Remove auparse-stub.h

With the previous commit, auparse-stub.h is now obsolete. Refactor
the code for it's removal.

Author: stevegrubb

auparse/internal.h

@@ -142,7 +142,6 @@ typedef struct data
 
 struct opaque
 {
-	nvlist interpretations;		// Per-parser interpretations list
 	ausource_t source;		// Source type
 	char **source_list;		// Array of buffers, or array of
 					//	 file names
@@ -181,6 +180,7 @@ struct opaque
 	debug_message_t debug_message;	// Whether or not messages are debug or not
 	const char *tmp_translation;	// Pointer to manage mem for field translation
 	normalize_data norm_data;
+	nvlist interpretations;		// Per-parser interpretations list
 	Queue *uid_cache;               // per-parser UID cache
 	int uid_cache_created;
 	Queue *gid_cache;               // per-parser GID cache
@@ -190,7 +190,8 @@ struct opaque
 AUDIT_HIDDEN_START
 
 // auditd-config.c
-int aup_load_config(auparse_state_t *au, struct daemon_conf *config, log_test_t lt);
+int aup_load_config(auparse_state_t *au, struct daemon_conf *config,
+		    log_test_t lt);
 void aup_free_config(struct daemon_conf *config);
 
 // normalize.c

src/Makefile.am

@@ -26,7 +26,7 @@ SUBDIRS = test
 AM_CPPFLAGS = -I${top_srcdir} -I${top_srcdir}/lib -I${top_srcdir}/src/libev -I${top_srcdir}/auparse -I${top_srcdir}/audisp -I${top_srcdir}/common
 sbin_PROGRAMS = auditd auditctl aureport ausearch
 AM_CFLAGS = -D_GNU_SOURCE -Wno-pointer-sign ${WFLAGS}
-noinst_HEADERS = auditd-config.h auditd-event.h auditd-listen.h ausearch-llist.h ausearch-options.h auditctl-llist.h aureport-options.h ausearch-parse.h aureport-scan.h ausearch-lookup.h ausearch-int.h auditd-dispatch.h ausearch-string.h ausearch-nvpair.h ausearch-common.h ausearch-avc.h ausearch-time.h ausearch-lol.h auditctl-listing.h ausearch-checkpt.h auparse-stub.h
+noinst_HEADERS = auditd-config.h auditd-event.h auditd-listen.h ausearch-llist.h ausearch-options.h auditctl-llist.h aureport-options.h ausearch-parse.h aureport-scan.h ausearch-lookup.h ausearch-int.h auditd-dispatch.h ausearch-string.h ausearch-nvpair.h ausearch-common.h ausearch-avc.h ausearch-time.h ausearch-lol.h auditctl-listing.h ausearch-checkpt.h 
 
 auditd_SOURCES = auditd.c auditd-event.c auditd-config.c auditd-reconfig.c auditd-sendmail.c auditd-dispatch.c
 if ENABLE_LISTENER

src/auditctl-listing.c

@@ -32,14 +32,13 @@
 #include "private.h"
 #include "auditctl-llist.h"
 #include "auparse-idata.h"
-#include "auparse-stub.h"
-
 
 #ifndef IORING_OP_LAST
 #define IORING_OP_LAST 37
 #endif
 
 /* Global vars */
+static auparse_state_t *au = NULL;
 static llist l;
 static int printed;
 extern int list_requested, interpret;
@@ -469,7 +468,7 @@ static void print_rule(const struct audit_rule_data *r)
 					type = auparse_interp_adjust_type(
 						AUDIT_SYSCALL, name, val);
 					out = auparse_do_interpretation(
-						interp_au, type, &id,
+						au, type, &id,
 						AUPARSE_ESC_TTY);
 					printf(" -F %s%s%s", name,
 						audit_operator_to_symbol(op),
@@ -568,8 +567,8 @@ int audit_print_reply(const struct audit_reply *rep, int fd)
 {
 	static int init_done = 0;
 	if (!init_done) {
-		interp_au = auparse_init(AUSOURCE_BUFFER, "");
-		if (interp_au == NULL)
+		au = auparse_init(AUSOURCE_BUFFER, "");
+		if (au == NULL)
 			return 0;
 		init_done = 1;
 	}

src/auparse-stub.h

@@ -42,13 +42,12 @@
 #include "ausearch-lol.h"
 #include "ausearch-lookup.h"
 #include "auparse-idata.h"
-#include "auparse-stub.h"
-
 #include "ausearch-parse.h"
 
 
 extern event very_first_event;
 event very_last_event;
+static auparse_state_t *au = NULL;
 static FILE *log_fd = NULL;
 static lol lo;
 static int found = 0;
@@ -100,8 +99,8 @@ int main(int argc, char *argv[])
 	set_aumessage_mode(MSG_STDERR, DBG_NO);
 	(void) umask( umask( 077 ) | 027 );
 	very_first_event.sec = 0;
-	interp_au = auparse_init(AUSOURCE_BUFFER, "");
-	if (interp_au == NULL) {
+	au = auparse_init(AUSOURCE_BUFFER, "");
+	if (au == NULL) {
 		fprintf(stderr, "cannot init parser\n");
 		return 1;
 	}
@@ -245,13 +244,13 @@ static void process_event(llist *entries)
 		// If its a single event or SYSCALL load interpretations
 		if ((entries->cnt == 1) ||
 				(entries->head->type == AUDIT_SYSCALL)) {
-			_auparse_load_interpretations(interp_au,
+			_auparse_load_interpretations(au,
 					entries->head->interp);
 		}
 		// This is the per entry action item
 		if (per_event_processing(entries))
 			found = 1;
-		_auparse_free_interpretations(interp_au);
+		_auparse_free_interpretations(au);
 	}
 }
 

src/aureport.c

@@ -32,8 +32,9 @@
 #include "ausearch-options.h"
 #include "ausearch-nvpair.h"
 #include "auparse-idata.h"
-#include "auparse-stub.h"
+
 static int interp_init = 0;
+static auparse_state_t *au = NULL;
 
 /* This is the name/value pair used by search tables */
 struct nv_pair {
@@ -76,8 +77,8 @@ const char *aulookup_syscall(llist *l, char *buf, size_t size)
 	const char *sys;
 
 	if (!interp_init) {
-		interp_au = auparse_init(AUSOURCE_BUFFER, "");
-		if (interp_au == NULL)
+		au = auparse_init(AUSOURCE_BUFFER, "");
+		if (au == NULL)
 			return NULL;
 		interp_init = 1;
 	}
@@ -87,8 +88,7 @@ const char *aulookup_syscall(llist *l, char *buf, size_t size)
 		return buf;
 	}
 
-	sys = _auparse_lookup_interpretation(interp_au,
-						"syscall");
+	sys = _auparse_lookup_interpretation(au, "syscall");
 	if (sys) {
 		snprintf(buf, size, "%s", sys);
 		free((void *)sys);
@@ -208,8 +208,8 @@ const char *aulookup_uid(uid_t uid, char *buf, size_t size)
 	int rc;
 
 	if (!interp_init) {
-		interp_au = auparse_init(AUSOURCE_BUFFER, "");
-		if (interp_au == NULL)
+		au = auparse_init(AUSOURCE_BUFFER, "");
+		if (au == NULL)
 			return NULL;
 		interp_init = 1;
 	}
@@ -223,7 +223,7 @@ const char *aulookup_uid(uid_t uid, char *buf, size_t size)
 		return buf;
 	}
 
-	name = _auparse_lookup_interpretation(interp_au, "auid");
+	name = _auparse_lookup_interpretation(au, "auid");
 	if (name) {
 		snprintf(buf, size, "%s", name);
 		free((void *)name);

src/ausearch-lookup.c

@@ -39,7 +39,6 @@
 #include "ausearch-lookup.h"
 #include "ausearch-parse.h"
 #include "auparse-idata.h"
-#include "auparse-stub.h"
 #include "ausearch-nvpair.h"
 
 
@@ -212,18 +211,19 @@ int extract_search_items(llist *l)
 static nvlist uid_nvl;
 static int uid_list_created=0;
 static int interp_init = 0;
+static auparse_state_t *au = NULL;
 static const char *lookup_uid(const char *field, uid_t uid)
 {
 	const char *value;
 
 	if (!interp_init) {
-		interp_au = auparse_init(AUSOURCE_BUFFER, "");
-		if (interp_au == NULL)
+		au = auparse_init(AUSOURCE_BUFFER, "");
+		if (au == NULL)
 			return NULL;
 		interp_init = 1;
 	}
 
-	value = _auparse_lookup_interpretation(interp_au, field);
+	value = _auparse_lookup_interpretation(au, field);
 	if (value)
 		return value;
 	if (uid == 0)

src/ausearch-parse.c

@@ -33,10 +33,10 @@
 #include "ausearch-lookup.h"
 #include "auparse.h"
 #include "auparse-idata.h"
-#include "auparse-stub.h"
 #include "auditd-config.h"
 
 static int interp_init = 0;
+static auparse_state_t *au = NULL;
 
 /* Local functions */
 static void output_raw(llist *l);
@@ -52,7 +52,7 @@ static void text_event(auparse_state_t *au,
 
 extern time_t lol_get_eoe_timeout(void);
 
-static auparse_state_t *au = NULL;
+static auparse_state_t *feed_au = NULL;
 
 
 /* The machine based on elf type */
@@ -69,20 +69,20 @@ void ausearch_load_interpretations(const lnode *n)
 {
 	if (loaded == 0) {
 		if (!interp_init) {
-			interp_au = auparse_init(AUSOURCE_BUFFER, "");
-			if (interp_au == NULL)
+			au = auparse_init(AUSOURCE_BUFFER, "");
+			if (au == NULL)
 				return;
 			interp_init = 1;
 		}
-		 _auparse_load_interpretations(interp_au, n->interp);
+		_auparse_load_interpretations(au, n->interp);
 		loaded = 1;
 	}
 }
 
 void ausearch_free_interpretations(void)
 {
-	if (loaded && interp_au) {
-		_auparse_free_interpretations(interp_au);
+	if (loaded && au) {
+		_auparse_free_interpretations(au);
 		loaded = 0;
 	}
 }
@@ -394,7 +394,7 @@ static void report_interpret(char *name, char *val, int comma, int rtype)
 	id.val = val;
 	id.cwd = NULL;
 
-	char *out = auparse_do_interpretation(interp_au,type,&id,escape_mode);
+	char *out = auparse_do_interpretation(au, type, &id, escape_mode);
 	if (type == AUPARSE_TYPE_UNCLASSIFIED)
 		printf("%s%c", val, comma ? ',' : ' ');
 	else if (name[0] == 'k' && strcmp(name, "key") == 0) {
@@ -819,30 +819,30 @@ static void feed_auparse(llist *l, auparse_callback_ptr callback)
 		fprintf(stderr, "Error - no elements in record.");
 		return;
 	}
-	if (au == NULL) {
-		au = auparse_init(AUSOURCE_FEED, 0);
-		auparse_set_escape_mode(au, escape_mode);
+	if (feed_au == NULL) {
+		feed_au = auparse_init(AUSOURCE_FEED, 0);
+		auparse_set_escape_mode(feed_au, escape_mode);
 		auparse_set_eoe_timeout(lol_get_eoe_timeout());
-		auparse_add_callback(au, callback, NULL, NULL);
-	}
+		auparse_add_callback(feed_au, callback, NULL, NULL);
+       }
 	do {
 		// Records need to be terminated by a newline
 		// Temporarily replace it.
 		if (l->fmt == LF_ENRICHED)
 			n->message[n->mlen] = AUDIT_INTERP_SEPARATOR;
 		n->message[n->tlen] = 0x0a;
-		auparse_feed(au, n->message, n->tlen+1);
+		auparse_feed(feed_au, n->message, n->tlen+1);
 		if (l->fmt == LF_ENRICHED)
 			n->message[n->mlen] = 0;
 		n->message[n->tlen] = 0;
 	} while ((n=list_next(l)));
 
-	auparse_flush_feed(au);
+	auparse_flush_feed(feed_au);
 }
 
 void output_auparse_finish(void)
 {
-	if (au)
-		auparse_destroy(au);
-	au = NULL;
+	if (feed_au)
+		auparse_destroy(feed_au);
+	feed_au = NULL;
 }