1 martin 1.6 //%LICENSE////////////////////////////////////////////////////////////////

  2 martin 1.7 //

  3 martin 1.6 // Licensed to The Open Group (TOG) under one or more contributor license
  4            // agreements.  Refer to the OpenPegasusNOTICE.txt file distributed with
  5            // this work for additional information regarding copyright ownership.
  6            // Each contributor licenses this file to you under the OpenPegasus Open
  7            // Source License; you may not use this file except in compliance with the
  8            // License.

  9 martin 1.7 //

 10 martin 1.6 // Permission is hereby granted, free of charge, to any person obtaining a
 11            // copy of this software and associated documentation files (the "Software"),
 12            // to deal in the Software without restriction, including without limitation
 13            // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 14            // and/or sell copies of the Software, and to permit persons to whom the
 15            // Software is furnished to do so, subject to the following conditions:

 16 martin 1.7 //

 17 martin 1.6 // The above copyright notice and this permission notice shall be included
 18            // in all copies or substantial portions of the Software.

 19 martin 1.7 //

 20 martin 1.6 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

 21 martin 1.7 // OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 22 martin 1.6 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 23            // IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 24            // CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 25            // TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 26            // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 27 martin 1.7 //

 28 martin 1.6 //////////////////////////////////////////////////////////////////////////

 29 thilo.boehm 1.1 //
 30                 //%/////////////////////////////////////////////////////////////////////////////
 31                 
 32                 #include <Pegasus/Common/Config.h>
 33                 #include <Pegasus/Common/Constants.h>
 34                 #include <Pegasus/Common/Logger.h>
 35                 #include <Pegasus/Common/AuditLogger.h>
 36                 
 37                 #ifdef PEGASUS_OS_DARWIN
 38                 # include <crt_externs.h>
 39                 #endif
 40                 
 41                 #ifndef PEGASUS_OS_TYPE_WINDOWS
 42                 # include <unistd.h>
 43                 #endif
 44                 
 45                 #ifdef PEGASUS_OS_VMS
 46                 # include <unixlib.h>
 47                 #endif
 48                 

 49 marek       1.3 #ifdef PEGASUS_OS_SOLARIS
 50                 extern char** environ;
 51                 #endif
 52                 

 53 thilo.boehm 1.1 #include <stdlib.h>
 54                 
 55                 #ifdef PEGASUS_ENABLE_AUDIT_LOGGER
 56                 

 57 karl        1.5 #if defined(PEGASUS_OS_SOLARIS)
 58                 extern char** environ;
 59                 #endif
 60                 

 61 thilo.boehm 1.1 PEGASUS_USING_STD;
 62                 
 63                 PEGASUS_NAMESPACE_BEGIN
 64                 
 65                 static const String providerModuleStatus [] = {
 66                     "Unknown", "Other", "OK", "Degraded",
 67                     "Stressed", "Predictive Failure", "Error", "Non-Recoverable Error",
 68                     "Starting", "Stopping", "Stopped", "In Service", "No Contact",
 69                     "Lost Communication"};
 70                 
 71                 Boolean AuditLogger::_auditLogFlag = false;
 72                 
 73                 AuditLogger::PEGASUS_AUDITLOGINITIALIZE_CALLBACK_T
 74                     AuditLogger::_auditLogInitializeCallback = 0;
 75                 
 76                 AuditLogger::PEGASUS_AUDITLOG_CALLBACK_T AuditLogger::_writeAuditMessage =
 77                     AuditLogger::_writeAuditMessageToLog;
 78                 
 79                 void AuditLogger::logCurrentConfig(
 80                     const Array<String> & propertyNames,
 81                     const Array<String> & propertyValues)
 82 thilo.boehm 1.1 {
 83                     for (Uint32 i = 0; i < propertyNames.size(); i++)
 84                     {
 85                         String propertyStr = propertyNames[i] + "=" + propertyValues[i];
 86                 
 87                         MessageLoaderParms msgParms("Common.AuditLogger.CURRENT_CONFIG",
 88                             "cimserver configuration $0", propertyStr);
 89                 
 90                         _writeAuditMessage(TYPE_CONFIGURATION,
 91                             SUBTYPE_CURRENT_CONFIGURATION,
 92                             EVENT_START_UP, Logger::INFORMATION, msgParms);
 93                     }
 94                 }
 95                 
 96                 void AuditLogger::logCurrentRegProvider(
 97                     const Array < CIMInstance > & instances)
 98                 {
 99                     String moduleName;
100                     Array<Uint16> moduleStatus;
101                     String statusValue;
102                     Uint32 pos;
103 thilo.boehm 1.1 
104                     // get all the registered provider module names and status
105                     for (Uint32 i = 0; i <instances.size(); i++)
106                     {
107                         instances[i].getProperty(instances[i].findProperty(
108                             _PROPERTY_PROVIDERMODULE_NAME)).getValue().get(moduleName);
109                 
110                         pos = instances[i].findProperty(_PROPERTY_OPERATIONALSTATUS);
111                 
112                         if (pos == PEG_NOT_FOUND)
113                         {
114                             moduleStatus.append(0);
115                         }
116                         else
117                         {
118                             CIMValue theValue = instances[i].getProperty(pos).getValue();
119                 
120                             if (theValue.isNull())
121                             {
122                                 moduleStatus.append(0);
123                             }
124 thilo.boehm 1.1             else
125                             {
126                                 theValue.get(moduleStatus);
127                             }
128                         }
129                 
130                         statusValue = _getModuleStatusValue(moduleStatus);
131                 
132                         MessageLoaderParms msgParms(
133                             "Common.AuditLogger.CURRENT_PROVIDER_REGISTRATION",
134                             "Provider module \"$0\" has status \"$1\".",
135                             moduleName, statusValue);
136                 
137                         _writeAuditMessage(TYPE_CONFIGURATION,
138                             SUBTYPE_CURRENT_PROVIDER_REGISTRATION,
139                             EVENT_START_UP, Logger::INFORMATION, msgParms);
140                     }
141                 }
142                 
143                 void AuditLogger::logCurrentEnvironmentVar()
144                 {
145 thilo.boehm 1.1 #ifdef PEGASUS_OS_DARWIN
146                     char** envp = *_NSGetEnviron();
147                 #else
148                     char** envp = environ;
149                 #endif
150                 
151                     Uint32 i = 0;
152                 
153                     while (envp[i])
154                     {
155                         MessageLoaderParms msgParms("Common.AuditLogger.CURRENT_ENV",
156                            "cimserver environment variable: $0", envp[i]);
157                 
158                         _writeAuditMessage(TYPE_CONFIGURATION,
159                             SUBTYPE_CURRENT_ENVIRONMENT_VARIABLES,
160                             EVENT_START_UP, Logger::INFORMATION, msgParms);
161                 
162                         i++;
163                     }
164                 }
165                 
166 thilo.boehm 1.1 void AuditLogger::logSetConfigProperty(
167                     const String & userName,
168                     const String & propertyName,
169                     const String & prePropertyValue,
170                     const String & newPropertyValue,
171                     Boolean isPlanned)
172                 {
173                     if (isPlanned)
174                     {
175                         MessageLoaderParms msgParms(
176                             "Common.AuditLogger.SET_PLANNED_CONFIG_PROPERTY",
177                             "The planned value of property \"$0\" is modified from "
178                                 "value \"$1\" to value \"$2\" by user \"$3\".",
179                             propertyName, prePropertyValue, newPropertyValue, userName);
180                 
181                         _writeAuditMessage(TYPE_CONFIGURATION,
182                             SUBTYPE_CONFIGURATION_CHANGE,
183                             EVENT_UPDATE, Logger::INFORMATION, msgParms);
184                     }
185                     else
186                     {
187 thilo.boehm 1.1         MessageLoaderParms msgParms(
188                             "Common.AuditLogger.SET_CURRENT_CONFIG_PROPERTY",
189                             "The current value of property \"$0\" is modified from "
190                                 "value \"$1\" to value \"$2\" by user \"$3\".",
191                             propertyName, prePropertyValue, newPropertyValue, userName);
192                 
193                         _writeAuditMessage(TYPE_CONFIGURATION,
194                             SUBTYPE_CONFIGURATION_CHANGE,
195                             EVENT_UPDATE, Logger::INFORMATION, msgParms);
196                     }
197                 }
198                 
199                 void AuditLogger::logUpdateClassOperation(
200                     const char* cimMethodName,
201                     AuditEvent eventType,
202                     const String& userName,
203                     const String& ipAddr,
204                     const CIMNamespaceName& nameSpace,
205                     const CIMName& className,
206                     CIMStatusCode statusCode)
207                 {
208 thilo.boehm 1.1     MessageLoaderParms msgParms(
209                         "Common.AuditLogger.OPERATION_UPDATE_CLASS",
210                         "A CIM $0 operation on class \"$1\" in namespace \"$2\" by user "
211                             "\"$3\" connected from system \"$4\" resulted in status \"$5\".",
212                         cimMethodName,
213                         className.getString(),
214                         nameSpace.getString(),
215                         userName,
216                         ipAddr,
217                         cimStatusCodeToString(statusCode));
218                 
219                     _writeAuditMessage(TYPE_CIMOPERATION, SUBTYPE_SCHEMA_OPERATION,
220                         eventType, Logger::INFORMATION, msgParms);
221                 }
222                 
223                 void AuditLogger::logUpdateQualifierOperation(
224                     const char* cimMethodName,
225                     AuditEvent eventType,
226                     const String& userName,
227                     const String& ipAddr,
228                     const CIMNamespaceName& nameSpace,
229 thilo.boehm 1.1     const CIMName& className,
230                     CIMStatusCode statusCode)
231                 {
232                     MessageLoaderParms msgParms(
233                         "Common.AuditLogger.OPERATION_UPDATE_QUALIFIER",
234                         "A CIM $0 operation on qualifier \"$1\" in namespace \"$2\" by user "
235                             "\"$3\" connected from system \"$4\" resulted in status \"$5\".",
236                         cimMethodName,
237                         className.getString(),
238                         nameSpace.getString(),
239                         userName,
240                         ipAddr,
241                         cimStatusCodeToString(statusCode));
242                 
243                     _writeAuditMessage(TYPE_CIMOPERATION, SUBTYPE_SCHEMA_OPERATION,
244                         eventType, Logger::INFORMATION, msgParms);
245                 }
246                 
247                 void AuditLogger::logUpdateInstanceOperation(
248                     const char* cimMethodName,
249                     AuditEvent eventType,
250 thilo.boehm 1.1     const String& userName,
251                     const String& ipAddr,
252                     const CIMNamespaceName& nameSpace,
253                     const CIMObjectPath& instanceName,
254                     const String& moduleName,
255                     const String& providerName,
256                     CIMStatusCode statusCode)
257                 {
258                     if (providerName != String::EMPTY)
259                     {
260                         MessageLoaderParms msgParms(
261                             "Common.AuditLogger.OPERATION_UPDATE_INSTANCE_WITH_PROVIDER",
262                             "A CIM $0 operation on instance \"$1\" in namespace \"$2\" by "
263                                 "user \"$3\" connected from system \"$4\" resulted in "
264                                 "status \"$5\".  "
265                                 "The provider for this operation is \"$6\" in module \"$7\".",
266                             cimMethodName,
267                             CIMObjectPath("", CIMNamespaceName(), instanceName.getClassName(),
268                                 instanceName.getKeyBindings()).toString(),
269                             nameSpace.getString(),
270                             userName,
271 thilo.boehm 1.1             ipAddr,
272                             cimStatusCodeToString(statusCode),
273                             providerName,
274                             moduleName);
275                 
276                         _writeAuditMessage(TYPE_CIMOPERATION, SUBTYPE_INSTANCE_OPERATION,
277                             eventType, Logger::INFORMATION, msgParms);
278                     }
279                     else
280                     {
281                         MessageLoaderParms msgParms(
282                             "Common.AuditLogger.OPERATION_UPDATE_INSTANCE",
283                             "A CIM $0 operation on instance \"$1\" in namespace \"$2\" by "
284                                 "user \"$3\" connected from system \"$4\" resulted in "
285                                 "status \"$5\".  ",
286                             cimMethodName,
287                             CIMObjectPath("", CIMNamespaceName(), instanceName.getClassName(),
288                                 instanceName.getKeyBindings()).toString(),
289                             nameSpace.getString(),
290                             userName,
291                             ipAddr,
292 thilo.boehm 1.1             cimStatusCodeToString(statusCode));
293                 
294                         _writeAuditMessage(TYPE_CIMOPERATION, SUBTYPE_INSTANCE_OPERATION,
295                             eventType, Logger::INFORMATION, msgParms);
296                     }
297                 }
298                 
299                 void AuditLogger::logInvokeMethodOperation(
300                     const String& userName,
301                     const String& ipAddr,
302                     const CIMNamespaceName& nameSpace,
303                     const CIMObjectPath& objectName,
304                     const CIMName& methodName,
305                     const String& moduleName,
306                     const String& providerName,
307                     CIMStatusCode statusCode)
308                 {
309                     if (providerName != String::EMPTY)
310                     {
311                         MessageLoaderParms msgParms(
312                             "Common.AuditLogger.OPERATION_INVOKE_METHOD_WITH_PROVIDER",
313 thilo.boehm 1.1             "A CIM InvokeMethod operation on method \"$0\" of object \"$1\" "
314                                 "in namespace \"$2\" by user \"$3\" connected from system "
315                                 "\"$4\" resulted in status \"$5\".  The provider for this "
316                                 "operation is \"$6\" in module \"$7\".",
317                             methodName.getString(),
318                             CIMObjectPath("", CIMNamespaceName(), objectName.getClassName(),
319                                 objectName.getKeyBindings()).toString(),
320                             nameSpace.getString(),
321                             userName,
322                             ipAddr,
323                             cimStatusCodeToString(statusCode),
324                             providerName,
325                             moduleName);
326                 
327                         _writeAuditMessage(TYPE_CIMOPERATION, SUBTYPE_INSTANCE_OPERATION,
328                             EVENT_INVOKE, Logger::INFORMATION, msgParms);
329                     }
330                     else
331                     {
332                         MessageLoaderParms msgParms(
333                             "Common.AuditLogger.OPERATION_INVOKE_METHOD",
334 thilo.boehm 1.1             "A CIM InvokeMethod operation on method \"$0\" of object \"$1\" "
335                                 "in namespace \"$2\" by user \"$3\" connected from system "
336                                 "\"$4\" resulted in status \"$5\".",
337                             methodName.getString(),
338                             CIMObjectPath("", CIMNamespaceName(), objectName.getClassName(),
339                                 objectName.getKeyBindings()).toString(),
340                             nameSpace.getString(),
341                             userName,
342                             ipAddr,
343                             cimStatusCodeToString(statusCode));
344                 
345                         _writeAuditMessage(TYPE_CIMOPERATION, SUBTYPE_INSTANCE_OPERATION,
346                             EVENT_INVOKE, Logger::INFORMATION, msgParms);
347                     }
348                 }
349                 

350 venkat.puvvada 1.8 void AuditLogger::logSetProvModuleGroupName(
351                        const String & moduleName,
352                        const String & oldModuleGroupName,
353                        const String & newModuleGroupName)
354                    {
355                        MessageLoaderParms msgParms(
356                            "Common.AuditLogger.SET_PROVIDER_MODULE_GROUP",
357                            "The ModuleGroupName of provider module \"$0\" has changed from \"$1\""
358                                " to \"$2\".",
359                            moduleName, oldModuleGroupName, newModuleGroupName);
360                    
361                        _writeAuditMessage(TYPE_CONFIGURATION,
362                            SUBTYPE_PROVIDER_MODULE_STATUS_CHANGE,
363                            EVENT_UPDATE, Logger::INFORMATION, msgParms);
364                    }
365                    
366                    

367 thilo.boehm    1.1 void AuditLogger::logUpdateProvModuleStatus(
368                        const String & moduleName,
369                        const Array<Uint16> currentModuleStatus,
370                        const Array<Uint16> newModuleStatus)
371                    {
372                        String currentModuleStatusValue =
373                            _getModuleStatusValue(currentModuleStatus);
374                    
375                        String newModuleStatusValue = _getModuleStatusValue(newModuleStatus);
376                    
377                        MessageLoaderParms msgParms(
378                            "Common.AuditLogger.UPDATE_PROVIDER_MODULE_STATUS",
379                            "The operational status of module \"$0\" has changed from \"$1\""
380                            " to \"$2\".",
381                            moduleName, currentModuleStatusValue, newModuleStatusValue);
382                    
383                        _writeAuditMessage(TYPE_CONFIGURATION,
384                            SUBTYPE_PROVIDER_MODULE_STATUS_CHANGE,
385                            EVENT_UPDATE, Logger::INFORMATION, msgParms);
386                    }
387                    
388 thilo.boehm    1.1 void AuditLogger::logLocalAuthentication(
389                        const String& userName,
390                        Boolean successful)
391                    {
392                        MessageLoaderParms msgParms(
393                            "Common.AuditLogger.LOCAL_AUTHENTICATION",
394                            "Local authentication attempt: "
395                            "successful = $0, user = $1. ",
396                            CIMValue(successful).toString(),
397                            userName);
398                    
399                        _writeAuditMessage(
400                            TYPE_AUTHENTICATION,
401                            SUBTYPE_LOCAL_AUTHENTICATION,
402                            successful ? EVENT_AUTH_SUCCESS : EVENT_AUTH_FAILURE,
403                            successful ? Logger::INFORMATION : Logger::WARNING,
404                            msgParms);
405                    }
406                    
407                    void AuditLogger::logBasicAuthentication(
408                        const String& userName,
409 thilo.boehm    1.1     const String& ipAddr,
410                        Boolean successful)
411                    {
412                        MessageLoaderParms msgParms(
413                            "Common.AuditLogger.BASIC_AUTHENTICATION",
414                            "Basic authentication attempt: "

415 sushma.fernandes 1.2         "successful = $0, from IP address = $2, user = $1.",

416 thilo.boehm      1.1         CIMValue(successful).toString(),
417                              userName,
418                              ipAddr);
419                      
420                          _writeAuditMessage( TYPE_AUTHENTICATION,
421                              SUBTYPE_BASIC_AUTHENTICATION,
422                              successful ? EVENT_AUTH_SUCCESS : EVENT_AUTH_FAILURE,
423                              successful ? Logger::INFORMATION: Logger::WARNING,
424                              msgParms);
425                      }
426                      
427                      void AuditLogger::logCertificateBasedAuthentication(
428                          const String& issuerName,
429                          const String& subjectName,
430                          const String& serialNumber,
431                          const String& ipAddr,
432                          Boolean successful)
433                      {
434                          MessageLoaderParms msgParms(
435                              "Common.AuditLogger.CERTIFICATE_BASED_AUTHENTICATION",
436                              "Certificate based authentication attempt: "

437 sushma.fernandes 1.2             "successful = $0, from IP address = $4, issuer = $1, "
438                                  "subject = $2, serialNumber = $3.",

439 thilo.boehm      1.1         CIMValue(successful).toString(),
440                              issuerName,
441                              subjectName,
442                              serialNumber,
443                              ipAddr);
444                      
445                          _writeAuditMessage(TYPE_AUTHENTICATION,
446                              SUBTYPE_CERTIFICATE_BASED_AUTHENTICATION,
447                              successful ? EVENT_AUTH_SUCCESS : EVENT_AUTH_FAILURE,
448                              successful ? Logger::INFORMATION: Logger::WARNING,
449                              msgParms);
450                      }
451                      
452                      void AuditLogger::logCertificateBasedUserValidation(
453                          const String& userName,
454                          const String& issuerName,
455                          const String& subjectName,
456                          const String& serialNumber,
457                          const String& ipAddr,
458                          Boolean successful)
459                      {
460 thilo.boehm      1.1     MessageLoaderParms msgParms(
461                              "Common.AuditLogger.CERTIFICATE_BASED_USER_VALIDATION",
462                              "Certificate based user validation attempt: "

463 sushma.fernandes 1.2             "successful = $0, from IP address = $5, userName = $1, "
464                                  "issuer = $2,  subject = $3, serialNumber = $4.",

465 thilo.boehm      1.1         CIMValue(successful).toString(),
466                              userName,
467                              issuerName,
468                              subjectName,
469                              serialNumber,
470                              ipAddr);
471                      
472                          _writeAuditMessage( TYPE_AUTHORIZATION,
473                              SUBTYPE_CERTIFICATE_BASED_USER_VALIDATION,
474                              successful ? EVENT_AUTH_SUCCESS : EVENT_AUTH_FAILURE,
475                              successful ? Logger::INFORMATION: Logger::WARNING,
476                              msgParms);
477                      }
478                      
479                      void AuditLogger::setInitializeCallback(
480                          PEGASUS_AUDITLOGINITIALIZE_CALLBACK_T auditLogInitializeCallback)
481                      {
482                          _auditLogInitializeCallback = auditLogInitializeCallback;
483                      }
484                      
485                      void AuditLogger::setEnabled(Boolean enabled)
486 thilo.boehm      1.1 {
487                          // Only write the enable/disable messages if we are set up to handle them
488                          if (_auditLogInitializeCallback != 0)
489                          {
490                              if (enabled)
491                              {
492                                  if (!_auditLogFlag)
493                                  {
494                                      _auditLogInitializeCallback();
495                      
496                                      MessageLoaderParms msgParms(
497                                          "Common.AuditLogger.ENABLE_AUDIT_LOG",
498                                          "Audit logging is enabled.");
499                      
500                                      _writeAuditMessage(TYPE_CONFIGURATION,
501                                          SUBTYPE_CONFIGURATION_CHANGE,
502                                          EVENT_UPDATE, Logger::INFORMATION, msgParms);
503                                  }
504                              }
505                              else
506                              {
507 thilo.boehm      1.1             if (_auditLogFlag)
508                                  {
509                                      MessageLoaderParms msgParms(
510                                          "Common.AuditLogger.DISABLE_AUDIT_LOG",
511                                          "Audit logging is disabled.");
512                      
513                                      _writeAuditMessage(TYPE_CONFIGURATION,
514                                          SUBTYPE_CONFIGURATION_CHANGE,
515                                          EVENT_UPDATE, Logger::INFORMATION, msgParms);
516                                  }
517                              }
518                          }
519                      
520                          _auditLogFlag = enabled;
521                      }
522                      
523                      void AuditLogger::setAuditLogWriterCallback(
524                          PEGASUS_AUDITLOG_CALLBACK_T writeAuditLogCallback)
525                      {
526                          _writeAuditMessage = writeAuditLogCallback;
527                      }
528 thilo.boehm      1.1 
529                      void AuditLogger::_writeAuditMessageToLog(
530                          AuditType auditType,
531                          AuditSubType auditSubType,
532                          AuditEvent auditEvent,
533                          Uint32 logLevel,
534                          MessageLoaderParms & msgParms)
535                      {
536                          String identifier = "cimserver audit";
537                      

538 kumpf            1.4     Logger::put_l(Logger::AUDIT_LOG, identifier, logLevel, msgParms);

539 thilo.boehm      1.1 }
540                      
541                      String AuditLogger::_getModuleStatusValue(
542                          const Array<Uint16>  moduleStatus)
543                      {
544                          String moduleStatusValue, statusValue;
545                          Uint32 moduleStatusSize = moduleStatus.size();
546                      
547                          for (Uint32 j=0; j < moduleStatusSize; j++)
548                          {
549                              statusValue = providerModuleStatus[moduleStatus[j]];
550                              moduleStatusValue.append(statusValue);
551                      
552                              if (j < moduleStatusSize - 1)
553                              {
554                                  moduleStatusValue.append(",");
555                              }
556                          }
557                      
558                          return moduleStatusValue;
559                      }
560 thilo.boehm      1.1 
561                      PEGASUS_NAMESPACE_END
562                      
563                      #endif