The branch, master has been updated
via 472dca2 debug: Add group logging classes
via dfa341c smb.conf: Add dsdb group change notification parameter
via 0c6cb46 messaging idl add group membersip events
via 2d47f9e auth_log: Rename the json variables
via c15fc14 auth_log: tidy up code formatting
via 7509727 auth_log: Use common code from audit_logging
via 36800d0 idl messaging: Add DSDB and Password events and message
types
via 5d06812 smb conf: Add DSDB event notification parameter
via 2ba55f8 logging: add ldb audit classes
via 74cf8f5 auth logging: Extract common audit logging code
from c7a3ce9 auth/ntlmssp: fix handling of GENSEC_FEATURE_LDAP_STYLE as
a server
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 472dca29055e02b97684e1d174e688aba2e83b7d
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Mon Apr 23 12:24:34 2018 +1200
debug: Add group logging classes
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
Autobuild-User(master): Andrew Bartlett <abart...@samba.org>
Autobuild-Date(master): Wed May 16 07:02:20 CEST 2018 on sn-devel-144
commit dfa341c1eb2d952adccce6b8f65d6d2ab02112aa
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Mon Apr 23 09:00:54 2018 +1200
smb.conf: Add dsdb group change notification parameter
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 0c6cb4639aba69262a1ad0d098aadb181035e79b
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Mon Apr 23 08:49:26 2018 +1200
messaging idl add group membersip events
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 2d47f9e160a3982b21293013b2f66999b62deab8
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Mon Apr 16 09:29:04 2018 +1200
auth_log: Rename the json variables
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit c15fc1442bd9fb0bc7753e3d67f88364653e06de
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Tue Apr 10 11:57:41 2018 +1200
auth_log: tidy up code formatting
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 75097275a705dbfa1ff8f75b701e2968c716eaa8
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Tue Apr 10 11:45:32 2018 +1200
auth_log: Use common code from audit_logging
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 36800d0903dcb7a8ebb12a347eb1dbbd038adba8
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Thu Apr 12 13:19:16 2018 +1200
idl messaging: Add DSDB and Password events and message types
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 5d068123f134e7c7f6ad2433720ba94e18d4f8b5
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Thu Apr 12 10:19:16 2018 +1200
smb conf: Add DSDB event notification parameter
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 2ba55f81a9514a9e8adc6904e58d166c98aecaa7
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Wed Apr 4 11:56:30 2018 +1200
logging: add ldb audit classes
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
commit 74cf8f5e3b991292ae592a0786e01914ca162caf
Author: Gary Lockyer <g...@catalyst.net.nz>
Date: Tue Apr 10 06:45:47 2018 +1200
auth logging: Extract common audit logging code
Extract the common audit logging code into a library to allow it's
re-use in other logging modules.
Signed-off-by: Gary Lockyer <g...@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abart...@samba.org>
-----------------------------------------------------------------------
Summary of changes:
auth/auth_log.c | 663 +++++-------------
auth/wscript_build | 2 +-
docs-xml/smbdotconf/logging/loglevel.xml | 28 +-
.../dsdbeventnotification.xml} | 13 +-
.../dsdbgroupchangenotification.xml} | 13 +-
.../dsdbpasswordeventnotification.xml} | 19 +-
lib/audit_logging/audit_logging.c | 771 +++++++++++++++++++++
lib/audit_logging/audit_logging.h | 89 +++
lib/audit_logging/tests/audit_logging_test.c | 557 +++++++++++++++
lib/audit_logging/wscript_build | 24 +
lib/util/debug.c | 8 +
lib/util/debug.h | 8 +
librpc/idl/messaging.idl | 13 +-
source4/selftest/tests.py | 2 +
wscript_build | 1 +
15 files changed, 1695 insertions(+), 516 deletions(-)
copy docs-xml/smbdotconf/{logon/autheventnotification.xml =>
misc/dsdbeventnotification.xml} (69%)
copy docs-xml/smbdotconf/{logon/autheventnotification.xml =>
misc/dsdbgroupchangenotification.xml} (69%)
copy docs-xml/smbdotconf/{logon/autheventnotification.xml =>
misc/dsdbpasswordeventnotification.xml} (55%)
create mode 100644 lib/audit_logging/audit_logging.c
create mode 100644 lib/audit_logging/audit_logging.h
create mode 100644 lib/audit_logging/tests/audit_logging_test.c
create mode 100644 lib/audit_logging/wscript_build
Changeset truncated at 500 lines:
diff --git a/auth/auth_log.c b/auth/auth_log.c
index 97b6537..87daf2f 100644
--- a/auth/auth_log.c
+++ b/auth/auth_log.c
@@ -57,48 +57,7 @@
#include "lib/util/server_id_db.h"
#include "lib/param/param.h"
#include "librpc/ndr/libndr.h"
-
-/*
- * Get a human readable timestamp.
- *
- * Returns the current time formatted as
- * "Tue, 14 Mar 2017 08:38:42.209028 NZDT"
- *
- * The returned string is allocated by talloc in the supplied context.
- * It is the callers responsibility to free it.
- *
- */
-static const char* get_timestamp(TALLOC_CTX *frame)
-{
- char buffer[40]; /* formatted time less usec and timezone */
- char tz[10]; /* formatted time zone */
- struct tm* tm_info; /* current local time */
- struct timeval tv; /* current system time */
- int r; /* response code from gettimeofday */
- const char * ts; /* formatted time stamp */
-
- r = gettimeofday(&tv, NULL);
- if (r) {
- DBG_ERR("Unable to get time of day: (%d) %s\n",
- errno,
- strerror(errno));
- return NULL;
- }
-
- tm_info = localtime(&tv.tv_sec);
- if (tm_info == NULL) {
- DBG_ERR("Unable to determine local time\n");
- return NULL;
- }
-
- strftime(buffer, sizeof(buffer)-1, "%a, %d %b %Y %H:%M:%S", tm_info);
- strftime(tz, sizeof(tz)-1, "%Z", tm_info);
- ts = talloc_asprintf(frame, "%s.%06ld %s", buffer, tv.tv_usec, tz);
- if (ts == NULL) {
- DBG_ERR("Out of memory formatting time stamp\n");
- }
- return ts;
-}
+#include "lib/audit_logging/audit_logging.h"
/*
* Determine the type of the password supplied for the
@@ -113,115 +72,35 @@ static const char* get_password_type(const struct
auth_usersupplied_info *ui);
#include "system/time.h"
/*
- * Context required by the JSON generation
- * routines
- *
- */
-struct json_context {
- json_t *root;
- bool error;
-};
-
-static NTSTATUS get_auth_event_server(struct imessaging_context *msg_ctx,
- struct server_id *auth_event_server)
-{
- NTSTATUS status;
- TALLOC_CTX *frame = talloc_stackframe();
- unsigned num_servers, i;
- struct server_id *servers;
-
- status = irpc_servers_byname(msg_ctx, frame,
- AUTH_EVENT_NAME,
- &num_servers, &servers);
-
- if (!NT_STATUS_IS_OK(status)) {
- DBG_NOTICE("Failed to find 'auth_event' registered on the "
- "message bus to send JSON authentication events to:
%s\n",
- nt_errstr(status));
- TALLOC_FREE(frame);
- return status;
- }
-
- /*
- * Select the first server that is listening, because
- * we get connection refused as
- * NT_STATUS_OBJECT_NAME_NOT_FOUND without waiting
- */
- for (i = 0; i < num_servers; i++) {
- status = imessaging_send(msg_ctx, servers[i], MSG_PING,
- &data_blob_null);
- if (NT_STATUS_IS_OK(status)) {
- *auth_event_server = servers[i];
- TALLOC_FREE(frame);
- return NT_STATUS_OK;
- }
- }
- DBG_NOTICE("Failed to find a running 'auth_event' server "
- "registered on the message bus to send JSON "
- "authentication events to\n");
- TALLOC_FREE(frame);
- return NT_STATUS_OBJECT_NAME_NOT_FOUND;
-}
-
-static void auth_message_send(struct imessaging_context *msg_ctx,
- const char *json)
-{
- struct server_id auth_event_server;
- NTSTATUS status;
- DATA_BLOB json_blob = data_blob_string_const(json);
- if (msg_ctx == NULL) {
- return;
- }
-
- /* Need to refetch the address each time as the destination server may
- * have disconnected and reconnected in the interim, in which case
- * messages may get lost, manifests in the auth_log tests
- */
- status = get_auth_event_server(msg_ctx, &auth_event_server);
- if (!NT_STATUS_IS_OK(status)) {
- return;
- }
-
- status = imessaging_send(msg_ctx, auth_event_server, MSG_AUTH_LOG,
- &json_blob);
-
- /* If the server crashed, try to find it again */
- if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
- status = get_auth_event_server(msg_ctx, &auth_event_server);
- if (!NT_STATUS_IS_OK(status)) {
- return;
- }
- imessaging_send(msg_ctx, auth_event_server, MSG_AUTH_LOG,
- &json_blob);
-
- }
-}
-
-/*
* Write the json object to the debug logs.
*
*/
static void log_json(struct imessaging_context *msg_ctx,
struct loadparm_context *lp_ctx,
- struct json_context *context,
- const char *type, int debug_class, int debug_level)
+ struct json_object *object,
+ const char *type,
+ int debug_class,
+ int debug_level)
{
char* json = NULL;
- if (context->error) {
+ if (object->error) {
return;
}
- json = json_dumps(context->root, 0);
+ json = json_dumps(object->root, 0);
if (json == NULL) {
DBG_ERR("Unable to convert JSON object to string\n");
- context->error = true;
+ object->error = true;
return;
}
DEBUGC(debug_class, debug_level, ("JSON %s: %s\n", type, json));
if (msg_ctx && lp_ctx && lpcfg_auth_event_notification(lp_ctx)) {
- auth_message_send(msg_ctx, json);
+ audit_message_send(msg_ctx,
+ AUTH_EVENT_NAME,
+ MSG_AUTH_LOG,
+ json);
}
if (json) {
@@ -231,227 +110,6 @@ static void log_json(struct imessaging_context *msg_ctx,
}
/*
- * Create a new json logging context.
- *
- * Free with a call to free_json_context
- *
- */
-static struct json_context get_json_context(void) {
-
- struct json_context context;
- context.error = false;
-
- context.root = json_object();
- if (context.root == NULL) {
- context.error = true;
- DBG_ERR("Unable to create json_object\n");
- }
- return context;
-}
-
-/*
- * free a previously created json_context
- *
- */
-static void free_json_context(struct json_context *context)
-{
- if (context->root) {
- json_decref(context->root);
- }
-}
-
-/*
- * Output a JSON pair with name name and integer value value
- *
- */
-static void add_int(struct json_context *context,
- const char* name,
- const int value)
-{
- int rc = 0;
-
- if (context->error) {
- return;
- }
-
- rc = json_object_set_new(context->root, name, json_integer(value));
- if (rc) {
- DBG_ERR("Unable to set name [%s] value [%d]\n", name, value);
- context->error = true;
- }
-
-}
-
-/*
- * Output a JSON pair with name name and string value value
- *
- */
-static void add_string(struct json_context *context,
- const char* name,
- const char* value)
-{
- int rc = 0;
-
- if (context->error) {
- return;
- }
-
- if (value) {
- rc = json_object_set_new(context->root, name,
json_string(value));
- } else {
- rc = json_object_set_new(context->root, name, json_null());
- }
- if (rc) {
- DBG_ERR("Unable to set name [%s] value [%s]\n", name, value);
- context->error = true;
- }
-}
-
-
-/*
- * Output a JSON pair with name name and object value
- *
- */
-static void add_object(struct json_context *context,
- const char* name,
- struct json_context *value)
-{
- int rc = 0;
-
- if (value->error) {
- context->error = true;
- }
- if (context->error) {
- return;
- }
- rc = json_object_set_new(context->root, name, value->root);
- if (rc) {
- DBG_ERR("Unable to add object [%s]\n", name);
- context->error = true;
- }
-}
-
-/*
- * Output a version object
- *
- * "version":{"major":1,"minor":0}
- *
- */
-static void add_version(struct json_context *context, int major, int minor)
-{
- struct json_context version = get_json_context();
- add_int(&version, "major", major);
- add_int(&version, "minor", minor);
- add_object(context, "version", &version);
-}
-
-/*
- * Output the current date and time as a timestamp in ISO 8601 format
- *
- * "timestamp":"2017-03-06T17:18:04.455081+1300"
- *
- */
-static void add_timestamp(struct json_context *context)
-{
- char buffer[40]; /* formatted time less usec and timezone */
- char timestamp[50]; /* the formatted ISO 8601 time stamp */
- char tz[10]; /* formatted time zone */
- struct tm* tm_info; /* current local time */
- struct timeval tv; /* current system time */
- int r; /* response code from gettimeofday */
-
- if (context->error) {
- return;
- }
-
- r = gettimeofday(&tv, NULL);
- if (r) {
- DBG_ERR("Unable to get time of day: (%d) %s\n",
- errno,
- strerror(errno));
- context->error = true;
- return;
- }
-
- tm_info = localtime(&tv.tv_sec);
- if (tm_info == NULL) {
- DBG_ERR("Unable to determine local time\n");
- context->error = true;
- return;
- }
-
- strftime(buffer, sizeof(buffer)-1, "%Y-%m-%dT%T", tm_info);
- strftime(tz, sizeof(tz)-1, "%z", tm_info);
- snprintf(timestamp, sizeof(timestamp),"%s.%06ld%s",
- buffer, tv.tv_usec, tz);
- add_string(context,"timestamp", timestamp);
-}
-
-
-/*
- * Output an address pair, with name name.
- *
- * "localAddress":"ipv6::::0"
- *
- */
-static void add_address(struct json_context *context,
- const char *name,
- const struct tsocket_address *address)
-{
- char *s = NULL;
- TALLOC_CTX *frame = talloc_stackframe();
-
- if (context->error) {
- return;
- }
-
- s = tsocket_address_string(address, frame);
- add_string(context, name, s);
- talloc_free(frame);
-
-}
-
-/*
- * Output a SID with name name
- *
- * "sid":"S-1-5-18"
- *
- */
-static void add_sid(struct json_context *context,
- const char *name,
- const struct dom_sid *sid)
-{
- char sid_buf[DOM_SID_STR_BUFLEN];
-
- if (context->error) {
- return;
- }
-
- dom_sid_string_buf(sid, sid_buf, sizeof(sid_buf));
- add_string(context, name, sid_buf);
-}
-
-/*
- * Add a formatted string representation of a GUID to a json object.
- *
- */
-static void add_guid(struct json_context *context,
- const char *name,
- struct GUID *guid)
-{
-
- char *guid_str;
- struct GUID_txt_buf guid_buff;
-
- if (context->error) {
- return;
- }
-
- guid_str = GUID_buf_string(guid, &guid_buff);
- add_string(context, name, guid_str);
-}
-
-/*
* Write a machine parsable json formatted authentication log entry.
*
* IF removing or changing the format/meaning of a field please update the
@@ -472,67 +130,81 @@ static void add_guid(struct json_context *context,
* \t\(.Authentication.localAddress)"'
*/
static void log_authentication_event_json(
- struct imessaging_context *msg_ctx,
- struct loadparm_context *lp_ctx,
- const struct auth_usersupplied_info *ui,
- NTSTATUS status,
- const char *domain_name,
- const char *account_name,
- const char *unix_username,
- struct dom_sid *sid,
- int debug_level)
+ struct imessaging_context *msg_ctx,
+ struct loadparm_context *lp_ctx,
+ const struct auth_usersupplied_info *ui,
+ NTSTATUS status,
+ const char *domain_name,
+ const char *account_name,
+ const char *unix_username,
+ struct dom_sid *sid,
+ int debug_level)
{
- struct json_context context = get_json_context();
- struct json_context authentication;
+ struct json_object wrapper = json_new_object();
+ struct json_object authentication;
char negotiate_flags[11];
- add_timestamp(&context);
- add_string(&context, "type", AUTH_JSON_TYPE);
-
- authentication = get_json_context();
- add_version(&authentication, AUTH_MAJOR, AUTH_MINOR);
- add_string(&authentication, "status", nt_errstr(status));
- add_address(&authentication, "localAddress", ui->local_host);
- add_address(&authentication, "remoteAddress", ui->remote_host);
- add_string(&authentication,
- "serviceDescription",
- ui->service_description);
- add_string(&authentication, "authDescription", ui->auth_description);
- add_string(&authentication, "clientDomain", ui->client.domain_name);
- add_string(&authentication, "clientAccount", ui->client.account_name);
- add_string(&authentication, "workstation", ui->workstation_name);
- add_string(&authentication, "becameAccount", account_name);
- add_string(&authentication, "becameDomain", domain_name);
- add_sid(&authentication, "becameSid", sid);
- add_string(&authentication, "mappedAccount", ui->mapped.account_name);
- add_string(&authentication, "mappedDomain", ui->mapped.domain_name);
- add_string(&authentication,
- "netlogonComputer",
- ui->netlogon_trust_account.computer_name);
- add_string(&authentication,
- "netlogonTrustAccount",
- ui->netlogon_trust_account.account_name);
+ json_add_timestamp(&wrapper);
+ json_add_string(&wrapper, "type", AUTH_JSON_TYPE);
+
+ authentication = json_new_object();
+ json_add_version(&authentication, AUTH_MAJOR, AUTH_MINOR);
+ json_add_string(&authentication, "status", nt_errstr(status));
+ json_add_address(&authentication, "localAddress", ui->local_host);
+ json_add_address(&authentication, "remoteAddress", ui->remote_host);
+ json_add_string(&authentication,
+ "serviceDescription",
+ ui->service_description);
+ json_add_string(&authentication,
+ "authDescription",
+ ui->auth_description);
+ json_add_string(&authentication,
+ "clientDomain",
+ ui->client.domain_name);
+ json_add_string(&authentication,
+ "clientAccount",
+ ui->client.account_name);
+ json_add_string(&authentication,
+ "workstation",
+ ui->workstation_name);
+ json_add_string(&authentication, "becameAccount", account_name);
+ json_add_string(&authentication, "becameDomain", domain_name);
+ json_add_sid(&authentication, "becameSid", sid);
+ json_add_string(&authentication,
+ "mappedAccount",
+ ui->mapped.account_name);
+ json_add_string(&authentication,
+ "mappedDomain",
+ ui->mapped.domain_name);
+ json_add_string(&authentication,
+ "netlogonComputer",
+ ui->netlogon_trust_account.computer_name);
+ json_add_string(&authentication,
--
Samba Shared Repository
