[PATCH ghak28/ghak25 user 2/2] ausearch-parse: mod parser for YAASAO for NETFILTER_CFG

[Richard Guy Briggs]

Modify the YAASAO parser to accomodate the ghak25 NETFILTER_CFG record.

Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
---
 src/ausearch-parse.c | 42 ++++++++++++++++++++++--------------------
 1 file changed, 22 insertions(+), 20 deletions(-)

diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index 147b1fa7acaf..7feabe40b6fa 100644
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -173,11 +173,11 @@ int extract_search_items(llist *l)
 			case AUDIT_BPRM_FCAPS:
 			case AUDIT_CAPSET:
 			case AUDIT_MMAP:
-			case AUDIT_NETFILTER_CFG:
 			case AUDIT_PROCTITLE:
 			case AUDIT_REPLACE...AUDIT_BPF:
 				// Nothing to parse
 				break;
+			case AUDIT_NETFILTER_CFG:
 			case AUDIT_EVENT_LISTENER:
 				ret = parse_yaasao(n, s);
 				break;
@@ -2620,23 +2620,23 @@ static int parse_yaasao(lnode *n, search_items *s)
 	// get loginuid if not already filled
 	if ((s->loginuid == -2 && !s->tauid) && (event_loginuid != -2 || event_tauid)) {
 		str = strstr(term, "auid=");
-		if (str == NULL) {
-			return 59;
-		} else
+		if (str) {
 			ptr = str + 5;
-		term = strchr(ptr, ' ');
-		if (term == NULL)
-			return 60;
-		*term = 0;
-		errno = 0;
-		s->loginuid = strtoul(ptr, NULL, 10);
-		if (errno)
+			term = strchr(ptr, ' ');
+			if (term == NULL)
+				return 59;
+			*term = 0;
+			errno = 0;
+			s->loginuid = strtoul(ptr, NULL, 10);
+			if (errno)
+				return 60;
+			*term = ' ';
+			if (s->tauid) free((void *)s->tauid);
+			s->tauid = lookup_uid("auid", s->loginuid);
+		} else
 			return 61;
-		*term = ' ';
-		if (s->tauid) free((void *)s->tauid);
-		s->tauid = lookup_uid("auid", s->loginuid);
 	}
-	// get tty if not already filled
+	// optionally get tty if not already filled
 	if (!s->terminal && event_terminal) {
 		// dont do this search unless needed
 		str = strstr(term, "tty=");
@@ -2650,9 +2650,10 @@ static int parse_yaasao(lnode *n, search_items *s)
 				free(s->terminal);
 			s->terminal = strdup(str);
 			*term = ' ';
-		}
+		} else
+			s->terminal = strdup("(none)");
 	}
-	// get ses if not already filled
+	// optionally get ses if not already filled
 	if (s->session_id == -2 && event_session_id != -2 ) {
 		str = strstr(term, "ses=");
 		if (str) {
@@ -2666,7 +2667,8 @@ static int parse_yaasao(lnode *n, search_items *s)
 			if (errno)
 				return 64;
 			*term = ' ';
-		}
+		} else
+			s->session_id = (unsigned long)-1;
 	}
 	// get subject if not already filled
 	if (!s->avc && event_subject) {
@@ -2712,7 +2714,7 @@ static int parse_yaasao(lnode *n, search_items *s)
 		} else
 			return 69;
 	}
-	// get exe if not already filled
+	// optionally get exe if not already filled
 	if (!s->exe && event_exe) {
 		// dont do this search unless needed
 		str = strstr(n->message, "exe=");
@@ -2729,7 +2731,7 @@ static int parse_yaasao(lnode *n, search_items *s)
 			} else 
 				s->exe = unescape(str);
 		} else
-			return 71;
+			s->exe = strdup("(null)");
 	}
 	return 0;
 }
-- 
1.8.3.1