From f259039c1560011c59654ea80d329e12ba1344c4 Mon Sep 17 00:00:00 2001
From: Steve Grubb <sgrubb@fedoraproject.org>
Date: Apr 18 2008 15:03:11 +0000
Subject: - Update auparse patch for audisp-prelude


---

diff --git a/audit-1.7.3-prelude.patch b/audit-1.7.3-prelude.patch
index 1dac041..20cebae 100644
--- a/audit-1.7.3-prelude.patch
+++ b/audit-1.7.3-prelude.patch
@@ -1,6 +1,6 @@
 diff -urp audit-1.7.2.orig/audisp/plugins/prelude/audisp-prelude.c audit-1.7.2/audisp/plugins/prelude/audisp-prelude.c
 --- audit-1.7.2.orig/audisp/plugins/prelude/audisp-prelude.c	2008-04-07 16:57:12.000000000 -0400
-+++ audit-1.7.2/audisp/plugins/prelude/audisp-prelude.c	2008-04-18 06:27:00.000000000 -0400
++++ audit-1.7.2/audisp/plugins/prelude/audisp-prelude.c	2008-04-18 10:18:46.000000000 -0400
 @@ -228,7 +228,8 @@ int main(int argc, char *argv[])
  		return -1;
  	}
@@ -25,7 +25,7 @@ diff -urp audit-1.7.2.orig/audisp/plugins/prelude/audisp-prelude.c audit-1.7.2/a
  	if (client) 
 diff -urp audit-1.7.2.orig/auparse/auparse.c audit-1.7.2/auparse/auparse.c
 --- audit-1.7.2.orig/auparse/auparse.c	2008-04-08 12:37:09.000000000 -0400
-+++ audit-1.7.2/auparse/auparse.c	2008-04-17 18:13:30.000000000 -0400
++++ audit-1.7.2/auparse/auparse.c	2008-04-18 10:43:49.000000000 -0400
 @@ -1130,6 +1130,7 @@ int auparse_first_record(auparse_state_t
  			return rc;
  	}
@@ -34,7 +34,31 @@ diff -urp audit-1.7.2.orig/auparse/auparse.c audit-1.7.2/auparse/auparse.c
  	
  	return 1;
  }
-@@ -1258,6 +1259,8 @@ const char *auparse_find_field_next(aupa
+@@ -1236,7 +1237,22 @@ const char *auparse_find_field(auparse_s
+ {
+ 	free(au->find_field);
+ 	au->find_field = strdup(name);
+-	return auparse_find_field_next(au);
++
++	if (au->le.e.sec) {
++		const char *cur_name;
++		rnode *r;
++
++		// look at current record before moving
++		r = aup_list_get_cur(&au->le);
++		if (r == NULL)
++			return NULL;
++		cur_name = nvlist_get_cur_name(&r->nv);
++		if (cur_name && strcmp(cur_name, name) == 0)
++			return nvlist_get_cur_val(&r->nv);
++
++		return auparse_find_field_next(au);
++	}
++	return NULL;
+ }
+ 
+ /* Increment 1 location and then scan for next field */
+@@ -1258,6 +1274,8 @@ const char *auparse_find_field_next(aupa
  			if (nvlist_find_name(&r->nv, au->find_field))
  				return nvlist_get_cur_val(&r->nv);
  			r = aup_list_next(&au->le);
diff --git a/audit.spec b/audit.spec
index 2f0e186..2f71237 100644
--- a/audit.spec
+++ b/audit.spec
@@ -1,5 +1,5 @@
 %define sca_version 0.4.6
-%define sca_release 2
+%define sca_release 3
 %define selinux_variants mls strict targeted
 %define selinux_policyver 3.0.8 
 %{!?python_sitelib: %define python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
@@ -7,7 +7,7 @@
 Summary: User space tools for 2.6 kernel auditing
 Name: audit
 Version: 1.7.2
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: GPLv2+
 Group: System Environment/Daemons
 URL: http://people.redhat.com/sgrubb/audit/
@@ -328,6 +328,9 @@ fi
 %config(noreplace) %{_sysconfdir}/security/console.apps/system-config-audit-server
 
 %changelog
+* Fri Apr 18 2008 Steve Grubb <sgrubb@redhat.com> 1.7.2-3
+- Update auparse patch for audisp-prelude 
+
 * Fri Apr 18 2008 Steve Grubb <sgrubb@redhat.com> 1.7.2-2
 - Apply patch3 this time