open-vault/builtin/audit/syslog/backend.go

126 lines
2.6 KiB
Go
Raw Normal View History

2016-12-19 20:35:55 +00:00
package syslog
2015-04-24 18:06:19 +00:00
import (
"bytes"
"fmt"
"strconv"
2015-04-24 18:06:19 +00:00
"github.com/hashicorp/go-syslog"
"github.com/hashicorp/vault/audit"
"github.com/hashicorp/vault/logical"
)
func Factory(conf *audit.BackendConfig) (audit.Backend, error) {
if conf.Salt == nil {
return nil, fmt.Errorf("Nil salt passed in")
}
2015-04-24 18:06:19 +00:00
// Get facility or default to AUTH
facility, ok := conf.Config["facility"]
2015-04-24 18:06:19 +00:00
if !ok {
facility = "AUTH"
}
// Get tag or default to 'vault'
tag, ok := conf.Config["tag"]
2015-04-24 18:06:19 +00:00
if !ok {
tag = "vault"
}
2016-09-21 14:29:42 +00:00
format, ok := conf.Config["format"]
if !ok {
format = "json"
}
switch format {
case "json", "jsonx":
default:
return nil, fmt.Errorf("unknown format type %s", format)
}
// Check if hashing of accessor is disabled
2016-03-14 18:52:29 +00:00
hmacAccessor := true
if hmacAccessorRaw, ok := conf.Config["hmac_accessor"]; ok {
value, err := strconv.ParseBool(hmacAccessorRaw)
if err != nil {
return nil, err
}
2016-03-14 18:52:29 +00:00
hmacAccessor = value
}
// Check if raw logging is enabled
2015-04-26 01:26:08 +00:00
logRaw := false
if raw, ok := conf.Config["log_raw"]; ok {
b, err := strconv.ParseBool(raw)
if err != nil {
return nil, err
}
logRaw = b
}
2015-04-24 18:06:19 +00:00
// Get the logger
logger, err := gsyslog.NewLogger(gsyslog.LOG_INFO, facility, tag)
if err != nil {
return nil, err
}
b := &Backend{
2016-09-21 14:29:42 +00:00
logger: logger,
formatConfig: audit.FormatterConfig{
Raw: logRaw,
Salt: conf.Salt,
HMACAccessor: hmacAccessor,
},
}
switch format {
case "json":
b.formatter.AuditFormatWriter = &audit.JSONFormatWriter{
Prefix: conf.Config["prefix"],
}
2016-09-21 14:29:42 +00:00
case "jsonx":
b.formatter.AuditFormatWriter = &audit.JSONxFormatWriter{
Prefix: conf.Config["prefix"],
}
2015-04-24 18:06:19 +00:00
}
2016-09-21 14:29:42 +00:00
2015-04-24 18:06:19 +00:00
return b, nil
}
// Backend is the audit backend for the syslog-based audit store.
type Backend struct {
2016-09-21 14:29:42 +00:00
logger gsyslog.Syslogger
formatter audit.AuditFormatter
formatConfig audit.FormatterConfig
2015-04-24 18:06:19 +00:00
}
func (b *Backend) GetHash(data string) string {
2016-09-21 14:29:42 +00:00
return audit.HashString(b.formatConfig.Salt, data)
}
func (b *Backend) LogRequest(auth *logical.Auth, req *logical.Request, outerErr error) error {
2015-04-24 18:06:19 +00:00
var buf bytes.Buffer
2016-09-21 14:29:42 +00:00
if err := b.formatter.FormatRequest(&buf, b.formatConfig, auth, req, outerErr); err != nil {
2015-04-24 18:06:19 +00:00
return err
}
// Write out to syslog
2015-04-24 18:06:19 +00:00
_, err := b.logger.Write(buf.Bytes())
return err
}
func (b *Backend) LogResponse(auth *logical.Auth, req *logical.Request, resp *logical.Response, err error) error {
2015-04-24 18:06:19 +00:00
var buf bytes.Buffer
2016-09-21 14:29:42 +00:00
if err := b.formatter.FormatResponse(&buf, b.formatConfig, auth, req, resp, err); err != nil {
2015-04-24 18:06:19 +00:00
return err
}
2016-12-19 20:35:55 +00:00
// Write out to syslog
2015-04-24 18:06:19 +00:00
_, err = b.logger.Write(buf.Bytes())
return err
}
func (b *Backend) Reload() error {
return nil
}