_int32, 16 times
 *
 */
int
group_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += 16 * sizeof (int32_t);

    return (0);
}

/*
 * Format of newgroups token:
 *  group token id      adr_char
 *  number of groups    adr_short
 *  group list      adr_int32, "number" times
 *
 */
int
newgroup_token(parse_context_t *ctx)
{
    short int   number;

    adrm_short(&(ctx->adr), &number, 1);

    ctx->adr.adr_now += number * sizeof (int32_t);

    return (0);
}

/*
 * Format of argument32 token:
 *  argument token id   adr_char
 *  argument number     adr_char
 *  argument value      adr_int32
 *  argument description    adr_string
 *
 */
int
argument32_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (char) + sizeof (int32_t);
    skip_bytes(ctx);

    return (0);
}

/*
 * Format of argument64 token:
 *  argument token id   adr_char
 *  argument number     adr_char
 *  argument value      adr_int64
 *  argument description    adr_string
 *
 */
int
argument64_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (char) + sizeof (int64_t);
    skip_bytes(ctx);

    return (0);
}

/*
 * Format of acl token:
 *  acl token id        adr_char
 *  type            adr_u_int32
 *  value           adr_u_int32
 *  mode            adr_u_int32
 */
int
acl_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += 3 * sizeof (uint32_t);

    return (0);
}

/*
 * Format of ace token:
 *  ace token id        adr_char
 *  id          adr_u_int32
 *  access_mask     adr_u_int32
 *  flags           adr_u_short
 *  type            adr_u_short
 */
int
ace_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += 2 * sizeof (uint32_t) + 2 * sizeof (ushort_t);

    return (0);
}

/*
 * Format of attribute token: (old pre SunOS 5.7 format)
 *  attribute token id  adr_char
 *  mode            adr_int32 (printed in octal)
 *  uid         adr_int32
 *  gid         adr_int32
 *  file system id      adr_int32
 *  node id         adr_int32
 *  device          adr_int32
 *
 */
int
attribute_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += 6 * sizeof (int32_t);

    return (0);
}

/*
 * Format of attribute32 token:
 *  attribute token id  adr_char
 *  mode            adr_int32 (printed in octal)
 *  uid         adr_int32
 *  gid         adr_int32
 *  file system id      adr_int32
 *  node id         adr_int64
 *  device          adr_int32
 *
 */
int
attribute32_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += (5 * sizeof (int32_t)) + sizeof (int64_t);

    return (0);
}

/*
 * Format of attribute64 token:
 *  attribute token id  adr_char
 *  mode            adr_int32 (printed in octal)
 *  uid         adr_int32
 *  gid         adr_int32
 *  file system id      adr_int32
 *  node id         adr_int64
 *  device          adr_int64
 *
 */
int
attribute64_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += (4 * sizeof (int32_t)) + (2 * sizeof (int64_t));

    return (0);
}


/*
 * Format of command token:
 *  attribute token id  adr_char
 *  argc            adr_short
 *  argv len        adr_short   variable amount of argv len
 *  argv text       argv len    and text
 *  .
 *  .
 *  .
 *  envp count      adr_short   variable amount of envp len
 *  envp len        adr_short   and text
 *  envp text       envp        len
 *  .
 *  .
 *  .
 *
 */
int
cmd_token(parse_context_t *ctx)
{
    short   cnt;
    short   i;

    adrm_short(&(ctx->adr), &cnt, 1);

    for (i = 0; i < cnt; i++)
        skip_bytes(ctx);

    adrm_short(&(ctx->adr), &cnt, 1);

    for (i = 0; i < cnt; i++)
        skip_bytes(ctx);

    return (0);
}


/*
 * Format of exit token:
 *  attribute token id  adr_char
 *  return value        adr_int32
 *  errno           adr_int32
 *
 */
int
exit_token(parse_context_t *ctx)
{
    int32_t retval;

    adrm_int32(&(ctx->adr), &retval, 1);
    ctx->adr.adr_now += sizeof (int32_t);

    ctx->out.sf_pass = (retval == 0) ? 1 : -1;
    return (0);
}

/*
 * Format of exec_args token:
 *  attribute token id  adr_char
 *  count value     adr_int32
 *  strings         null terminated strings
 *
 */
int
exec_args_token(parse_context_t *ctx)
{
    int count, i;

    adrm_int32(&(ctx->adr), (int32_t *)&count, 1);
    for (i = 1; i <= count; i++) {
        skip_string(ctx);
    }

    return (0);
}

/*
 * Format of exec_env token:
 *  attribute token id  adr_char
 *  count value     adr_int32
 *  strings         null terminated strings
 *
 */
int
exec_env_token(parse_context_t *ctx)
{
    int count, i;

    adrm_int32(&(ctx->adr), (int32_t *)&count, 1);
    for (i = 1; i <= count; i++)
        skip_string(ctx);

    return (0);
}

/*
 * Format of liaison token:
 */
int
liaison_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (int32_t);

    return (0);
}


/*
 * Format of path token:
 *  path                adr_string
 */
int
path_token(parse_context_t *ctx)
{
    get_bytes_to_string(ctx, &(ctx->out.sf_pathlen), &(ctx->out.sf_path),
        0);
    if (ctx->out.sf_path == NULL)
        return (-1);
    /*
     * anchor the path because collapse_path needs it
     */
    if (*(ctx->out.sf_path) != '/') {
        anchor_path(ctx->out.sf_path);
        ctx->out.sf_pathlen++;
    }
    ctx->out.sf_pathlen = collapse_path(ctx->out.sf_path,
        ctx->out.sf_pathlen);

    return (0);
}

/*
 * path attr token / AUT_XATPATH
 *
 * Format of path attr token:
 *  token id        adr_char
 *  string count        adr_int32
 *  strings         adr_string
 *
 * the sequence of strings is converted to a single string with
 * a blank separator replacing the EOS for all but the last
 * string.
 */
int
path_attr_token(parse_context_t *ctx)
{
    int count, i;
    int last_len;
    size_t  offset;
    char    *p;

    adrm_int32(&(ctx->adr), &count, 1);

    offset = ctx->out.sf_atpathlen;
    p = ctx->adr.adr_now;
    for (i = 0; i <= count; i++) {
        last_len = strlen(p);
        ctx->out.sf_atpathlen += last_len + 1;
        p += last_len + 1;
    }
    ctx->out.sf_atpath = realloc(ctx->out.sf_atpath, ctx->out.sf_atpathlen);
    ctx->out.sf_atpath += offset;
    p = ctx->out.sf_atpath;     /* save for fix up, below */
    (void) memcpy(ctx->out.sf_atpath, ctx->adr.adr_now,
        ctx->out.sf_atpathlen - offset);
    ctx->out.sf_atpathlen--;

    /* fix up: replace each eos except the last with ' ' */

    for (i = 0; i < count; i++) {
        while (*p++ != '\0')
            ;
        *(p - 1) = ' ';
    }
    return (0);
}


/*
 * Format of System V IPC permission token:
 *  System V IPC permission token id    adr_char
 *  uid                 adr_int32
 *  gid                 adr_int32
 *  cuid                    adr_int32
 *  cgid                    adr_int32
 *  mode                    adr_int32
 *  seq                 adr_int32
 *  key                 adr_int32
 */
int
s5_IPC_perm_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += (7 * sizeof (int32_t));
    return (0);
}

static void
common_process(parse_context_t *ctx)
{
    int32_t ruid, rgid, egid, pid;
    uint32_t asid;

    adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_pauid), 1);
    adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_peuid), 1);
    adrm_int32(&(ctx->adr), &egid, 1);
    adrm_int32(&(ctx->adr), &ruid, 1);
    adrm_int32(&(ctx->adr), &rgid, 1);
    adrm_int32(&(ctx->adr), &pid, 1);
    adrm_u_int32(&(ctx->adr), &asid, 1);
}

/*
 * Format of process32 token:
 *  process token id    adr_char
 *  auid            adr_int32
 *  euid            adr_int32
 *  egid            adr_int32
 *  ruid            adr_int32
 *  rgid            adr_int32
 *  pid         adr_int32
 *  sid         adr_int32
 *  termid          adr_int32*2
 *
 */
int
process32_token(parse_context_t *ctx)
{
    int32_t port, machine;

    common_process(ctx);

    adrm_int32(&(ctx->adr), &port, 1);
    adrm_int32(&(ctx->adr), &machine, 1);

    return (0);
}

/*
 * Format of process32_ex token:
 *  process token id    adr_char
 *  auid            adr_int32
 *  euid            adr_int32
 *  egid            adr_int32
 *  ruid            adr_int32
 *  rgid            adr_int32
 *  pid         adr_int32
 *  sid         adr_int32
 *  termid
 *      port        adr_int32
 *      type        adr_int32
 *      ip address  adr_u_char*type
 *
 */
int
process32_ex_token(parse_context_t *ctx)
{
    int32_t port, type;
    uchar_t addr[16];

    common_process(ctx);

    adrm_int32(&(ctx->adr), &port, 1);
    adrm_int32(&(ctx->adr), &type, 1);
    adrm_u_char(&(ctx->adr), addr, type);

    return (0);
}

/*
 * Format of process64 token:
 *  process token id    adr_char
 *  auid            adr_int32
 *  euid            adr_int32
 *  egid            adr_int32
 *  ruid            adr_int32
 *  rgid            adr_int32
 *  pid         adr_int32
 *  sid         adr_int32
 *  termid          adr_int64+adr_int32
 *
 */
int
process64_token(parse_context_t *ctx)
{
    int64_t port;
    int32_t machine;

    common_process(ctx);

    adrm_int64(&(ctx->adr), &port, 1);
    adrm_int32(&(ctx->adr), &machine, 1);

    return (0);
}

/*
 * Format of process64_ex token:
 *  process token id    adr_char
 *  auid            adr_int32
 *  euid            adr_int32
 *  egid            adr_int32
 *  ruid            adr_int32
 *  rgid            adr_int32
 *  pid         adr_int32
 *  sid         adr_int32
 *  termid
 *      port        adr_int64
 *      type        adr_int32
 *      ip address  adr_u_char*type
 *
 */
int
process64_ex_token(parse_context_t *ctx)
{
    int64_t port;
    int32_t type;
    uchar_t addr[16];

    common_process(ctx);

    adrm_int64(&(ctx->adr), &port, 1);
    adrm_int32(&(ctx->adr), &type, 1);
    adrm_u_char(&(ctx->adr), addr, type);

    return (0);
}

/*
 * Format of System V IPC token:
 *  System V IPC token id   adr_char
 *  System V IPC type   adr_char
 *  object id       adr_int32
 *
 */
int
s5_IPC_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (char);
    ctx->adr.adr_now += sizeof (int32_t);

    return (0);
}


/*
 * Format of socket token:
 *  socket_type     adrm_short
 *  remote_port     adrm_short
 *  remote_inaddr       adrm_int32
 *
 */
int
socket_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += (2 * sizeof (short)) + sizeof (int32_t);

    return (0);
}


/*
 * Format of socket_ex token:
 *  socket_domain       adrm_short
 *  socket_type     adrm_short
 *  address_type        adrm_short
 *  local_port      adrm_short
 *  local_inaddr        adrm_u_char*address_type
 *  remote_port     adrm_short
 *  remote_inaddr       adrm_u_char*address_type
 *
 */
int
socket_ex_token(parse_context_t *ctx)
{
    short   ip_size;

    ctx->adr.adr_now += (2 * sizeof (short));
    adrm_short(&(ctx->adr), &ip_size, 1);

    ctx->adr.adr_now += sizeof (short) + (ip_size * sizeof (char)) +
        sizeof (short) + (ip_size * sizeof (char));
    return (0);
}


static void
common_subject(parse_context_t *ctx)
{
    int32_t ruid, rgid, pid;

    adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_auid), 1);
    adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_euid), 1);
    adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_egid), 1);
    adrm_int32(&(ctx->adr), &ruid, 1);
    adrm_int32(&(ctx->adr), &rgid, 1);
    adrm_int32(&(ctx->adr), &pid, 1);
    adrm_u_int32(&(ctx->adr), (uint32_t *)&(ctx->out.sf_asid), 1);
}

/*
 * Format of subject32 token:
 *  subject token id    adr_char
 *  auid            adr_int32
 *  euid            adr_int32
 *  egid            adr_int32
 *  ruid            adr_int32
 *  rgid            adr_int32
 *  pid         adr_int32
 *  sid         adr_int32
 *  termid          adr_int32*2
 *
 */
int
subject32_token(parse_context_t *ctx)
{
    int32_t port;   /* not used in output */

    common_subject(ctx);

    adrm_int32(&(ctx->adr), &port, 1);
    ctx->out.sf_tid.at_type = AU_IPv4;
    adrm_u_char(&(ctx->adr), (uchar_t *)&(ctx->out.sf_tid.at_addr[0]), 4);

    return (0);
}

/*
 * Format of subject32_ex token:
 *  subject token id    adr_char
 *  auid            adr_int32
 *  euid            adr_int32
 *  egid            adr_int32
 *  ruid            adr_int32
 *  rgid            adr_int32
 *  pid         adr_int32
 *  sid         adr_int32
 *  termid
 *      port        adr_int32
 *      type        adr_int32
 *      ip address  adr_u_char*type
 *
 */
int
subject32_ex_token(parse_context_t *ctx)
{
    int32_t port;   /* not used in output */

    common_subject(ctx);

    adrm_int32(&(ctx->adr), &port, 1);
    adrm_u_int32(&(ctx->adr), &(ctx->out.sf_tid.at_type), 1);
    adrm_u_char(&(ctx->adr), (uchar_t *)&(ctx->out.sf_tid.at_addr[0]),
        ctx->out.sf_tid.at_type);

    return (0);
}

/*
 * Format of subject64 token:
 *  subject token id    adr_char
 *  auid            adr_int32
 *  euid            adr_int32
 *  egid            adr_int32
 *  ruid            adr_int32
 *  rgid            adr_int32
 *  pid         adr_int32
 *  sid         adr_int32
 *  termid          adr_int64+adr_int32
 *
 */
int
subject64_token(parse_context_t *ctx)
{
    int64_t port;

    common_subject(ctx);

    adrm_int64(&(ctx->adr), &port, 1);
    ctx->out.sf_tid.at_type = AU_IPv4;
    adrm_u_char(&(ctx->adr), (uchar_t *)&(ctx->out.sf_tid.at_addr[0]), 4);

    return (0);
}

/*
 * Format of subject64_ex token:
 *  subject token id    adr_char
 *  auid            adr_int32
 *  euid            adr_int32
 *  egid            adr_int32
 *  ruid            adr_int32
 *  rgid            adr_int32
 *  pid         adr_int32
 *  sid         adr_int32
 *  termid
 *      port        adr_int64
 *      type        adr_int32
 *      ip address  adr_u_char*type
 *
 */
int
subject64_ex_token(parse_context_t *ctx)
{
    int64_t port;

    common_subject(ctx);

    adrm_int64(&(ctx->adr), &port, 1);
    adrm_u_int32(&(ctx->adr), &(ctx->out.sf_tid.at_type), 1);
    adrm_u_char(&(ctx->adr), (uchar_t *)&(ctx->out.sf_tid.at_addr[0]),
        ctx->out.sf_tid.at_type);

    return (0);
}


int
xatom_token(parse_context_t *ctx)
{
    skip_bytes(ctx);

    return (0);
}


int
xselect_token(parse_context_t *ctx)
{
    skip_bytes(ctx);
    skip_bytes(ctx);
    skip_bytes(ctx);

    return (0);
}

/*
 * anchor a path name with a slash
 * assume we have enough space
 */
static void
anchor_path(char *path)
{

    (void) memmove((void *)(path + 1), (void *)path, strlen(path) + 1);
    *path = '/';
}


/*
 * copy path to collapsed path.
 * collapsed path does not contain:
 *  successive slashes
 *  instances of dot-slash
 *  instances of dot-dot-slash
 * passed path must be anchored with a '/'
 */
static size_t
collapse_path(char *s, size_t ls)
{
    int id; /* index of where we are in destination string */
    int is; /* index of where we are in source string */
    int slashseen;  /* have we seen a slash */

    ls++; /* source length including '\0' */

    slashseen = 0;
    for (is = 0, id = 0; is < ls; is++) {
        if (s[is] == '\0') {
            if (id > 1 && s[id-1] == '/') {
                --id;
            }
            s[id++] = '\0';
            break;
        }
        /* previous character was a / */
        if (slashseen) {
            if (s[is] == '/')
                continue;   /* another slash, ignore it */
        } else if (s[is] == '/') {
            /* we see a /, just copy it and try again */
            slashseen = 1;
            s[id++] = '/';
            continue;
        }
        /* /./ seen */
        if (s[is] == '.' && s[is+1] == '/') {
            is += 1;
            continue;
        }
        /* XXX/. seen */
        if (s[is] == '.' && s[is+1] == '\0') {
            if (id > 1)
                id--;
            continue;
        }
        /* XXX/.. seen */
        if (s[is] == '.' && s[is+1] == '.' && s[is+2] == '\0') {
            is += 1;
            if (id > 0)
                id--;
            while (id > 0 && s[--id] != '/')
                ;
            id++;
            continue;
        }
        /* XXX/../ seen */
        if (s[is] == '.' && s[is+1] == '.' && s[is+2] == '/') {
            is += 2;
            if (id > 0)
                id--;
            while (id > 0 && s[--id] != '/')
                ;
            id++;
            continue;
        }
        while (is < ls && (s[id++] = s[is++]) != '/')
            ;
        is--;
    }
    return ((size_t)id - 1);
}

/*
 * for tokens with sub-fields that include a length, this
 * skips the sub-field.
 */

static void
skip_bytes(parse_context_t *ctx)
{
    ushort_t    c;

    adrm_u_short(&(ctx->adr), &c, 1);
    ctx->adr.adr_now += c;
}

static void
skip_string(parse_context_t *ctx)
{
    char    c;

    do {
        adrm_char(&(ctx->adr), &c, 1);
    } while (c != (char)0);
}

/*
 * add a byte to specified length so there can be a prefix of
 * '/' added (if needed for paths).  Another is added for '\0'
 *
 * if offset is zero, new data overwrites old, if any.  Otherwise
 * new data is appended to the end.
 */

static void
get_bytes_to_string(parse_context_t *ctx, size_t *l, char **p,
    size_t offset)
{
    ushort_t    len;
    char        *bp;

    adrm_u_short(&(ctx->adr), &len, 1);

    len++;  /* in case need to add '/' prefix */
    *p = realloc(*p, 1 + (size_t)len + offset);
    if (*p == NULL) {
        perror("audit_sysudp.so");
        return;
    }
    if (offset > 0)
        offset--;   /* overwrite end of string */

    *l = (size_t)len - 2 + offset;

    bp = *p + offset;
    adrm_char(&(ctx->adr), bp, len - 1);
    *(bp + len - 1) = '\0';
}


/*
 * Format of host token:
 *  host        adr_uint32
 */
int
host_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (int32_t);

    return (0);
}

/*
 * Format of useofauth token:
 *  uauth token id      adr_char
 *  uauth           adr_string
 *
 */
int
useofauth_token(parse_context_t *ctx)
{
    get_bytes_to_string(ctx, &(ctx->out.sf_uauthlen),
        &(ctx->out.sf_uauth), 0);

    return (0);
}

/*
 * Format of user token:
 *  user token id       adr_char
 *  uid         adr_uid
 *  username        adr_string
 *
 */
int
user_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (uid_t);
    skip_bytes(ctx);

    return (0);
}

/*
 * Format of zonename token:
 *  zonename token id       adr_char
 *  zonename            adr_string
 *
 */
int
zonename_token(parse_context_t *ctx)
{
    get_bytes_to_string(ctx,
        &(ctx->out.sf_zonelen),
        &(ctx->out.sf_zonename),
        0);

    return (0);
}

/*
 * Format of fmri token:
 *  fmri token id       adr_char
 *  fmri            adr_string
 */
int
fmri_token(parse_context_t *ctx)
{
    skip_bytes(ctx);

    return (0);
}

int
xcolormap_token(parse_context_t *ctx)
{
    return (xgeneric(ctx));
}

int
xcursor_token(parse_context_t *ctx)
{
    return (xgeneric(ctx));
}

int
xfont_token(parse_context_t *ctx)
{
    return (xgeneric(ctx));
}

int
xgc_token(parse_context_t *ctx)
{
    return (xgeneric(ctx));
}

int
xpixmap_token(parse_context_t *ctx)
{
    return (xgeneric(ctx));
}

int
xwindow_token(parse_context_t *ctx)
{
    return (xgeneric(ctx));
}
/*
 * Format of xgeneric token:
 *  XID         adr_int32
 *  creator UID     adr_int32
 *
 * Includes:  xcolormap, xcursor, xfont, xgc, xpixmap, and xwindow
 */
static int
xgeneric(parse_context_t *ctx)
{
    ctx->adr.adr_now += 2 * sizeof (int32_t);

    return (0);
}
/*
 * Format of xproperty token:
 *  XID         adr_int32
 *  creator UID     adr_int32
 *  atom string     adr_string
 */
int
xproperty_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += 2 * sizeof (int32_t);

    return (0);
}
/*
 * Format of xclient token:
 *  xclient id      adr_int32
 */
int
xclient_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (int32_t);

    return (0);
}

/*
 * -----------------------------------------------------------------------
 * privilege_token()    : Process privilege token and display contents
 *
 * Format of privilege token:
 *  privilege token id  adr_char
 *  privilege type      adr_string
 *  privilege       adr_string
 * -----------------------------------------------------------------------
 */

int
privilege_token(parse_context_t *ctx)
{
    skip_bytes(ctx);
    skip_bytes(ctx);

    return (0);
}

/*
 * -----------------------------------------------------------------------
 * secflags_token() : Process secflags token and display contents
 *
 * Format of privilege token:
 *  secflags token id   adr_char
 *  secflag set name    adr_string
 *  secflags        adr_string
 * -----------------------------------------------------------------------
 */
int
secflags_token(parse_context_t *ctx)
{
    skip_bytes(ctx);
    skip_bytes(ctx);

    return (0);
}

/*
 * Format of label token:
 *  label ID                1 byte
 *  compartment length      1 byte
 *  classification          2 bytes
 *  compartment words       <compartment length> * 4 bytes
 */
int
label_token(parse_context_t *ctx)
{
    char    c;

    ctx->adr.adr_now += sizeof (char);  /* label ID */
    adrm_char(&(ctx->adr), &c, 1);

    ctx->adr.adr_now += sizeof (ushort_t);  /* classification */
    ctx->adr.adr_now += 4 * c;      /* compartments */

    return (0);
}

/*
 * Format of useofpriv token:
 *  priv_type           adr_char
 *  priv_set_t          adr_short
 *  priv_set            adr_char*(sizeof (priv_set_t))
 */
int
useofpriv_token(parse_context_t *ctx)
{
    ctx->adr.adr_now += sizeof (char); /* success / fail */
    skip_bytes(ctx);

    return (0);
}