自学教程：C++ ADD_U_INT16函数代码示例

/* * token ID                1 byte * record byte count       4 bytes * version #               1 byte    [2] * event type              2 bytes * event modifier          2 bytes * address type/length     4 bytes * machine address         4 bytes/16 bytes (IPv4/IPv6 address) * seconds of time         4 bytes/8 bytes (32-bit/64-bit value) * milliseconds of time    4 bytes/8 bytes (32-bit/64-bit value) */token_t *au_to_header32_ex_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,    struct timeval tm, struct auditinfo_addr *aia){	token_t *t;	u_char *dptr = NULL;	u_int32_t timems;	au_tid_addr_t *tid;	tid = &aia->ai_termid;	KASSERT(tid->at_type == AU_IPv4 || tid->at_type == AU_IPv6,	    ("au_to_header32_ex_tm: invalid address family"));	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 3 *	    sizeof(u_int32_t) + tid->at_type);	ADD_U_CHAR(dptr, AUT_HEADER32_EX);	ADD_U_INT32(dptr, rec_size);	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);	ADD_U_INT16(dptr, e_type);	ADD_U_INT16(dptr, e_mod);	ADD_U_INT32(dptr, tid->at_type);	if (tid->at_type == AU_IPv6)		ADD_MEM(dptr, &tid->at_addr[0], 4 * sizeof(u_int32_t));	else		ADD_MEM(dptr, &tid->at_addr[0], sizeof(u_int32_t));	timems = tm.tv_usec/1000;	/* Add the timestamp */	ADD_U_INT32(dptr, tm.tv_sec);	ADD_U_INT32(dptr, timems);      /* We need time in ms. */	return (t);   }

/* * token ID                1 byte * socket family           2 bytes * local port              2 bytes * socket address          4 bytes */token_t *au_to_sock_inet32(struct sockaddr_in *so){	token_t *t;	u_char *dptr = NULL;	uint16_t family;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(uint16_t) +	    sizeof(uint32_t));	ADD_U_CHAR(dptr, AUT_SOCKINET32);	/*	 * BSM defines the family field as 16 bits, but many operating	 * systems have an 8-bit sin_family field.  Extend to 16 bits before	 * writing into the token.  Assume that both the port and the address	 * in the sockaddr_in are already in network byte order, but family	 * is in local byte order.	 *	 * XXXRW: Should a name space conversion be taking place on the value	 * of sin_family?	 */	family = so->sin_family;	ADD_U_INT16(dptr, family);	ADD_MEM(dptr, &so->sin_port, sizeof(uint16_t));	ADD_MEM(dptr, &so->sin_addr.s_addr, sizeof(uint32_t));	return (t);}

token_t *au_to_attr64(struct vnode_au_info *vni){	token_t *t;	u_char *dptr = NULL;	u_int16_t pad0_16 = 0;	u_int32_t pad0_32 = 0;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +	    3 * sizeof(u_int32_t) + sizeof(u_int64_t) * 2);	ADD_U_CHAR(dptr, AUT_ATTR64);	/*	 * BSD defines the size for the file mode as 2 bytes; BSM defines 4	 * so pad with 0.	 *	 * XXXRW: Possibly should be conditionally compiled.	 *	 * XXXRW: Should any conversions take place on the mode?	 */	ADD_U_INT16(dptr, pad0_16);	ADD_U_INT16(dptr, vni->vn_mode);	ADD_U_INT32(dptr, vni->vn_uid);	ADD_U_INT32(dptr, vni->vn_gid);	ADD_U_INT32(dptr, vni->vn_fsid);	/*	 * Some systems use 32-bit file ID's, other's use 64-bit file IDs.	 * Attempt to handle both, and let the compiler sort it out.  If we	 * could pick this out at compile-time, it would be better, so as to	 * avoid the else case below.	 */	if (sizeof(vni->vn_fileid) == sizeof(uint32_t)) {		ADD_U_INT32(dptr, pad0_32);		ADD_U_INT32(dptr, vni->vn_fileid);	} else if (sizeof(vni->vn_fileid) == sizeof(uint64_t))		ADD_U_INT64(dptr, vni->vn_fileid);	else		ADD_U_INT64(dptr, 0LL);	ADD_U_INT64(dptr, vni->vn_dev);	return (t);}

/* * token ID                1 byte * socket domain           2 bytes * socket type             2 bytes * address type            2 byte * local port              2 bytes * local address           4 bytes/16 bytes (IPv4/IPv6 address) * remote port             2 bytes * remote address          4 bytes/16 bytes (IPv4/IPv6 address) * * Domain and type arguments to this routine are assumed to already have been * converted to the BSM constant space, so we don't do that here. */token_t *au_to_socket_ex(u_short so_domain, u_short so_type,    struct sockaddr *sa_local, struct sockaddr *sa_remote){	token_t *t;	u_char *dptr = NULL;	struct sockaddr_in *sin;	struct sockaddr_in6 *sin6;	if (so_domain == AF_INET)		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +		    5 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t));	else if (so_domain == AF_INET6)		GET_TOKEN_AREA(t, dptr, sizeof(u_char) +		    5 * sizeof(u_int16_t) + 8 * sizeof(u_int32_t));	else		return (NULL);	ADD_U_CHAR(dptr, AUT_SOCKET_EX);	ADD_U_INT16(dptr, au_domain_to_bsm(so_domain));	ADD_U_INT16(dptr, au_socket_type_to_bsm(so_type));	if (so_domain == AF_INET) {		ADD_U_INT16(dptr, AU_IPv4);		sin = (struct sockaddr_in *)sa_local;		ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));		ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));		sin = (struct sockaddr_in *)sa_remote;		ADD_MEM(dptr, &sin->sin_port, sizeof(uint16_t));		ADD_MEM(dptr, &sin->sin_addr.s_addr, sizeof(uint32_t));	} else {		ADD_U_INT16(dptr, AU_IPv6);		sin6 = (struct sockaddr_in6 *)sa_local;		ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));		ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));		sin6 = (struct sockaddr_in6 *)sa_remote;		ADD_MEM(dptr, &sin6->sin6_port, sizeof(uint16_t));		ADD_MEM(dptr, &sin6->sin6_addr, 4 * sizeof(uint32_t));	}	return (t);}

token_t *kau_to_socket(struct socket_au_info *soi){	token_t *t;	u_char *dptr;	u_int16_t so_type;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int16_t) +	    sizeof(u_int32_t) + sizeof(u_int16_t) + sizeof(u_int32_t));                                                 	ADD_U_CHAR(dptr, AUT_SOCKET);	/* Coerce the socket type into a short value */	so_type = soi->so_type;	ADD_U_INT16(dptr, so_type);	ADD_U_INT16(dptr, soi->so_lport);	ADD_U_INT32(dptr, soi->so_laddr);	ADD_U_INT16(dptr, soi->so_rport);	ADD_U_INT32(dptr, soi->so_raddr);	return (t);}

/* * token ID                1 byte * port IP address         2 bytes */token_t *au_to_iport(u_int16_t iport){	token_t *t;	u_char *dptr = NULL;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t));	ADD_U_CHAR(dptr, AUT_IPORT);	ADD_U_INT16(dptr, iport);	return (t);}

/* * token ID                1 byte * size                    2 bytes * data                    size bytes */token_t *au_to_opaque(const char *data, u_int16_t bytes){	token_t *t;	u_char *dptr = NULL;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + bytes);	ADD_U_CHAR(dptr, AUT_OPAQUE);	ADD_U_INT16(dptr, bytes);	ADD_MEM(dptr, data, bytes);	return (t);}

token_t *au_to_header64_tm(int rec_size, au_event_t e_type, au_emod_t e_mod,    struct timeval tm){	token_t *t;	u_char *dptr = NULL;	u_int32_t timems;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int32_t) +	    sizeof(u_char) + 2 * sizeof(u_int16_t) + 2 * sizeof(u_int64_t));	ADD_U_CHAR(dptr, AUT_HEADER64);	ADD_U_INT32(dptr, rec_size);	ADD_U_CHAR(dptr, AUDIT_HEADER_VERSION_OPENBSM);	ADD_U_INT16(dptr, e_type);	ADD_U_INT16(dptr, e_mod);	timems = tm.tv_usec/1000;	/* Add the timestamp */	ADD_U_INT64(dptr, tm.tv_sec);	ADD_U_INT64(dptr, timems);	/* We need time in ms. */	return (t);}

/* * token ID                1 byte * zonename length         2 bytes * zonename                N bytes + 1 terminating NULL byte */token_t *au_to_zonename(const char *zonename){	u_char *dptr = NULL;	u_int16_t textlen;	token_t *t;	textlen = strlen(zonename) + 1;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);	ADD_U_CHAR(dptr, AUT_ZONENAME);	ADD_U_INT16(dptr, textlen);	ADD_STRING(dptr, zonename, textlen);	return (t);}

/* * token ID                1 byte * trailer magic number    2 bytes * record byte count       4 bytes */token_t *au_to_trailer(int rec_size){	token_t *t;	u_char *dptr = NULL;	u_int16_t magic = AUT_TRAILER_MAGIC;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +	    sizeof(u_int32_t));	ADD_U_CHAR(dptr, AUT_TRAILER);	ADD_U_INT16(dptr, magic);	ADD_U_INT32(dptr, rec_size);	return (t);}

/* * token ID                1 byte * number groups           2 bytes * group list              count * 4 bytes */token_t *au_to_newgroups(u_int16_t n, gid_t *groups){	token_t *t;	u_char *dptr = NULL;	int i;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) +	    n * sizeof(u_int32_t));	ADD_U_CHAR(dptr, AUT_NEWGROUPS);	ADD_U_INT16(dptr, n);	for (i = 0; i < n; i++)		ADD_U_INT32(dptr, groups[i]);	return (t);}

/* * token ID                1 byte * path length             2 bytes * path                    N bytes + 1 terminating NULL byte */token_t *au_to_path(const char *text){	token_t *t;	u_char *dptr = NULL;	u_int16_t textlen;	textlen = strlen(text);	textlen += 1;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);	ADD_U_CHAR(dptr, AUT_PATH);	ADD_U_INT16(dptr, textlen);	ADD_STRING(dptr, text, textlen);	return (t);}

/* * token ID                1 byte * text length             2 bytes * text                    N bytes + 1 terminating NULL byte */token_t *au_to_text(const char *text){	token_t *t;	u_char *dptr = NULL;	u_int16_t textlen;	textlen = strlen(text);	textlen += 1;	/* XXXRW: Should validate length against token size limit. */	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + sizeof(u_int16_t) + textlen);	ADD_U_CHAR(dptr, AUT_TEXT);	ADD_U_INT16(dptr, textlen);	ADD_STRING(dptr, text, textlen);	return (t);}

token_t *au_to_arg64(char n, const char *text, u_int64_t v){	token_t *t;	u_char *dptr = NULL;	u_int16_t textlen;	textlen = strlen(text);	textlen += 1;	GET_TOKEN_AREA(t, dptr, 2 * sizeof(u_char) + sizeof(u_int64_t) +	    sizeof(u_int16_t) + textlen);	ADD_U_CHAR(dptr, AUT_ARG64);	ADD_U_CHAR(dptr, n);	ADD_U_INT64(dptr, v);	ADD_U_INT16(dptr, textlen);	ADD_STRING(dptr, text, textlen);	return (t);}

token_t *au_to_sock_inet128(struct sockaddr_in6 *so){	token_t *t;	u_char *dptr = NULL;	GET_TOKEN_AREA(t, dptr, 3 * sizeof(u_char) + sizeof(u_int16_t) +	    4 * sizeof(u_int32_t));	ADD_U_CHAR(dptr, AUT_SOCKINET128);	/*	 * In BSD, sin6_family is one octet, but BSM defines the token to	 * store two. So we copy in a 0 first.  XXXRW: Possibly should be	 * conditionally compiled.	 */	ADD_U_CHAR(dptr, 0);	ADD_U_CHAR(dptr, so->sin6_family);	ADD_U_INT16(dptr, so->sin6_port);	ADD_MEM(dptr, &so->sin6_addr, 4 * sizeof(uint32_t));	return (t);}

/* * token ID                1 byte * seconds of time         4 bytes * milliseconds of time    4 bytes * file name len           2 bytes * file pathname           N bytes + 1 terminating NULL byte */token_t *au_to_file(const char *file, struct timeval tm){	token_t *t;	u_char *dptr = NULL;	u_int16_t filelen;	u_int32_t timems;	filelen = strlen(file);	filelen += 1;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 2 * sizeof(u_int32_t) +	    sizeof(u_int16_t) + filelen);	timems = tm.tv_usec/1000;	ADD_U_CHAR(dptr, AUT_OTHER_FILE32);	ADD_U_INT32(dptr, tm.tv_sec);	ADD_U_INT32(dptr, timems);	/* We need time in ms. */	ADD_U_INT16(dptr, filelen);	ADD_STRING(dptr, file, filelen);	return (t);}

/* * token ID                1 byte * owner user ID           4 bytes * owner group ID          4 bytes * creator user ID         4 bytes * creator group ID        4 bytes * access mode             4 bytes * slot sequence #         4 bytes * key                     4 bytes */token_t *au_to_ipc_perm(struct ipc_perm *perm){	token_t *t;	u_char *dptr = NULL;	u_int16_t pad0 = 0;	GET_TOKEN_AREA(t, dptr, sizeof(u_char) + 12 * sizeof(u_int16_t) +	    sizeof(u_int32_t));	ADD_U_CHAR(dptr, AUT_IPC_PERM);	/*	 * Systems vary significantly in what types they use in struct	 * ipc_perm; at least a few still use 16-bit uid's and gid's, so	 * allow for that, as BSM define 32-bit values here.	 * Some systems define the sizes for ipc_perm members as 2 bytes;	 * BSM defines 4 so pad with 0.	 *	 * XXXRW: Possibly shoulid be conditionally compiled, and more cases	 * need to be handled.	 */	if (sizeof(perm->uid) != sizeof(u_int32_t)) {		ADD_U_INT16(dptr, pad0);		ADD_U_INT16(dptr, perm->uid);		ADD_U_INT16(dptr, pad0);		ADD_U_INT16(dptr, perm->gid);		ADD_U_INT16(dptr, pad0);		ADD_U_INT16(dptr, perm->cuid);		ADD_U_INT16(dptr, pad0);		ADD_U_INT16(dptr, perm->cgid);	} else {		ADD_U_INT32(dptr, perm->uid);		ADD_U_INT32(dptr, perm->gid);		ADD_U_INT32(dptr, perm->cuid);		ADD_U_INT32(dptr, perm->cgid);	}	ADD_U_INT16(dptr, pad0);	ADD_U_INT16(dptr, perm->mode);	ADD_U_INT16(dptr, pad0);	ADD_U_INT16(dptr, perm->seq);	ADD_U_INT32(dptr, perm->key);	return (t);}