2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2018-03-02 20:18:39 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"fmt"
|
2022-11-30 20:59:05 +03:00
|
|
|
"runtime/debug"
|
2018-03-02 20:18:39 +03:00
|
|
|
"sync"
|
|
|
|
"time"
|
|
|
|
|
|
|
|
metrics "github.com/armon/go-metrics"
|
2018-04-03 03:46:59 +03:00
|
|
|
log "github.com/hashicorp/go-hclog"
|
2018-03-02 20:18:39 +03:00
|
|
|
multierror "github.com/hashicorp/go-multierror"
|
|
|
|
"github.com/hashicorp/vault/audit"
|
2019-05-23 01:52:53 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2018-03-02 20:18:39 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
type backendEntry struct {
|
|
|
|
backend audit.Backend
|
|
|
|
view *BarrierView
|
2018-09-18 06:03:00 +03:00
|
|
|
local bool
|
2018-03-02 20:18:39 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// AuditBroker is used to provide a single ingest interface to auditable
|
|
|
|
// events given that multiple backends may be configured.
|
|
|
|
type AuditBroker struct {
|
|
|
|
sync.RWMutex
|
|
|
|
backends map[string]backendEntry
|
|
|
|
logger log.Logger
|
|
|
|
}
|
|
|
|
|
|
|
|
// NewAuditBroker creates a new audit broker
|
|
|
|
func NewAuditBroker(log log.Logger) *AuditBroker {
|
|
|
|
b := &AuditBroker{
|
|
|
|
backends: make(map[string]backendEntry),
|
|
|
|
logger: log,
|
|
|
|
}
|
|
|
|
return b
|
|
|
|
}
|
|
|
|
|
|
|
|
// Register is used to add new audit backend to the broker
|
2018-09-18 06:03:00 +03:00
|
|
|
func (a *AuditBroker) Register(name string, b audit.Backend, v *BarrierView, local bool) {
|
2018-03-02 20:18:39 +03:00
|
|
|
a.Lock()
|
|
|
|
defer a.Unlock()
|
|
|
|
a.backends[name] = backendEntry{
|
|
|
|
backend: b,
|
|
|
|
view: v,
|
2018-09-18 06:03:00 +03:00
|
|
|
local: local,
|
2018-03-02 20:18:39 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Deregister is used to remove an audit backend from the broker
|
|
|
|
func (a *AuditBroker) Deregister(name string) {
|
|
|
|
a.Lock()
|
|
|
|
defer a.Unlock()
|
|
|
|
delete(a.backends, name)
|
|
|
|
}
|
|
|
|
|
|
|
|
// IsRegistered is used to check if a given audit backend is registered
|
|
|
|
func (a *AuditBroker) IsRegistered(name string) bool {
|
|
|
|
a.RLock()
|
|
|
|
defer a.RUnlock()
|
|
|
|
_, ok := a.backends[name]
|
|
|
|
return ok
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
// IsLocal is used to check if a given audit backend is registered
|
|
|
|
func (a *AuditBroker) IsLocal(name string) (bool, error) {
|
|
|
|
a.RLock()
|
|
|
|
defer a.RUnlock()
|
|
|
|
be, ok := a.backends[name]
|
|
|
|
if ok {
|
|
|
|
return be.local, nil
|
|
|
|
}
|
|
|
|
return false, fmt.Errorf("unknown audit backend %q", name)
|
|
|
|
}
|
|
|
|
|
2018-03-02 20:18:39 +03:00
|
|
|
// GetHash returns a hash using the salt of the given backend
|
2018-03-08 22:21:11 +03:00
|
|
|
func (a *AuditBroker) GetHash(ctx context.Context, name string, input string) (string, error) {
|
2018-03-02 20:18:39 +03:00
|
|
|
a.RLock()
|
|
|
|
defer a.RUnlock()
|
|
|
|
be, ok := a.backends[name]
|
|
|
|
if !ok {
|
2018-04-05 18:49:21 +03:00
|
|
|
return "", fmt.Errorf("unknown audit backend %q", name)
|
2018-03-02 20:18:39 +03:00
|
|
|
}
|
|
|
|
|
2018-03-08 22:21:11 +03:00
|
|
|
return be.backend.GetHash(ctx, input)
|
2018-03-02 20:18:39 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// LogRequest is used to ensure all the audit backends have an opportunity to
|
|
|
|
// log the given request and that *at least one* succeeds.
|
2019-05-23 01:52:53 +03:00
|
|
|
func (a *AuditBroker) LogRequest(ctx context.Context, in *logical.LogInput, headersConfig *AuditedHeadersConfig) (ret error) {
|
2018-03-02 20:18:39 +03:00
|
|
|
defer metrics.MeasureSince([]string{"audit", "log_request"}, time.Now())
|
|
|
|
a.RLock()
|
|
|
|
defer a.RUnlock()
|
2022-02-17 22:43:07 +03:00
|
|
|
if in.Request.InboundSSCToken != "" {
|
|
|
|
if in.Auth != nil {
|
|
|
|
reqAuthToken := in.Auth.ClientToken
|
|
|
|
in.Auth.ClientToken = in.Request.InboundSSCToken
|
|
|
|
defer func() {
|
|
|
|
in.Auth.ClientToken = reqAuthToken
|
|
|
|
}()
|
|
|
|
}
|
|
|
|
}
|
2018-03-02 20:18:39 +03:00
|
|
|
|
|
|
|
var retErr *multierror.Error
|
|
|
|
|
|
|
|
defer func() {
|
|
|
|
if r := recover(); r != nil {
|
2022-11-30 20:59:05 +03:00
|
|
|
a.logger.Error("panic during logging", "request_path", in.Request.Path, "error", r, "stacktrace", string(debug.Stack()))
|
2018-03-02 20:18:39 +03:00
|
|
|
retErr = multierror.Append(retErr, fmt.Errorf("panic generating audit log"))
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = retErr.ErrorOrNil()
|
|
|
|
failure := float32(0.0)
|
|
|
|
if ret != nil {
|
|
|
|
failure = 1.0
|
|
|
|
}
|
|
|
|
metrics.IncrCounter([]string{"audit", "log_request_failure"}, failure)
|
|
|
|
}()
|
|
|
|
|
|
|
|
// All logged requests must have an identifier
|
|
|
|
//if req.ID == "" {
|
2018-04-03 03:46:59 +03:00
|
|
|
// a.logger.Error("missing identifier in request object", "request_path", req.Path)
|
2018-03-02 20:18:39 +03:00
|
|
|
// retErr = multierror.Append(retErr, fmt.Errorf("missing identifier in request object: %s", req.Path))
|
|
|
|
// return
|
|
|
|
//}
|
|
|
|
|
|
|
|
headers := in.Request.Headers
|
|
|
|
defer func() {
|
|
|
|
in.Request.Headers = headers
|
|
|
|
}()
|
|
|
|
|
|
|
|
// Ensure at least one backend logs
|
|
|
|
anyLogged := false
|
|
|
|
for name, be := range a.backends {
|
|
|
|
in.Request.Headers = nil
|
2018-03-08 22:21:11 +03:00
|
|
|
transHeaders, thErr := headersConfig.ApplyConfig(ctx, headers, be.backend.GetHash)
|
2018-03-02 20:18:39 +03:00
|
|
|
if thErr != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
a.logger.Error("backend failed to include headers", "backend", name, "error", thErr)
|
2018-03-02 20:18:39 +03:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
in.Request.Headers = transHeaders
|
|
|
|
|
|
|
|
start := time.Now()
|
|
|
|
lrErr := be.backend.LogRequest(ctx, in)
|
|
|
|
metrics.MeasureSince([]string{"audit", name, "log_request"}, start)
|
|
|
|
if lrErr != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
a.logger.Error("backend failed to log request", "backend", name, "error", lrErr)
|
2018-03-02 20:18:39 +03:00
|
|
|
} else {
|
|
|
|
anyLogged = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if !anyLogged && len(a.backends) > 0 {
|
|
|
|
retErr = multierror.Append(retErr, fmt.Errorf("no audit backend succeeded in logging the request"))
|
|
|
|
}
|
|
|
|
|
|
|
|
return retErr.ErrorOrNil()
|
|
|
|
}
|
|
|
|
|
|
|
|
// LogResponse is used to ensure all the audit backends have an opportunity to
|
|
|
|
// log the given response and that *at least one* succeeds.
|
2019-05-23 01:52:53 +03:00
|
|
|
func (a *AuditBroker) LogResponse(ctx context.Context, in *logical.LogInput, headersConfig *AuditedHeadersConfig) (ret error) {
|
2018-03-02 20:18:39 +03:00
|
|
|
defer metrics.MeasureSince([]string{"audit", "log_response"}, time.Now())
|
|
|
|
a.RLock()
|
|
|
|
defer a.RUnlock()
|
2022-02-17 22:43:07 +03:00
|
|
|
if in.Request.InboundSSCToken != "" {
|
|
|
|
if in.Auth != nil {
|
|
|
|
reqAuthToken := in.Auth.ClientToken
|
|
|
|
in.Auth.ClientToken = in.Request.InboundSSCToken
|
|
|
|
defer func() {
|
|
|
|
in.Auth.ClientToken = reqAuthToken
|
|
|
|
}()
|
|
|
|
}
|
|
|
|
}
|
2018-03-02 20:18:39 +03:00
|
|
|
|
|
|
|
var retErr *multierror.Error
|
|
|
|
|
|
|
|
defer func() {
|
|
|
|
if r := recover(); r != nil {
|
2022-11-30 20:59:05 +03:00
|
|
|
a.logger.Error("panic during logging", "request_path", in.Request.Path, "error", r, "stacktrace", string(debug.Stack()))
|
2018-03-02 20:18:39 +03:00
|
|
|
retErr = multierror.Append(retErr, fmt.Errorf("panic generating audit log"))
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = retErr.ErrorOrNil()
|
|
|
|
|
|
|
|
failure := float32(0.0)
|
|
|
|
if ret != nil {
|
|
|
|
failure = 1.0
|
|
|
|
}
|
|
|
|
metrics.IncrCounter([]string{"audit", "log_response_failure"}, failure)
|
|
|
|
}()
|
|
|
|
|
|
|
|
headers := in.Request.Headers
|
|
|
|
defer func() {
|
|
|
|
in.Request.Headers = headers
|
|
|
|
}()
|
|
|
|
|
|
|
|
// Ensure at least one backend logs
|
|
|
|
anyLogged := false
|
|
|
|
for name, be := range a.backends {
|
|
|
|
in.Request.Headers = nil
|
2018-03-08 22:21:11 +03:00
|
|
|
transHeaders, thErr := headersConfig.ApplyConfig(ctx, headers, be.backend.GetHash)
|
2018-03-02 20:18:39 +03:00
|
|
|
if thErr != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
a.logger.Error("backend failed to include headers", "backend", name, "error", thErr)
|
2018-03-02 20:18:39 +03:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
in.Request.Headers = transHeaders
|
|
|
|
|
|
|
|
start := time.Now()
|
|
|
|
lrErr := be.backend.LogResponse(ctx, in)
|
|
|
|
metrics.MeasureSince([]string{"audit", name, "log_response"}, start)
|
|
|
|
if lrErr != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
a.logger.Error("backend failed to log response", "backend", name, "error", lrErr)
|
2018-03-02 20:18:39 +03:00
|
|
|
} else {
|
|
|
|
anyLogged = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if !anyLogged && len(a.backends) > 0 {
|
|
|
|
retErr = multierror.Append(retErr, fmt.Errorf("no audit backend succeeded in logging the response"))
|
|
|
|
}
|
|
|
|
|
|
|
|
return retErr.ErrorOrNil()
|
|
|
|
}
|
|
|
|
|
|
|
|
func (a *AuditBroker) Invalidate(ctx context.Context, key string) {
|
|
|
|
// For now we ignore the key as this would only apply to salts. We just
|
|
|
|
// sort of brute force it on each one.
|
|
|
|
a.Lock()
|
|
|
|
defer a.Unlock()
|
|
|
|
for _, be := range a.backends {
|
|
|
|
be.backend.Invalidate(ctx)
|
|
|
|
}
|
|
|
|
}
|