auditlog.c 6.14 KB
Newer Older
Howard Chu's avatar
Howard Chu committed
1
2
3
4
/* auditlog.c - log modifications for audit/history purposes */
/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
 *
Quanah Gibson-Mount's avatar
Quanah Gibson-Mount committed
5
 * Copyright 2005-2020 The OpenLDAP Foundation.
Howard Chu's avatar
Howard Chu committed
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
 * Portions copyright 2004-2005 Symas Corporation.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */
/* ACKNOWLEDGEMENTS:
 * This work was initially developed by Symas Corp. for inclusion in
 * OpenLDAP Software.  This work was sponsored by Hewlett-Packard.
 */

#include "portable.h"

#ifdef SLAPD_OVER_AUDITLOG

#include <stdio.h>

#include <ac/string.h>
#include <ac/ctype.h>

#include "slap.h"
32
#include "config.h"
Howard Chu's avatar
Howard Chu committed
33
34
35
36
37
38
39
#include "ldif.h"

typedef struct auditlog_data {
	ldap_pvt_thread_mutex_t ad_mutex;
	char *ad_logfile;
} auditlog_data;

40
41
42
43
44
45
static ConfigTable auditlogcfg[] = {
	{ "auditlog", "filename", 2, 2, 0,
	  ARG_STRING|ARG_OFFSET,
	  (void *)offsetof(auditlog_data, ad_logfile),
	  "( OLcfgOvAt:15.1 NAME 'olcAuditlogFile' "
	  "DESC 'Filename for auditlogging' "
46
	  "EQUALITY caseExactMatch "
47
48
49
50
51
52
53
54
55
56
57
58
59
60
	  "SYNTAX OMsDirectoryString )", NULL, NULL },
	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
};

static ConfigOCs auditlogocs[] = {
	{ "( OLcfgOvOc:15.1 "
	  "NAME 'olcAuditlogConfig' "
	  "DESC 'Auditlog configuration' "
	  "SUP olcOverlayConfig "
	  "MAY ( olcAuditlogFile ) )",
	  Cft_Overlay, auditlogcfg },
	{ NULL, 0, NULL }
};

Howard Chu's avatar
Howard Chu committed
61
static int fprint_ldif(FILE *f, char *name, char *val, ber_len_t len) {
Howard Chu's avatar
Howard Chu committed
62
63
64
65
66
67
68
69
	char *s;
	if((s = ldif_put(LDIF_PUT_VALUE, name, val, len)) == NULL)
		return(-1);
	fputs(s, f);
	ber_memfree(s);
	return(0);
}

Howard Chu's avatar
Howard Chu committed
70
static int auditlog_response(Operation *op, SlapReply *rs) {
Howard Chu's avatar
Howard Chu committed
71
72
73
74
75
	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
	auditlog_data *ad = on->on_bi.bi_private;
	FILE *f;
	Attribute *a;
	Modifications *m;
76
	struct berval *b, *who = NULL, peername;
77
	char *what, *whatm, *suffix;
78
	time_t stamp;
Howard Chu's avatar
Howard Chu committed
79
80
81
82
	int i;

	if ( rs->sr_err != LDAP_SUCCESS ) return SLAP_CB_CONTINUE;

Howard Chu's avatar
cleanup    
Howard Chu committed
83
	if ( !ad->ad_logfile ) return SLAP_CB_CONTINUE;
Howard Chu's avatar
Howard Chu committed
84
85
86
87
88
89
90
91
92
93
94
95

/*
** add or modify: use modifiersName if present
**
*/
	switch(op->o_tag) {
		case LDAP_REQ_MODRDN:	what = "modrdn";	break;
		case LDAP_REQ_DELETE:	what = "delete";	break;
		case LDAP_REQ_ADD:
			what = "add";
			for(a = op->ora_e->e_attrs; a; a = a->a_next)
				if( a->a_desc == slap_schema.si_ad_modifiersName ) {
96
					who = &a->a_vals[0];
Howard Chu's avatar
Howard Chu committed
97
98
99
100
101
102
					break;
				}
			break;
		case LDAP_REQ_MODIFY:
			what = "modify";
			for(m = op->orm_modlist; m; m = m->sml_next)
Howard Chu's avatar
Howard Chu committed
103
104
105
				if( m->sml_desc == slap_schema.si_ad_modifiersName &&
					( m->sml_op == LDAP_MOD_ADD ||
					m->sml_op == LDAP_MOD_REPLACE )) {
106
					who = &m->sml_values[0];
Howard Chu's avatar
Howard Chu committed
107
108
109
110
111
112
113
114
115
116
117
118
119
120
					break;
				}
			break;
		default:
			return SLAP_CB_CONTINUE;
	}

	suffix = op->o_bd->be_suffix[0].bv_len ? op->o_bd->be_suffix[0].bv_val :
		"global";

/*
** note: this means requestor's dn when modifiersName is null
*/
	if ( !who )
121
		who = &op->o_dn;
Howard Chu's avatar
Howard Chu committed
122

123
	peername = op->o_conn->c_peer_name;
Howard Chu's avatar
Howard Chu committed
124
125
126
127
128
129
	ldap_pvt_thread_mutex_lock(&ad->ad_mutex);
	if((f = fopen(ad->ad_logfile, "a")) == NULL) {
		ldap_pvt_thread_mutex_unlock(&ad->ad_mutex);
		return SLAP_CB_CONTINUE;
	}

130
	stamp = slap_get_time();
131
132
133
	fprintf(f, "# %s %ld %s%s%s %s conn=%ld\n",
		what, (long)stamp, suffix, who ? " " : "", who ? who->bv_val : "",
		peername.bv_val ? peername.bv_val: "", op->o_conn->c_connid);
134

Howard Chu's avatar
Howard Chu committed
135
136
137
	if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) &&
		(!who || !dn_match( who, &op->o_conn->c_dn )))
		fprintf(f, "# realdn: %s\n", op->o_conn->c_dn.bv_val );
138
139

	fprintf(f, "dn: %s\nchangetype: %s\n",
Howard Chu's avatar
Howard Chu committed
140
141
142
143
144
		op->o_req_dn.bv_val, what);

	switch(op->o_tag) {
	  case LDAP_REQ_ADD:
		for(a = op->ora_e->e_attrs; a; a = a->a_next)
145
		  if((b = a->a_vals) != NULL)
Howard Chu's avatar
Howard Chu committed
146
147
148
149
150
151
152
			for(i = 0; b[i].bv_val; i++)
				fprint_ldif(f, a->a_desc->ad_cname.bv_val, b[i].bv_val, b[i].bv_len);
		break;

	  case LDAP_REQ_MODIFY:
		for(m = op->orm_modlist; m; m = m->sml_next) {
			switch(m->sml_op & LDAP_MOD_OP) {
153
154
155
156
				case LDAP_MOD_ADD:	 whatm = "add";		break;
				case LDAP_MOD_REPLACE:	 whatm = "replace";	break;
				case LDAP_MOD_DELETE:	 whatm = "delete";	break;
				case LDAP_MOD_INCREMENT: whatm = "increment";	break;
Howard Chu's avatar
Howard Chu committed
157
158
159
160
				default:
					fprintf(f, "# MOD_TYPE_UNKNOWN:%02x\n", m->sml_op & LDAP_MOD_OP);
					continue;
			}
161
			fprintf(f, "%s: %s\n", whatm, m->sml_desc->ad_cname.bv_val);
162
163
			if((b = m->sml_values) != NULL)
			  for(i = 0; b[i].bv_val; i++)
Howard Chu's avatar
Howard Chu committed
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
				fprint_ldif(f, m->sml_desc->ad_cname.bv_val, b[i].bv_val, b[i].bv_len);
			fprintf(f, "-\n");
		}
		break;

	  case LDAP_REQ_MODRDN:
		fprintf(f, "newrdn: %s\ndeleteoldrdn: %s\n",
			op->orr_newrdn.bv_val, op->orr_deleteoldrdn ? "1" : "0");
		if(op->orr_newSup) fprintf(f, "newsuperior: %s\n", op->orr_newSup->bv_val);
		break;

	  case LDAP_REQ_DELETE:
		/* nothing else needed */
		break;
	}

180
	fprintf(f, "# end %s %ld\n\n", what, (long)stamp);
Howard Chu's avatar
Howard Chu committed
181
182
183
184
185
186
187
188
189
190

	fclose(f);
	ldap_pvt_thread_mutex_unlock(&ad->ad_mutex);
	return SLAP_CB_CONTINUE;
}

static slap_overinst auditlog;

static int
auditlog_db_init(
191
	BackendDB *be,
192
	ConfigReply *cr
Howard Chu's avatar
Howard Chu committed
193
194
195
)
{
	slap_overinst *on = (slap_overinst *)be->bd_info;
Howard Chu's avatar
Howard Chu committed
196
	auditlog_data *ad = ch_calloc(1, sizeof(auditlog_data));
Howard Chu's avatar
Howard Chu committed
197
198
199
200
201
202
203
204

	on->on_bi.bi_private = ad;
	ldap_pvt_thread_mutex_init( &ad->ad_mutex );
	return 0;
}

static int
auditlog_db_destroy(
205
	BackendDB *be,
206
	ConfigReply *cr
Howard Chu's avatar
Howard Chu committed
207
208
209
210
211
212
)
{
	slap_overinst *on = (slap_overinst *)be->bd_info;
	auditlog_data *ad = on->on_bi.bi_private;

	ldap_pvt_thread_mutex_destroy( &ad->ad_mutex );
213
	free( ad->ad_logfile );
Howard Chu's avatar
Howard Chu committed
214
	free( ad );
215
	return 0;
Howard Chu's avatar
Howard Chu committed
216
217
}

218
int auditlog_initialize() {
219
	int rc;
Howard Chu's avatar
Howard Chu committed
220
221

	auditlog.on_bi.bi_type = "auditlog";
222
	auditlog.on_bi.bi_flags = SLAPO_BFLAG_SINGLE;
Howard Chu's avatar
Howard Chu committed
223
224
225
226
	auditlog.on_bi.bi_db_init = auditlog_db_init;
	auditlog.on_bi.bi_db_destroy = auditlog_db_destroy;
	auditlog.on_response = auditlog_response;

227
228
229
230
	auditlog.on_bi.bi_cf_ocs = auditlogocs;
	rc = config_register_schema( auditlogcfg, auditlogocs );
	if ( rc ) return rc;

Howard Chu's avatar
Howard Chu committed
231
232
233
234
	return overlay_register(&auditlog);
}

#if SLAPD_OVER_AUDITLOG == SLAPD_MOD_DYNAMIC && defined(PIC)
235
236
237
238
int
init_module( int argc, char *argv[] )
{
	return auditlog_initialize();
Howard Chu's avatar
Howard Chu committed
239
240
241
242
}
#endif

#endif /* SLAPD_OVER_AUDITLOG */