[PATCH 1/2] auparse: Remove quotes from parsed fields

[Marcelo Cerri]

Auparse just removes single quotes at the end of a field value and leaves
quotes at the beginning. With this patch, auparse removes quotes at the
beggining of a parsed field value and handles double quotes at the same way as
single quotes.

This is a simple test program to reproduce the problem:

-----
int main() {
	const char *buffer= "type=VIRT_RESOURCE msg=audit(1327574186.046:174): user pid=6748 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='virt=kvm resrc=net reason=start vm=\"CentOS\" uuid=fb4149f5-9ff6-4095-f6d3-a1d03936fdfa old-net='?' new-net='52:54:00:DB:AE:B4 test': exe=\"/usr/sbin/libvirtd\" hostname=? addr=? terminal=? res=success'\n";
	auparse_state_t *au = auparse_init(AUSOURCE_BUFFER, buffer);
	if (au == NULL) return -1;
	while (auparse_next_event(au) > 0) {
		printf("%s\n", auparse_find_field(au, "new-net"));
	}
	auparse_destroy(au);
	return 0;
}

-----
---
 auparse/ellist.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/auparse/ellist.c b/auparse/ellist.c
index eafcfee..8c3061d 100644
--- a/auparse/ellist.c
+++ b/auparse/ellist.c
@@ -137,6 +137,9 @@ static int parse_up_record(rnode* r)
 			// Remove beginning cruft of name
 			if (*ptr == '(')
 				ptr++;
+			// Remove quotes
+			if (*val == '\'' || *val == '"')
+				val++;
 			n.name = strdup(ptr);
 			n.val = strdup(val);
 			// Remove trailing punctuation
@@ -149,7 +152,8 @@ static int parse_up_record(rnode* r)
 				n.val[len-1] = 0;
 				len--;
 			}
-			if (len && n.val[len-1] == '\'') {
+			if (len && (n.val[len - 1] == '\''
+					|| n.val[len - 1] == '"')) {
 				n.val[len-1] = 0;
 				len--;
 			}
-- 
1.7.1