auditlog.c revision 1.1.1.4 
1/*	$NetBSD: auditlog.c,v 1.1.1.4 2014/05/28 09:58:51 tron Exp $	*/
2
3/* auditlog.c - log modifications for audit/history purposes */
4/* $OpenLDAP$ */
5/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
6 *
7 * Copyright 2005-2014 The OpenLDAP Foundation.
8 * Portions copyright 2004-2005 Symas Corporation.
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted only as authorized by the OpenLDAP
13 * Public License.
14 *
15 * A copy of this license is available in the file LICENSE in the
16 * top-level directory of the distribution or, alternatively, at
17 * <http://www.OpenLDAP.org/license.html>.
18 */
19/* ACKNOWLEDGEMENTS:
20 * This work was initially developed by Symas Corp. for inclusion in
21 * OpenLDAP Software.  This work was sponsored by Hewlett-Packard.
22 */
23
24#include "portable.h"
25
26#ifdef SLAPD_OVER_AUDITLOG
27
28#include <stdio.h>
29
30#include <ac/string.h>
31#include <ac/ctype.h>
32
33#include "slap.h"
34#include "config.h"
35#include "ldif.h"
36
37typedef struct auditlog_data {
38	ldap_pvt_thread_mutex_t ad_mutex;
39	char *ad_logfile;
40} auditlog_data;
41
42static ConfigTable auditlogcfg[] = {
43	{ "auditlog", "filename", 2, 2, 0,
44	  ARG_STRING|ARG_OFFSET,
45	  (void *)offsetof(auditlog_data, ad_logfile),
46	  "( OLcfgOvAt:15.1 NAME 'olcAuditlogFile' "
47	  "DESC 'Filename for auditlogging' "
48	  "SYNTAX OMsDirectoryString )", NULL, NULL },
49	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
50};
51
52static ConfigOCs auditlogocs[] = {
53	{ "( OLcfgOvOc:15.1 "
54	  "NAME 'olcAuditlogConfig' "
55	  "DESC 'Auditlog configuration' "
56	  "SUP olcOverlayConfig "
57	  "MAY ( olcAuditlogFile ) )",
58	  Cft_Overlay, auditlogcfg },
59	{ NULL, 0, NULL }
60};
61
62static int fprint_ldif(FILE *f, char *name, char *val, ber_len_t len) {
63	char *s;
64	if((s = ldif_put(LDIF_PUT_VALUE, name, val, len)) == NULL)
65		return(-1);
66	fputs(s, f);
67	ber_memfree(s);
68	return(0);
69}
70
71static int auditlog_response(Operation *op, SlapReply *rs) {
72	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
73	auditlog_data *ad = on->on_bi.bi_private;
74	FILE *f;
75	Attribute *a;
76	Modifications *m;
77	struct berval *b, *who = NULL, peername;
78	char *what, *whatm, *suffix;
79	time_t stamp;
80	int i;
81
82	if ( rs->sr_err != LDAP_SUCCESS ) return SLAP_CB_CONTINUE;
83
84	if ( !ad->ad_logfile ) return SLAP_CB_CONTINUE;
85
86/*
87** add or modify: use modifiersName if present
88**
89*/
90	switch(op->o_tag) {
91		case LDAP_REQ_MODRDN:	what = "modrdn";	break;
92		case LDAP_REQ_DELETE:	what = "delete";	break;
93		case LDAP_REQ_ADD:
94			what = "add";
95			for(a = op->ora_e->e_attrs; a; a = a->a_next)
96				if( a->a_desc == slap_schema.si_ad_modifiersName ) {
97					who = &a->a_vals[0];
98					break;
99				}
100			break;
101		case LDAP_REQ_MODIFY:
102			what = "modify";
103			for(m = op->orm_modlist; m; m = m->sml_next)
104				if( m->sml_desc == slap_schema.si_ad_modifiersName &&
105					( m->sml_op == LDAP_MOD_ADD ||
106					m->sml_op == LDAP_MOD_REPLACE )) {
107					who = &m->sml_values[0];
108					break;
109				}
110			break;
111		default:
112			return SLAP_CB_CONTINUE;
113	}
114
115	suffix = op->o_bd->be_suffix[0].bv_len ? op->o_bd->be_suffix[0].bv_val :
116		"global";
117
118/*
119** note: this means requestor's dn when modifiersName is null
120*/
121	if ( !who )
122		who = &op->o_dn;
123
124	peername = op->o_conn->c_peer_name;
125	ldap_pvt_thread_mutex_lock(&ad->ad_mutex);
126	if((f = fopen(ad->ad_logfile, "a")) == NULL) {
127		ldap_pvt_thread_mutex_unlock(&ad->ad_mutex);
128		return SLAP_CB_CONTINUE;
129	}
130
131	stamp = slap_get_time();
132	fprintf(f, "# %s %ld %s%s%s %s conn=%ld\n",
133		what, (long)stamp, suffix, who ? " " : "", who ? who->bv_val : "",
134		peername.bv_val ? peername.bv_val: "", op->o_conn->c_connid);
135
136	if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) &&
137		(!who || !dn_match( who, &op->o_conn->c_dn )))
138		fprintf(f, "# realdn: %s\n", op->o_conn->c_dn.bv_val );
139
140	fprintf(f, "dn: %s\nchangetype: %s\n",
141		op->o_req_dn.bv_val, what);
142
143	switch(op->o_tag) {
144	  case LDAP_REQ_ADD:
145		for(a = op->ora_e->e_attrs; a; a = a->a_next)
146		  if((b = a->a_vals) != NULL)
147			for(i = 0; b[i].bv_val; i++)
148				fprint_ldif(f, a->a_desc->ad_cname.bv_val, b[i].bv_val, b[i].bv_len);
149		break;
150
151	  case LDAP_REQ_MODIFY:
152		for(m = op->orm_modlist; m; m = m->sml_next) {
153			switch(m->sml_op & LDAP_MOD_OP) {
154				case LDAP_MOD_ADD:	 whatm = "add";		break;
155				case LDAP_MOD_REPLACE:	 whatm = "replace";	break;
156				case LDAP_MOD_DELETE:	 whatm = "delete";	break;
157				case LDAP_MOD_INCREMENT: whatm = "increment";	break;
158				default:
159					fprintf(f, "# MOD_TYPE_UNKNOWN:%02x\n", m->sml_op & LDAP_MOD_OP);
160					continue;
161			}
162			fprintf(f, "%s: %s\n", whatm, m->sml_desc->ad_cname.bv_val);
163			if((b = m->sml_values) != NULL)
164			  for(i = 0; b[i].bv_val; i++)
165				fprint_ldif(f, m->sml_desc->ad_cname.bv_val, b[i].bv_val, b[i].bv_len);
166			fprintf(f, "-\n");
167		}
168		break;
169
170	  case LDAP_REQ_MODRDN:
171		fprintf(f, "newrdn: %s\ndeleteoldrdn: %s\n",
172			op->orr_newrdn.bv_val, op->orr_deleteoldrdn ? "1" : "0");
173		if(op->orr_newSup) fprintf(f, "newsuperior: %s\n", op->orr_newSup->bv_val);
174		break;
175
176	  case LDAP_REQ_DELETE:
177		/* nothing else needed */
178		break;
179	}
180
181	fprintf(f, "# end %s %ld\n\n", what, (long)stamp);
182
183	fclose(f);
184	ldap_pvt_thread_mutex_unlock(&ad->ad_mutex);
185	return SLAP_CB_CONTINUE;
186}
187
188static slap_overinst auditlog;
189
190static int
191auditlog_db_init(
192	BackendDB *be,
193	ConfigReply *cr
194)
195{
196	slap_overinst *on = (slap_overinst *)be->bd_info;
197	auditlog_data *ad = ch_calloc(1, sizeof(auditlog_data));
198
199	on->on_bi.bi_private = ad;
200	ldap_pvt_thread_mutex_init( &ad->ad_mutex );
201	return 0;
202}
203
204static int
205auditlog_db_close(
206	BackendDB *be,
207	ConfigReply *cr
208)
209{
210	slap_overinst *on = (slap_overinst *)be->bd_info;
211	auditlog_data *ad = on->on_bi.bi_private;
212
213	free( ad->ad_logfile );
214	ad->ad_logfile = NULL;
215	return 0;
216}
217
218static int
219auditlog_db_destroy(
220	BackendDB *be,
221	ConfigReply *cr
222)
223{
224	slap_overinst *on = (slap_overinst *)be->bd_info;
225	auditlog_data *ad = on->on_bi.bi_private;
226
227	ldap_pvt_thread_mutex_destroy( &ad->ad_mutex );
228	free( ad );
229	return 0;
230}
231
232int auditlog_initialize() {
233	int rc;
234
235	auditlog.on_bi.bi_type = "auditlog";
236	auditlog.on_bi.bi_db_init = auditlog_db_init;
237	auditlog.on_bi.bi_db_close = auditlog_db_close;
238	auditlog.on_bi.bi_db_destroy = auditlog_db_destroy;
239	auditlog.on_response = auditlog_response;
240
241	auditlog.on_bi.bi_cf_ocs = auditlogocs;
242	rc = config_register_schema( auditlogcfg, auditlogocs );
243	if ( rc ) return rc;
244
245	return overlay_register(&auditlog);
246}
247
248#if SLAPD_OVER_AUDITLOG == SLAPD_MOD_DYNAMIC && defined(PIC)
249int
250init_module( int argc, char *argv[] )
251{
252	return auditlog_initialize();
253}
254#endif
255
256#endif /* SLAPD_OVER_AUDITLOG */
257