1 /* $NetBSD: auditlog.c,v 1.1.1.6 2018/02/06 01:53:16 christos Exp $ */ 2 3 /* auditlog.c - log modifications for audit/history purposes */ 4 /* $OpenLDAP$ */ 5 /* This work is part of OpenLDAP Software <http://www.openldap.org/>. 6 * 7 * Copyright 2005-2017 The OpenLDAP Foundation. 8 * Portions copyright 2004-2005 Symas Corporation. 9 * All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted only as authorized by the OpenLDAP 13 * Public License. 14 * 15 * A copy of this license is available in the file LICENSE in the 16 * top-level directory of the distribution or, alternatively, at 17 * <http://www.OpenLDAP.org/license.html>. 18 */ 19 /* ACKNOWLEDGEMENTS: 20 * This work was initially developed by Symas Corp. for inclusion in 21 * OpenLDAP Software. This work was sponsored by Hewlett-Packard. 22 */ 23 24 #include <sys/cdefs.h> 25 __RCSID("$NetBSD: auditlog.c,v 1.1.1.6 2018/02/06 01:53:16 christos Exp $"); 26 27 #include "portable.h" 28 29 #ifdef SLAPD_OVER_AUDITLOG 30 31 #include <stdio.h> 32 33 #include <ac/string.h> 34 #include <ac/ctype.h> 35 36 #include "slap.h" 37 #include "config.h" 38 #include "ldif.h" 39 40 typedef struct auditlog_data { 41 ldap_pvt_thread_mutex_t ad_mutex; 42 char *ad_logfile; 43 } auditlog_data; 44 45 static ConfigTable auditlogcfg[] = { 46 { "auditlog", "filename", 2, 2, 0, 47 ARG_STRING|ARG_OFFSET, 48 (void *)offsetof(auditlog_data, ad_logfile), 49 "( OLcfgOvAt:15.1 NAME 'olcAuditlogFile' " 50 "DESC 'Filename for auditlogging' " 51 "SYNTAX OMsDirectoryString )", NULL, NULL }, 52 { NULL, NULL, 0, 0, 0, ARG_IGNORED } 53 }; 54 55 static ConfigOCs auditlogocs[] = { 56 { "( OLcfgOvOc:15.1 " 57 "NAME 'olcAuditlogConfig' " 58 "DESC 'Auditlog configuration' " 59 "SUP olcOverlayConfig " 60 "MAY ( olcAuditlogFile ) )", 61 Cft_Overlay, auditlogcfg }, 62 { NULL, 0, NULL } 63 }; 64 65 static int fprint_ldif(FILE *f, char *name, char *val, ber_len_t len) { 66 char *s; 67 if((s = ldif_put(LDIF_PUT_VALUE, name, val, len)) == NULL) 68 return(-1); 69 fputs(s, f); 70 ber_memfree(s); 71 return(0); 72 } 73 74 static int auditlog_response(Operation *op, SlapReply *rs) { 75 slap_overinst *on = (slap_overinst *)op->o_bd->bd_info; 76 auditlog_data *ad = on->on_bi.bi_private; 77 FILE *f; 78 Attribute *a; 79 Modifications *m; 80 struct berval *b, *who = NULL, peername; 81 char *what, *whatm, *suffix; 82 time_t stamp; 83 int i; 84 85 if ( rs->sr_err != LDAP_SUCCESS ) return SLAP_CB_CONTINUE; 86 87 if ( !ad->ad_logfile ) return SLAP_CB_CONTINUE; 88 89 /* 90 ** add or modify: use modifiersName if present 91 ** 92 */ 93 switch(op->o_tag) { 94 case LDAP_REQ_MODRDN: what = "modrdn"; break; 95 case LDAP_REQ_DELETE: what = "delete"; break; 96 case LDAP_REQ_ADD: 97 what = "add"; 98 for(a = op->ora_e->e_attrs; a; a = a->a_next) 99 if( a->a_desc == slap_schema.si_ad_modifiersName ) { 100 who = &a->a_vals[0]; 101 break; 102 } 103 break; 104 case LDAP_REQ_MODIFY: 105 what = "modify"; 106 for(m = op->orm_modlist; m; m = m->sml_next) 107 if( m->sml_desc == slap_schema.si_ad_modifiersName && 108 ( m->sml_op == LDAP_MOD_ADD || 109 m->sml_op == LDAP_MOD_REPLACE )) { 110 who = &m->sml_values[0]; 111 break; 112 } 113 break; 114 default: 115 return SLAP_CB_CONTINUE; 116 } 117 118 suffix = op->o_bd->be_suffix[0].bv_len ? op->o_bd->be_suffix[0].bv_val : 119 "global"; 120 121 /* 122 ** note: this means requestor's dn when modifiersName is null 123 */ 124 if ( !who ) 125 who = &op->o_dn; 126 127 peername = op->o_conn->c_peer_name; 128 ldap_pvt_thread_mutex_lock(&ad->ad_mutex); 129 if((f = fopen(ad->ad_logfile, "a")) == NULL) { 130 ldap_pvt_thread_mutex_unlock(&ad->ad_mutex); 131 return SLAP_CB_CONTINUE; 132 } 133 134 stamp = slap_get_time(); 135 fprintf(f, "# %s %ld %s%s%s %s conn=%ld\n", 136 what, (long)stamp, suffix, who ? " " : "", who ? who->bv_val : "", 137 peername.bv_val ? peername.bv_val: "", op->o_conn->c_connid); 138 139 if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) && 140 (!who || !dn_match( who, &op->o_conn->c_dn ))) 141 fprintf(f, "# realdn: %s\n", op->o_conn->c_dn.bv_val ); 142 143 fprintf(f, "dn: %s\nchangetype: %s\n", 144 op->o_req_dn.bv_val, what); 145 146 switch(op->o_tag) { 147 case LDAP_REQ_ADD: 148 for(a = op->ora_e->e_attrs; a; a = a->a_next) 149 if((b = a->a_vals) != NULL) 150 for(i = 0; b[i].bv_val; i++) 151 fprint_ldif(f, a->a_desc->ad_cname.bv_val, b[i].bv_val, b[i].bv_len); 152 break; 153 154 case LDAP_REQ_MODIFY: 155 for(m = op->orm_modlist; m; m = m->sml_next) { 156 switch(m->sml_op & LDAP_MOD_OP) { 157 case LDAP_MOD_ADD: whatm = "add"; break; 158 case LDAP_MOD_REPLACE: whatm = "replace"; break; 159 case LDAP_MOD_DELETE: whatm = "delete"; break; 160 case LDAP_MOD_INCREMENT: whatm = "increment"; break; 161 default: 162 fprintf(f, "# MOD_TYPE_UNKNOWN:%02x\n", m->sml_op & LDAP_MOD_OP); 163 continue; 164 } 165 fprintf(f, "%s: %s\n", whatm, m->sml_desc->ad_cname.bv_val); 166 if((b = m->sml_values) != NULL) 167 for(i = 0; b[i].bv_val; i++) 168 fprint_ldif(f, m->sml_desc->ad_cname.bv_val, b[i].bv_val, b[i].bv_len); 169 fprintf(f, "-\n"); 170 } 171 break; 172 173 case LDAP_REQ_MODRDN: 174 fprintf(f, "newrdn: %s\ndeleteoldrdn: %s\n", 175 op->orr_newrdn.bv_val, op->orr_deleteoldrdn ? "1" : "0"); 176 if(op->orr_newSup) fprintf(f, "newsuperior: %s\n", op->orr_newSup->bv_val); 177 break; 178 179 case LDAP_REQ_DELETE: 180 /* nothing else needed */ 181 break; 182 } 183 184 fprintf(f, "# end %s %ld\n\n", what, (long)stamp); 185 186 fclose(f); 187 ldap_pvt_thread_mutex_unlock(&ad->ad_mutex); 188 return SLAP_CB_CONTINUE; 189 } 190 191 static slap_overinst auditlog; 192 193 static int 194 auditlog_db_init( 195 BackendDB *be, 196 ConfigReply *cr 197 ) 198 { 199 slap_overinst *on = (slap_overinst *)be->bd_info; 200 auditlog_data *ad = ch_calloc(1, sizeof(auditlog_data)); 201 202 on->on_bi.bi_private = ad; 203 ldap_pvt_thread_mutex_init( &ad->ad_mutex ); 204 return 0; 205 } 206 207 static int 208 auditlog_db_destroy( 209 BackendDB *be, 210 ConfigReply *cr 211 ) 212 { 213 slap_overinst *on = (slap_overinst *)be->bd_info; 214 auditlog_data *ad = on->on_bi.bi_private; 215 216 ldap_pvt_thread_mutex_destroy( &ad->ad_mutex ); 217 free( ad->ad_logfile ); 218 free( ad ); 219 return 0; 220 } 221 222 int auditlog_initialize() { 223 int rc; 224 225 auditlog.on_bi.bi_type = "auditlog"; 226 auditlog.on_bi.bi_db_init = auditlog_db_init; 227 auditlog.on_bi.bi_db_destroy = auditlog_db_destroy; 228 auditlog.on_response = auditlog_response; 229 230 auditlog.on_bi.bi_cf_ocs = auditlogocs; 231 rc = config_register_schema( auditlogcfg, auditlogocs ); 232 if ( rc ) return rc; 233 234 return overlay_register(&auditlog); 235 } 236 237 #if SLAPD_OVER_AUDITLOG == SLAPD_MOD_DYNAMIC && defined(PIC) 238 int 239 init_module( int argc, char *argv[] ) 240 { 241 return auditlog_initialize(); 242 } 243 #endif 244 245 #endif /* SLAPD_OVER_AUDITLOG */ 246