2 common routines for audit logging
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2018
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "librpc/ndr/libndr.h"
28 #include "lib/tsocket/tsocket.h"
29 #include "libcli/security/dom_sid.h"
30 #include "lib/messaging/messaging.h"
31 #include "auth/common_auth.h"
32 #include "audit_logging.h"
35 * @brief Get a human readable timestamp.
37 * Returns the current time formatted as
38 * "Tue, 14 Mar 2017 08:38:42.209028 NZDT"
40 * The returned string is allocated by talloc in the supplied context.
41 * It is the callers responsibility to free it.
43 * @param mem_ctx talloc memory context that owns the returned string.
45 * @return a human readable time stamp, or NULL in the event of an error.
48 char* audit_get_timestamp(TALLOC_CTX
*frame
)
50 char buffer
[40]; /* formatted time less usec and timezone */
51 char tz
[10]; /* formatted time zone */
52 struct tm
* tm_info
; /* current local time */
53 struct timeval tv
; /* current system time */
54 int ret
; /* response code */
55 char * ts
; /* formatted time stamp */
57 ret
= gettimeofday(&tv
, NULL
);
59 DBG_ERR("Unable to get time of day: (%d) %s\n",
65 tm_info
= localtime(&tv
.tv_sec
);
66 if (tm_info
== NULL
) {
67 DBG_ERR("Unable to determine local time\n");
71 strftime(buffer
, sizeof(buffer
)-1, "%a, %d %b %Y %H:%M:%S", tm_info
);
72 strftime(tz
, sizeof(tz
)-1, "%Z", tm_info
);
73 ts
= talloc_asprintf(frame
, "%s.%06ld %s", buffer
, tv
.tv_usec
, tz
);
75 DBG_ERR("Out of memory formatting time stamp\n");
81 * @brief write an audit message to the audit logs.
83 * Write a human readable text audit message to the samba logs.
85 * @param prefix Text to be printed at the start of the log line
86 * @param message The content of the log line.
87 * @param debub_class The debug class to log the message with.
88 * @param debug_level The debug level to log the message with.
90 void audit_log_human_text(const char* prefix
,
95 DEBUGC(debug_class
, debug_level
, ("%s %s\n", prefix
, message
));
100 * Constant for empty json object initialisation
102 const struct json_object json_empty_object
= {.valid
= false, .root
= NULL
};
104 * @brief write a json object to the samba audit logs.
106 * Write the json object to the audit logs as a formatted string
108 * @param message The content of the log line.
109 * @param debub_class The debug class to log the message with.
110 * @param debug_level The debug level to log the message with.
112 void audit_log_json(struct json_object
* message
,
116 TALLOC_CTX
*frame
= NULL
;
119 if (json_is_invalid(message
)) {
120 DBG_ERR("Invalid JSON object, unable to log\n");
124 frame
= talloc_stackframe();
125 s
= json_to_string(frame
, message
);
127 DBG_ERR("json_to_string returned NULL, "
128 "JSON audit message could not written\n");
133 * This is very strange, but we call this routine to get a log
134 * output without the header. JSON logs all have timestamps
135 * so this only makes parsing harder.
137 * We push out the raw JSON blob without a prefix, consumers
138 * can find such lines by the leading {
140 DEBUGADDC(debug_class
, debug_level
, ("%s\n", s
));
145 * @brief get a connection to the messaging event server.
147 * Get a connection to the messaging event server registered by server_name.
149 * @param msg_ctx a valid imessaging_context.
150 * @param server_name name of messaging event server to connect to.
151 * @param server_id The event server details to populate
155 static NTSTATUS
get_event_server(
156 struct imessaging_context
*msg_ctx
,
157 const char *server_name
,
158 struct server_id
*event_server
)
161 TALLOC_CTX
*frame
= talloc_stackframe();
162 unsigned num_servers
, i
;
163 struct server_id
*servers
;
165 status
= irpc_servers_byname(
172 if (!NT_STATUS_IS_OK(status
)) {
174 "Failed to find '%s' registered on the message bus to "
175 "send JSON audit events to: %s\n",
183 * Select the first server that is listening, because we get
184 * connection refused as NT_STATUS_OBJECT_NAME_NOT_FOUND
187 for (i
= 0; i
< num_servers
; i
++) {
188 status
= imessaging_send(
193 if (NT_STATUS_IS_OK(status
)) {
194 *event_server
= servers
[i
];
200 "Failed to find '%s' registered on the message bus to "
201 "send JSON audit events to: %s\n",
205 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
209 * @brief send an audit message to a messaging event server.
211 * Send the message to a registered and listening event server.
212 * Note: Any errors are logged, and the message is not sent. This is to ensure
213 * that a poorly behaved event server does not impact Samba.
215 * As it is possible to lose messages, especially during server
216 * shut down, currently this function is primarily intended for use
217 * in integration tests.
219 * @param msg_ctx an imessaging_context, can be NULL in which case no message
221 * @param server_name the naname of the event server to send the message to.
222 * @param messag_type A message type defined in librpc/idl/messaging.idl
223 * @param message The message to send.
226 void audit_message_send(
227 struct imessaging_context
*msg_ctx
,
228 const char *server_name
,
229 uint32_t message_type
,
230 struct json_object
*message
)
232 struct server_id event_server
= {};
235 const char *message_string
= NULL
;
236 DATA_BLOB message_blob
= data_blob_null
;
237 TALLOC_CTX
*ctx
= NULL
;
239 if (json_is_invalid(message
)) {
240 DBG_ERR("Invalid JSON object, unable to send\n");
243 if (msg_ctx
== NULL
) {
244 DBG_DEBUG("No messaging context\n");
248 /* Need to refetch the address each time as the destination server may
249 * have disconnected and reconnected in the interim, in which case
250 * messages may get lost
252 status
= get_event_server(msg_ctx
, server_name
, &event_server
);
253 if (!NT_STATUS_IS_OK(status
)) {
258 message_string
= json_to_string(ctx
, message
);
259 message_blob
= data_blob_string_const(message_string
);
260 status
= imessaging_send(
267 * If the server crashed, try to find it again
269 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
270 status
= get_event_server(msg_ctx
, server_name
, &event_server
);
271 if (!NT_STATUS_IS_OK(status
)) {
285 * @brief Create a new struct json_object, wrapping a JSON Object.
287 * Create a new json object, the json_object wraps the underlying json
288 * implementations JSON Object representation.
290 * Free with a call to json_free_object, note that the jansson inplementation
291 * allocates memory with malloc and not talloc.
293 * @return a struct json_object, valid will be set to false if the object
294 * could not be created.
297 struct json_object
json_new_object(void) {
299 struct json_object object
= json_empty_object
;
301 object
.root
= json_object();
302 if (object
.root
== NULL
) {
303 object
.valid
= false;
304 DBG_ERR("Unable to create JSON object\n");
312 * @brief Create a new struct json_object wrapping a JSON Array.
314 * Create a new json object, the json_object wraps the underlying json
315 * implementations JSON Array representation.
317 * Free with a call to json_free_object, note that the jansson inplementation
318 * allocates memory with malloc and not talloc.
320 * @return a struct json_object, error will be set to true if the array
321 * could not be created.
324 struct json_object
json_new_array(void) {
326 struct json_object array
= json_empty_object
;
328 array
.root
= json_array();
329 if (array
.root
== NULL
) {
331 DBG_ERR("Unable to create JSON array\n");
340 * @brief free and invalidate a previously created JSON object.
342 * Release any resources owned by a json_object, and then mark the structure
343 * as invalid. It is safe to call this multiple times on an object.
346 void json_free(struct json_object
*object
)
348 if (object
->root
!= NULL
) {
349 json_decref(object
->root
);
352 object
->valid
= false;
356 * @brief is the current JSON object invalid?
358 * Check the state of the object to determine if it is invalid.
360 * @return is the object valid?
363 bool json_is_invalid(const struct json_object
*object
)
365 return !object
->valid
;
369 * @brief Add an integer value to a JSON object.
371 * Add an integer value named 'name' to the json object.
373 * @param object the JSON object to be updated.
374 * @param name the name of the value.
375 * @param value the value.
377 * @return 0 the operation was successful
378 * -1 the operation failed
381 int json_add_int(struct json_object
*object
, const char *name
, const int value
)
384 json_t
*integer
= NULL
;
386 if (json_is_invalid(object
)) {
387 DBG_ERR("Unable to add int [%s] value [%d], "
388 "target object is invalid\n",
394 integer
= json_integer(value
);
395 if (integer
== NULL
) {
396 DBG_ERR("Unable to create integer value [%s] value [%d]\n",
402 ret
= json_object_set_new(object
->root
, name
, integer
);
404 json_decref(integer
);
405 DBG_ERR("Unable to add int [%s] value [%d]\n", name
, value
);
411 * @brief Add a boolean value to a JSON object.
413 * Add a boolean value named 'name' to the json object.
415 * @param object the JSON object to be updated.
416 * @param name the name.
417 * @param value the value.
419 * @return 0 the operation was successful
420 * -1 the operation failed
423 int json_add_bool(struct json_object
*object
,
429 if (json_is_invalid(object
)) {
430 DBG_ERR("Unable to add boolean [%s] value [%d], "
431 "target object is invalid\n",
437 ret
= json_object_set_new(object
->root
, name
, json_boolean(value
));
439 DBG_ERR("Unable to add boolean [%s] value [%d]\n", name
, value
);
445 * @brief Add a string value to a JSON object.
447 * Add a string value named 'name' to the json object.
449 * @param object the JSON object to be updated.
450 * @param name the name.
451 * @param value the value.
453 * @return 0 the operation was successful
454 * -1 the operation failed
457 int json_add_string(struct json_object
*object
,
463 if (json_is_invalid(object
)) {
464 DBG_ERR("Unable to add string [%s], target object is invalid\n",
469 json_t
*string
= json_string(value
);
470 if (string
== NULL
) {
471 DBG_ERR("Unable to add string [%s], "
472 "could not create string object\n",
476 ret
= json_object_set_new(object
->root
, name
, string
);
479 DBG_ERR("Unable to add string [%s]\n", name
);
483 ret
= json_object_set_new(object
->root
, name
, json_null());
485 DBG_ERR("Unable to add null string [%s]\n", name
);
493 * @brief Assert that the current JSON object is an array.
495 * Check that the current object is a JSON array, and if not
496 * invalidate the object. We also log an error message as this indicates
497 * bug in the calling code.
499 * @param object the JSON object to be validated.
501 void json_assert_is_array(struct json_object
*array
) {
503 if (json_is_invalid(array
)) {
507 if (json_is_array(array
->root
) == false) {
508 DBG_ERR("JSON object is not an array\n");
509 array
->valid
= false;
515 * @brief Add a JSON object to a JSON object.
517 * Add a JSON object named 'name' to the json object.
519 * @param object the JSON object to be updated.
520 * @param name the name.
521 * @param value the value.
523 * @return 0 the operation was successful
524 * -1 the operation failed
527 int json_add_object(struct json_object
*object
,
529 struct json_object
*value
)
534 if (value
!= NULL
&& json_is_invalid(value
)) {
535 DBG_ERR("Invalid JSON object [%s] supplied\n", name
);
538 if (json_is_invalid(object
)) {
539 DBG_ERR("Unable to add object [%s], target object is invalid\n",
544 jv
= value
== NULL
? json_null() : value
->root
;
546 if (json_is_array(object
->root
)) {
547 ret
= json_array_append_new(object
->root
, jv
);
548 } else if (json_is_object(object
->root
)) {
549 ret
= json_object_set_new(object
->root
, name
, jv
);
551 DBG_ERR("Invalid JSON object type\n");
555 DBG_ERR("Unable to add object [%s]\n", name
);
561 * @brief Add a string to a JSON object, truncating if necessary.
564 * Add a string value named 'name' to the json object, the string will be
565 * truncated if it is more than len characters long. If len is 0 the value
566 * is encoded as a JSON null.
569 * @param object the JSON object to be updated.
570 * @param name the name.
571 * @param value the value.
572 * @param len the maximum number of characters to be copied.
574 * @return 0 the operation was successful
575 * -1 the operation failed
578 int json_add_stringn(struct json_object
*object
,
585 if (json_is_invalid(object
)) {
586 DBG_ERR("Unable to add string [%s], target object is invalid\n",
591 if (value
!= NULL
&& len
> 0) {
592 json_t
*string
= NULL
;
595 strncpy(buffer
, value
, len
);
598 string
= json_string(buffer
);
599 if (string
== NULL
) {
600 DBG_ERR("Unable to add string [%s], "
601 "could not create string object\n",
605 ret
= json_object_set_new(object
->root
, name
, string
);
608 DBG_ERR("Unable to add string [%s]\n", name
);
612 ret
= json_object_set_new(object
->root
, name
, json_null());
614 DBG_ERR("Unable to add null string [%s]\n", name
);
622 * @brief Add a version object to a JSON object
624 * Add a version object to the JSON object
625 * "version":{"major":1, "minor":0}
627 * The version tag is intended to aid the processing of the JSON messages
628 * The major version number should change when an attribute is:
631 * - its meaning changes
632 * - its contents change format
633 * The minor version should change whenever a new attribute is added and for
634 * minor bug fixes to an attributes content.
637 * @param object the JSON object to be updated.
638 * @param major the major version number
639 * @param minor the minor version number
641 * @return 0 the operation was successful
642 * -1 the operation failed
644 int json_add_version(struct json_object
*object
, int major
, int minor
)
647 struct json_object version
;
649 if (json_is_invalid(object
)) {
650 DBG_ERR("Unable to add version, target object is invalid\n");
654 version
= json_new_object();
655 if (json_is_invalid(&version
)) {
656 DBG_ERR("Unable to add version, failed to create object\n");
659 ret
= json_add_int(&version
, "major", major
);
664 ret
= json_add_int(&version
, "minor", minor
);
669 ret
= json_add_object(object
, "version", &version
);
678 * @brief add an ISO 8601 timestamp to the object.
680 * Add the current date and time as a timestamp in ISO 8601 format
683 * "timestamp":"2017-03-06T17:18:04.455081+1300"
686 * @param object the JSON object to be updated.
688 * @return 0 the operation was successful
689 * -1 the operation failed
691 int json_add_timestamp(struct json_object
*object
)
693 char buffer
[40]; /* formatted time less usec and timezone */
694 char timestamp
[65]; /* the formatted ISO 8601 time stamp */
695 char tz
[10]; /* formatted time zone */
696 struct tm
* tm_info
; /* current local time */
697 struct timeval tv
; /* current system time */
698 int r
; /* response code from gettimeofday */
699 int ret
; /* return code from json operations */
701 if (json_is_invalid(object
)) {
702 DBG_ERR("Unable to add time stamp, target object is invalid\n");
706 r
= gettimeofday(&tv
, NULL
);
708 DBG_ERR("Unable to get time of day: (%d) %s\n",
714 tm_info
= localtime(&tv
.tv_sec
);
715 if (tm_info
== NULL
) {
716 DBG_ERR("Unable to determine local time\n");
720 strftime(buffer
, sizeof(buffer
)-1, "%Y-%m-%dT%T", tm_info
);
721 strftime(tz
, sizeof(tz
)-1, "%z", tm_info
);
729 ret
= json_add_string(object
, "timestamp", timestamp
);
731 DBG_ERR("Unable to add time stamp to JSON object\n");
737 *@brief Add a tsocket_address to a JSON object
739 * Add the string representation of a Samba tsocket_address to the object.
741 * "localAddress":"ipv6::::0"
744 * @param object the JSON object to be updated.
745 * @param name the name.
746 * @param address the tsocket_address.
748 * @return 0 the operation was successful
749 * -1 the operation failed
752 int json_add_address(struct json_object
*object
,
754 const struct tsocket_address
*address
)
758 if (json_is_invalid(object
)) {
759 DBG_ERR("Unable to add address [%s], "
760 "target object is invalid\n",
765 if (address
== NULL
) {
766 ret
= json_object_set_new(object
->root
, name
, json_null());
768 DBG_ERR("Unable to add null address [%s]\n", name
);
772 TALLOC_CTX
*ctx
= talloc_new(NULL
);
776 DBG_ERR("Out of memory adding address [%s]\n", name
);
780 s
= tsocket_address_string(address
, ctx
);
782 DBG_ERR("Out of memory adding address [%s]\n", name
);
786 ret
= json_add_string(object
, name
, s
);
789 "Unable to add address [%s] value [%s]\n", name
, s
);
799 * @brief Add a formatted string representation of a sid to a json object.
801 * Add the string representation of a Samba sid to the object.
806 * @param object the JSON object to be updated.
807 * @param name the name.
810 * @return 0 the operation was successful
811 * -1 the operation failed
814 int json_add_sid(struct json_object
*object
,
816 const struct dom_sid
*sid
)
820 if (json_is_invalid(object
)) {
821 DBG_ERR("Unable to add SID [%s], "
822 "target object is invalid\n",
828 ret
= json_object_set_new(object
->root
, name
, json_null());
830 DBG_ERR("Unable to add null SID [%s]\n", name
);
834 struct dom_sid_buf sid_buf
;
836 ret
= json_add_string(
837 object
, name
, dom_sid_str_buf(sid
, &sid_buf
));
839 DBG_ERR("Unable to add SID [%s] value [%s]\n",
849 * @brief Add a formatted string representation of a guid to a json object.
851 * Add the string representation of a Samba GUID to the object.
853 * "guid":"1fb9f2ee-2a4d-4bf8-af8b-cb9d4529a9ab"
856 * @param object the JSON object to be updated.
857 * @param name the name.
858 * @param guid the guid.
860 * @return 0 the operation was successful
861 * -1 the operation failed
865 int json_add_guid(struct json_object
*object
,
867 const struct GUID
*guid
)
872 if (json_is_invalid(object
)) {
873 DBG_ERR("Unable to add GUID [%s], "
874 "target object is invalid\n",
880 ret
= json_object_set_new(object
->root
, name
, json_null());
882 DBG_ERR("Unable to add null GUID [%s]\n", name
);
887 struct GUID_txt_buf guid_buff
;
889 guid_str
= GUID_buf_string(guid
, &guid_buff
);
890 ret
= json_add_string(object
, name
, guid_str
);
892 DBG_ERR("Unable to guid GUID [%s] value [%s]\n",
902 * @brief Convert a JSON object into a string
904 * Convert the jsom object into a string suitable for printing on a log line,
905 * i.e. with no embedded line breaks.
907 * If the object is invalid it logs an error and returns NULL.
909 * @param mem_ctx the talloc memory context owning the returned string
910 * @param object the json object.
912 * @return A string representation of the object or NULL if the object
915 char *json_to_string(TALLOC_CTX
*mem_ctx
, const struct json_object
*object
)
918 char *json_string
= NULL
;
920 if (json_is_invalid(object
)) {
921 DBG_ERR("Invalid JSON object, unable to convert to string\n");
925 if (object
->root
== NULL
) {
930 * json_dumps uses malloc, so need to call free(json) to release
933 json
= json_dumps(object
->root
, 0);
935 DBG_ERR("Unable to convert JSON object to string\n");
939 json_string
= talloc_strdup(mem_ctx
, json
);
940 if (json_string
== NULL
) {
942 DBG_ERR("Unable to copy JSON object string to talloc string\n");
951 * @brief get a json array named "name" from the json object.
953 * Get the array attribute named name, creating it if it does not exist.
955 * @param object the json object.
956 * @param name the name of the array attribute
958 * @return The array object, will be created if it did not exist.
960 struct json_object
json_get_array(struct json_object
*object
, const char *name
)
963 struct json_object array
= json_empty_object
;
967 if (json_is_invalid(object
)) {
968 DBG_ERR("Invalid JSON object, unable to get array [%s]\n",
974 array
= json_new_array();
975 if (json_is_invalid(&array
)) {
976 DBG_ERR("Unable to create new array for [%s]\n", name
);
980 a
= json_object_get(object
->root
, name
);
985 ret
= json_array_extend(array
.root
, a
);
987 DBG_ERR("Unable to get array [%s]\n", name
);
996 * @brief get a json object named "name" from the json object.
998 * Get the object attribute named name, creating it if it does not exist.
1000 * @param object the json object.
1001 * @param name the name of the object attribute
1003 * @return The object, will be created if it did not exist.
1005 struct json_object
json_get_object(struct json_object
*object
, const char *name
)
1008 struct json_object o
= json_new_object();
1012 if (json_is_invalid(object
)) {
1013 DBG_ERR("Invalid JSON object, unable to get object [%s]\n",
1019 v
= json_object_get(object
->root
, name
);
1023 ret
= json_object_update(o
.root
, v
);
1025 DBG_ERR("Unable to get object [%s]\n", name
);