Implement audit record deserialization

auditd-record.cpp

@@ -605,3 +605,146 @@ boost::property_tree::ptree AuditRecord::toPtree() const
 
 	return data;
 }
+
+AuditRecord AuditRecord::fromPtree(const boost::property_tree::ptree &data)
+{
+	AuditRecord result;
+
+	{
+		auto child = data.get_child_optional("time");
+		if (child)
+		{
+			result.time = boost::lexical_cast<decltype(AuditRecord::time)>(child->get_value<std::string>());
+		}
+	}
+
+	{
+		auto child = data.get_child_optional("milliseconds");
+		if (child)
+		{
+			result.milliseconds = boost::lexical_cast<decltype(AuditRecord::milliseconds)>(child->get_value<std::string>());
+		}
+	}
+
+	{
+		auto child = data.get_child_optional("serial");
+		if (child)
+		{
+			result.serial = boost::lexical_cast<decltype(AuditRecord::serial)>(child->get_value<std::string>());
+		}
+	}
+
+	{
+		auto child = data.get_child_optional("node");
+		if (child)
+		{
+			result.node = boost::lexical_cast<decltype(AuditRecord::node)>(child->get_value<std::string>());
+		}
+	}
+
+	{
+		auto fields = data.get_child_optional("fields");
+		if (fields)
+		{
+			for (auto iter = fields->begin(); iter != fields->end(); ++iter)
+			{
+				auto field_type = iter->second.get_child_optional("type");
+				if (field_type)
+				{
+					auto field_type_value = static_cast<AbstractRecordField::Type>(boost::lexical_cast<int>(field_type->get_value<std::string>()));
+
+					switch (field_type_value)
+					{
+					case AbstractRecordField::Type::Int:
+						{
+							auto record_field = std::dynamic_pointer_cast<IntegerRecordField>(IntegerRecordField::createRecord(iter->first));
+							if (record_field)
+							{
+								auto int_value = iter->second.get_child_optional("value_int");
+								if (int_value)
+								{
+									record_field->setIntValue(boost::lexical_cast<int>(int_value->get_value<std::string>()));
+								}
+
+								auto str_value = iter->second.get_child_optional("value_str");
+								if (str_value)
+								{
+									record_field->setStringValue(str_value->get_value<std::string>());
+								}
+
+								result.fields[iter->first] = record_field;
+							}
+						}
+						break;
+
+					case AbstractRecordField::Type::String:
+						{
+							auto record_field = std::dynamic_pointer_cast<StringRecordField>(StringRecordField::createRecord(iter->first));
+							if (record_field)
+							{
+								auto str_value = iter->second.get_child_optional("value_str");
+								if (str_value)
+								{
+									record_field->setStringValue(str_value->get_value<std::string>());
+								}
+
+								result.fields[iter->first] = record_field;
+							}
+						}
+						break;
+
+					case AbstractRecordField::Type::InterpretedString:
+						{
+							auto record_field = std::dynamic_pointer_cast<InterpretedStringRecordField>(InterpretedStringRecordField::createRecord(iter->first));
+							if (record_field)
+							{
+								auto str_value = iter->second.get_child_optional("value_str");
+								if (str_value)
+								{
+									record_field->setStringValue(str_value->get_value<std::string>());
+								}
+
+								result.fields[iter->first] = record_field;
+							}
+						}
+						break;
+
+					case AbstractRecordField::Type::InterpretedStringArray:
+						{
+							auto record_field = std::dynamic_pointer_cast<InterpretedStringArrayRecordField>(InterpretedStringArrayRecordField::createRecord(iter->first));
+							if (record_field)
+							{
+								std::list<std::string> names, values;
+
+								auto name_child = iter->second.get_child_optional("names");
+								if (name_child)
+								{
+									for (auto child_iter = name_child->begin(); child_iter != name_child->end(); ++child_iter)
+									{
+										names.push_back(child_iter->second.get_value<std::string>());
+									}
+								}
+
+								auto value_child = iter->second.get_child_optional("values");
+								if (value_child)
+								{
+									for (auto child_iter = value_child->begin(); child_iter != value_child->end(); ++child_iter)
+									{
+										values.push_back(child_iter->second.get_value<std::string>());
+									}
+								}
+
+								record_field->setArrays(names, values);
+
+								result.fields[iter->first] = record_field;
+							}
+						}
+						break;
+					}
+				}
+			}
+		}
+	}
+
+	return result;
+}

auditd-record.hpp

@@ -93,6 +93,7 @@ struct AuditRecord
 	std::map<std::string, std::shared_ptr<AbstractRecordField> > fields;
 
 	boost::property_tree::ptree toPtree() const;
+	static AuditRecord fromPtree(const boost::property_tree::ptree &data);
 };
 
 class CommonStringRecordField: public AbstractRecordField