auparse_interpret_field()

[Steve Grubb]

On Friday 09 November 2007 14:56:05 klausk at br.ibm.com wrote:
> See that 'r->machine' and 'r->syscall' are only filled when the 'arch'
> field in found in the 2nd position, and syscall in the 3rd position
> respectively. That is not true when the dispatcher is appending a 'node='
> field to each record.

This is the patch I'm testing.

-Steve


--- audit-1.6.3.orig/auparse/ellist.c	2007-10-01 13:56:21.000000000 -0400
+++ audit-1.6.3/auparse/ellist.c	2007-11-12 14:27:31.000000000 -0500
@@ -65,6 +65,7 @@
 static int parse_up_record(rnode* r)
 {
 	char *ptr, *buf, *saved;
+	int offset = 0;
 
 	buf = strdup(r->record);
 	ptr = strtok_r(buf, " ", &saved);
@@ -123,27 +124,34 @@
 				}
 			}
 			nvlist_append(&r->nv, &n);
-			if (r->nv.cnt == 1 && strcmp(n.name, "type") == 0) {
+			if (r->nv.cnt == 1 && strcmp(n.name, "node") == 0)
+				offset = 1; // if node, some positions changes
+			else if (r->nv.cnt == (1 + offset) &&
+					strcmp(n.name, "type") == 0) {
 				r->type = audit_name_to_msg_type(n.val);
-			} else if(r->nv.cnt == 2 && strcmp(n.name, "arch")== 0){
+			} else if (r->nv.cnt == (2 + offset) && 
+					strcmp(n.name, "arch")== 0){
 				unsigned int ival;
 				errno = 0;
 				ival = strtoul(n.val, NULL, 16);
 				if (errno)
-					r->machine = -1;
-				r->machine = audit_elf_to_machine(ival);
-			} else if(r->nv.cnt == 3 && strcmp(n.name,
-							"syscall") == 0){
+					r->machine = -2;
+				else
+					r->machine = audit_elf_to_machine(ival);
+			} else if (r->nv.cnt == (3 + offset) &&
+					strcmp(n.name, "syscall") == 0){
 				errno = 0;
 				r->syscall = strtoul(n.val, NULL, 10);
 				if (errno)
 					r->syscall = -1;
-			} else if(r->nv.cnt == 6 && strcmp(n.name, "a0") == 0){
+			} else if (r->nv.cnt == (6 + offset) &&
+					strcmp(n.name, "a0") == 0){
 				errno = 0;
 				r->a0 = strtoull(n.val, NULL, 16);
 				if (errno)
 					r->a0 = -1LL;
-			} else if(r->nv.cnt == 7 && strcmp(n.name, "a1") == 0){
+			} else if (r->nv.cnt == (7 + offset) &&
+					strcmp(n.name, "a1") == 0){
 				errno = 0;
 				r->a1 = strtoull(n.val, NULL, 16);
 				if (errno)
@@ -152,12 +160,12 @@
 		} else if (r->type == AUDIT_AVC || r->type == AUDIT_USER_AVC) {
 			// We special case these 2 fields because selinux
 			// avc messages do not label these fields.
-			if (nvlist_get_cnt(&r->nv) == 1) {
+			if (nvlist_get_cnt(&r->nv) == (1 + offset)) {
 				// skip over 'avc:'
 				if (strncmp(ptr, "avc", 3) == 0)
 					continue;
 				n.name = strdup("seresult");
-			} else if (nvlist_get_cnt(&r->nv) == 2) {
+			} else if (nvlist_get_cnt(&r->nv) == (2 + offset)) {
 				// skip over open brace
 				if (*ptr == '{') {
 					int total = 0, len;