BSM token format questions

[Ilmar S. Habibulin]

On Tue, 3 May 2005, Robert Watson wrote:

> Another related question concerns byte order and APIs for constructing/
> tearing down data types relating to the network.  In the case of APIs that
> involve IP addresses, I think there's a strong argument to be made that the
> caller should pass the IP address in network byte order, as other system API
> that use addresses also expect network byte order -- i.e., bind(), connect(),
> inet_aton(), etc.  How about port numbers, though?  I'm currently leaning
> towards network byte order, as that's how they'll be when extracted from
> socket addresses, for example...

I think that everything (any data) in audit.log should be stored as it is
used. Network attributes are used in network byte order format, so store
them like that. But i also think, that compatibility of audit logs amoung
platforms is more importaint, that the actual log format or data
representation format. So thinking of sparc/solaris compatibility issue it
is reasonable to use network byteorder.
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-audit" in the body of the message