2 common routines for audit logging
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2018
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "librpc/ndr/libndr.h"
28 #include "lib/tsocket/tsocket.h"
29 #include "libcli/security/dom_sid.h"
30 #include "lib/messaging/messaging.h"
31 #include "auth/common_auth.h"
32 #include "audit_logging.h"
35 * @brief Get a human readable timestamp.
37 * Returns the current time formatted as
38 * "Tue, 14 Mar 2017 08:38:42.209028 NZDT"
40 * The returned string is allocated by talloc in the supplied context.
41 * It is the callers responsibility to free it.
43 * @param mem_ctx talloc memory context that owns the returned string.
45 * @return a human readable time stamp, or NULL in the event of an error.
48 char* audit_get_timestamp(TALLOC_CTX
*frame
)
50 char buffer
[40]; /* formatted time less usec and timezone */
51 char tz
[10]; /* formatted time zone */
52 struct tm
* tm_info
; /* current local time */
53 struct timeval tv
; /* current system time */
54 int ret
; /* response code */
55 char * ts
; /* formatted time stamp */
57 ret
= gettimeofday(&tv
, NULL
);
59 DBG_ERR("Unable to get time of day: (%d) %s\n",
65 tm_info
= localtime(&tv
.tv_sec
);
66 if (tm_info
== NULL
) {
67 DBG_ERR("Unable to determine local time\n");
71 strftime(buffer
, sizeof(buffer
)-1, "%a, %d %b %Y %H:%M:%S", tm_info
);
72 strftime(tz
, sizeof(tz
)-1, "%Z", tm_info
);
73 ts
= talloc_asprintf(frame
, "%s.%06ld %s", buffer
, (long)tv
.tv_usec
, tz
);
75 DBG_ERR("Out of memory formatting time stamp\n");
81 * @brief write an audit message to the audit logs.
83 * Write a human readable text audit message to the samba logs.
85 * @param prefix Text to be printed at the start of the log line
86 * @param message The content of the log line.
87 * @param debub_class The debug class to log the message with.
88 * @param debug_level The debug level to log the message with.
90 void audit_log_human_text(const char* prefix
,
95 DEBUGC(debug_class
, debug_level
, ("%s %s\n", prefix
, message
));
100 * Constant for empty json object initialisation
102 const struct json_object json_empty_object
= {.valid
= false, .root
= NULL
};
104 * @brief write a json object to the samba audit logs.
106 * Write the json object to the audit logs as a formatted string
108 * @param message The content of the log line.
109 * @param debub_class The debug class to log the message with.
110 * @param debug_level The debug level to log the message with.
112 void audit_log_json(struct json_object
* message
,
116 TALLOC_CTX
*frame
= NULL
;
119 if (json_is_invalid(message
)) {
120 DBG_ERR("Invalid JSON object, unable to log\n");
124 frame
= talloc_stackframe();
125 s
= json_to_string(frame
, message
);
127 DBG_ERR("json_to_string returned NULL, "
128 "JSON audit message could not written\n");
133 * This is very strange, but we call this routine to get a log
134 * output without the header. JSON logs all have timestamps
135 * so this only makes parsing harder.
137 * We push out the raw JSON blob without a prefix, consumers
138 * can find such lines by the leading {
140 DEBUGADDC(debug_class
, debug_level
, ("%s\n", s
));
145 * @brief get a connection to the messaging event server.
147 * Get a connection to the messaging event server registered by server_name.
149 * @param msg_ctx a valid imessaging_context.
150 * @param server_name name of messaging event server to connect to.
151 * @param server_id The event server details to populate
155 static NTSTATUS
get_event_server(
156 struct imessaging_context
*msg_ctx
,
157 const char *server_name
,
158 struct server_id
*event_server
)
161 TALLOC_CTX
*frame
= talloc_stackframe();
162 unsigned num_servers
, i
;
163 struct server_id
*servers
;
165 status
= irpc_servers_byname(
172 if (!NT_STATUS_IS_OK(status
)) {
173 DBG_DEBUG("Failed to find the target '%s' on the message bus "
174 "to send JSON audit events to: %s\n",
182 * Select the first server that is listening, because we get
183 * connection refused as NT_STATUS_OBJECT_NAME_NOT_FOUND
186 for (i
= 0; i
< num_servers
; i
++) {
187 status
= imessaging_send(
192 if (NT_STATUS_IS_OK(status
)) {
193 *event_server
= servers
[i
];
199 "Failed to find '%s' registered on the message bus to "
200 "send JSON audit events to: %s\n",
204 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
208 * @brief send an audit message to a messaging event server.
210 * Send the message to a registered and listening event server.
211 * Note: Any errors are logged, and the message is not sent. This is to ensure
212 * that a poorly behaved event server does not impact Samba.
214 * As it is possible to lose messages, especially during server
215 * shut down, currently this function is primarily intended for use
216 * in integration tests.
218 * @param msg_ctx an imessaging_context, can be NULL in which case no message
220 * @param server_name the naname of the event server to send the message to.
221 * @param messag_type A message type defined in librpc/idl/messaging.idl
222 * @param message The message to send.
225 void audit_message_send(
226 struct imessaging_context
*msg_ctx
,
227 const char *server_name
,
228 uint32_t message_type
,
229 struct json_object
*message
)
231 struct server_id event_server
= {
236 const char *message_string
= NULL
;
237 DATA_BLOB message_blob
= data_blob_null
;
238 TALLOC_CTX
*ctx
= NULL
;
240 if (json_is_invalid(message
)) {
241 DBG_ERR("Invalid JSON object, unable to send\n");
244 if (msg_ctx
== NULL
) {
245 DBG_DEBUG("No messaging context\n");
249 ctx
= talloc_new(NULL
);
251 DBG_ERR("Out of memory creating temporary context\n");
255 /* Need to refetch the address each time as the destination server may
256 * have disconnected and reconnected in the interim, in which case
257 * messages may get lost
259 status
= get_event_server(msg_ctx
, server_name
, &event_server
);
260 if (!NT_STATUS_IS_OK(status
)) {
265 message_string
= json_to_string(ctx
, message
);
266 message_blob
= data_blob_string_const(message_string
);
267 status
= imessaging_send(
274 * If the server crashed, try to find it again
276 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
277 status
= get_event_server(msg_ctx
, server_name
, &event_server
);
278 if (!NT_STATUS_IS_OK(status
)) {
292 * @brief Create a new struct json_object, wrapping a JSON Object.
294 * Create a new json object, the json_object wraps the underlying json
295 * implementations JSON Object representation.
297 * Free with a call to json_free_object, note that the jansson implementation
298 * allocates memory with malloc and not talloc.
300 * @return a struct json_object, valid will be set to false if the object
301 * could not be created.
304 struct json_object
json_new_object(void) {
306 struct json_object object
= json_empty_object
;
308 object
.root
= json_object();
309 if (object
.root
== NULL
) {
310 object
.valid
= false;
311 DBG_ERR("Unable to create JSON object\n");
319 * @brief Create a new struct json_object wrapping a JSON Array.
321 * Create a new json object, the json_object wraps the underlying json
322 * implementations JSON Array representation.
324 * Free with a call to json_free_object, note that the jansson implementation
325 * allocates memory with malloc and not talloc.
327 * @return a struct json_object, error will be set to true if the array
328 * could not be created.
331 struct json_object
json_new_array(void) {
333 struct json_object array
= json_empty_object
;
335 array
.root
= json_array();
336 if (array
.root
== NULL
) {
338 DBG_ERR("Unable to create JSON array\n");
347 * @brief free and invalidate a previously created JSON object.
349 * Release any resources owned by a json_object, and then mark the structure
350 * as invalid. It is safe to call this multiple times on an object.
353 void json_free(struct json_object
*object
)
355 if (object
->root
!= NULL
) {
356 json_decref(object
->root
);
359 object
->valid
= false;
363 * @brief is the current JSON object invalid?
365 * Check the state of the object to determine if it is invalid.
367 * @return is the object valid?
370 bool json_is_invalid(const struct json_object
*object
)
372 return !object
->valid
;
376 * @brief Add an integer value to a JSON object.
378 * Add an integer value named 'name' to the json object.
380 * @param object the JSON object to be updated.
381 * @param name the name of the value.
382 * @param value the value.
384 * @return 0 the operation was successful
385 * -1 the operation failed
388 int json_add_int(struct json_object
*object
, const char *name
, const int value
)
391 json_t
*integer
= NULL
;
393 if (json_is_invalid(object
)) {
394 DBG_ERR("Unable to add int [%s] value [%d], "
395 "target object is invalid\n",
401 integer
= json_integer(value
);
402 if (integer
== NULL
) {
403 DBG_ERR("Unable to create integer value [%s] value [%d]\n",
409 ret
= json_object_set_new(object
->root
, name
, integer
);
411 json_decref(integer
);
412 DBG_ERR("Unable to add int [%s] value [%d]\n", name
, value
);
418 * @brief Add a boolean value to a JSON object.
420 * Add a boolean value named 'name' to the json object.
422 * @param object the JSON object to be updated.
423 * @param name the name.
424 * @param value the value.
426 * @return 0 the operation was successful
427 * -1 the operation failed
430 int json_add_bool(struct json_object
*object
,
436 if (json_is_invalid(object
)) {
437 DBG_ERR("Unable to add boolean [%s] value [%d], "
438 "target object is invalid\n",
444 ret
= json_object_set_new(object
->root
, name
, json_boolean(value
));
446 DBG_ERR("Unable to add boolean [%s] value [%d]\n", name
, value
);
452 * @brief Add a string value to a JSON object.
454 * Add a string value named 'name' to the json object.
456 * @param object the JSON object to be updated.
457 * @param name the name.
458 * @param value the value.
460 * @return 0 the operation was successful
461 * -1 the operation failed
464 int json_add_string(struct json_object
*object
,
470 if (json_is_invalid(object
)) {
471 DBG_ERR("Unable to add string [%s], target object is invalid\n",
476 json_t
*string
= json_string(value
);
477 if (string
== NULL
) {
478 DBG_ERR("Unable to add string [%s], "
479 "could not create string object\n",
483 ret
= json_object_set_new(object
->root
, name
, string
);
486 DBG_ERR("Unable to add string [%s]\n", name
);
490 ret
= json_object_set_new(object
->root
, name
, json_null());
492 DBG_ERR("Unable to add null string [%s]\n", name
);
500 * @brief Assert that the current JSON object is an array.
502 * Check that the current object is a JSON array, and if not
503 * invalidate the object. We also log an error message as this indicates
504 * bug in the calling code.
506 * @param object the JSON object to be validated.
508 void json_assert_is_array(struct json_object
*array
) {
510 if (json_is_invalid(array
)) {
514 if (json_is_array(array
->root
) == false) {
515 DBG_ERR("JSON object is not an array\n");
516 array
->valid
= false;
522 * @brief Add a JSON object to a JSON object.
524 * Add a JSON object named 'name' to the json object.
526 * @param object the JSON object to be updated.
527 * @param name the name.
528 * @param value the value.
530 * @return 0 the operation was successful
531 * -1 the operation failed
534 int json_add_object(struct json_object
*object
,
536 struct json_object
*value
)
541 if (value
!= NULL
&& json_is_invalid(value
)) {
542 DBG_ERR("Invalid JSON object [%s] supplied\n", name
);
545 if (json_is_invalid(object
)) {
546 DBG_ERR("Unable to add object [%s], target object is invalid\n",
551 jv
= value
== NULL
? json_null() : value
->root
;
553 if (json_is_array(object
->root
)) {
554 ret
= json_array_append_new(object
->root
, jv
);
555 } else if (json_is_object(object
->root
)) {
556 ret
= json_object_set_new(object
->root
, name
, jv
);
558 DBG_ERR("Invalid JSON object type\n");
562 DBG_ERR("Unable to add object [%s]\n", name
);
568 * @brief Add a string to a JSON object, truncating if necessary.
571 * Add a string value named 'name' to the json object, the string will be
572 * truncated if it is more than len characters long. If len is 0 the value
573 * is encoded as a JSON null.
576 * @param object the JSON object to be updated.
577 * @param name the name.
578 * @param value the value.
579 * @param len the maximum number of characters to be copied.
581 * @return 0 the operation was successful
582 * -1 the operation failed
585 int json_add_stringn(struct json_object
*object
,
592 if (json_is_invalid(object
)) {
593 DBG_ERR("Unable to add string [%s], target object is invalid\n",
598 if (value
!= NULL
&& len
> 0) {
599 json_t
*string
= NULL
;
602 strncpy(buffer
, value
, len
);
605 string
= json_string(buffer
);
606 if (string
== NULL
) {
607 DBG_ERR("Unable to add string [%s], "
608 "could not create string object\n",
612 ret
= json_object_set_new(object
->root
, name
, string
);
615 DBG_ERR("Unable to add string [%s]\n", name
);
619 ret
= json_object_set_new(object
->root
, name
, json_null());
621 DBG_ERR("Unable to add null string [%s]\n", name
);
629 * @brief Add a version object to a JSON object
631 * Add a version object to the JSON object
632 * "version":{"major":1, "minor":0}
634 * The version tag is intended to aid the processing of the JSON messages
635 * The major version number should change when an attribute is:
638 * - its meaning changes
639 * - its contents change format
640 * The minor version should change whenever a new attribute is added and for
641 * minor bug fixes to an attributes content.
644 * @param object the JSON object to be updated.
645 * @param major the major version number
646 * @param minor the minor version number
648 * @return 0 the operation was successful
649 * -1 the operation failed
651 int json_add_version(struct json_object
*object
, int major
, int minor
)
654 struct json_object version
;
656 if (json_is_invalid(object
)) {
657 DBG_ERR("Unable to add version, target object is invalid\n");
661 version
= json_new_object();
662 if (json_is_invalid(&version
)) {
663 DBG_ERR("Unable to add version, failed to create object\n");
666 ret
= json_add_int(&version
, "major", major
);
671 ret
= json_add_int(&version
, "minor", minor
);
676 ret
= json_add_object(object
, "version", &version
);
685 * @brief add an ISO 8601 timestamp to the object.
687 * Add the current date and time as a timestamp in ISO 8601 format
690 * "timestamp":"2017-03-06T17:18:04.455081+1300"
693 * @param object the JSON object to be updated.
695 * @return 0 the operation was successful
696 * -1 the operation failed
698 int json_add_timestamp(struct json_object
*object
)
700 char buffer
[40]; /* formatted time less usec and timezone */
701 char timestamp
[65]; /* the formatted ISO 8601 time stamp */
702 char tz
[10]; /* formatted time zone */
703 struct tm
* tm_info
; /* current local time */
704 struct timeval tv
; /* current system time */
705 int r
; /* response code from gettimeofday */
706 int ret
; /* return code from json operations */
708 if (json_is_invalid(object
)) {
709 DBG_ERR("Unable to add time stamp, target object is invalid\n");
713 r
= gettimeofday(&tv
, NULL
);
715 DBG_ERR("Unable to get time of day: (%d) %s\n",
721 tm_info
= localtime(&tv
.tv_sec
);
722 if (tm_info
== NULL
) {
723 DBG_ERR("Unable to determine local time\n");
727 strftime(buffer
, sizeof(buffer
)-1, "%Y-%m-%dT%T", tm_info
);
728 strftime(tz
, sizeof(tz
)-1, "%z", tm_info
);
736 ret
= json_add_string(object
, "timestamp", timestamp
);
738 DBG_ERR("Unable to add time stamp to JSON object\n");
744 *@brief Add a tsocket_address to a JSON object
746 * Add the string representation of a Samba tsocket_address to the object.
748 * "localAddress":"ipv6::::0"
751 * @param object the JSON object to be updated.
752 * @param name the name.
753 * @param address the tsocket_address.
755 * @return 0 the operation was successful
756 * -1 the operation failed
759 int json_add_address(struct json_object
*object
,
761 const struct tsocket_address
*address
)
765 if (json_is_invalid(object
)) {
766 DBG_ERR("Unable to add address [%s], "
767 "target object is invalid\n",
772 if (address
== NULL
) {
773 ret
= json_object_set_new(object
->root
, name
, json_null());
775 DBG_ERR("Unable to add null address [%s]\n", name
);
779 TALLOC_CTX
*ctx
= talloc_new(NULL
);
783 DBG_ERR("Out of memory adding address [%s]\n", name
);
787 s
= tsocket_address_string(address
, ctx
);
789 DBG_ERR("Out of memory adding address [%s]\n", name
);
793 ret
= json_add_string(object
, name
, s
);
796 "Unable to add address [%s] value [%s]\n", name
, s
);
806 * @brief Add a formatted string representation of a sid to a json object.
808 * Add the string representation of a Samba sid to the object.
813 * @param object the JSON object to be updated.
814 * @param name the name.
817 * @return 0 the operation was successful
818 * -1 the operation failed
821 int json_add_sid(struct json_object
*object
,
823 const struct dom_sid
*sid
)
827 if (json_is_invalid(object
)) {
828 DBG_ERR("Unable to add SID [%s], "
829 "target object is invalid\n",
835 ret
= json_object_set_new(object
->root
, name
, json_null());
837 DBG_ERR("Unable to add null SID [%s]\n", name
);
841 struct dom_sid_buf sid_buf
;
843 ret
= json_add_string(
844 object
, name
, dom_sid_str_buf(sid
, &sid_buf
));
846 DBG_ERR("Unable to add SID [%s] value [%s]\n",
856 * @brief Add a formatted string representation of a guid to a json object.
858 * Add the string representation of a Samba GUID to the object.
860 * "guid":"1fb9f2ee-2a4d-4bf8-af8b-cb9d4529a9ab"
863 * @param object the JSON object to be updated.
864 * @param name the name.
865 * @param guid the guid.
867 * @return 0 the operation was successful
868 * -1 the operation failed
872 int json_add_guid(struct json_object
*object
,
874 const struct GUID
*guid
)
879 if (json_is_invalid(object
)) {
880 DBG_ERR("Unable to add GUID [%s], "
881 "target object is invalid\n",
887 ret
= json_object_set_new(object
->root
, name
, json_null());
889 DBG_ERR("Unable to add null GUID [%s]\n", name
);
894 struct GUID_txt_buf guid_buff
;
896 guid_str
= GUID_buf_string(guid
, &guid_buff
);
897 ret
= json_add_string(object
, name
, guid_str
);
899 DBG_ERR("Unable to guid GUID [%s] value [%s]\n",
909 * @brief Replaces the object for a given key with a given json object.
911 * If key already exists, the value will be replaced. Otherwise the given
912 * value will be added under the given key.
914 * @param object the JSON object to be updated.
915 * @param key the key which will be updated.
916 * @param new_obj the new value object to be inserted.
918 * @return 0 the operation was successful
919 * -1 the operation failed (e.j. if one of the paramters is invalid)
921 int json_update_object(struct json_object
*object
,
923 struct json_object
*new_obj
)
927 if (json_is_invalid(object
)) {
928 DBG_ERR("Unable to update key [%s], "
929 "target object is invalid\n",
933 if (json_is_invalid(new_obj
)) {
934 DBG_ERR("Unable to update key [%s], "
935 "new object is invalid\n",
941 DBG_ERR("Unable to add null String as key\n");
945 ret
= json_object_set(object
->root
, key
, new_obj
->root
);
947 DBG_ERR("Unable to update object\n");
955 * @brief Convert a JSON object into a string
957 * Convert the json object into a string suitable for printing on a log line,
958 * i.e. with no embedded line breaks.
960 * If the object is invalid it logs an error and returns NULL.
962 * @param mem_ctx the talloc memory context owning the returned string
963 * @param object the json object.
965 * @return A string representation of the object or NULL if the object
968 char *json_to_string(TALLOC_CTX
*mem_ctx
, const struct json_object
*object
)
971 char *json_string
= NULL
;
973 if (json_is_invalid(object
)) {
974 DBG_ERR("Invalid JSON object, unable to convert to string\n");
978 if (object
->root
== NULL
) {
983 * json_dumps uses malloc, so need to call free(json) to release
986 json
= json_dumps(object
->root
, 0);
988 DBG_ERR("Unable to convert JSON object to string\n");
992 json_string
= talloc_strdup(mem_ctx
, json
);
993 if (json_string
== NULL
) {
995 DBG_ERR("Unable to copy JSON object string to talloc string\n");
1004 * @brief get a json array named "name" from the json object.
1006 * Get the array attribute named name, creating it if it does not exist.
1008 * @param object the json object.
1009 * @param name the name of the array attribute
1011 * @return The array object, will be created if it did not exist.
1013 struct json_object
json_get_array(struct json_object
*object
, const char *name
)
1016 struct json_object array
= json_empty_object
;
1020 if (json_is_invalid(object
)) {
1021 DBG_ERR("Invalid JSON object, unable to get array [%s]\n",
1027 array
= json_new_array();
1028 if (json_is_invalid(&array
)) {
1029 DBG_ERR("Unable to create new array for [%s]\n", name
);
1033 a
= json_object_get(object
->root
, name
);
1038 ret
= json_array_extend(array
.root
, a
);
1040 DBG_ERR("Unable to get array [%s]\n", name
);
1049 * @brief get a json object named "name" from the json object.
1051 * Get the object attribute named name, creating it if it does not exist.
1053 * @param object the json object.
1054 * @param name the name of the object attribute
1056 * @return The object, will be created if it did not exist.
1058 struct json_object
json_get_object(struct json_object
*object
, const char *name
)
1061 struct json_object o
= json_new_object();
1065 if (json_is_invalid(object
)) {
1066 DBG_ERR("Invalid JSON object, unable to get object [%s]\n",
1072 v
= json_object_get(object
->root
, name
);
1076 ret
= json_object_update(o
.root
, v
);
1078 DBG_ERR("Unable to get object [%s]\n", name
);