Add auparse_new_buffer function to auparse library

ChangeLog

@@ -3,6 +3,7 @@
 - Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
 - Only enable periodic timers when listening on the network
 - Upgrade libev to 4.33
+- Add auparse_new_buffer function to auparse library
 
 3.0
 - Generate checkpoint file even when no results are returned (Burn Alting)

auparse/auparse.c

@@ -626,6 +626,19 @@ static void consume_feed(auparse_state_t *au, int flush)
 	}
 }
 
+int auparse_new_buffer(auparse_state_t *au, const char *data, size_t data_len)
+{
+	if (au->source != AUSOURCE_BUFFER)
+		return 1;
+
+	auparse_reset(au);
+
+	if (databuf_replace(&au->databuf, data, data_len) < 0)
+		return 1;
+
+	return 0;
+}
+
 int auparse_feed(auparse_state_t *au, const char *data, size_t data_len)
 {
 	if (databuf_append(&au->databuf, data, data_len) < 0)

auparse/auparse.h

@@ -41,6 +41,7 @@ typedef void (*auparse_callback_ptr)(auparse_state_t *au,
 
 /* General functions that affect operation of the library */
 auparse_state_t *auparse_init(ausource_t source, const void *b);
+int auparse_new_buffer(auparse_state_t *au, const char *data, size_t data_len);
 int auparse_feed(auparse_state_t *au, const char *data, size_t data_len);
 void auparse_feed_age_events(auparse_state_t *au);
 int auparse_flush_feed(auparse_state_t *au);

auparse/data_buf.c

@@ -210,10 +210,11 @@ int databuf_append(DataBuf *db, const char *src, size_t src_size)
     if (debug) databuf_print(db, 1, "databuf_append() size=%zd", src_size);
 #endif
     if ((new_size > db->alloc_size) ||
-        ((db->flags & DATABUF_FLAG_PRESERVE_HEAD) && !databuf_tail_available(db, src_size))) {
+        ((db->flags & DATABUF_FLAG_PRESERVE_HEAD) &&
+			!databuf_tail_available(db, src_size))) {
         /* not enough room, we must realloc */
         void *new_alloc;
-        
+
         databuf_shift_data_to_beginning(db);
         if ((new_alloc = realloc(db->alloc_ptr, new_size))) {
             db->alloc_ptr  = new_alloc;
@@ -243,6 +244,16 @@ int databuf_append(DataBuf *db, const char *src, size_t src_size)
     return 1;
 }
 
+int databuf_replace(DataBuf *db, const char *src, size_t src_size)
+{
+    DATABUF_VALIDATE(db);
+
+    if (src == NULL || src_size == 0) return 0;
+
+    db->len = 0;
+    return databuf_append(db, src, src_size);
+}
+
 static int databuf_strcat(DataBuf *db, const char *str)
 {
     size_t str_len;

auparse/data_buf.h

@@ -76,6 +76,7 @@ void databuf_print(DataBuf *db, int print_data, char *fmt, ...)
 int databuf_init(DataBuf *db, size_t size, unsigned flags);
 void databuf_free(DataBuf *db);
 int databuf_append(DataBuf *db, const char *src, size_t src_size);
+int databuf_replace(DataBuf *db, const char *src, size_t src_size);
 int databuf_advance(DataBuf *db, size_t advance);
 int databuf_reset(DataBuf *db);
 

docs/Makefile.am

@@ -1,5 +1,5 @@
 # Makefile.am --
-# Copyright 2004-09,2012,2014-18 Red Hat Inc., Durham, North Carolina.
+# Copyright 2004-09,2012,2014-18 Red Hat Inc.
 # All Rights Reserved.
 #
 # This program is free software; you can redistribute it and/or modify
@@ -32,7 +32,7 @@ audit_get_reply.3 audit_get_session.3 \
 audit_log_acct_message.3 audit_log_user_avc_message.3 \
 audit_log_user_command.3 audit_log_user_comm_message.3 \
 audit_log_user_message.3 audit_log_semanage_message.3 \
-audit_open.3 audit_request_rules_list_data.3 \
+auparse_new_buffer.3 audit_open.3 audit_request_rules_list_data.3 \
 audit_request_signal_info.3 audit_request_status.3 audit.rules.7 \
 audit_set_backlog_limit.3 audit_set_enabled.3 audit_set_failure.3 \
 audit_setloginuid.3 audit_set_pid.3 audit_set_rate_limit.3 \

docs/auparse_new_buffer.3

@@ -0,0 +1,38 @@
+.TH "AUPARSE_NEW_BUFFER" "3" "Feb 2021" "Red Hat" "Linux Audit API"
+.SH NAME
+auparse_new_buffer \- replace the buffer in the parser
+.SH "SYNOPSIS"
+.B #include <auparse.h>
+.sp
+.nf
+int auparse_new_buffer(auparse_state_t *au, const char *data, size_t data_len);
+.fi
+
+.TP
+.I au
+The audit parse state
+.TP
+.I data
+a buffer of data to give to the parser, it is
+.I data_len
+bytes long. The data is copied in the parser, upon return the caller may free or reuse the data buffer.
+.TP
+.I data_len
+number of bytes in
+.I data
+
+.SH "DESCRIPTION"
+
+.I auparse_new_buffer
+replaces the data that the parser works on.
+.I auparse_init()
+must have been called with a source type of AUSOURCE_BUFFER.
+
+.SH "RETURN VALUE"
+
+Returns 1 if an error occurs; otherwise, 0 for success.
+
+.SH "SEE ALSO"
+
+.BR auparse_init (3)
+