Hex decode name value in PATH record (#21)

The name field (filename) contained in PATH records can be hex encoded. This updates auparse to attempt hex decoding on the field.

Fixes #20

CHANGELOG.md

@@ -8,6 +8,9 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Changed
 
+- auparse - Fixed an issue where the name value was not being hex decoded from
+  PATH records. #20
+
 ### Deprecated
 
 ### Removed

auparse/auparse.go

@@ -353,6 +353,7 @@ func enrichData(msg *AuditMessage) error {
 		}
 	case AUDIT_PATH:
 		parseSELinuxContext("obj", msg.fields)
+		hexDecode("name", msg.fields)
 	case AUDIT_USER_LOGIN:
 		// acct only exists in failed logins.
 		hexDecode("acct", msg.fields)

auparse/testdata/audit-ubuntu14.log

@@ -0,0 +1 @@
+type=PATH msg=audit(1521758453.536:1428931): item=0 name=2F73686172652F67656E6572616C2F706174685F7265646163746564 inode=1442434 dev=fc:01 mode=042775 ouid=10067 ogid=7003 rdev=00:00 nametype=NORMAL

auparse/testdata/audit-ubuntu14.log.golden

@@ -0,0 +1,19 @@
+[
+  {
+    "@timestamp": "2018-03-22T22:40:53.536Z",
+    "record_type": "path",
+    "sequence": 1428931,
+    "raw_msg": "audit(1521758453.536:1428931): item=0 name=2F73686172652F67656E6572616C2F706174685F7265646163746564 inode=1442434 dev=fc:01 mode=042775 ouid=10067 ogid=7003 rdev=00:00 nametype=NORMAL",
+    "data": {
+      "dev": "fc:01",
+      "inode": "1442434",
+      "item": "0",
+      "mode": "042775",
+      "name": "/share/general/path_redacted",
+      "nametype": "NORMAL",
+      "ogid": "7003",
+      "ouid": "10067",
+      "rdev": "00:00"
+    }
+  }
+]