Re: [PATCH 1/2] auparse: Remove quotes from parsed fields

Auparse just removes single quotes at the end of a field value and leaves quotes at the beginning. With this patch, auparse removes quotes at the beggining of a parsed field value and handles double quotes at the same way as single quotes.

This is a simple test program to reproduce the problem: ----- int main() { const char *buffer= "type=VIRT_RESOURCE msg=audit(1327574186.046:174): user pid=6748 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='virt=kvm resrc=net reason=start vm=\"CentOS\" uuid=fb4149f5-9ff6-4095-f6d3-a1d03936fdfa old-net='?' new-net='52:54:00:DB:AE:B4 test': exe=\"/usr/sbin/libvirtd\" hostname=? addr=? terminal=? res=success'\n"; auparse_state_t *au = auparse_init(AUSOURCE_BUFFER, buffer); if (au == NULL) return -1; while (auparse_next_event(au) > 0) { printf("%s\n", auparse_find_field(au, "new-net")); } auparse_destroy(au); return 0; } ----- --- auparse/ellist.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/auparse/ellist.c b/auparse/ellist.c index eafcfee..8c3061d 100644 --- a/auparse/ellist.c +++ b/auparse/ellist.c @@ -137,6 +137,9 @@ static int parse_up_record(rnode* r) // Remove beginning cruft of name if (*ptr == '(') ptr++; + // Remove quotes + if (*val == '\'' || *val == '"') + val++; n.name = strdup(ptr); n.val = strdup(val); // Remove trailing punctuation @@ -149,7 +152,8 @@ static int parse_up_record(rnode* r) n.val[len-1] = 0; len--; } - if (len && n.val[len-1] == '\'') { + if (len && (n.val[len - 1] == '\'' + || n.val[len - 1] == '"')) { n.val[len-1] = 0; len--; }